Amid continued tension over what it takes to satisfy auditors and regulators with respect to management review controls, the Securities and Exchange Commission is starting to consider whether some kind of new guidance might be in order.

Brian Croteau, deputy chief accountant at the SEC, said at an Ohio regional conference of the Institute of Management Accountants, that the SEC is putting some additional focus this year on persistent findings in audit inspections performed by the Public Company Accounting Oversight Board that focus on the adequacy of management review controls. “It’s an ongoing issue with a frequent number of inspection comments,” he said. “It’s not an area that seems to be improving. So why might that be? Is there something we could do to be more clear?”

PCAOB inspection reports the past few years have shown big increases in negative findings with respect to internal controls over financial reporting, with management review controls among several issues commonly called out for improvement. The PCAOB published an audit alert in October 2013 focused on several concerns, including persistent audit failures around testing the design and operating effectiveness of management review controls that are used to monitor the results of operations and the testing of controls over system-generated data and reports that support important controls.

Croteau said that SEC staff intends to study the issue to determine why there’s an apparent disconnect between how some companies apply the SEC’s interpretive guidance directed at management compared to how their auditors respond to their requirements set forth in Auditing Standard No. 5 and inspection findings. “There is an initial tendency among some to quickly suggest that PCAOB inspectors are driving auditors to perform work that is unnecessary,” he said. “While the inspection findings are, of course, one very visible factor to consider, its only one of several factors in the equation. The SEC's interpretive guidance and AS5 are aligned in this area, so as a starting point I'd like to better understand examples of the types of facts and circumstances where the differences in views between management and auditors are most significant."

It’s possible, said Croteau, that in some instances management may not be fully informed about the nature of the issues behind the most frequent PCAOB inspection deficiencies related to the auditing of management review controls. “For example, if management review controls are not designed at an adequate level of precision to address the intended financial reporting risks, or if the control does not operate effectively and consistently, then management may be placing more reliance than warranted on the particular control. If so, this means there are higher chances that a material misstatements will not be prevented or detected on a timely basis. It also, of course, could mean that a material weakness in ICFR exists." 

Another possible explanation: “Perhaps some audit engagement teams aren’t fully explaining the reasons why such procedures are an important element of the audit when explaining their planned procedures,” he says. “Focusing on inspection findings to explain to management or the audit committee why particular procedures are necessary is probably not very helpful without first describing the risks that the work is designed to address and the requirements in existing auditing standards.” It’s also possible, he said, that the SEC and PCAOB could help by encouraging greater consideration of existing SEC guidance and requirements, or whether incremental guidance is needed. Croteau said he planned to work closely with the PCAOB staff in considering the matter further.

Topics