For the last several years, one very interesting audit quality metric has not been widely reported in the media, and the largest audit firms barely mention it. It has been hiding in plain sight and could be a useful data point to audit committees or investors that are trying to understand the quality of audits.
One reason why large firms may want this data to stay under wraps is that it differentiates audit quality among the four global firms on the only factor they say is a true indicator of an audit failure – restatements.
Going Concern reviewed PCAOB inspection reports from 2012 to 2015 for each of the Big 41 and found that PwC’s “restatement rate”2 has been considerably higher than its rivals during this period. This restatement rate expresses the sum of financial statement audits (“FSA”) and internal controls for financial reporting (“ICFR”) restatements as a percentage of the total number of audits inspected by the PCAOB.
In 2015, for example, the PCAOB inspected 53 issuer audits3 performed by PwC, noting 12 deficiencies. The board found that two of the deficiencies “relate to auditing aspects of an issuer’s financial statements that the issuer restated after the primary inspection procedures.” A simple example might be an instance where a firm failed to obtain sufficient evidence to support the value of a company’s investments. After the PCAOB started its inspection, the company retracts the financial statements, and in the subsequent filing, the value of the investments was restated.
An additional six instances were those where “the Firm revised its opinion on the effectiveness of the issuer’s internal control over financial reporting (‘ICFR’) to express an adverse opinion.” Again, this suggests that something prompted a change to the firm’s initial conclusion about the issuer’s ICFR.
As the table shows below, the cumulative number of restatements and revisions for issuers audited by PwC from 2012-2015 were higher than those of Ernst & Young, Deloitte, and KPMG.
| Firm | Restated FS Audits 2012-2015 | Revised Opinion on ICFR 2012-2015 | Total | Total Issuer Audits Inspected | FSA and ICFR opinions inspected | Restatement Rate |
| PwC | 8 | 16 | 24 | 219 | 438 | 5.48% |
| EY | 3 | 2 | 5 | 218 | 436 | 1.15% |
| Deloitte | 2 | 1 | 3 | 209 | 418 | 0.72% |
| KPMG | 1 | 1 | 2 | 196 | 392 | 0.51% |
When presented with the above table , a PwC spokesperson emailed the following statement, “In connection with PCAOB inspections from 2012-2015, our audit reports on internal control required revision with respect to 16 issuers. In 8 situations, issuers determined it was appropriate to restate their financial statements, which caused us to reevaluate, and ultimately revise our report on their Internal Control. In addition, we revised our report on Internal Control with respect to 8 issuers where there was no financial statement restatement.”
The firm also stated that “Inspection comments related to internal controls are prevalent among firms. At PwC, we evaluate those comments and their impacts on our previously issued reports in a robust, thoughtful and consistent manner.”
EY did not provide Going Concern with comment before publication. Spokespersons for Deloitte and KPMG did not respond to multiple requests for comment.
The results are unexpected, in part, simply based on the number of audit engagements performed by each firm. Research firm Audit Analytics reported earlier this month that Ernst & Young audited the most public companies by far, while the remainder of the Big 4 were within a few dozen engagements of each other. One might expect EY to have more restatements mentioned in its PCAOB inspection reports and the other three firms to be relatively close to one another.
The responses and opinions on the results among experts on PCAOB inspections and restatements were varied.
“I think it is a useful and compelling stat,” one former Securities and Exchange Commission staffer told Going Concern. “It does provide a data point on the quality of audits.”
“If the PCAOB’s inspection practices are consistent across the Big 4 firms, then this is a potentially interesting indicator of audit quality,” said Arizona State University Professor Phil Lamoreaux. “There is certainly a stark difference for PwC.”
But Timothy Seidel, an Assistant Professor of Accounting at Brigham Young University’s Marriott School of Business was less convinced, saying, “I don’t necessarily think, or wouldn’t feel confident, that any generalization about the firm’s audit quality could be made.”
Reporting of restatements in PCAOB inspection reports
Language and content within PCAOB inspection reports have evolved over many years, gradually increasing the focus on restatements. Before 2009, the number of audits inspected was not even stated. Before 2010, there are no mentions of restatements in the reports except some footnote disclosures.
In the early years of PCAOB inspection reports, many firms complained that the review procedures only called into question the methods of the auditors, rather than highlighting important matters for investors. That is, investors and users don’t care whether a firm rigidly follows its internal rules, but rather if their methods were sloppy and failed to detect problems with the financial statements or internal controls.
So starting in 2010, PCAOB inspection reports4 mention the number of deficiencies that relate to “auditing aspects of the issuers’ financial statements that the issuers restated after the primary inspection procedures.”
Before 2012, mentions of restatements appear in a slightly different part of Section A. Here’s PwC’s 2011 inspection report:
And since 2012, both restatements of the financial statements and revisions of the internal controls over financial reporting have been stated in Part I of the inspection reports in a section entitled “Review of Audit Engagements.”
Here’s an example from PwC’s 2012 inspection report with the relevant portion highlighted:
And this is where the restatements and revisions have continued to be reported. Still, they don’t draw much attention.
Deficiency Rate vs. Restatement Rate
When the inspection reports began reporting the number of audits reviewed, many observers calculated and noted the “deficiency rate,” the number of issuer audits with deficiencies listed in the report divided by the number of inspections conducted.
Audits that are deficient, as many observers note, do not necessarily signify a failure by the audit firm. They do, however, highlight where firms struggle to follow their own methods or rules set by the PCAOB. Here’s how Compliance Week reported it last year for PwC:
At PwC, where inspectors selected 55 engagements for inspection and found problems in 12, the firm’s 22 percent deficiency rate for 2015 represents an improvement over the 2014 rate of 29 percent.
By contrast, the number of restatements and revised ICFR opinions looks specifically at undesirable, potentially damaging results from a deficient audit. Here’s the next sentence from the same Compliance Week article:
At the same time, however, two of the firm’s 12 deficient audits ended up in restatement after the PCAOB spotted problems, and PwC revised its opinion on internal control in six cases.
The CW article does not report a “restatement rate” however, this is one of the few instances where it is noted. The Wall Street Journal’s report on the same inspection mentions the deficiencies and its rate, but there is no mention of the restatements.
The nature of the restatements
What most people agree on is that the context around a restatement matters. Jim Peterson, a former in-house lawyer at Arthur Andersen, whose focus has been on the large firms’ litigations, disputes, and regulatory issues, is “distinctly unimpressed” by the restatement rate. “Choices whether to restate have always been so judgmental and only incidentally if at all, related to actual substantive reporting issues,” he said.
What’s not disputable is that the restatements are material. The restatements noted by the PCAOB are of such a nature that they require filing an 8-K disclosure with the SEC that states that the financial statements in question are being retracted and should not to be relied upon. This contrasts with so-called “stealth restatements” that are only disclosed by issuers in later filings. They do not require an 8-K disclosure form and do not result in the withdrawal of the financial statements. These stealth restatements are also not included in the total restatements reported by the PCAOB.
The difference is significant also because the withdrawn financial statements have the potential to trigger a clawback of executive compensation. A 2015 study by Jonathan S. Pyzoha of Miami University concluded that executives might hesitate to restate their results if it would put bonus compensation at risk.
The initiation of a restatement often comes from an audit firm. As one Big 4 audit executive told Going Concern regarding the restatement data for his firm, “All of these restatements came as a result of not the PCAOB determining there was a restatement,” but rather “that’s us [the firm] determining that a restatement was necessary.”
However, a Board Report from 2012 entitled, “Information for Audit Committees About the PCAOB Inspection Process,” gives a little more context concerning how some of these restatements come about (emphasis added):
[I]n the inspection staff’s view the audit firm did not have a sufficient basis for an audit opinion and, absent obtaining additional audit evidence, could not have such a basis. That finding does not mean that the financial statements are misstated, and it is usually not possible for the inspection staff, based only on the information available from the firm, to reach a conclusion about whether the financial statements are misstated. Auditors that have performed additional procedures in response to such criticisms, however, have sometimes discovered that there was material misstatement that they had not detected before issuing the audit report, and those discoveries have led to restatements.
One challenge with the current form is that it is not clear what the origin of a restatement is, whether it was prompted by the audit firm on its own or after the PCAOB discovered something in its review.
Michael Shaub, an accounting professor at Texas A&M University, sees the restatements as a firm acting proactively. “It looks more like the other firms could be ignoring the need to restate,” Professor Shaub said. “Especially if they have a similar distribution of clients and the same or higher PCAOB ‘failure’ rates on inspections.”
Shortcomings of PCAOB’s inspections
Several aspects of the PCAOB inspection process and its procedures make the results problematic, although some of these are outside the board’s controls.
For starters, Sarbanes-Oxley, the law that created the PCAOB, prevents the inspections from naming the issuers. This secrecy prevents shareholders of issuers from knowing whether the audit of their investment was deficient. The lack of transparency “[provides] little if any upside benefit from a process that is so prolonged and opaque,” according to Peterson.
Complicating matters further is how the deficiency rate metric has been referred to as a “failure rate.” That characterization has been scorned by the Big 4 and called “incomplete and potentially misleading.” Former PCAOB member Jay Hanson publicly opposed the descriptor “audit failure” in PCAOB reports. At a conference in 2014, Mr. Hanson said:
I don’t believe it is necessary or appropriate for us to deviate from this more commonly understood definition of ‘audit failure’ by using the term to refer to our inspection findings—which are deficiencies in the firm’s work but not necessarily representative of problems in the audit client’s financial statements or internal controls.
The PCAOB has maintained that, regardless of terminology, the language in Part I of their inspection reports convey that the audit procedures and resulting reports were deficient and that did not mean that the issuer financial statements were misstated.
One other criticism of PCAOB inspections is that the sample of audits selected is based on their perceived risk. The Board selects the riskiest audits and inspects those, while seemingly simpler or less risky audits are not reviewed. The inspection reports contain language that specifically warns against “extrapolating from the results presented in the public portion of a report to broader conclusions about the frequency of deficiencies throughout the firm’s practice.”
Although the deficiency rate is a somewhat controversial measure of audit quality, it is still referenced in media reports, and the PCAOB remains focused on examining the riskiest audits, rather than casting a wider net on the population of audits. One Big 4 audit executive told Going Concern, “We do look at deficiency rate,” and believe “[it’s] a very good indicator that audit quality is moving in the right direction.”
“I understand why [the PCAOB] picks the risky ones because that’s where you really need the auditors to get it right,” Susan Scholz, Professor and Associate Dean of Faculty Development and Research at the University of Kansas said. “On the other hand, to give us a clear picture on whether the auditors do things well, you’d want to pick a sample that includes more typical companies.”
Additionally, the Big 4 audit executive said, “If you want to improve audit quality, [high-risk audits are] what you focus on.”
Bad behavior
Also, as recent events have proven, there’s either pressure within firms to improve the metric or a lack of respect for its authority. Earlier this month, the Wall Street Journal broke the news that a PCAOB employee leaked confidential inspection details to a former colleague who was working at KPMG. Further improper action by five other KPMG employees, including two audit leaders, resulted in their firings.
And late last year, Deloitte’s Brazil affiliate was fined $8 million for violations, covering up those violations, and failure to cooperate with the PCAOB. Although the Brazil affiliate’s inspection results are separate from the U.S. firm’s, the instance illustrates a disdain for the PCAOB’s process.
Citing its policy, the PCAOB declined to “publicly comment on inspection reports or its analysis of inspection results other than as described in such published documents.”
Restatements and Audit Quality Indicators
The question surrounding these metrics from the PCAOB inspections is what they mean for audit quality. Audit quality has been a topic of interest for the last couple of years, specifically how it can be measured.
In July 2015, the PCAOB issued a Concept Release on Audit Quality Indicators (“AQIs”) that drew 50 comments from various stakeholders. The appendix to the Concept Release lists “Number and percentage of PCAOB inspected audits that led to a restatement” as an “illustrative calculation.” However, after reviewing all of the Big 4’s audit quality reports5, only KPMG mentions the restatements from the PCAOB inspection reports, in addition to the number of deficiencies.
AQIs, like the restatement rate, are still not a major part of determining audit quality, however. The Center for Audit Quality (“CAQ”) noted last November that PwC’s 2016 Annual Corporate Directors Survey found 42% of audit committees surveyed do not formally use any AQIs. Of the AQIs listed, only one — “Firm-wide restatements of financial statements” — related to the number of restatements and only 12% of the boards surveyed used it.
One Big 4 audit executive believes that there are “probably other considerations” that audit committees weigh more heavily. “Firm reputation, their personal assessment of the firm, their history with the audit firm, their personal perspectives on the engagement partner as well as the engagement team,” would all be significant, the executive said.
“Part of what is holding back the widespread use of AQIs is the absence of AQIs from competing firms,” said Bob Conway, a retired KPMG audit partner and former leader of the PCAOB’s Southern California offices. “Without data from competing firms, audit committees have little context to understand the meaningfulness of the AQIs they have for their own audit.
“Many audit committees don’t realize — all they need to do is to ask the competing firms for firm-wide AQIs and [for] their local market. The competing firms will comply because they want your business,” Mr. Conway added.
A CAQ spokesperson did not comment before publication.
In the wake of the leak of confidential information from the PCAOB to a major audit firm, investors, audit committees and other observers will want reassurance about the inspections and what value they provide. Restatement rates mostly overlooked until this point could provide a useful data point to users of the inspection reports to learn about their nature and what that means for the overall quality of a firm’s audits.
1 In case you’re new here, that’s Deloitte, Ernst & Young, KPMG, and PwC.
2 This includes both financial statement audits (“FSA”) and internal controls over financial reporting (“ICFR”) audits.
3 This excludes engagements where the firm was not the principal auditor. For the inspection reports for 2012-2015, there were seven total engagements inspected where PwC was not the principal auditor.
4 Check it out in PwC’s 2010 report, on page 4.
5For posterity’s sake, here are audit quality reports for PwC, EY, and Deloitte.
