Audit firms are still having some trouble pleasing the audit overlords at the PCAOB — particularly with Auditing Standard No. 5. ICFR is the new WTF, though the PCAOB sees audit firms making progress. Unfortunately, the firms are also kinda missing the point of this whole exercise.
Compliance Week has the details:
The next round of audit inspection reports will show leading audit firms have made progress in their audit of internal controls over financial reporting, but often are still missing the final step in asserting controls are effective, according to Jay Hanson, a member of the Public Company Accounting Oversight Board.
Speaking at Compliance Week 2014, Hanson said 2013 inspection reports, which the board will begin publishing soon, will show audit firms in some cases are not closing the loop in their assessment and testing of controls to assure the controls are actually effective in preventing or detecting material misstatements in financial statements. “The new phrase that concludes the new failure deficiency is the firm did not assess whether the control operated at a level of precision that would detect a material misstatement,” he said. “Effectively, the question is ‘does the control work?' That's a tough question to answer.”
This reminds me of getting in a fight with my mom as a kid over my filthy room. Instead of cleaning it like a normal, responsible young lady, I'd get in some huge fight with her and be like "FINE! You want me to clean my room?! I WILL CLEAN MY ROOM THEN!!" I'd then swoop through my room, throw all the dirty clothes and magazines and CDs into a big garbage bag and throw it all in the dumpster. DONE! My room is clean, ARE YOU HAPPY?! Long story short, it didn't make either of us happy.
It appears audit firms are taking a similar approach to AS 5. Instead of taking the PCAOB's suggestions as an opportunity to "close the loop" on their assessments of controls, they're simply doing the work they think the PCAOB wants them to do and missing the point of that work. In the immortal words of Murs, "C'mon, you don't leave work early on pay day."
Auditing Standard No. 5 requires auditors to audit internal controls over financial reporting and attest to their effectiveness as part of their financial statement audit. The PCAOB has called out many cases over the past few years where auditors failed to properly assess or test controls to determine their effectiveness. Now, said Hanson, there's plenty of evidence the firms have dug in to take a closer look at assessing and testing controls, but ultimately aren't always successful in determining effectiveness. “The firms are putting a lot of effort and attention into upping their game relative to the testing of controls,” he said. “They've all made good progress in identifying the problem.” However, “that closing the loop on it is something many firms are struggling with.”
And this is not a pop quiz; the PCAOB has given audit firms a cheat sheet that lays out exactly how they want this standard interpreted:
Over the last three years, the PCAOB's inspections staff has observed a significant number of auditing deficiencies in audits of internal control. As reported in Observations from 2010 Inspections of Domestic Annually Inspected Firms Regarding Deficiencies in Audits of Internal Control Over Financial Reporting ("the general inspection report"),1 in 46 of the 309 integrated audit engagements (or 15 percent) covered by the general inspection report, inspections staff found that the firm, at the time it issued its audit report, had failed to obtain sufficient appropriate evidence to support its opinion on the effectiveness of internal control due to one or more auditing deficiencies identified by the inspections staff.
So audit firms were like "Ohhh, you want evidence? You got it!" and got the evidence. Now the PCAOB is saying "no, you really don't get it, there is a reason we want the evidence."
Patience, children, the firms will figure this out eventually.