Please ensure Javascript is enabled for purposes of website accessibility

PCAOB Sick of Audit Firms Playing Dumb with ICFR Standard

The PCAOB is still chugging along spitting out reports about how sucky the firms are at doing audits, this time releasing their observations from the 2010 inspections of domestic annually inspected firms regarding deficiencies in audits of internal control – which, in fewer words, is a dig at how crappily the firms are testing internal controls.

Specifically named in the report are eight firms: BDO, Crowe Horwath, Deloitte, Ernst & Young, Grant Thornton, KPMG, McGladrey and PwC. The PCAOB doesn't come out and say that the firms are completely blowing Auditing Standard No. 5 but, really, we all know what they mean:

The Board is concerned about the number and significance of deficiencies identified in firms' audits of internal control during the 2010 inspections, which generally involved reviews of the integrated audits of financial statements and internal control ("integrated audits") for issuers' fiscal years ending in 2009. This report describes the most pervasive deficiencies identified in firms' auditing of internal control during the 2010 inspections, and also includes information on the potential root causes of the deficiencies. Although not specifically described in this report, the Board is also concerned that the rate of these deficiencies increased during the Board's 2011 inspections. The Board emphasizes, however, that the findings described in this report should be considered against the broader background that, in many cases, the Inspections staff did not identify significant audit deficiencies in the portions of audits of internal control that were reviewed in 2010 and 2011, an encouraging fact that reflects well on the firms' ability to implement AS No. 5 appropriately when their engagement teams approach the issues properly.

Okay, so I read this to say that the PCAOB is irritated by audit firms' loose interpretation of AS 5 but wants to make it clear that they aren't actually saying the firms did anything wrong or anything, even though it seems pretty heavily implied:

In 46 of the 309 integrated audit engagements (15 percent) that were inspected in 2010, Inspections staff found that the firm, at the time it issued its audit report, had failed to obtain sufficient audit evidence to support its audit opinion on the effectiveness of internal control due to one or more deficiencies identified by the Inspections staff. In 39 of those 46 engagements (85 percent) where the firm did not have sufficient evidence to support the internal control opinion, representing 13 percent of the 309 integrated audit engagements that were inspected, the firm also failed to obtain sufficient audit evidence to support the financial statement audit opinion.

In addition, in another 50 of the 309 integrated audit engagements, Inspections staff identified deficiencies in the auditing of internal control that did not involve findings of such significance that they indicated a failure to support the firm's internal control opinion. These deficiencies, however, did evidence deficiencies in some firms' systems of quality control of such significance that in the Board's view they require remediation.

The deficiencies do not mean the issuer's financial statements were materially misstated or that the issuer's internal controls were inadequate. Generally, the deficiencies related to execution issues on the part of individual engagement teams where those teams did not meet the requirements of the firms' methodologies.

Again, we're talking about deficiencies that aren't deficiencies here because if audits are supposed to detect material misstatements and these deficiencies didn't necessarily have anything to do with the reliability of the issuer's financial statements, all this says to me is that the PCAOB is upset the right self-imposed boxes aren't being checked at the firm level. Amiright?

Oh, and don't think you're off the hook, small audit firms, even if you aren't listed in this report the PCAOB expects y'all to pay attention and check your own work:

Although this report is based on inspections of eight domestic firms, the Board's inspections have found similar problems with audits of internal control at other registered firms. Therefore, all registered firms should review this report and consider whether the auditing deficiencies that the Board has observed could manifest themselves in their practices.

Much of this report seems to go back to the very thing BoMo & Co. said back when the PCAOB was up their butts last month. If the PCAOB wants tighter audits and specific procedures, it needs to stop beating around the bush and say as much. Case in point:

While auditors are not required to perform walkthroughs, AS No. 5 states that performing walkthroughs will frequently be the most effective way of achieving the above objectives. Inspections staff have observed instances in which firms appear to have significantly reduced the procedures performed in comparison to prior years to obtain an understanding of the flow of transactions and the risks of misstatement and to determine which controls to test.

In some situations, the firms' procedures have been limited to:

  • Using inquiry and observation to confirm that there have been no significant changes to the processes;
  • Obtaining their understanding through controls testing and substantive procedures;
  • Reviewing walkthroughs that were performed by the company's internal auditor who provided direct assistance to the firm;
  • or Relying on their knowledge and experience obtained from prior years' audits.

Hold up just one minute… they just said walkthroughs are "not required." Is it a good idea? Probably. But why oh why would an audit firm do anything they aren't absolutely required to do? If the PCAOB wants them, then just require them. End of story. Don't get all upset later if the firms aren't doing them if you want them so bad, guys.

The PCAOB guesses that some of these deficiencies are also due, in part, to decreases in staffing at the senior associate and associate levels. That means partners, senior managers and managers are doing way too much work as is and as recently hired but experienced audit staff are shuffled into the mix, they may not fully understand the client, their teams' work and their firms' methodologies. So that could be leading to some of this muddled mess too.

Oh and get this, the PCAOB also thinks just maybe there isn't enough AS 5 training at the firm level and when you combine that with staff turnover, it could be that staff, who couldn't punch their way out of a paper bag let alone properly test internal controls, might be doing more work than they should be given their minimal understanding of how AS 5 really works.

So here's what it comes down to – the firms are playing dumb with these standards because hey, if the PCAOB didn't actually require it they don't actually have to do it, right? They know they should and the PCAOB knows they should so maybe instead of playing grab ass with the guidance, both sides need to have a sit down and figure out a compromise. Because if they don't, the PCAOB might have to go from being a light-handed regulator to an enforcer, shredding the firms' flimsy methodologies like so many Arthur Andersen documents. And no one wants that.