The Public Company Accounting Oversight Board released a report in early December in which it identified widespread problems at eight major firms with their audits of internal control over financial reporting.

The report is the first full review of how well firms are complying with Auditing Standard No. 5: An Audit of Internal Control over Financial Reporting that is Integrated with an Audit of Financial Statements, which was adopted in 2007. In 46 of the 309 engagements inspected in 2010, or 15 percent, the firms failed to obtain sufficient audit evidence to support their ICFR audit opinions due to one or more deficiencies in audits of 2009 financial statements. Of those engagements, 32 had two or more deficiencies.

In 39 of those 46 engagements, or 85 percent, the firms also failed to obtain sufficient audit evidence to support their financial statement audit opinions. This represents 13 percent of the 309 engagements inspected. The firms in the report include BDO, Crowe Horwath, Deloitte, Ernst & Young, Grant Thornton, KPMG, McGladrey and PricewaterhouseCoopers.

The deficiencies discussed in the report include failures by the auditors to identify and sufficiently test controls that address the risk of material misstatement; to sufficiently test the design and operating effectiveness of management review controls; to obtain sufficient evidence to test controls from an interim date to the company's year-end (the roll-forward period); to sufficiently test system-generated data and reports that support important controls; to sufficiently perform procedures regarding the use of the work of others; and to sufficiently evaluate identified control deficiencies and consider their effect on both the financial statement audit and on the audit of internal control.

In the 2011 inspections, the number climbed from 15 to 22 percent of engagements where firms failed to obtain sufficient audit evidence to support their ICFR audit opinions. The PCAOB cautioned, however, that not all of the 2011 inspection reports have been finalized. These deficiencies were similar to those identified in 2010, but the number of the deficiencies increased in the audits of 2010 financial statements. Of that 22 percent, approximately 82 percent also failed to obtain sufficient audit evidence to support their financial statement audit opinions.

The PCAOB cautioned that the deficiencies do not mean the financial statements were materially misstated or that the issuer's internal controls were inadequate, and said the findings should be considered against the broader background that, in many cases, inspectors found no significant deficiencies in the portions of the audits they reviewed.