The Public Company Accounting Oversight Board released a report Monday in which it identified widespread problems at eight major accounting firms with their audits of internal control over financial reporting.

Jeanette Franzel

The report is the first full review of how well firms are  complying with Auditing Standard No. 5: “An Audit of Internal Control over Financial Reporting that is Integrated with an Audit of Financial Statements,” which was adopted in 2007. In 46 of the 309 engagements inspected in 2010, or 15 percent, the firms failed to obtain sufficient audit evidence to support their ICFR audit opinions due to one or more deficiencies in audits of 2009 financial statements. Of those engagements, 32 had two or more deficiencies.

In 39 of those 46 engagements, or 85 percent, the firms also failed to obtain sufficient audit evidence to support their financial statement audit opinions. This represents 13 percent of the 309 engagements inspected. The firms in the report include BDO, Crowe Horwath, Deloitte, Ernst & Young, Grant Thornton, KPMG, McGladrey and PricewaterhouseCoopers.

The deficiencies discussed in the report include failures by the auditors to identify and sufficiently test controls that address the risk of material misstatement; sufficiently test the design and operating effectiveness of management review controls; obtain sufficient evidence to test controls from an interim date to the company’s year-end (the roll-forward period); sufficiently test system-generated data and reports that support important controls; sufficiently perform procedures regarding the use of the work of others; and sufficiently evaluate identified control deficiencies and consider their effect on both the financial statement audit and on the audit of internal control.

In the 2011 inspections, the number climbed from 15 to 22 percent of engagements where firms failed to obtain sufficient audit evidence to support their ICFR audit opinions. The PCAOB cautioned, however, that not all of the 2011 inspection reports have been finalized. These deficiencies were similar to those identified in 2010, but the number of the deficiencies increased in the audits of 2010 financial statements. Of that 22 percent, approximately 82 percent also failed to obtain sufficient audit evidence to support their financial statement audit opinions. 

“As this report today shows, if a firm has not done enough work to support its opinion on the internal controls, it is also unlikely to be able to support its audit of the financial statement,” said PCAOB board member Jay Hanson during a press conference Monday at the PCAOB’s offices in New York to discuss the new report.

He and other board members said they are concerned about the number and significance of deficiencies identified and that the rate of these deficiencies continued to increase during the 2011 inspections.

However, the PCOAB cautioned that the deficiencies do not mean the financial statements were materially misstated or that the issuer’s internal controls were inadequate. The board said the findings should be considered against the broader background that, in many cases in 2010 and 2011, inspectors found no significant deficiencies in the portions of the audits of ICFR they reviewed. In addition, the deficiencies generally related to execution issues on the part of individual engagement teams where those teams did not meet the requirements of the firms’ methodologies. 

“This report contains good news and bad news,” said PCAOB board member Jeanette Franzel. “The bad news is that the number of audits in which firms failed to obtain sufficient audit evidence to support their audit opinions on internal control over financial reporting is too high, and getting higher. The good news is that, in many of the audits inspected, our inspections staff did not find such deficiencies. Many engagement teams can and do properly implement PCAOB’s Auditing Standard No. 5. Generally, the deficiencies found by our inspections teams related to execution issues on the part of individual engagement teams.”

The results also reflect well on many firms’ ability to implement the standard appropriately when their engagement teams approach the issues properly, the board noted. The report describes the most frequent deficiencies, and also includes information on the potential root causes of the deficiencies.

The root causes identified that may have contributed to the deficiencies include improper application of the top-down approach, decreases in audit firm staffing, insufficient firm training and guidance, and ineffective communication with firm information specialists.

The PCAOB said that firms need to perform more thorough analyses of both the risk of material misstatement and the approach taken to auditing internal control. Similar problems with audits of ICFR have been found at other registered firms, and the PCAOB plans to issue a report in the next few months on its findings at smaller audit firms.

The PCAOB noted that firms should be proactive in considering how to prevent similar deficiencies, through strong firm quality control systems, robust training and guidance, and by seeking ways to better anticipate and address risks that might arise in specific issuer audits.

Auditing Standard No. 5, or AS5, requires that auditors plan and perform the audit to obtain reasonable assurance about whether material weaknesses exist. ICFR is required to reasonably assure that the issuer’s “books, records, and accounts ... accurately and fairly reflect the transactions and dispositions of the assets of the issuer,” according to the Securities Exchange Act of 1934.

“The report reflects the board's commitment to inform auditors, audit committees, and the investing public about significant issues identified in our inspection program,” said PCAOB chairman James R. Doty in a statement. “Firms should take note of the matters identified in the report in planning and performing their audits.”

The Center for Audit Quality also recommended that auditors should familiarize themselves with the report.

“The PCAOB has issued a report summarizing common inspection findings in the area of internal control over financial reporting, an important aspect of financial reporting for investors,” said CAQ executive director Cindy Fornelli. “The profession recognizes the need to improve performance in this important area and has devoted significant additional resources to this effort over the last year. We encourage all auditors to read the report and consider the items noted in planning and performing public company audits. We also encourage preparers and audit committee members to familiarize themselves with the report as it may contain observations that might be useful in improving upon the design or operating effectiveness of internal controls over financial reporting.”

Transitioning from AS 2 to AS 5
AS 5 was originally intended to make audits more efficient by allowing auditing firms to use a risk-based approach. The PCAOB board members at the press briefing said the firms should still use this risk-based approach, but it had to be applied in the correct manner by the auditors themselves.

“I think the real takeaway for the firms is their overarching methodology, which aligns to the standard that we’re inspecting against, that it’s the execution of that overarching methodology of properly identifying and testing controls, and bringing it down to the engagement team, that’s the message, that we didn’t find significant fault with the firms’ overall guidance, but it’s down at the grass roots level, that individual auditor who’s doing it needs a little more help on it,” said Hanson. “In some situations, they might have stepped back and said, ‘Wow, we weren’t very clear in what we told the teams to do.’ And other times, it’s just training and guidance and supervision. So there is good news in here, that the firms’ overall policies generally are what we would expect. It’s the execution of the individual human beings in the job that are doing the work.”

Franzel pointed out that the PCAOB still wants firms to follow the top-down, risk-based approach of AS 5. “Those methodologies are anchored to AS 5, so the message is follow those methodologies, which are anchored to AS 5, which is the top-down risk-based approach,” said Franzel. “It is not the bottoms-up, check everything approach that we’re saying is the problem. We’re saying the firms need to execute against their methodologies, which in fact are anchored in AS 5. So it’s really getting the firms to pay attention in terms of getting the risk assessment and top-down approach right. That’s really what we’re after here.”

“Generally the firms at the margins might push back some on the findings, but by and large agree with us on our observations,” Hanson added.

“We’re already seeing the firms take actions in this area,” said Franzel.

The AS 5 standards were supposed to replace the older AS 2 standards, which many firms claimed were inefficient. “In my personal view, clearly there’s a pendulum that swings here,” said Hanson. “The original AS 2 was focused on a bottom-up approach, looking at the actual processing of transactions and building up, and AS 5 is the top-down approach. We think that there’s some of the blending and combination of the top-down and bottom-up that has mixed over time, and the firms are more focused on the top-down approach, but maybe haven’t been properly executing that top-down approach in terms of both identifying the proper top-down controls and then actually testing to see that the design and the actual implementation is working,”

Franzel noted that the PCAOB issued a report in 2009 on this topic, looking at auditing firms’ transition from AS 2 to AS 5 and concluded that the firms were making the transition successfully in many cases. “We did find some issues similar to the current report,” she added. “I think the top-down approach is difficult. It’s a difficult analytical exercise, so it’s not unexpected that we would still be finding some issues there.”

The PCAOB board members were also asked about the cutbacks in audit firm staff that may be contributing to the problem with audits of internal control, and whether firms are dedicating more staff members to more lucrative areas such as their consulting practices. “We don’t know where some of that staff may have gone and why the firms were cutting back, but we did notice in some of the engagements with deficiencies that in fact the staffing levels had been cut back, and that’s why it’s listed as a potential root cause,” said Franzel.