Audit Firm Inspections: The PCAOB's first inspections: What did they find?

As of late December, the Public Company Accoun- ting Oversight Board had published on its Web site the results of some 173 inspections of audit firms.The purpose of this article is to attempt to identify the more prevalent audit performance deficiencies cited in the inspection reports.

Before doing so, however, a few words of explanation might be helpful in placing the inspection reports in their proper context.

First, many of the deficiencies found by the board are based on specific documentation and information provided by the firms during the course of the inspections, but which, pursuant to the confidentiality provisions of the Sarbanes-Oxley Act, the board is restricted from publicly disclosing.

Although this restriction does not prevent the board from generally describing the deficiencies that it found, it does prevent the board from giving the specifics, including the names of the issuers. Accordingly, unless one was privy to the inspection process of the firm concerned, one is left with findings that are divorced from the facts that led to them.

Second, the board will not publicize any defects found in a firm's quality control systems without first giving the firm the opportunity to rectify those defects. If they are rectified to the satisfaction of the board within 12 months after the date of the inspection report, they will not be publicized. If, however, they are not so rectified, the board will (subject to the firm's right, under SOX, to seek Securities and Exchange Commission review of the matter) make the quality control defects public.

Accordingly, with respect to the board's findings on the firm's quality controls, the most that can be learned at this stage from the inspection reports is whether the firm passed the inspection or not. If an accounting firm did not pass, one cannot know why it did not pass until the findings are published, if at all.

Third, it should be remembered that the PCAOB's findings are preliminary, in the sense that they can be challenged. Following the inspection, the board must make available for review by the firm a draft inspection report in which the board points out the deficiencies found. The firm then has the right to respond to the draft report, and the board must consider the firm's response in its final inspection report.

Furthermore, the board's findings do not conclusively establish that there has been a violation of law or a violation of the rules. Such violations can only be conclusively established through a disciplinary process, which includes a hearing with an opportunity to defend and a right to seek review by the commission and the court of appeals.

In this sense, except for consent orders entered into in connection with disciplinary proceedings, the findings publicized in the inspection reports are still preliminary. Nevertheless, the PCAOB expects firms to take corrective action to address its findings.

Fourth, the board cautions against a firm drawing conclusions that the firm's audits, or its issuer clients' financial statements, are free of any deficiencies not specifically described in an inspection report. This is because the PCAOB is performing a spot check, not a comprehensive universal check. The inspectors only look at a handful of audits, and, within those audits, only at a handful of issues.

In addition, whatever deficiency was not picked up in the first inspection may be discovered in subsequent inspections. It is little wonder then, that firms have not published testimonials about how well they did in the inspection.

The basics

* Did any firm escape public criticism? Yes. Out of 173 firms inspected, 67 firms passed the inspection without being cited for auditing deficiencies or quality control deficiencies.

* Are all deficiencies equal? No. There are deficiencies that in the inspector's view are sufficiently important to warrant a general mention in the report but not important enough to go into details. The language used in the inspection reports to describe such deficiencies is as follows: "The inspection team identified matters that it considered to be audit deficiencies."

There are other deficiencies that the board considers to be of such significance that they are identified individually and itemized. The language used in the reports for significant deficiencies is as follows: "It appeared to the inspection team that the firm did not obtain sufficient competent evidential matter to support its opinion on the issuer's financial statements."

* What are the consequences of significant deficiencies? PCAOB standards require a firm to take appropriate actions to assess the importance of audit deficiencies discovered after the date of the issuance of the audit report with regard to the firm's present ability to stand by its previously issued audit report. Accordingly, after the PCAOB inspection team has completed its inspection and has discussed the deficiencies with the firm, the firm must determine what action it will take to correct them.

In some instances, although all the required auditing procedures may have been performed, such procedures may not have been sufficiently documented to make the audit report self-explanatory to the inspector or in compliance with the documentary requirements of PCAOB Auditing Standard No. 3. For example, the auditor of Parmalat may indeed have confirmed with the Bank of America the existence of $4.9 billion in the account, but may not have received the confirmation in writing.

In these instances, the firm needs to add an addendum to its workpapers to reflect the procedures that it conducted but that it failed to record, taking care to date such supplemental records with the date that they were supplemented, rather than the date that the procedures were originally performed. The supplemental information should also include the name of the person who supplemented the workpapers and the reasons for doing so.

In other instances, the firm may conclude that a required auditing procedure was omitted from the audit of the financial statements and that such omission impairs the auditing firm's present ability to stand by its previously issued audit report. In this situation, the auditor must promptly perform the omitted audit procedure.

If, after the performance of the omitted audit procedure, the auditing firm becomes aware that facts existed at the time that the report was issued that might have affected the report had the firm known about them at that time, and the firm believes that persons who are currently relying on the financial statements would attach importance to such information, the firm will have to assess whether to advise the issuer in question to make appropriate corrective disclosures in its public filings by way of a restatement of its financial statements or otherwise.

In making this assessment, the firm should follow the guidelines of AU 390, Consideration of Omitted Procedures After the Report Date, and AU 561, Subsequent Discovery of Facts Existing at the Date of the Auditor's Report (both included among the PCAOB's interim auditing standards, pursuant to PCAOB Rule 3200T).

The inspection reports cite certain instances in which the significant deficiencies cited by the inspection team led to the performance of omitted audit procedures, which, in turn, identified misstatements in the financial statements, which, in turn, led to the issuers in question restating their financial statements. The inspection reports also cite other instances in which certain firms reached the conclusion that no restatement was necessary.

The decision of the firm whether or not to advise the issuer to restate is subject to the review of the PCAOB at the next inspection. The PCAOB has the additional option of reporting the matter to the SEC, which may then contact the auditor or the client to further investigate the matter. In any event, whether or not financial statements must be restated is a decision within the jurisdiction of the SEC, not the PCAOB.

As for the consequences arising out of the finding of significant deficiencies to auditing firms are concerned, they range from the embarrassment of being criticized in public to having the firm's registration with the PCAOB revoked.

Although it is difficult to discern which of the firms with long lists of significant deficiencies will incur the ultimate sanction of registration revocation, it would appear that, in view of the relatively low number of registration revocations so far to the total number of firms cited for significant deficiencies, the inspection teams will be more inclined to apply the revocation sanction when they have detected a nonchalant attitude towards compliance that leads them to believe that the deficiencies will not be fixed in the future.

It is also possible that registration revocation may result in situations in which an auditing firm, in performing its audits, relies almost exclusively on the work of another auditor while at the same time issuing the opinion. Such a firm is probably not in the business of auditing financial statements in the first place.

* What are the most commonly cited significant deficiencies? What follows is a list of some of the more frequently cited deficiencies in the inspection reports.

1. The failure to perform appropriate testing of revenues, costs and expenses, including evaluating whether revenues and expenses were recognizable in the period in which they were recorded.

Closely connected to this is the failure to sufficiently evaluate the appropriateness of recognizing certain gains and revenues at, or shortly before, the issuer's fiscal year-end, rather than recognizing them in the next fiscal year.

Although the specifics of revenue-recognition audit failures were not enumerated in the inspection reports, such failures might typically include inadequate consideration of the issuer's revenue-recognition policy; allowing income recognition on transactions where the earnings process was not complete; ignoring unusual sales transactions; and allowing income recognition when the right to return the sold product exists. A documented adherence to the guidelines of SAB Topic 13 would be helpful in avoiding such deficiencies.

2. The failure to perform and document an adequate evaluation with respect to the issuer's ability to continue as a going concern, or the omission of a going-concern paragraph in an audit opinion where one should have been included. A documented adherence to the guidelines of SAS No. 59 would be helpful in avoiding such a deficiency.

3. Inappropriate reliance on the work of another auditor to perform substantially all of the audit procedures that served as the basis for the firm's opinion.

4. The firm's improper reference, in an audit report, to the work of another auditor whose report was not filed with the financial statements.

5. The failure to perform and document adequate procedures related to the collectibility of accounts receivable. Although the specifics of such failures were not enumerated in the inspection reports, they might typically include failure to confirm the receivables; perform alternative auditing procedures if a significant number of accounts receivable selected did not respond to the confirmation requests; summarize the results of confirmation in the working papers; test for discounts and allowances; adequately consider the collectibility of receivables; inquire whether the receivables are sold or encumbered; coordinate receivable work with tests of revenue, including cut-off tests; and failure to apply appropriate procedures to notes receivable, including imputation of interest, carrying amount and fair value.

6. The improper classification of certain liabilities as long-term, rather than current, obligations, including the classification of an unsecured, due-on-demand debt obligation as a long-term liability.

Disciplinary actions

PCAOB Rule 3100 requires that a registered public accounting firm and its associated persons comply with all applicable auditing and related professional practice standards, including the PCAOB's interim auditing standards as described in PCAOB Rule 3200T.

SOX and the PCAOB rules further provide that the board may commence a disciplinary proceeding when it appears to the board that a registered accounting firm, or an associated person of such a firm, has engaged in any act or practice in violation of SOX or the rules of the board relating to the preparation and issuance of audit reports and the obligations and liabilities of accountants with respect thereto.

To date, the board has published on its Web site four disciplinary hearings, two of which arose out of inspection findings.

Pursuant to PCAOB Rule 5205, which permits any firm or person who is notified that a disciplinary proceeding may or will be instituted to propose a settlement in writing, both of these two proceedings ended in an offer of settlement that the board agreed to accept, pursuant to which the registrations of the two accounting firms in question were revoked and the sole shareholders of the accounting firm in question were barred from being associated persons of registered public accounting firms.

The auditing failures that led to the revocation of registration in the first case reported included the following:

* Failure by the accounting firm to perform audit procedures to test whether an option to purchase certain assets, and which the issuer recorded as being worth $2 million, representing a majority of the issuer's total reported assets, was in fact worth that amount. Other than obtaining the option agreements, reviewing the board resolutions authorizing the option purchases, and relying on representations made by management, the accounting firm performed no audit procedures to assess the values assigned by management to the option rights.

This failure was in the face of several red flags that should have made it clear that the company did not have the financial ability to pay the exercise price for the options, or to fulfill other financial conditions precedent to the exercise of the options.

* Failure to perform the necessary audit procedures to evaluate whether amounts recognized by an issuer as revenue from the partial performance of a contract met the revenue recognition criteria set forth in SAB 101, notwithstanding the fact that the contract did not provide for payment for partial performance.

* Failure to perform the necessary audit procedures to evaluate whether the company had engaged in material related-party transactions, notwithstanding clear evidence that such transactions may have occurred.

* Failure to perform audit procedures necessary to assess the valuation of marketable securities representing nearly 40 percent of total recorded assets, and relying instead upon the valuation of management, which was substantially different from the value reflected in a brokerage statement issued by the company's investment firm.

* Reliance by the auditor who issued the audit opinion on the work of another auditor who was engaged to perform substantially all of the audit procedures but who did not issue the audit opinion, without sufficiently testing, supervising and reviewing the work of the other auditor.

* Issuing a new audit report on the financial statements of a company that had previously been audited and reported upon by an accounting firm that was not registered with the PCAOB simply by consulting with and relying on the workpapers of the previous auditor without planning and performing a re-audit.

The auditing failures that led to the revocation of registration in the second case reported included the following:

* Issuing an unqualified opinion on the financial statements of an issuer that reported an increase of approximately $49 million in assets, arising out of the purchase of two real estate properties from a company that held a controlling stake in the issuer and whose chairman was also the chairman of the issuer, without verifying whether the parties had executed a definitive agreement for the sale of the properties; without evaluating the experience, certification or standing of the appraisers who performed the property valuations; and without questioning the appraisers relationship to the issuer or its controlling shareholder.

* Taking insufficient steps to obtain an understanding of the products and services for which the issuer claimed to have prepaid and which prepayment it had recorded on its balance sheet as an asset valued at $10 million, and failing to perform adequate audit procedures to test whether the issuer had actually prepaid these costs.

* Failure to perform audit procedures to evaluate whether the issuer's recording of deferred tax assets that it computed based solely on U.S. federal and state taxes, even though most of the company's activities were outside of the United States, constituted a departure from GAAP.

* Accepting an offer to serve as director and chairman of the audit committee of an issuer while engaged as the issuer's independent auditor, in violation of the PCAOB's independence standards.

* Accepting at face value certain restatement journal entries proposed by the issuer's management regarding changes in accounting, without conducting any audit procedures to determine whether the restated amounts proposed by management were fairly stated in conformity with GAAP.

Cooperation

The other two disciplinary proceedings involved participation by the partners of an accounting firm in a scheme to conceal information from the board and to submit false information to the board in connection with a board inspection. Because these enforcement actions are so important to the issue of cooperation with the PCAOB inspectors and investigators, it is useful to recite in some detail the facts of these cases as found in the report of the proceeding on the PCAOB's Web site.

In violation of federal law, which prohibits a registered public accounting firm from preparing the issuer's financial statements, the accounting firm concerned prepared the financial statements of two of its issuer audit clients.

When the PCAOB inspectors notified the firm that it was about to undergo an inspection, it asked the firm to provide in writing the total number of engagement hours incurred by the firm's professional personnel related to the firm's audits of those two issuers. Fearing that information about an employee's work on the two audits concerned might lead the inspectors to discover that the firm had prepared the financial statements, and wishing to conceal this from the PCAOB, the written response submitted by the firm to the PCAOB omitted the number of hours worked by the firm employee on the audits in question. In addition, the three partners carried out a plan to create and backdate management representation letters and place them in the firm's audit files before the inspectors reviewed the files.

Approximately two weeks after the firm's submission of the written response and before the inspectors began their field work, one of the partners, represented by the undersigned, together with another partner, contacted the PCAOB and disclosed the conduct described above. Within one day of that disclosure, these two self-reporting partners resigned their positions with the firm and then made themselves available for voluntary interviews with, and provided information to, the PCAOB's investigators.

Although the board viewed the misconduct in which the two self-reporting partners participated as serious, in determining the appropriate sanction, the board took into account their voluntary self-reporting of that misconduct, and that the timing of the reporting was shortly after the occurrence of the misconduct and before the board took any substantial steps in reliance upon the false information.

In addition, the board took into account their affirmative efforts to provide the board with all relevant information and documents. Accordingly, the board, in censuring the two self-reporting partners, did not revoke their registration with the PCAOB.

In meting out a less severe sanction to the two partners who self-reported the misconduct, the PCAOB took a page out of the book of other law enforcement agencies that reward violators that self-report their own wrongdoing and blow the whistle on others.

Conclusion

The lessons emerging from the first wave of inspections are many. First, the inspectors are consummate professionals who conduct focused and thorough inspections. As evidenced by the fact that approximately a third of the firms inspected received no citations in their first inspection, it is clear that there is no agenda to fail firms in the inspections.

Judging by the small number of enforcement proceedings brought against firms that had auditing deficiencies, it would appear that the purpose of the inspectors is to educate, rather than to castigate.

It seems that the PCAOB may take the view with firms that were cited for deficiencies that the jury is out until their next inspection, at which time the PCAOB would expect to see previously cited deficiencies corrected. Cooperation with the inspectors goes a long way in making sure that deficiencies do not end up in disciplinary proceedings.

For those accounting firms that have not yet been inspected, we hope this article will assist them in readying themselves for inspection.

For reprint and licensing requests for this article, click here.
Accounting standards Audit Regulatory actions and programs
MORE FROM ACCOUNTING TODAY