The staff of the Public Company Accounting Oversight Board anticipates that approximately 40 percent of the audits inspected in 2022 will have one or more deficiencies included in Part I.A of the audit firm’s inspection report, up from 34 percent in 2021 and 29 percent in 2020. Spotlight: Staff Update and Preview of 2022 Inspection Observations (Preview Report) presents aggregate observations from the PCAOB’s 2022 inspections of 710 public company audits performed by 157 audit firms. In a statement, PCAOB Chair Erica Williams described the 40 percent deficiency rate as “completely unacceptable.” Ms. Williams also urged audit committees “to hold audit firms accountable on behalf of investors” and noted that the report “includes important questions audit committees should ask their audit firm” regarding its inspection results. (For a discussion of last year’s inspections preview, see PCAOB Staff 2021 Inspections Preview Reports Rising Deficiencies, January 2023 Update.)
Key Findings
According to the Preview Report, the 2022 inspections resulted in four key findings:
Audit deficiencies rose in 2022. As noted above, the staff expects that 40 percent of all audit engagements inspected in 2022 will be included in Part I.A of an inspection report. (Part I.A discusses deficiencies that were of such significance that, in the PCAOB’s view, the firm, at the time it issued its audit report, had not obtained sufficient appropriate audit evidence to support its opinion on the financial statements and/or internal control over financial reporting (ICFR).) For the six largest U.S. firms (i.e., the six U.S.-based audit firms that are part of global networks), Part I.A deficiencies rose from 16 percent in 2020 and 21 percent in 2021 to 30 percent in 2022.
Noncompliance with PCAOB standards and rules rose in 2022. Deficiencies not related to the sufficiency of audit evidence also rose in 2022. Forty-six percent of the 710 engagements inspected in 2022 are expected to be included in Part I.B of an inspection report, up from 40 percent in 2021 and 26 percent in 2020. Part I.B discusses deficiencies that relate to instances of noncompliance with PCAOB standards or rules other than those where the firm had not obtained sufficient appropriate audit evidence to support its opinion and other than those related to independence. This increase was largely due to an increase in deficiencies related to critical audit matters.
Audit firms can learn from good practices. The PCAOB staff also observed “positive practices” that may be effective in enhancing a firm’s quality control system and audit quality. These good practices, which are described at the end of the Preview Report, include effective risk assessment procedures; use of audit practice aids, such as tools and templates; utilization of Individuals with specialized skills or knowledge, such as subject matter experts; and supervision and review practices that include timely involvement of partners and other supervisors and the use of concise, top-down supervision and review practice aids.
The percentage of randomly selected engagements expected to be in Part I.A is lower than the percentage expected for risk-based selections. For the larger firms (i.e., those inspected annually) the PCAOB selects some engagements for review based on the perceived difficulty or riskiness of the engagement and some on a random basis. In 2022, 48 percent of randomly selected engagements resulted in at least one deficiency, and approximately 26 percent will be included in Part I.A. In comparison, 64 percent of the risk-based selections resulted in at least one deficiency and approximately 42 percent will be included in Part I.A.
Common Deficiencies Found By 2022 Inspections
The Preview Report states that deficiencies observed in the 2022 inspections are similar to those identified in prior years. “Many of these deficiencies are in areas that are inherently complex and in turn generally include greater risks of material misstatement and hence demand more attention from the auditor.”
1. Deficiencies in Auditing ICFR
The Preview Report notes that deficiencies in auditing ICFR remain high and that “it is important that auditors continue to focus on auditor performance” in three areas where ICFR audit deficiencies are common:
Review controls. The auditors did not sufficiently evaluate whether controls with a review element selected for testing operated at a level of precision sufficient to prevent or detect material misstatements.
Company-provided information. Engagement teams did not perform procedures to test the accuracy and completeness of company-produced information that the auditor used for testing user access and change management controls.
Controls that address risk of material misstatement. Auditors did not identify and test controls that were important to the auditor’s conclusions about whether the issuer’s controls sufficiently address the assessed risk of misstatement for relevant assertions.
2. Deficiencies in Auditing Financial Statement Areas
The top five financial statement areas in which inspectors have found deficiencies are listed below. The Preview Report notes that these areas have remained consistent during the 2020 to 2022 period.
Revenue and related accounts. The Preview Report states that the inspection staff frequently identifies deficiencies pertaining to basic auditing principles, including “Appropriate response to a significant fraud risk,” “Sampling of transactions, confirmation procedures of related receivables,” and “Sufficient procedures to test presentation and disclosure.”
Accounting estimates. Accounting estimates are often among the areas of greatest audit risk. “The challenges of auditing estimates may be compounded by cognitive bias, which could lead auditors to anchor on management’s estimates and inappropriately weight confirmatory over contradictory evidence.”
Business combinations. The Preview Report notes that business combinations “impact many accounts and include a broad spectrum of accounting and estimates, including fair value.” Among other things, inspectors found instances of “Insufficient or no risk assessment procedures related to an acquisition and inappropriate or no basis for a conclusion that no risk exists,” “Insufficient procedures to evaluate whether significant financial statement disclosures are complete and accurate,” and “Insufficient procedures to evaluate the relevance and reliability of a company’s specialist report.”
Inventory. Inventory often presents a heightened risk of material misstatement due to the complexities of determining inventory cost and of measuring inventory at a point in time.
Long-lived assets. “The valuation of long-lived assets requires considerable judgement and professional skepticism, and an appropriate assessment of the risks of material misstatement at the financial statement level and the assertion level. The process to assess if an impairment exists and, if necessary, to perform valuation is often complex, including both qualitative and quantitative factors.”
3. Deficiencies Related to Other PCAOB Standards or Rules
The most common Part I.B deficiencies relate to critical audit matters (CAMs) and to audit committee communications. CAMs, which must be disclosed in the audit report, are matters arising from the financial statement audit that the auditor communicated to the audit committee and that relate to accounts or disclosures that are material to the financial statements and involve especially challenging, subjective, or complex auditor judgment. Inspection deficiencies with respect to CAMs primarily involved instances in which auditor’s procedures to determine whether matters were CAMs did not include every matter communicated, or required to be communicated, to the audit committee. Deficiencies of this type do not necessarily mean that the auditor should have included additional CAMs in the audit report.
As to audit committee communications, common deficiencies include the auditor’s failure to communicate such things as –
Significant risks identified during risk assessment procedures, including fraud risks.
Overall audit strategy and timing of the audit.
The auditor’s evaluation of, and conclusions about, the qualitative aspects of significant accounting policies and practices of the public company’s financial reporting.
A complete list of material weaknesses identified during the audit prior to the issuance of the auditor’s report.
The auditor’s evaluation of the company’s ability to continue as a going concern.
The uncorrected and corrected misstatements identified by the auditor.
The engagement team’s evaluation of the company’s accounting for, and disclosure of, transactions with related parties.
Observations Related to Quality Control Systems
In addition to reviewing audit engagements, PCAOB inspections include a review of the inspected firm’s quality control system. The Preview Report discusses quality control findings in four areas.
Independence. Inspectors identified potential violations of the SEC’s independence rules, mainly at smaller accounting firms. These potential violations included such things as prohibited financial relationships, employment relationships, or business relationships between the auditor and the client; prohibited non-audit services; contingent fees; and lack of audit committee administration of the engagement.
Engagement Quality Review. PCAOB rules require that public company audits include an engagement quality review (EQR) – a second partner review of key aspects of the audit and concurrence before issuance of the audit opinion. EQR deficiencies included failure to perform an EQR or failure to perform with due care, reviewers that lacked competence, failure to document the EQR, and issuance of audit reports before the reviewer had provided concurring approval.
Monitoring. Some firms did not have policies and procedures to monitor compliance with professional standards applicable to their accounting and auditing practice. At some firms, the documentation of the quality control system included internal inspection procedures, but the firm either did not actually perform internal inspections or such inspections were not suitably designed.
State Practice Qualification Requirements. Inspections revealed instances in which audit firms performed public company financial statement audits in jurisdictions where the firm was not registered or licensed to practice.
Suggested Questions for the Audit Committee
The Preview Report suggests that, in light of increased inspection findings, audit committees may want to consider asking these four questions in discussions with their independent auditors:
Has our audit engagement been inspected, and, if so, would you share the results? Were there any audit areas that required significant discussions with the PCAOB that did not result in a comment form?
Has the engagement partner been inspected on other engagements? If so, what were the results of that inspection?
What is the audit firm doing to address overall increased inspection findings?
Are there any audit procedures that are unnecessarily complicated or not “straight-forward” because management is not providing clear, supportable information? (While not related to inspection reporting, this question “may encourage effective two-way communication to assist in understanding matters relevant to the audit.)
Comment: Although the causes of the increasing number of inspection deficiencies are not clear, the Preview Report does underscore the importance of the audit committees reviewing their firm’s report and discussing it with the engagement partner. As Chair Williams stated in urging audit committees to engage in dialogue with their auditor regarding its inspection report, “There is no one-size-fits-all answer as to why deficiencies increased. The causes likely vary from firm to firm. So, the solutions will vary as well.” The Preview Report can serve as a reference point for these conversations and as a tool in the audit committee’s evaluation of the auditor.
The Preview Report also provides insight into issues the PCAOB is likely to focus on in future inspections and into what it regards as the audit areas likely to generate deficiencies. Audit committees may want to discuss with their auditor how it plans to address such areas. See also So Many Questions: PCAOB Suggests Questions Audit Committees Should Ask in this Update. The Preview Report may also be useful to audit committees in understanding what aspects of the company’s future audits are likely to attract the PCAOB inspection staff’s attention. Auditors can be expected to devote attention to these areas in anticipation of potential future PCAOB scrutiny. Therefore, the Preview Report may also aid audit committees in understanding their auditor’s risk assessment and resource allocation decisions and in discussing these matters with the engagement team.