On August 15, the Public Company Accounting Oversight Board released the 2023 inspection reports for the 14 U.S. annually inspected accounting firms, including the U.S. affiliates of the six global network firms (GNFs).  In 34 percent of the engagements it inspected for these six large firms, the PCAOB found one or more Part I.A deficiencies – that is, deficiencies of such significance that it appeared that the firm did not obtain sufficient evidence to support its opinion.  This compares to a 30 percent deficient engagement rate for the six GNFs in 2022. See 2022 PCAOB Large Firm Inspection Reports -- Updated, May-June 2024 Update.  Substantially higher deficiency rates at BDO and Grant were primarily responsible for the increase.  For the Big Four firms only, the 2023 deficiency rate was 26 percent – the same as in 2022. For the eight annually inspected firms that are not global network members (non-affiliate firms--NAFs), the deficiency rates ranged from seven percent (Crowe) to 100 percent (B.F. Borgers).  

In the PCAOB's press release announcing the publication of the 14 inspection reports, Chair Williams characterized the results as pointing “to some small signs of movement in the right direction.”  The release notes that the aggregate deficiency rate at the Big Four firms leveled off in 2023 and that there were “improvements in the deficiency rates at several of the other annually inspected firms,” although “outliers” influenced the overall averages.

In addition to the inspection reports, the Board made available two new sources of comprehensive information concerning inspection results:

• The Board published on its website charts summarizing and illustrating much of the data in the 14 annually inspected firm reports.  This material includes separate presentations regarding the six GNF inspection reports (U.S. Global Network Firms Inspection Data) and the eight NAF inspection reports (Non-Affiliated Firms Inspection Data).

• The Board also released Spotlight: Staff Update on 2023 Inspection Activities, which provides staff observations based on all of its 2023 inspections, including inspections of triennially inspected firms and broker-dealer auditor inspections.   See PCAOB Staff Explains the 2023 Inspection Results in this Update.

This post analyzes the 2023 inspection reports of the six global network affiliate firms, compares them to last year’s results and each other, and offers some comments.  Audit committees should review their audit firm’s inspection report and discuss it with their engagement partner.  

Overview of 2023 GNF Results

As noted above, in 34 percent of the global network firm audit engagements inspected in 2023, the PCAOB found one or more Part I.A deficiencies.  For two firms – BDO and Grant –deficiency rates rose sharply and exceeded 50 percent in 2023.   In contrast, for EY and KPMG, the deficiency rates fell (by nine and four percent, respectively), although at both firms the share of inspected engagements that contained a deficiency remained above 25 percent.  See Tables 1 and 2. 

As in the 2020, 2021, and 2022 inspection cycles, PwC’s results were the best in the GNF group, even though PwC’s deficiency rate doubled in 2023. The Board found deficiencies in 10 of the 57 PwC audits it inspected (18 percent). In 2022, the Board found deficiencies in five (9 percent) of 54 PwC engagements inspected.  Deloitte maintained its second-place position, with 12 deficient engagements (21 percent) in its 2023 inspection report, a modest increase over its 17 percent rate in 2022.  At the other end of the spectrum, BDO, as in 2022, had the highest percentage of deficient engagements. The Board found problems in 25 (86 percent) of the 29 BDO audits it inspected, up from 66 percent last year. The 86 percent deficient engagement rate appears to be the highest ever experienced by one of the GNF firms. 

Each engagement in Part I.A of an inspection report may contain several auditing standard violations.  Therefore, in addition to comparing the number of engagements in Part I.A of the firms’ inspection reports, another way of assessing their inspection results is to compare the number of auditing standard violations the Board found.  See Table 3.  Deloitte was best-in-class by this metric, followed by PwC.  For Deloitte, the Board inspected 56 engagements and found 26 auditing standards violations) – 0.46 standards violations per inspected engagement.  Each Deloitte Part I.A engagement had on average 2.2 standards violations.  In PwC’s report, there were 0.54 standards violations per inspection and an average of 3.1 violations per Part I.A engagement.  In contrast, for BDO the comparable numbers were 4.62 standards violations per inspection and an average of 5.36 violations per Part I.A engagement.    

In 2023, as in past years, the PCAOB found flaws in a substantial number of audits of internal control over financial reporting (ICFR). Inspectors found ICFR audit deficiencies in 27 percent of global network firm integrated audits inspected in 2023, essentially unchanged from 28 percent in the 2022. Similarly, 30 percent of all inspected engagements were found to have a financial statement audit deficiency. Sixty-seven percent of audit engagements described in Part I.A of the 2023 inspection reports of the six large firms included an ICFR deficiency and 88 percent included a financial statement audit deficiency.   AS 2201, An Audit of Internal Control Over Financial Reporting that is Integrated with An Audit of the Financial Statements, was the most frequently cited auditing standard by a wide margin.  See Table 4.  “Did not perform sufficient testing related to a significant account or disclosure or to address an identified risk” in the financial statement audit was the most frequently cited audit deficiency.  See Table 5.

Inspection reports also include a section (Part I.B) describing instances of non-compliance with PCAOB standards or rules that do not relate directly to the sufficiency or appropriateness of the evidence supporting an audit opinion and a section (Part I.C) describing instances of potential non-compliance with rules related to auditor independence.  The six global network firm 2023 reports include 149 Part I.B deficiencies, compared to 139 in 2022.  The most common Part I.B finding was the failure of the firm to perform procedures to determine whether all individuals who participated in an audit were in compliance with the independence requirements. See Tables 6 and 7. 

For the six firms as a group, 484 instances of potential non-compliance with the independence rules are described in Part I.C, of which 460 were firm self-reported.  The most common of these potential independence issues were violations of the audit committee pre-approval requirements, including instances related to services provided to an audit client affiliate by a non-U.S. firm associated with the auditor without obtaining audit committee pre-approval. See Tables 8 and 9. The 2023 increase in firm-reported Part I.C noncompliance was the result of circumstances at a single firm.  See paragraph 1.d of the Audit Committee Takeaways below. 

Summaries of 2023 GNF Inspection Reports

Below are summaries of the 2023 inspection reports of each of the six U.S. GNF affiliates:

• BDO USA, LLP.  The PCAOB reviewed 29 BDO public company audits, 19 of which were integrated audits of both the financial statements and ICFR.  In 25 of the 29 audits (86 percent), the PCAOB identified deficiencies of such significance that it appeared that the firm had not obtained sufficient appropriate audit evidence to support its opinion. This compares to BDO’s 66 percent deficient engagement rate in 2022.  In two of the 25 deficient engagements, the public company’s financial statements and/or its report on ICFR effectiveness, and the firm’s opinions thereon, were determined to be incorrect and were revised and reissued.  Eleven of the 25 engagements in Part I.A included deficiencies related to both the audit of the financial statements and the audit of ICFR; 11 included only a financial statement audit deficiency; and three included only an ICFR audit deficiency.  The PCAOB described 134 audit deficiencies (4.62 deficiencies per inspection) associated with 145 auditing standards (5.0 standards per inspection) in the 25 engagements in Part I.A.  In Part I.B of the inspection report, the PCAOB identified 32 instances of noncompliance with PCAOB standards or rules that did not relate directly to the evidence the firm obtained to support an opinion.  In Part I.C, the Board described five instances it identified of potential non-compliance with independence rules and one instance the firm identified.

• Deloitte & Touche LLP.  The PCAOB reviewed 56 Deloitte public company audits, 50 of which were integrated audits of both the financial statements and ICFR.  In 12 of the 56 audits (21 percent), the PCAOB staff identified deficiencies of such significance that it appeared that the firm had not obtained sufficient appropriate audit evidence to support its opinion.  This compares to Deloitte’s 17 percent deficient engagement rate in 2022. Six of the 12 engagements in Part I.A included deficiencies related to both the audit of the financial statements and the audit of ICFR, four included only a financial statement audit deficiency, and two included only an ICFR audit deficiency.  The PCAOB described 26 audit deficiencies (0.46 deficiencies per inspection) associated with 29 auditing standards (0.52 standards per inspection) in the 12 engagements in Part I.A.  In Part I.B of the inspection report, the PCAOB identified 14 instances of noncompliance with PCAOB standards or rules that did not relate directly to the evidence the firm obtained to support an opinion. In Part I.C, the Board described no instances it identified of potential non-compliance with independence rules and 83 instances that the firm identified.

  
  

• Ernst & Young LLP.  The PCAOB reviewed 59 EY public company audits, 51 of which were integrated audits of both the financial statements and ICFR.  In 22 of the 59 audits (37 percent), the PCAOB staff identified deficiencies of such significance that it appeared that the firm had not obtained sufficient appropriate audit evidence to support its opinion. This compares to EY’s 46 percent deficient engagement rate in 2022. In two of the 22 deficient engagements, the firm’s opinion and the public company’s report on ICFR effectiveness were determined to be incorrect and were revised and reissued. Twelve of the 22 engagements in Part I.A included deficiencies related to both the audit of the financial statements and the audit of ICFR, eight included only a financial statement audit deficiency, and two included only a deficiency in the ICFR audit. The PCAOB described 91 audit deficiencies (2.54 deficiencies per inspection) associated with 96 auditing standards (1.63 standards per inspection) in the 22 engagements in Part I.A.  In Part I.B of the inspection report, the PCAOB identified 22 instances of non-compliance with PCAOB standards or rules that did not relate directly to the evidence the firm obtained to support an opinion.  In Part I.C, the Board described no instances it identified of potential non-compliance with independence rules and 66 instances that the firm identified.

• Grant Thornton LLP.  The PCAOB reviewed 28 Grant public company audits, 20 of which were integrated audits of both the financial statements and ICFR.  In 15 of the 28 audits (54 percent), the PCAOB staff identified deficiencies of such significance that it appeared that the firm had not obtained sufficient appropriate audit evidence to support its opinion. This compares to Grant’s 31 percent deficient engagement rate in 2022.  Five of the engagements in Part I.A included deficiencies related to both the audit of the financial statements and the audit of ICFR, eight included only a financial statement audit deficiency, and two included only an ICFR audit deficiency. The PCAOB described 52 audit deficiencies (1.86 deficiencies per inspection) associated with 59 auditing standards (2.11 standards per inspection) in the 15 engagements in Part I.A.  In Part I.B of the inspection report, the PCAOB identified 30 instances of noncompliance with PCAOB standards or rules that did not relate directly to the evidence the firm obtained to support an opinion. In Part I.C, the Board described 19 instances it identified of potential non-compliance with independence rules and 16 instances that the firm identified.

• KPMG LLP.  The PCAOB reviewed 58 KPMG public company audits, 52 of which were integrated audits of both the financial statements and ICFR.  In 15 of the 58 audits (26 percent), the PCAOB identified deficiencies of such significance that it appeared that the firm had not obtained sufficient appropriate audit evidence to support its opinion.  KPMG’s deficient engagement rate in 2022 was 30 percent. All 15 of the engagements in Part I.A included deficiencies related to both the audit of the financial statements and the audit of ICFR.  The PCAOB described 74 audit deficiencies (1.28 deficiencies per inspection) associated with 79 auditing standards (1.36 standards per inspection) in the 15 engagements in Part I.A.  In Part I.B of the inspection report, the PCAOB identified 36 instances of noncompliance with PCAOB standards or rules that did not relate directly to the evidence the firm obtained to support an opinion.  In Part I.C, the Board described no instances it identified of potential non-compliance with independence rules and 219 instances that the firm identified.

• PricewaterhouseCoopers LLP.  The PCAOB reviewed 57 PwC public company audits, 50 of which were integrated audits of both the financial statements and ICFR.  In ten of the 57 audits (18  percent), the PCAOB staff identified deficiencies of such significance that it appeared that the firm had not obtained sufficient appropriate audit evidence to support its opinion. This compares to PwC’s nine percent deficient engagement rate in 2022. In one of the ten deficient engagements, the firm’s opinion and the public company’s report on ICFR effectiveness were determined to be incorrect and were revised and reissued.  Five of the engagements in Part I.A included deficiencies related to both the audit of the financial statements and the audit of ICFR, two included only a financial statement audit deficiency, and three included only an ICFR audit deficiency.  The PCAOB described 31 audit deficiencies (0.54 deficiencies per inspection) associated with 33 auditing standards (0.58 standards per inspection) in the ten engagements in Part I.A.  In Part I.B of the inspection report, the PCAOB identified 15 instances of noncompliance with PCAOB standards or rules that did not relate directly to the evidence the firm obtained to support an opinion.  In Part I.C, the Board described no instance it identified of potential non-compliance with independence rules and 75 instances that the firm identified.

Comparison of Firm Part I.A Results

Table 1 compares the results of the 2023 inspections of the U.S. affiliates of the six global network firms.  Table 2, which appeared in 2022 PCAOB Large Firm Inspection Reports--Updated, May-June 2024 Update, compares the results of the 2022 inspections of the six global network firms. 

Tables 1 and 2 focus on the percentage of inspected engagements that have at least one audit deficiency.  Other indicators of the relative performance of the six firms are the number individual audit deficiencies in each report and the number of citations to auditing standards associated with those deficiencies.  These metrics differ from the percentage-of-deficient engagements measure because an engagement included in Part I.A may involve more than one deficiency.  Table 3 compares the performance of the six firms based on the number of audit deficiencies in each inspection report and the number of auditing standards associated with those deficiencies.  In some cases, there is an element of judgment in determining the number of deficiencies in a Part I.A engagement description. 

Aggregate Part I.A Data on Auditing Standards, Deficiency Descriptions, and Audit Areas

Auditing standards cited in deficiencies. Table 4 lists the auditing standards most frequently cited as the basis for audit deficiencies in Part I.A of the 2023 GNF inspection reports.  Table 4 also shows the percentage of all deficiencies that were based on each auditing standard.  The same auditing standard may have been cited multiple times in an engagement described in Part I.A.  Table 4 only includes standards cited more than once.

Audit deficiencies.  In each inspection report, the PCAOB lists the most frequently identified audit deficiencies, divided between the most frequent deficiencies in financial statement (FS) audits and the most frequent deficiencies in ICFR audits.  Table 5 aggregates these frequent deficiencies lists for the six GNF firms.  Table 5 also indicates what percentage of the engagements in Part I of the six reports included these deficiencies.

Audit/financial statement areas.  For each inspection report, the PCAOB lists the audit areas with frequent Part I.A deficiencies.  For the six firms, on an aggregate basis, these areas (excluding those cited only once) are:

• Revenue and related accounts – 45 deficiencies.

• Inventory – 19 deficiencies.

• Business combinations – 12 deficiencies.

• Investment securities -- 9 deficiencies.  

• Goodwill and intangible assets – 6 deficiencies.

• Allowance for credit losses/Allowance for loan losses – 4 deficiencies.

• Going concern – 3 deficiencies.

• Long-lived assets – 2 deficiencies.

• Insurance-related assets and liabilities, including insurance reserves – 2 deficiencies.

Other Instances of Non-Compliance: Comparison of Firm Part I.B Results

Part I.B of an inspection report describes instances of non-compliance with PCAOB standards or rules that do not relate directly to the sufficiency or appropriateness of the evidence supporting an audit opinion.  In 2023, the PCAOB found an aggregate of 149 such deficiencies, compared to 139 in 2022. Table 6 presents the number of Part I.B deficiencies for each of the six firms and compares each firm’s 2023 Part I.B results to its 2022 report. 

Note:  Year-to-year comparisons may provide general insight into Part I.B trends but should be interpreted with caution. It appears that the PCAOB does not review all inspected engagements for every type of Part I.B deficiency.  Therefore, the number of Part I.B deficiencies in a firm’s inspection report may not be directly comparable to the number in other firms’ reports or to the number reported in prior years.  

 Table 7 lists the most frequent Part I.B deficiencies in the six reports.  Table 7 only includes deficiencies cited at least four times.

Independence:  Comparison of Firm Part I.C Results

Part I.C of an inspection report discusses instances of potential non-compliance with SEC or PCAOB auditor independence rules. Part I.C describes both instances of potential noncompliance that the PCAOB identified and instances that the firm self-reported to the Board during the inspection.  Across the six global network firms, the Board identified 24 instances of potential independence rule noncompliance, 19 of which were at Grant.  The six firms self-reported 416 such instances, 215 of which were at KPMG.  See paragraph 1.d of the Audit Committee Takeaways below.

Table 8 presents the Part I.C instances of potential non-compliance with the independence rules for each of the six firms.  In reviewing Table 8, readers should be aware that each inspection report contains the following warning:  

“While we have not evaluated the underlying reasons for the instances of potential non-compliance,  the number, large or small, of firm-identified instances of potential non-compliance may be reflective of the size of the firm, including the number of non-U.S. associated firms in the global network; the design and effectiveness of the firm’s independence monitoring activities; and the size and/or complexity of the issuers it audits, including the number of affiliates of the issuer. Therefore, we caution against making any comparison of these firm-identified instances of potential non-compliance across firms.”

As the Board also points out, disclosure in Part I.C of an instance of potential non-compliance with the independence rules does not necessarily mean that the Board (or the firm) has concluded the firm was not objective and impartial throughout the audit and professional engagement period.  In all 416 firm-reported cases, if the firm involved was the principal auditor, it evaluated the potential non-compliance and determined that its objectivity and impartiality were not impaired.

Each inspection report describes the most common instances of potential independence non-compliance in the firm-reported cases.  Table 9 lists these independence issues on an aggregate basis. Because the descriptions in each inspection report include only the most common instances, Table 9 does not reflect all 416 firm-reported potential non-compliance instances. 

Audit Committee Takeaways

1.     Audit committees seeking to understand their audit firm’s inspection results and how they fit into the overall context of the 2023 inspections may want to review Spotlight: Staff Update on 2023 Inspection Activities, discussed in PCAOB Staff Explains the 2023 Inspection Results in this Update.  Audit committees may also want to consider several points:

a.     Audit quality is steady or improving at the four largest firms as a group. 

While the overall Part I.A deficiency rate for the six GNFs rose from 30 percent in 2022 to 34 percent in 2023, at the Big Four – Deloitte, EY, PwC, and KPMG – the rate was constant at 26 percent in both years. To some extent, this reflects convergence among the Big Four – the two firms with the best records (Deloitte and PwC) experienced some deterioration in their Part I.A deficiency rates, while the other two firms (EY and KPMG) improved their deficiency rates somewhat.  The PCAOB staff also points out in the Spotlight report cited above that the percentage of Big Four audits reviewed with multiple Part I.A deficiencies was 20 percent in 2023, essentially the same as the 21 percent rate in 2021, and that these firms’ deficiencies tended to be “more isolated incidents than in the past” rather than part of a pattern of deficiencies affecting multiple audits. 

b.     The disparity between the six global network firms is increasing. 

While the Big Four may be converging, the other GNFs are not. In 2023, the gap between the GNF firm with the lowest percent of inspected engagements that were deficient (PwC – 18 percent) and the firm with the highest percentage (BDO – 86 percent) was 68 percentage points.  This gap has widened over the last three years.  In 2022, it was 57 percent, and in 2021 it was 49 percent. Similarly, the PCAOB found 0.46 deficiencies for every Deloitte audit it inspected and 4.62 deficiencies – ten times more -- for every BDO audit. The PCAOB staff observes that, for the GNFs as a group, “outliers are substantially affecting the aggregate deficiency rate.” 

c.     Part I.B deficiencies increased modestly.  

Part I.B deficiencies increased modestly from 139 in 2022 to 149 2023.  As in the past, it is not clear whether this increase reflects more underlying deficiencies or more PCAOB inspection focus on Part I.B issues.  The most frequent Part I.B issue in 2023 was “Firm did not perform procedures to determine whether all individuals who participated in the audit were in compliance with independence requirements” which was cited in inspection reports 22 times. The frequency of this violation was primarily driven by 16 instances in KPMG audits. The second most frequent Part I.B violation was “Firm did not include all relevant work papers in the final set of audit documentation it was required to assemble.” The PCAOB identified 19 instances of this deficiency, nine of which occurred at Grant. The most common Part I.B deficiency in 2022 and 2021, “Engagement team performed procedures to determine whether matters were critical audit matters but did not include one or more matters that were communicated to the audit committee and that related to accounts or disclosures that were material to the financial statements” fell to fifth place in 2023.

d.     Part I.C independence violations increased, but the increase resulted from one mistake.  

In 2023, the six global network firms self-reported 460 instances of potential non-compliance with the independence rules, and the PCAOB uncovered 24 more instances.  This compares to 392 self-reported and nine PCAOB-identified incidences in 2022.  In all instances of non-compliance described in Part I.C where the firm was the principal auditor, it determined that its objectivity and impartiality were not impaired. 

More than half of the firm-identified events – 216 instances -- involved noncompliance with the requirement for audit committee pre-approval of services.  The vast majority of those instances arose at KPMG.  KPMG’s inspection report contains the following explanation:

“The firm reported 202 instances of potential non-compliance with Rule 2-01(c)(7) of Regulation S-X regarding audit committee pre-approval. In the current year, the firm identified that certain non-U.S. associated firms requested that the firm obtain pre-approval for those firms to perform statutory audits but did not report to the firm certain other services that also required preapproval that those firms provided in connection with those statutory audits. As a result, the firm obtained pre-approval for the statutory audits but did not obtain pre-approval for the additional services provided. In response to this, the firm surveyed all non-U.S. associated firms that provided statutory audits associated with the firm’s issuer audit clients in the past three years and identified 192 total instances in which additional services were provided by non-U.S. associated firms that were not pre-approved.”

But for these 202 instances of noncompliance with the pre-approval rule, the total number of firm-identified potential independence violations in 2023 would have substantially declined compared to 2022.

All 24 of the PCAOB-identified instances of potential non-compliance with the independence rules also involved noncompliance with the requirement for audit committee pre-approval.  Nineteen of these instances occurred at Grant and five at BDO.  The inspection report does not provide any detail concerning those lapses.

2.     Audit committees should discuss their audit firm’s inspection report with the engagement partner.  In last year’s Spotlight: Staff Update and Preview of 2022 Inspection Observations, the staff suggested that, in light of increased inspection findings, audit committees may want to consider asking these four questions in discussions with their independent auditors:

• Has our audit engagement been inspected, and, if so, would you share the results? Were there any audit areas that required significant discussions with the PCAOB that did not result in a comment form?

• Has the engagement partner been inspected on other engagements? If so, what were the results of that inspection?

• What is the audit firm doing to address overall increased inspection findings?

• Are there any audit procedures that are unnecessarily complicated or not “straight-forward” because management is not providing clear, supportable information? (While not related to inspection reporting, the staff believes this question “may encourage effective two-way communication to assist in understanding matters relevant to the audit.")

3.     As noted in past Updates, the audit deficiency descriptions and auditing standard deficiency tables could serve as a discussion topic checklist.  Audit committees may also want to understand how the auditor addressed, or plans to address, engagement deficiencies highlighted in its report and whether the report will result in any changes in audit procedures that could affect the company’s audit.  Of course, if the company’s engagement was the basis for an inspection finding, the audit committee should understand in depth the cause of the deficiency, the impact on the audit as a whole, and how the auditor plans to remedy it and prevent a recurrence.