Did your last inspection feel too easy? Take-aways from a Clean PCAOB Inspection

Auditors typically feel a sense of tremendous relief when the regulators complete an inspection without receiving comment forms. There is a deep sense of accomplishment to know the audit was nearly perfect. However, does that mean if the same audit is reviewed next year and all other factors remain equal, will the inspection result still be clean? Not necessarily. Different inspection teams, different regulatory focus-areas and different overall internal and external market pressures could produce different results.
In fact, some clients with recent clean PCAOB inspections are concerned that they may have ‘just been lucky’ in their last inspection and are concerned they are one inspection away from a vastly different outcome. We think this is a valid concern that firms should take to heart. We thought we might take a moment to dig into why this happens and what areas you should consider even in the event of a clean report to prevent surprises in the next inspection.
When discussing concerns with clients, we hear a desire from firm quality control (QC) leadership and engagement teams to be proactive and continue to drive improvement on their engagements. Not only are they preparing for the next inspection, but they are strengthening the quality control of the firm and the quality of their engagements. Here are some things to consider.
The PCAOB inspection is not an absolute guarantee of audit quality.
While the PCAOB may select other audit areas to incorporate unpredictability into the inspection process, they focus much of their attention on specific audit areas – and often only specific assertions – that they consider to be of greater complexity or a heightened risk of material misstatement. In fact, in its newly formatted reports, the PCOAB states that its reviews “are not an assessment of all of the firm’s audit work nor of all of the audit procedures performed for the audits reviewed.” Through our practice monitoring and pre-inspection reviews of issuer audit files, we have raised concerns to engagement teams about design and testing of a particular audit procedure or test of control that were not identified in the last inspection. Unidentified important interface controls, compensating controls that are insufficiently precise, or substantive procedures to test an estimate that uses data that was contradictory to the conclusions or that was not tested for completeness and accuracy are just a few examples of situations we identify that do not always get picked up in the inspection but could raise to the level of a finding. Sometimes it turns out the scope of the inspection was not focused on these issues. Making engagement teams aware that this could be a concern in the next inspection helps the firm be prepared and make changes during the next audit.
The focus and approach of a new inspection team may be different from the last inspection team.
Just as engagement team members are in a constant state of change, so are inspection team members. Each inspection team brings their own unique experience of:
- the types of firms they have inspected in the past,
- the type of public accounting experience earlier in their career, and
- their technical and industry experience.
Each inspector brings previous experience and issues they have worked through in the past to their subsequent inspections. As an example, in our work supporting firms through their inspection and remediation, we have seen inconsistencies applied where some inspectors expect an inventory cycle count program to be equivalent to a full physical (i.e. the program should count everything at least once per year). In other cases, however, this is not an explicit issue, so long as the risk of what could go wrong is properly addressed.
To further illustrate how someone else coming into an inspection can look at the same thing and reach a different conclusion, consider a recent firm monitoring client. We assisted them with a deep dive into a revenue process flowchart for a pre-issuance review and identified key controls that should have been flagged and tested by the engagement team. This was never identified as an issue in any previous inspection.
Client process and business changes may and should require a change in audit strategy.
We are going out on a limb here saying that every audit client is continuously evolving their processes, procedures, and operations. This requires auditors to change the strategy and scope from one audit to the next. Avoid the trap of applying a “same as last year” approach without ensuring this is the right approach. All these factors should be considered as you change your strategy and approach as part of your audit planning for your upcoming audits. Just a couple examples:
- Increased incorporation and integration of automated information technology processes into a company’s operations. This integration could arise because of many reasons – as a result of forced changes due to the current pandemic or perhaps because that is how the industry is naturally evolving. Consider how industries such as the financial services industry have changed over decades to become highly automated and so over the years auditing in this industry has changed from a mix of manual and IT control testing to highly automated and integrated control testing. My colleague Dane Dowell penned an article on this topic where he discussed "The Inevitability of Integrated Audits".
RELATED: The Inevitability of Integrated Audits
- Acquisitions and disposals of business units are a constant in today’s economy. Companies are always looking for new targets to acquire. Along with those acquisitions are new considerations such as merging different business models, systems and processes of two companies. Has your client made changes to an acquiree’s internal control structure? Are there (or should there be) new or different procedures to centralize the process with a common set of controls? Or has the client decided that the acquired company’s controls will remain unchanged? All of these shifts in the company could cause necessary shifts in the audit procedures and controls.
Changes to the firm’s tools could mean new and unexpected inspection procedures.
Firms are constantly updating and changing tools and resources available to its engagement teams. As a result, an audit that used a specific tool on your last audit that was inspected by the PCAOB, may be changed, or revised by the firm. Many of our clients have integrated AI or other technology tools from external providers to identify the journal entries to test for the risk of management override due to fraud. Although these tools are designed to make the audit more efficient, it leads us to ask other questions:
- How does the engagement team know that the tool is working as intended?
- Does the external provider control the process whereby they provide a service auditors report?
- Is this a new tool that is part of the Firm’s QC system over audit technology (consider the IT component per ISQM 1)?
- Does the tool allow flexibility to address the unique risks of each audit?
Changes in tools could affect the conclusions made by a future inspection team on the sufficiency of your audit procedures or system of quality control.
How can you prevent these surprises in the next inspection?
Now that we have identified some of the reasons a clean inspection may have a different outcome next time around, here are some actions we recommend firms take to mitigate some of these risks:
- Review the approach and procedures that were performed in the most recent audit with a fresh perspective. Be honest in your considerations and seek input even from less experienced team members. Thinking critically about the risks and whether they are covered from a controls and substantive perspective provides that all-important on-the-job-training and development skills.
- Perform post-issuance reviews of completed audits to determine whether the potential risks and pitfalls could be identified by an astute inspector. An independent reviewer applying an “inspector mindset” helps bring objectivity to this process. These reviews are also used as a tool to consider changes that need to be made to the audit strategy in a future audit.
- Perform pre-issuance reviews on riskier audits. In our work with firms on these strategic reviews, we focus on areas that have complexity and auditor judgment, focus on the important considerations, and make sure the documentation is complete.
- Conduct engagement team and national office debriefs after the audit, and again after the inspection to understand what went well and what aspects of an audit should change for future audits.
Just like every public investment disclosure, past performance is no guarantee of future returns. The same mantra can be applied to inspections. Have you done enough to mitigate that risk?
Geoff Dingle, JGA Managing Director, works with PCAOB-registered accounting firms helping them identify, develop, and implement opportunities to improve audit quality. With over 20 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Geoff has extensive experience in audits of ICFR and firms’ systems of quality controls. Prior to the PCAOB, he worked on audits in various industries at Deloitte in Atlanta and Durban (South Africa).
Jackson Johnson is president of Johnson Global Accountancy, a public accounting and consulting firm with clients throughout the world. He works directly with PCAOB-registered accounting firms and other firms to help them identify, develop, and implement opportunities to improve audit quality.. He also works with public and private companies on various technical accounting and transactional matters. His experience includes nearly six years with the PCAOB, where he worked with small and medium-sized accounting firms throughout the world, including foreign affiliates of large international accounting firms, in the areas of firm quality control and ICFR audits of financial statements. Prior to the PCAOB, Johnson worked with public and private clients in a variety of industries at Grant Thornton LLP in Boston, Los Angeles, and Hong Kong.









