The Growing Use of Other Auditors: Managing Risk and the New PCAOB Standard

Globalization has led to increasing decentralization of audits, through the use of shared service centers, branch offices, or other auditors. Principal auditors are farming out portions of their audits to other individuals or firms for a number of reasons, whether it be to maintain margins in an inflationary and competitive US cost market, serve multinational clients more quickly, conduct work by local auditors in local languages, or other reasons. Other auditors may be associated with the principal auditor either through a network or affiliation arrangement or none at all. How does the financial reporting ecosystem manage these risks that have always been there but seem to be increasing in volume and complexity? Let’s discuss the audit quality and regulatory challenges, the risks these approaches can bring with them, and the new standards that will require changes to both the principal auditor and group auditors, now called “Lead Auditor” and “Referred-to Auditors,” respectively.
It is the Lead Auditor’s responsibility to ensure that the referred-to auditors comply with the standards. The PCAOB has made clear from inspection procedures, comment forms, reports, and even public settled disciplinary orders that it will fault the principal auditor for not properly supervising the other auditors. Supervision includes ensuring the referred-to auditors are registered with the PCAOB if they perform a substantial role. A substantial role is defined as auditing 20% or more of the assets or revenues of the entity, or incurring 20% of more of the audit fees or hours.
In practice at JGA, it is most common to see the lead auditor take responsibility of the work of other auditors. We very seldom see reference in the lead auditor’s report to work performed by other auditors. Definitively, the lead auditor is taking on all of the risks over the consolidated audit.
Risks to the Principal Auditor
We have seen through our design, implementation, and continuous monitoring of engagement execution and quality management that the impact on audit quality can be both positive and negative. If done right, using the work of other auditors allows firms to scale and meet the needs of their growing and geographically challenging client base.
But what are the risks of using the work of other auditors? I have seen through my own experience managing a “U.S. desk” in Southeast Asia, that culture, technical experience, and frequency and depth of working on PCAOB audits, all pose potential risks.
Some specific examples where we have seen problems include, but are not limited to:
- Lack of understanding of the principal auditor’s role in a group audit;
- Supervision is untimely or otherwise insufficient;
- Lack of integrated planning and risk assessment with all auditors;
- Insufficient knowledge, skills, and experience of the other auditors relative to the group audit; and
- Inconsistent systems of quality management over personnel across different firms, including training, ethics, and independence relative to the audit and needs of the principal auditor.
Regulatory Challenges
We have seen the recent disciplinary orders thrown down by the PCAOB on some of the fact patterns where firms are overly “outsourcing” their work in such a way that regulatory compliance is overlooked. We have particularly seen the uptick in using other auditors by firms stateside to get audits done in China (“PRC”) and Hong Kong (“HK”). Since the Holding Foreign Companies Accountable Act, or HFCAA, was implemented to address the lack of access to workpapers of auditors in this region, relying on the work of other auditors from these regions is receiving its due scrutiny from PCAOB inspections and enforcement.
This is directly affecting lead auditor relationships and the allocation of work. We have seen significant activity of Chinese issuers, previously audited by a PRC or HK firm, changing auditors to firms in other countries. The SEC has identified approximately 155 issuers that face delisting unless either (1) the issuer changes auditors, or (2) the PRC’s Ministry of Finance, Chinese Securities Regulatory Commission, and the PCAOB come to agreement quickly for unfettered inspections in the country. The list continues to grow.
Regulatory Responses
Inspectors will continue to look carefully at these types of arrangements to ensure they comply with the various standards, particularly PCAOB Rule 3211, Auditor Reporting of Certain Audit Participants, and how the lead auditor addresses the risk assessment and supervision standards. Inspection issues in this area can quickly lead to enforcement trouble for the principal auditor.
Based on our experience supporting firms with informal inquiries, orders of formal investigation, and working with firms and legal counsel to prepare for investigation or for negotiation of offers for settlement, we know that PCAOB enforcement prefers to take on issues where non-compliance is clear. In the context of compliance with other auditors, these instances of non-compliance can easily lead to an enforcement inquiry:
- Untimely, inaccurate (missing other auditor information), or non-filing of Form AP;
2. The other auditor is not PCAOB-registered and performed a substantial role in the audit; and
3. Lack of documentation supporting the work performed by other auditors and how
principal auditors review and supervise others.
After nearly six years of discussions, drafts, and requests for comments, the final standards were adopted in June, 2022. The new standard removes key distinctions in expectations whether a lead auditor is relying on the work of another auditor, or the lead auditor is doing the work themselves. For example, AS 1205, Part of the Audit Performed by Other Independent Auditors, will be superseded but not replaced. Instead, the requirements will be embedded into the supervision, risk assessment, and other standards. In effect, the changes clearly show the lead auditor engagement partner’s responsibility to use a risk-based approach to supervise the work of referred-to auditors. Obtaining a “reporting package” from the other auditor will not be sufficient. These amendments will take effect for audits of fiscal years ending on or after December 15, 2024.
What Firms Should Do Now
I recommend firms take a close look at these factors when determining the compliance of their quality management and planning programs when planning and coordinating work with other auditors:
- Take an inventory of and assess the tools available to measure and monitor compliance with the substantial role definition: How does the firm calculate whether another auditor will perform a substantial role on an audit? How does the firm ensure this plan stays within that range through the end of the audit? Are we confident the tools that we have developed for firms will get this process off to the right start? Firms then need to ensure these thresholds are reevaluated on a continuous basis.
- Dig deeper to evaluate the audit quality indicators of referred-to auditors. When gathering internal inspection, network or affiliate inspection report results, consider:
- Was the engagement partner included in the scope?
- Did the sample include a cross-section of partners and audits in the disciplines of PCAOB, ICFR, and US GAAP? Or better, was the specific engagement and partners selected?
- What is the status of remediation of relevant findings, if applicable
- Determine the KPIs that are important to understanding the risks related to the other auditor(s). For example, do these factors play a role in risk assessment:
- billing rates
- tenure of the engagement team
- size of the book of business of non-PCAOB work
- hours managed
- proportion and amount of audit hours vs. non-audit hours by the other auditor.
- Set and understand language expectations. How is the lead auditor’s supervision effectiveness affected with English being not the primary language of the other auditors? What if workpapers are documented in another language, or originally prepared in local language and then translated into English?
- Lead and supervise the audit through the lens of risk assessment. The lead
auditor should be focusing its efforts on audit areas with the greatest risk of
material misstatement to the financial statements, whether those areas are
audited by the lead auditor directly or by another auditor under the lead auditor’s
supervision.
- Hold planning discussions with the referred-to auditor(s). In these meetings,
discuss the planned audit program or, where applicable, instructions issued to the
team. Ensure understanding of expectations between the firms.
- Ensure you are covered on HFCAA. For firms dealing with an increase in work, or shifting in work among a network, to address the implications of HFCAA, check out my recommendations here.
- Consider the impact to the system of quality management: As firms are working now to implement ISQM 1 and/or SQMS 1, it’s important to identify the risks and controls to address those risks to ensure this work meets the relevant objectives in the standards.
Key Takeaways
- Audits of multinational corporations has become increasingly complicated. The globalization of companies has led to a decentralization of the obligations of the auditor.
- Movement of PCAOB work out of PRC and HK to other foreign firms creates new global audit quality risk that must be managed by the lead (principal) auditors.
- Recurring inspection deficiencies and increasing enforcement actions in these areas mean a heightened compliance risk for both existing and new requirements
- The PCAOB’s updated standards, among other changes, shift the objectives of the lead (principal) auditor from reviewing reports of the other auditors to supervising the work of the other auditors.
- Firms – both lead and referred-to auditors – should examine their processes and systems of quality management around their planning and supervision of work among other auditors to prepare for the updated standards.
Jackson Johnson, CPA is president of Johnson Global Accountancy, a public accounting and consulting firm with clients throughout the world. He works directly with PCAOB-registered accounting firms and other firms to help them identify, develop, and implement opportunities to improve audit quality.. He also works with public and private companies on various technical accounting and transactional matters. His experience includes nearly six years with the PCAOB, where he worked with small and medium-sized accounting firms throughout the world, including foreign affiliates of large international accounting firms, in the areas of firm quality control and ICFR audits of financial statements. Prior to the PCAOB, Johnson worked with public and private clients in a variety of industries at Grant Thornton LLP in Boston, Los Angeles, and Hong Kong.









