Remediation in a World of Repeat Findings: PCAOB Guidance for the Remediation Process

It has been more than 20 years since the formation of the PCAOB. Over time, the inspections process has transformed and along with it, the reporting and remediation processes. In February of 2023, the PCAOB published its Spotlight: Additional Insights on the Remediation Process. In light of the new guidance as well as considering the fact that the new quality management standards will require all audit firms (international or domestic, public or private company audits) to remediate both engagement and firm-level deficiencies, it’s clear that there is a renewed emphasis on the remediation process within the industry.
The spotlight provides much of the same information previously released through various publications, such as the PCAOB Staff Guidance from November 2013, which highlights the main considerations that the Board reviews when evaluating the effectiveness of remedial efforts. Specifically, the Board reviews the following criteria:
- Change: Is the remedial action a change from the current quality control (QC) system? In what ways?
- Relevance: Does the action specifically address the deficiency? Both in terms of subject but also in terms of causal factors? Design: Is the remedial action, as designed, appropriate to address the QC failures?
- Implementation: Was the remedial action implemented in the remediation period?
- Execution and Effectiveness: How effective was the remedial action? How does the auditing firm evidence that?
While we’ve touched on many of these items in previous remediation articles, let’s explore some of the new insights from the February 2023 Spotlight below:
Repeat Criticisms
Most firms have at some point probably had some sort of repeat finding. For many, the EQR deficiency seems to recur in every inspection report, but I imagine many firms are also seeing repeat findings in ICFR (think of management review controls or MRCs) and estimates, two of the most commonly cited deficiencies for many years running now. When firms have repeat findings (i.e. same or similar deficiencies in consecutive inspection reports), the PCAOB critically assesses the remedial actions to understand how these actions will resolve the issue. We like to use the word “incremental.” How is the remedial action incremental, or “meaningfully different” in the words of the PCAOB. For instance, if you develop and deliver a training on auditing estimates, but then have a repeat finding in your subsequent inspection report, the PCAOB will challenge whether another training is an effective remedial action. The question will be asked “how is that additional training meaningfully different to what was delivered previously?” What other incremental actions could be implemented to address the criticism? We’ll delve more into training later, but the point is that just because a remedial action was considered effective in the past does not mean it will be considered effective today. And if it was truly effective in the past, why then is there a deficiency today?
Root Cause Analysis
This leads well into the next concept: root cause analysis. If you are seeing repeat findings in your inspections, it’s an indication that the root cause for the deficiency has not yet been addressed OR there could also be a new root cause that requires specific attention. The new quality management standards require firms to perform a root cause analysis. A thorough root cause analysis helps firms to understand the causal factors contributing to the overall deficiency. From these causal factors, the firm can then appropriately design remedial actions. Think of it like going to the doctor; a doctor could prescribe medications to treat symptoms, but a root cause will direct the doctor in how to prescribe the right medication to treat the causal illness and thereby eliminating all symptoms.
Firms need to start performing robust root cause analyses to understand what is giving rise to the deficiencies. The PCAOB warns that there may be multiple causes so don’t jump to the most obvious conclusion. If you don’t address all causal factors, while you may be able to pass remediation, you risk having the deficiency occur yet again and the remediation process will only get more stringent.
As well, while root cause analysis is typically focused on deficiencies (negative audit quality), the PCAOB has indicated that many firms are starting to perform root cause analyses for “clean” audits (positive audit quality) so as to identify what worked well. These success factors could be fodder for new remedial actions implemented at a firm-wide level.
Training
Training is the most common remedial response we see in the industry. And that makes sense; awareness is certainly the first step in driving change. However, after 20 years of inspections and remediation, training is proving less effective given the number of recurring deficiencies.
When the PCAOB evaluates the sufficiency of training for remediation purposes, it considers the following:
- Is the training specifically tailored to the company? Does the training speak to the specific deficiency? At what level of granularity? Buying an off-the-shelf training that summarizes the requirements of AS 2501 is different than engaging a consultant with audit expertise to specifically design a tailor-made training on AS 2501, pulling in PCAOB inspection results, identifying common PCAOB failures, and crafting case studies from the firm’s specific findings.
- What is the format of the training? Live webinars and in-person trainings are typically viewed as more effective than e-learning self- studies.
- Who is delivering the training? What are the qualifications and experience of the presenters?
- Who is the audience and how was participation monitored/enforced? The PCAOB generally expects that firms identify their target audience. However, if the training is covering something such as inventory observations, it probably makes sense that all staff levels attend the training since the procedures are typically performed by more junior associates and by the time a manager is reviewing, it might be too late to effectuate real change (we rarely go back to perform a second inventory count). How does the firm ensure those absent from the training get “caught up?” Even if the firm offers a make-up session or records the training for future reference, there’s an implicit attitude when only 50% attend live and the rest make-up the training later. It’s an indication of tone-at-the-top and a lack of regard for the importance of that training. Training that is designed for remediation should be attended by all required professionals; truants should be the exception.
- Is there a post-course knowledge check? Is the course CPE eligible? Both factors elevate the significance of the training. Post-course knowledge checks are especially important as they help evidence knowledge retention, which helps demonstrate the effectiveness of the remedial action (i.e. refer to the five criteria above). We’ve seen firms fail remediation because they didn’t do knowledge checks, so don’t underestimate its significance.
Guidance and Tools
The other most common remedial action is the development of new guidance and tools/templates to guide teams through various auditing requirements. We’ve helped numerous firms develop templates for auditing ICFR (or even more specifically, auditing management review controls), auditing estimates, evaluating CAMS, etc. When evaluating the sufficiency of tools and templates, the Board considers the following:
- Design of the tool: Does the template pull guidance directly from the standard? Does it specifically address the deficiency cited in the inspection report?
- Effective date: When was the guidance/tool implemented and effective?
- Required use: When is the template applicable? Is it required in all circumstances? Generally, the PCAOB will expect tools to be required to be used on all audits where there is potential for a failure.
- Communications: How was the guidance/tool communicated within the firm? Again, tone at the top matters. Did the firm provide any education around the guidance / templates?
- Implementation and monitoring: How did the firm go about implementing the tool? Were there required consultations in the first year? Were there targeted inspections to ensure teams are complying with the new guidance and/or effectively completing the templates?
Subsequent Inspections
We have started to see an acceleration of inspections and many clients are being inspected every two years instead of every three years as they were accustomed to. Considering that PCAOB reports are sometimes issued a year or more after the inspection and by the time you add another year for the remediation process, many firms are now being inspected while they still have open remediation periods. So, what’s the big deal? It means that the PCAOB will be in the midst of evaluating the effectiveness of remedial actions while also performing a subsequent inspection. Results of that subsequent inspection could have a direct impact on the remediation assessment.
The Board did clarify that a subsequent inspection finding is not automatically a failure. Rather, the PCAOB looks to see how proactive the firm is in monitoring and addressing known deficiencies. As well, the PCAOB looks to see whether there were multiple actions to address a deficiency or just one and how broad the remedial actions were (i.e. training over inventory estimates vs. training over all accounting estimates). Finally, there’s this concept of continual improvement. If a firm had six ICFR findings in one inspection report, but only had one ICFR finding in the subsequent inspection, that could be a sign of improvement. Of course, it’s always facts and circumstances specific and numbers can be deceiving. If there was only one audit with ICFR, then one finding would result in a 100% hit rate. If there were eight integrated audits and only one with an ICFR deficiency, that tells a different story.
The point is, be aware of the timelines and understand that the results of PCAOB inspections will impact any open remediation assessments. This is why it’s important to understand root causes and map remedial actions to causal factors. While a firm might have ICFR deficiencies recur in multiple inspection periods, if the firm can identify different root causes and thus different remedial actions, it helps demonstrate how and why the firm responded as it did.
The point is to acknowledge subsequent inspection findings and incorporate them into your remediation response, demonstrating how the firm has analyzed the results, what they are proactively doing to address the new findings and how the results impact (or do not impact, and why) any open remediation responses.
Timing and Dialogue
Finally, we can’t emphasize this enough, but start dialogue in the 12-month remediation period early! In its letter that accompanies inspection reports, the PCAOB has now indicated that it expects firms to initiate a dialogue within 60 days of receiving the report. Remember, the remediation period only lasts for one year and firms need to demonstrate how their remedial actions fulfilled the five criteria during that time; this means, demonstrating the effectiveness of remedial actions which often is validated through internal firm monitoring procedures which take time!
Start the conversation early. Explain the intended remedial responses. Begin implementing the actions and continue dialoguing with the PCAOB to understand their concerns or feedback. Firms are able to have as many conversations as they would like with the PCAOB remediation staff during the one-year timeline, but each submission and review takes several weeks for the PCAOB and PCAOB feedback sometimes requires changing course or entirely altering the intended actions. Allow time to modify your response without being rushed.
Understandably, some remedial actions will take longer than a year to fully implement and/or see the improvement. That doesn’t mean wait until the last minute to implement. In these circumstances, break down your response into milestones to demonstrate progress and help define various measures of success.
Key Takeaways
- Consider how remedial actions are incremental and “meaningfully different” from previous remedial actions, especially if there are repeat findings.
- Start performing root cause analyses and build the results into your remediation response.
- Ensure training is designed appropriately. Consider content modification, expertise of the presenters, delivery methods, target audience, and don’t overlook knowledge checks (an effective tool to demonstrate effectiveness).
- Design robust new tools and templates and intentionally communicate the new requirements.
- Consider results of subsequent inspections and specifically address them in your remediation response. Some results may indicate a need to perform additional actions. Some results may indicate a nuanced finding that tells a different story.
- Start early! Engage in dialogue and keep the process moving.









