The Never-Ending Story: How to Remediate Recurring EQR Findings
In August 2021, we wrote an article summarizing our research on the most common PCAOB Part I audit findings based on inspection reports published from 2017 through July 7, 2021. In that article, we found that 77.8% of deficiencies boiled down to just a couple auditing standards including AS 2201 (internal controls), AS 2301 (response to risk of material misstatement), AS 2501 (auditing estimates), and AS 2810 (evaluating audit results). The focus of the 2021 article was on the nature of Part I findings, but whenever there is a Part I finding, the PCAOB undergoes a process to determine whether the finding is attributable to the engagement quality reviewer (“EQR”). In other words, would a thorough review by the EQR, in accordance with AS 1220: Engagement Quality Review, identify the deficiency? Generally, if the deficiency is in an area of significant risk, the answer is almost always “Yes.”
At first glance, fair enough. But having worked with engagement teams supporting them through PCAOB inspections and looking at the nuanced and sometimes detailed nature of some of the PCAOB Part I findings, attributing the audit issue to a deficient EQR review can sometimes feel like the regulator is being overly exigent. Engagement teams often ask, “What is the PCAOB expecting here? Do they expect the EQR to review every test of design and operating effectiveness for internal controls related to every significant risk? Do they expect the EQR to review every substantive workpaper in significant risk audit areas?” Though not explicitly required in the AS 1220 standard, implicitly by the very nature of the EQR attribution, the PCAOB is inherently creating an expectation of a very detailed EQR review. AS 1220.09 does after all require the EQR to “review documentation.”
While I can empathize with engagement teams, and misery loves company, complaining doesn’t change the view of the PCAOB. The reality for most firms is that if there is a Part I finding in the report (especially if it’s linked to what is typically a significant and/or fraud risk, such as revenue), there will likely also be a Part II finding in the report linked to deficient EQR reviews.
For those not as familiar with PCAOB inspection reports, Part I contains audit deficiencies; this part is made public when the report is published. Part II contains the firm’s QC criticisms; this part isn’t initially released to the public. Rather, the firm has one year from the date the report is published to then remediate the QC criticisms. If the remediation is satisfactory to the Board, then Part II is kept private. If the firm “fails” remediation however, Part II is then released to the public.
When the PCAOB evaluates remediation, they pay particular attention to recurring deficiencies. So if the same deficiency occurs in two subsequent reports, remediation efforts must necessarily be incremental in each report to address the recurring deficiency. Said otherwise, a firm can’t deliver the same training year after year and expect it to drive change; it must change its approach to remediate the recurring deficiencies.
EQR findings started popping up around 2012/2013, so regardless of whether a firm is inspected annually or triennially, all firms with Part I findings are facing the challenge of how to remediate a recurring EQR deficiency. We have numerous clients telling us that this is the second, third, or sometimes even fourth inspection report including an EQR finding. They often ask us, “This time, what can we do that is incremental that we haven’t already done?”
Remediation Considerations
Training
The starting point for many firms is to provide a training specific to AS 1220. Most firms have already attempted this by sourcing an online training from the marketplace. If this is the first time your firm has received a Part II EQR finding, then this might work. In our experience, most of the generic EQR trainings are exactly that, generic. They don’t delve into the specificity of the standard and the nuances that are found in PCAOB comments. We have often partnered with firms to help tailor specific EQR trainings that cover AS 1220, but also focus on the firm’s Part I findings where the EQR failed to identify the audit deficiency(ies). If you’ve already done training once, consider hiring an expert to deliver a more firm-specific training or consider building in hands-on case studies that pull specific examples from the Part I deficiencies.
EQR Checklist
Another common remedial action is to review and modify the EQR checklist. Most audit programs already have a basic EQR checklist that calls out the requirements under AS 1220. However, we’ve worked with firms that have taken steps to either modify the EQR checklist and/or create addendums that specifically call out the issues or concerns identified in Part I. For instance, if there are specific concerns around the firm’s testing of management review controls, we’ve seen instances where firms will modify the EQR checklist to build out specific questions related to management review controls. The idea is to ensure that EQRs are specifically thinking about the firm-specific issues when performing their reviews.
QC Policies
Depending on the size of the firm, we’ve seen a gamut of potential revisions to firm QC policies related to EQRs. Some policy revisions include restricting who can serve as an EQR (i.e. no partner may serve as EQR if they have received Part I comments on other audit inspections and/or received an EQR comment from previous inspections). Some policies focus on partner workload allocations and ensure EQRs do not have too many year-ends at the same time. We’ve even seen some instances where the firm will designate specific partners who only perform EQR reviews so as to specialize their skillset and ensure they have appropriate ability to challenge engagement teams. Finally, for smaller firms with less EQR resources, we’ve seen firms outsource the EQR function to more technical and/or PCAOB-experienced firms. There’s no “silver bullet” here as no one policy is going to work for every firm; the point here is for firms to be intentional about who they assign as EQRs and ensuring that the EQRs have the right skillset and workload to effectively execute a quality review.
EQR Monitoring / Coaching
Many firms have already successfully implemented the previous three actions and the PCAOB has been okay with these efforts up until now. However, seeing that EQRs are continuing to fail to identify Part I issues, the PCAOB is asking firms to do more to ensure quality audits. As we’ve worked with firms on remediation, we’re recommending many firms consider an EQR monitoring and coaching program. Essentially, EQR’s perform their reviews and work with a “coach” who challenges the review process, asks probing questions about specific risks and how the engagement team addressed the matters. For instance, a coach might ask the EQR how the engagement team sufficiently audited the intangible asset valuation from a recent business combination. If management used an income approach, the coach might ask about specific assumptions. The idea is to create a dialog between the coach and the EQR where the two collaborate to ensure the EQR has asked the appropriate questions of the engagement team and has reviewed the relevant documentation. We’ve seen some firms create an internal “EQR coach” role and we’ve also partnered with other firms where we help perform an “in-flight” review so that we can help coach the EQR in their review
Other Considerations
The above remedial actions are the most “classic” that we’ve seen in the industry, but again, remedial actions are going to look different at every firm. The reality is that the remedial action should be in response to the actual root cause of the EQR deficiency. Why are EQR’s not identifying the Part I deficiencies? In light of ISQM 1, SQMS1, and the imminent PCAOB QC standard, all firms will soon be required to perform root cause analyses for deficiencies, so firms might as well consider implementing root cause analyses now. By doing so, they can identify the real root cause behind why EQRs are failing to identify audit deficiencies and then design specific remedial actions to address these root causes.
Given that recurring findings become increasingly difficult to remediate, we can’t stress enough the importance of beginning the remediation process early. Engage the PCAOB in a dialogue to discuss the planned remedial actions and get feedback on the sufficiency of those actions. In addition, to demonstrate the effectiveness of EQR remedial actions, EQRs will need to have performed some year-end audits, which means for many firms, the remedial actions need to be implemented prior to December year-end audits so that the EQR role can function. So don’t underestimate the amount of time it will take to implement remedial actions.
Another important point is that EQRs are essentially the last line of defense with regards to audit quality. Said differently, audit quality starts with the audit team and the firm’s entire QC system that enables and supports audit engagement teams to perform quality audits. That includes the associates, seniors, managers, partner and the EQR. While this article has been solely focused on EQR considerations, firms must also necessarily consider the remedial actions that address the Part I audit deficiency(ies) as well. The EQR finding, while linked to its own standard, is really just the review of the audit work performed by under all the other audit standards. So, let’s not blame the EQR too harshly; it’s a collective effort and the EQR as well as the entire engagement team should be considered when remediating all QC deficiencies identified in firm inspection reports.
By incorporating the EQR finding in the firm inspection reports, the PCAOB is inherently telling firms they need to bring Part I audit deficiencies down to zero. So long as there continue to be Part I deficiencies (which are generally identified in areas of significant risk since that’s the general focus of the PCAOB), there will continue to be EQR findings. While I certainly believe the PCAOB has continued to expect more and more of the audit profession, it doesn’t exonerate firms from continually pursuing greater audit quality.
Key Takeaways
As firms consider the recurrent nature of EQR findings, possible remedial actions include:
- Developing more robust trainings that specifically address nuances of firm findings and walk through examples of EQR reviews, such as case studies;
- Modifying EQR checklists and/or creating addendums to include specific bullets and questions addressing firm audit deficiencies, specifically calling it out to the EQR’s attention;
- Revising firm QC policies linked to how EQRs are assigned to jobs and/or considering outsourcing options using more experienced/technical firms;
- Implementing new EQR coaching programs to assist EQRs and challenge their reviews, building in learning through hands-on coaching;
- Performing root cause analyses to really delve into the specific issues giving rise to the EQR failures to identify audit deficiencies;
- Designing a firm-wide remediation plan to addresses all audit deficiencies and not narrowly focusing on the EQR criticism; and
- Engaging the PCAOB early in the remediation process to seek feedback on the sufficiency of the remedial actions.
We are long past the pre-Sarbanes-Oxley audit days and EQR reviews need to be taken seriously. Whereas once they might have consisted of high-level conversations between the lead partner and the EQR, today, an EQR review needs to incorporate a thorough review of the audit documentation supporting the engagement team’s planning of the audit and conclusions reached after executing audit procedures. Perhaps this is the biggest surprise to EQRs, the level of granularity that is now expected of them. It may feel like a never-ending story and perhaps the PCAOB is being overly exigent, but the reality is the PCAOB is not backing down off this issue, so firms need to consider what incremental actions they can take to truly ensure EQRs perform quality reviews.
Geoff Dingle, JGA Managing Director, works with PCAOB-registered accounting firms helping them identify, develop, and implement opportunities to improve audit quality. With over 20 years of public accounting experience, he spent nearly half of his career at the PCAOB where he conducted inspections of audits and quality control. Geoff has extensive experience in audits of ICFR and firms’ systems of quality controls. Prior to the PCAOB, he worked on audits in various industries at Deloitte in Atlanta and Durban (South Africa)
