The Year of Ampersand Part II: The Never-Ending Story of Completeness and Accuracy
I remember in my early days of auditing, there wasn’t much thought given to the completeness and accuracy (C&A) of information. Certainly, engagement teams tied out subledgers to the GL and performed tests of details or analytics to validate information, but there wasn’t the same consciousness as there is currently in this, the information age. Today, it seems testing completeness and accuracy is a never-ending story with always more to be done.
Conscious of the growing need for relevant and reliable information, in October 2021, the PCAOB published its Staff Guidance – Insights for Auditors Evaluating Relevance and Reliability of Audit Evidence Obtained From External Sources. This guidance is predicated on AS 1105.06 – Audit Evidence which states that “Appropriateness is the measure of the quality of audit evidence, i.e., its relevance and reliability. To be appropriate, audit evidence must be both relevant and reliable in providing support for the conclusions on which the auditor's opinion is based.”
In Part 1 of our series on this topic, we wrote about important considerations in evaluating relevance and reliability. While ALL audit evidence must be both relevant and reliable, there is an important distinction between audit evidence that emanates from sources external to the company and information produced by the entity (also known as IPE). The auditing standards are more stringent when considering the relevance and reliability of IPE. AS 1105.10 goes on to specifically require that:
When using information produced by the company as audit evidence, the auditor should evaluate whether the information is sufficient and appropriate for purposes of the audit by performing procedures to:
- Test the accuracy and completeness of the information, or test the controls over the accuracy and completeness of that information; and
- Evaluate whether the information is sufficiently precise and detailed for purposes of the audit.
Despite the continued focus on C&A, teams are still struggling to sufficiently test IPE for C&A. In its most recent inspection observations, the PCAOB identified issues surrounding C&A of information both within the realm of ICFR as well as in substantive testing. Let’s dig into the two potential testing approaches: controls and substantive.
Testing Controls Over C&A
Given the fact that more and more information is being generated electronically, it’s becoming increasingly difficult to test C&A without testing controls. When applying a controls approach, remember that controls are first and foremost the responsibility of management. In fact, as part of the management representation letter, management must assert to its “responsibility for the fair presentation in the financial statements of financial position, results of operations, and cash flows in conformity with generally accepted accounting principles” (AS 2805.06). As well, for controls, management must state “that management did not use the auditor's procedures performed during the audits of internal control over financial reporting or the financial statements as part of the basis for management's assessment of the effectiveness of internal control over financial reporting” (AS 2201.75).
With that in mind, when testing controls over the C&A of information, it’s important to understand the information pipeline. While the end result may be a simple report, controls over completeness and accuracy require various controls from origination to reporting. As the old adage says, “Garbage in, garbage out.”
What data matters
Before you start tracing the data through the process, you first need to think about the key data that matters. Too often, reports are considered in their entirety, but there is always specific data that is critical to what eventually shows up on the financial statements. For example, for revenue you likely need to know the product sold, the revenue recognition date (e.g., the shipment date), and the purchase price. Additional information may be critical to certain controls over that data (e.g., management review controls), but when understanding the information pipeline, it helps to narrow it down to the data that really matters, especially when testing the reliability of information used in the audit. Too often, a report is tested without addressing all the key data.
Data origination
Consider next the source of the information; where does it originate? Upstream controls are critical as they govern the initial input of information into a system. For instance, when testing an inventory aging report, the input of the initial purchase date is a critical component for calculating the aging of the inventory. These upstream controls typically involve business-process-level controls.
Systems, Interfaces and Data Warehouses
Once source data is input into a system, it’s important to understand the flow of information from input to the reporting system. Sometimes this might be one all-encompassing system, but often, there are multiple interfaces, systems and even sometimes data warehouses involved prior to the generation of a report.
For each system involved in the pipeline, management should have robust information technology general controls (ITGCs) in place to ensure the reliability of the systems. ITGCs themselves don’t provide direct assurance over data or reports, but rather, they are designed to ensure that systems are safeguarded from inappropriate access and inappropriate changes throughout the audit period. In other words, if effective ITGCs are in place, then the system should operate as designed, but that means the auditor still needs to validate the design (i.e. testing the report – we’ll get to that in the next section).
For each interface, it’s important to test the relevant controls that ensure complete and accurate transference of data between systems. Most interfaces involve processing and filtering of data. In these cases, the engagement team will need to validate what filters are in place, whether they are appropriate and how data transmission exceptions are resolved.
Finally, if there are data warehouses involved, similar to systems, it’s critical to understand the controls in place that safeguard the information while it resides in the data warehouse. Data warehouses often store data in different structures than the source system to aid in reporting. How is management comfortable that the data is completely and accurately transferred to the data warehouse?
Reports and queries
The final step in the process is understanding how the information is gathered and aggregated into the report or query. The nature of the controls and testing to be done will always depend on the type of report and output. Standard reports that generate PDFs pose less risk, for example, than customized queries that produce an Excel output.
Regardless of the nature of the report, there is always some testing to be performed. If the report is a simple standard report (e.g., a listing of information), the testing may be limited to understanding the change management controls around the report and validating that the report has in fact not been customized. If, on the other hand, it is a customized query, the engagement team should consider:
- What is the report configuration? Teams will need to review and test the report parameters. Does the report run automatically based on a schedule? Or is it run ad-hoc? Are there pre-set report parameters or does the user have the ability to dictate what information is included in the report (i.e. date ranges, business units, GL accounts, customer accounts, etc.)?
- What data fields are pulled in for the report? Is there any processing / manipulation / aggregation / synthesis of data as a result of the reporting functionality? If so, we need to understand what processing there is and validate it.
- What controls are in place to govern change management around reports? Often, companies will write specific standardized query scripts where the user has to input specific data parameters. In addition to understanding those parameters, teams need to understand and test the change management controls that safeguard the script.
- What controls are in place to protect data / queries once reports have been produced? This is especially important for dynamic files that may either a) be modified by human review subsequent to report generation or b) are linked and updated either real-time or on regular frequencies. Because of the susceptibility to change, for any report that is generated in Excel, the team should observe the generation of the report, including transference to the auditor directly.
These are just some of the questions to consider. The reality is that there is no one way to test a report. The testing approach will always be unique to the company’s systems and controls and will be impacted by the nature of the information being tested.
Substantively Testing C&A
Alternatively, if engagement teams opt not to test controls over C&A, they may substantively test the C&A of IPE. When performing substantive testing without controls reliance however, it’s important to remember that teams must test the C&A each and every time they obtain a report.
Completeness
There are various ways to substantively test the completeness of information. One approach is to reconcile a report with an alternative report / source. For instance, an engagement team could reconcile an investments purchases and sales journal with bank/broker statements to ensure completeness. Some reports, such as the journal entry listing could be tested for completeness by performing an account rollforward where the opening trial balances (i.e. prior year balances) are rolled forward to the current period balances using the journal entry listing. Alternatively, some reports such as cash disbursement journals may have sequential numbering which could help validate completeness. The design of the completeness test will always depend on the nature of the information. Finally, the completeness of some reports may be validated through detailed substantive testing such as floor-to-sheet testing for physical inventory. When testing completeness of a report, it is important to distinguish between the testing performed for completeness as a financial statement assertion and completeness as an information processing objective. Sometimes, the testing can accomplish both, such as the floor-to-sheet testing for physical inventory, but often, the completeness of a report does not directly translate into the same completeness for a financial statement assertion.
Accuracy
Accuracy is less difficult a concept to grasp as this is often the nature of a test of detail. In other words, accuracy is typically validated through taking a sample of items on a report and reconciling it back to audit evidence. When testing accuracy, it’s important to test the accuracy of all key data fields.
Other Considerations
Though the standard has not changed, with experience and learning, the industry has become more conscious of C&A. Though everything falls under the realm of either testing controls or substantively testing C&A, some specific considerations include:
- ICFR audits: In an ICFR audit, all information that is used in controls must specifically have internal controls that ensure completeness and accuracy. For the substantive portion of the audit (and/or for financial statement audits only), engagement teams have the choice of either identifying controls over C&A or substantively testing information for C&A.
- Data fields: often teams will review information directly within the system through remote-screen sharing with a client or through direct observation at a client’s desk. This is still “data” and although it is not a typical report, the engagement team should consider the controls in place from origination to observation of the data in the system.
- ITGCs: If ITGCs fail, teams will often have no choice but to test IPE through substantive means as ITGCs are the foundation for all other controls involving systems.
- Service Providers: Although service providers are technically “external” to a company, service providers are viewed as an extension of the company’s system of internal control and thus reports from service providers are still considered IPE. This means that teams must either identify and test controls over IPE or substantively test the IPE. If teams obtain SSAE 18 reports (i.e. SOC 1) over service providers, teams cannot automatically assume that C&A of reports are covered by the SSAE 18 report (most often the reports are not covered, but rather, are mentioned in the complimentary user entity controls). Teams must specifically review the SSAE 18 report and ensure the control objectives adequately address C&A of reporting.
- FS and IT Auditors: Most teams consider IPE testing to fall within the realm of IT auditors. Certainly, there are numerous IT controls such as ITGCs and automated controls that require the assistance of IT auditors, but teams must begin to shift perspectives and understand that IPE testing is a collaborative effort between FS and IT auditors. FS auditors often understand the purpose / use of a report (including the key data) and thus can understand the risk profile linked to a report. When testing controls, it is not just IT controls, but rather a suite of controls including business-process-level controls. We always encourage teams to engage IT auditors to assist with the testing as IT auditors have the competencies to test system controls, but it is not solely an IT auditor responsibility; integrate the testing!
Key Takeways
- C&A continues to be a recurring finding in the audit industry. Information produced by the entity (including service providers) must be tested for C&A either by testing controls or through substantive testing.
- When testing controls, consider the entire information pipeline and identify the key controls from origination through to reporting. This includes controls over the source inputs, systems, interfaces, and data warehouses.
- All reports (yes, even standard reports) require some testing to understand the report configuration, controls around change management and data integrity once the report is generated.
- While controls can be burdensome, substantive testing of C&A can be equally challenging. While there are multiple ways to test completeness and accuracy, a key consideration here is that each and every report must be substantively tested each and every time it is run/generated from a system.
- Reports from service providers are still considered IPE even though it is technically “external” from the company.
- IPE testing is NOT just an IT auditor’s responsibility. There are IT components for which an FS auditor may not be suitably equipped to test, but IPE testing is a collaborative effort and audit teams need to be integrating FS and IT auditor knowledge, risks, and competencies to design an effective and efficient approach to testing IPE.
WASHINGTON, D.C.: Johnson Global is pleased to announce that Joe Lynch, JGA Managing Director will speak at the AICPA® & CIMA® ENGAGE 24 Conference on June 9–12, 2025, at the ARIA Resort & Casino in Las Vegas, NV and live online. This CPE-eligible event is the premier annual event for accounting and finance professionals, bringing together thousands of peers, experts, and industry leaders for top-tier learning, networking, and career growth opportunities. Register by May 1, 2025, to take advantage of Early Bird rates— $1,995 for members ( regularly $2,095 ) and $2,445 for nonmembers ( regularly $2,545 ). *PCPS, Tax and PFP section members and CITP®, PFS™, CGMA® credential holders save an additional $150 . Discount reflected in section member/credential pricing during checkout. Register Today ! About Johnson Global Advisory Johnson Global partners with leadership of public accounting firms, driving change to achieve the highest level of audit quality. Led by former PCAOB and SEC staff, JGA professionals are passionate and practical in their support to firms in their audit quality journey. We accelerate the opportunities to improve quality through policies, practices, and controls throughout the firm. This innovative approach harnesses technology to transform audit quality. Our team is designed to maintain a close pulse on regulatory environments around the world and incorporates solutions which navigates those standards. JGA is committed to helping the profession in amplifying quality worldwide. Visit www.johnson-global.com to learn more about Johnson Global.
WASHINGTON, D.C.: Johnson Global Advisory (JGA) is proud to sponsor the Accountants' Liability Conference hosted by ALI-CLE. This two-day event will take place in Washington, D.C. and virtually on June 2nd and 3rd. This is an excellent opportunity to gain valuable insights into a wide range of critical issues. The 2025 conference will focus on audits and oversight, providing essential guidance to help you navigate the evolving landscape of regulatory compliance and better protect your firm and clients. “We are pleased to sponsor this conference for the last several years. This event brings together top law firms, internal counsel, and risk experts for dynamic discussions on trending topics such as accounting liability and other important issues affecting the profession,” said Jackson Johnson, JGA President. “I look forward to personally engaging with participants, presenters, and stakeholders at this conference.” This year’s program is still being finalized but planned topics include: Recent Trends in Accounting Litigation Living in a post- Jarkesy world The future of enforcement PCAOB inspection program update SEC perspectives on gatekeeper liability AI and emerging technologies in the accounting industry Accounting firms entering the legal space International firm considerations Alternative practice structures and AICPA independence rules Register by April 25 to attend in-person and use the code “ JGA ” to save $250 off . OR, for webcast attendance, use the code " JOHNSON " to save $125 off the tuition. Click here to register. About Johnson Global Advisory JGA is dedicated to helping public accounting firms around the globe achieve the highest level of audit quality. All CPAs and former PCAOB inspection staff, JGA professionals are passionate and practical about working alongside firm leadership to ensure the right controls, policies, and practices are implemented throughout the organization. Visit www.johnson-global.com to learn more about Johnson Global.
WASHINGTON, D.C.: Johnson Global Advisory (JGA) makes third annual contribution to the Boys & Girls Club of Greater Kansas City. The 29th Annual Kids Night Out is scheduled for Saturday, April 26, 2025, and promises to be an unforgettable evening, bringing together over 1,500 guests to support the children served by Boys & Girls Clubs of Greater Kansas City. “We’re thrilled to continue our support for the Boys & Girls Club of Greater Kansas City. This marks our third year backing this chapter, and I know that many of our JGA employees have personally benefited from the programs the Boys & Girls Clubs offer nationwide,” said Jackson Johnson, JGA President. “Kids Night Out is Boys & Girls Clubs of Greater Kansas City’s biggest fundraiser each year– and all dollars raised stay right here in Kansas City”, said Andy Burczyk, Board Member and Chair of Kids Night Out. “This organization is doing extraordinary things, and it is because we as a community invest in their impact.” For over 100 years, Boys & Girls Clubs of Greater Kansas City has provided a safe, supportive environment for youth. Serving over 8,000 kids and teens annually across 11 locations, the organization helps young people achieve their full potential through programs that promote academic success, healthy lifestyles, and character development. Through mentoring and leadership training, they equip members with the skills needed for success now and in the To learn more information on the Boys & Girls Club of Greater Kansas City and their work with the youth, please visit www.bgc-gkc.org . About Johnson Global Advisory JGA is dedicated to helping public accounting firms around the globe achieve the highest level of audit quality. All CPAs and former PCAOB inspection staff, as well as JGA professionals, are passionate and practical about working alongside firm leadership to ensure the right controls, policies, and practices are implemented throughout the organization. Visit www.johnson-global.com to learn more about Johnson Global.
WASHINGTON, D.C.: Johnson Global Advisory (JGA) is proud to provide a financial contribution to Sustainable Harvest International (“SHI”). SHI is a nonprofit helping Central American farmers adopt sustainable farming practices for over 27 years. Their mission is to address the destruction of tropical forests caused by slash-and-burn farming and logging. SHI’s mission benefits both current and future generations by equipping farmers with the knowledge to farm sustainably. “We’re proud to partner with Sustainable Harvest International in their important work,” said Jackson Johnson, JGA President. “This collaboration helps drive lasting, positive changes and by backing such vital organizations, we stay true to our mission of giving back and making a real difference. JGA’s philanthropic efforts focus on supporting organizations that are important to our people. I appreciate Vernon sharing his experience as a board member and we are grateful to work with him to amplify this organization.” Vernon Johnson, JGA Director, is a Board Member and Treasurer for SHI. He is actively involved in this organization. "My nonprofit work has helped me maintain perspective in both life and at work,” said Vernon. “It’s taught me to stay calm during challenges and focus on the bigger picture. This experience has improved my relationships and made me more resilient in stressful situations. My advice to busy professionals is to step back, appreciate the simple things, and not sweat the small stuff—being thankful and present can make a big difference." To learn more about SHI, visit www.sustainableharvest.org/donate . About Johnson Global Advisory JGA is dedicated to helping public accounting firms around the globe achieve the highest level of audit quality. All CPAs and former PCAOB inspection staff and JGA professionals are passionate and practical about working alongside firm leadership to ensure the right controls, policies, and practices are implemented throughout the organization. Visit www.johnson-global.com to learn more about Johnson Global.
The implementation of the System of Quality Management (SQM) is not just a compliance requirement but an opportunity to drive significant business value. By aligning firm-wide goals, improving internal processes, and optimizing controls, firms can streamline their operations, reduce inefficiencies, and improve overall performance. The process also provides an opportunity for firms to gain valuable insights through key metrics, enabling data-driven decisions which provide strategic business insights, enhances audit quality, and promotes employee retention. In addition, early adopters who focus on the business value from the outset see improvements that reach across different practices within the firm, making the SQM implementation a strategic investment that benefits the whole firm long-term. We have seen that our work in this area results in meaningful improvements to the way the business of audit and assurance is conducted, and many of these improvements will have benefits that reach across other practices of the firm. This is part II of a series on the benefits of SQM implementation. This article builds on our insights from 2022 in Part I of this series . Compliance as a Driver Compliance is the main driver of the new System of Quality Management (for all standard-setters, referred to as “SQM”) standards issued by the IAASB, AICPA, and the PCAOB. There is no disputing that. However, for the early adopters, what we are finding is immense business value that come out of this process; more so if you start the process with business value in mind. Our ability to anticipate the benefits of executing ISQM 1 years ago is a key strength. Some firms have already implemented ISQM 1 at some level (partial adoption for group audits, for example). For SQMS 1 and QC 1000, since firms are all in various stages preparing for the December 15, 2025, go-live date, now is the time to lay out the strategic value drivers from this compliance exercise. Related: See a breakdown of the various implementation dates here . SQM implementation requires firms to take a closer look at their internal process; every process that touches the value chain of getting an audit done. To demonstrate how this requirement goes beyond the confines of the “audit practice”, consider these examples: Employee onboarding, training, and retention; Software tools and technology used to monitor internal aspects like independence; Tools used by engagement teams, for example, to test 100 percent of smart contracts or select journal entries to examine for fraud; Archiving of binders on time, and in compliance with audit documentation requirements; or Monitoring programs that identify and fix deficiencies in both audit performance and the underlying functions supporting the audit. Getting Buy-In, Aligning Goals, and Engaging Personnel We have seen firm quality leaders struggling to get the buy-in needed from stakeholders across the business (IT, HR, Tax, Advisory) for effective SQM implementation. And we have heard leadership from firms around the world ask: “What’s in it for us?” “All this investment just for a compliance exercise?” “Why do I need to be involved in something the audit group has to do?” But the best question we’ve heard is: “How can the system of quality management implementation improve our business?” When everyone is working toward the same objectives and goals, implementation becomes a cohesive and streamlined process. It’s important to have goals that are aligned throughout the organization, with them tailored to the component and roles within those areas. This includes: Getting the invested support from the partnership board down to process owners; Having goals that are specific and measurable (e.g. documenting the current process and eventually operating controls consistently and timely); Aligning the firm’s tone-at-the-top helps get everyone in sync; and Reinforcing management’s responsibility to establish a culture of quality and its importance in all the services performed by the firm. Management should: Lay out the long-term benefits of improved business performance, reduced risks, more timely and accurate data created which leads to insightful decisions; Emphasize the benefits of overall reduced costs related to non-compliance with network, firm, peer review, and regulators requirements; and Evaluate the potential for lower costs of insurance upon implementation and overtime. Understanding Current Processes Conducting interviews, gathering data, and documenting the processes within the firm’s system of quality management allows visibility of how these processes currently work (or don’t work). When SQM implementation project leaders invite personnel involved in a process together into one room and facilitates an open discussion, a clear picture of how each process really works materializes, and this strengthens cross-functional teaming. For instance, these meetings often result in the realization that two (or more) people are doing the same tasks (inefficiency) or discovering that no one is performing an important review check (gap). Formalizing and Optimizing Processes Once the current process is understood (“As-Is”) and with the right people in the room, the identification of areas where procedures can be more uniform, streamlined or simplified emerges. We often find that processes can be improved without adding more controls. This optimization effort incorporates standardization and normalization across the firm’s services and business functions providing benefit beyond the compliance exercise of the audit practice. Gaining Business Insights A sound system of quality management will bring new business insights and transparency to make confident decisions with reliable data. The optimization process will identify the key information used in the system of quality management (a similar concept to the work auditors performs with their companies as described here). This information provides new insights to help process owners and firm leaders make decisions. A firm can develop key quality metrics that are used to measure and improve the operation of the firm and audit quality which results in a modernized competitive firm. When a firm establishes a system to monitor the SQM environment, these insights allow for timely monitoring which enables leaders to quickly make decisions that address anomalies or negative trends as they arise. Getting Started Early Getting started early begins with: Firm leadership embracing the need for a consistent and well-monitored SQM to improve the business; Aligning objectives and goals for all firm personnel based on their role within the SQM; Disseminating to all firm personnel the importance of how their role contributes to the SQM; and Incentivizing all firm personnel to commit to their SQM objectives and goals which contributes to the benefits of these modern practices that lead to competitiveness. While compliance may be the hand forcing you forward, the upside to this “exercise” is that undoubtedly you will be a stronger, more efficient firm when executed correctly. We see firms that begin with such a mindset have more success internally and in the marketplace. Conclusion The journey of implementing a quality management system is transformative. Beyond compliance, it reveals deep insights and benefits, positioning firms at an advantage in our profession. For more information, reach out to your JGA audit quality expert. Jackson Johnson , JGA President and Founder, is a seasoned expert in audit quality and technical accounting matters. With nearly six years of experience at the PCAOB, he has worked with small and medium-sized accounting firms globally, focusing on firm quality control and ICFR audits. Jackson advises firms in PCAOB and SEC investigations related to cryptocurrency audits and has served on the Enforcement Advisory Committee of the California Board of Accountancy. Before his tenure at the PCAOB, he worked with public and private clients at Grant Thornton LLP in Boston, Los Angeles, and Hong Kong. Jackson is also a frequent speaker on quality control and enforcement issues in the accounting industry. Joe Lynch , JGA Managing Director and Shareholder, and a member of the AICPA Quality Management Implementation Task Force. Joe works with mid-market public accounting firms worldwide to implement quality management programs that integrate technology and process to improve the delivery of audits. Joe spent more than six years as an Inspection Leader at the PCAOB, he conducted inspections of quality control and global issuer audits at large firms in the US as well as foreign affiliate firms, focusing on examining quality control and the design and implementation of audit work. Joe also has experience supporting financial service industry audit teams at a Big Four firm. In addition, his experience includes active-duty service in the US Air Force and supporting companies with IT strategic initiatives such as designing the IT framework for technology departments as well as leading implementations of ERPs and systems.
The Public Company Accounting Oversight Board (PCAOB) recently decided to withdraw proposed rules that would have required registered firms to report a significant new set of firms and engagement metrics. It was also set to mandate that large accounting firms submit financial statements to the U.S. Regulator, as part of a wider effort to enhance oversight. This decision came after criticisms from a variety of stakeholders from both the PCAOB and SEC comment process. For example, the American Institute of CPAs (AICPA) expressed concerns that these requirements could harm U.S. capital markets and negatively impact small and midsized audit firms, potentially driving them out of the public company auditing practice. The PCAOB's decision to withdraw the rules was seen as a positive move by the AICPA, which had urged the Securities and Exchange Commission (SEC) to refrain from approving the rules due to the significant challenges they posed. JGA commented to the SEC on the proposal; you can read our position on the proposal here .
WASHINGTON, D.C.: Johnson Global Advisory (JGA) has published a new third edition guide examining the key considerations faced by public company auditors during their PCAOB inspections. Drawing experience as audit and audit regulation experts and advisors to firms worldwide on all aspects of audit quality improvement, the JGA team has authored NAVIGATING PCAOB INSPECTIONS: Understanding the Inspection Process from Start to Finish.
Firm and Engagement Metrics: Getting a Head Start *** Please see the updated information on the PCAOB Firm & Engagement metrics Rule change. Click here . Introduction As regulatory requirements in the accounting profession continue to evolve, accounting firms are facing new challenges in ensuring compliance with quality management standards. One of the most significant changes comes with the adoption of the PCAOB’s QC 1000 and the associated Firm and Engagement Metrics requirements , which aim to increase transparency and accountability within the auditing process. These new requirements are set to provide critical data on a firm’s operations and other factors that can inform audit quality, including partner involvement, workload distribution, and other factors. In this article, we’ll explore the challenges and opportunities firms face as they begin collecting the information necessary for firm and engagement metrics. We’ll also provide actionable steps that, in concert with implementation of QC 1000 / ISQM 1 / SQMS 1, firms can take to ensure they’re ready for compliance, with a focus on the key areas highlighted in recent industry discussions. 1. Quality Management Implementation: Bridging Internal and External Requirements Key Insights: A major challenge shared by our clients was the distinction between internal quality management (QM) processes and external regulatory requirements. Firms are finding it difficult to ensure that the information they provide to regulators will be complete and accurate. The requirement to report accurate and non-misleading information to external parties under QC 1000 , such as firm and engagement level metrics necessitates a shift in how firms view and manage data internally. Action Items for Firms: Ensure Data Accuracy : Firms must evaluate their quality management system to ensure they are designed to meet the requirements for accurate and non-misleading information. This is crucial as QC 1000 requires firms to communicate data to external parties that is accurate and complete. Implement Data Tracking Systems : Develop systems to track and report data, ensuring that the information provided to external parties, including regulators aligns with quality management objectives. This may require new systems or modifications to existing systems. Evaluate Communication Processes : Firms should focus on improving or implementing communication processes to ensure that all external communications, especially those with regulators, meet the high standards of accuracy and clarity mandated by QC 1000. 2. Comparability of Metrics Among Accounting Firms Key Insights: The introduction of standardized firm and engagement metrics is designed to increase comparability and accountability across accounting firms. This allows regulators, investors, and stakeholders to evaluate firms based on consistent data. However, there are concerns about how these metrics might influence firm selection by audit committees and whether these metrics alone tell the full picture to accurately represent audit quality. Action Items for Firms: Adopt Standardized Metrics : Firms should ensure that their reported metrics align with the prescriptive guidelines outlined in the adopted Firm and Engagement Metrics Rule. This includes applying the defined roles in a consistent manner (such as engagement partners and managers) and calculating metrics consistently across all engagements. Prepare for External Scrutiny : Be aware that these metrics may not only be scrutinized by regulators but also by audit committees and investors. Firms should ensure that they are accurately capturing and reporting their metrics to avoid misrepresentations. Monitor AI Usage in Audits : Consider how AI tools may impact workload calculations and the measurement of audit hours. As AI becomes more prevalent in auditing , firms may need to report on the extent of its use, which could influence workload metrics. 3. Potential Implications of Reporting Metrics Key Insights: While firm and engagement-level metrics can provide valuable insights, there are potential risks to firms that are likely to emerge. These include the possibility that the metrics may inadvertently point to root causes of issues in the inspection process, particularly regarding workload and capacity challenges. Additionally, these metrics – coupled with inspection report findings - may influence how audit committees select firms, potentially providing a skewed representation of audit quality. Action Items for Firms: Use Metrics Internally for Root Cause Analysis : Firms should utilize firm and engagement level metrics as reported, when performing internal root cause analysis , identifying potential problems in workload distribution or staffing levels before they escalate. Evaluate the Impact on Firm Selection : Be mindful of how these metrics might affect firm selection. Firms should aim to demonstrate the full context behind their metrics to avoid misinterpretations that could impact their reputation. Balance Metrics with Qualitative Insights : Firms should complement quantitative metrics with qualitative insights, ensuring a comprehensive picture of their audit quality is presented to external stakeholders. 4. Engaging Stakeholders in the Use of Metrics Key Insights: One concern we have heard was the uncertain use of metrics by investors and other stakeholders. While the objective of the PCAOB in the rule-setting process was for investors and audit committees to analyze these metrics, it’s unclear how much weight they will place on the data in making decisions about firms’ audit quality. In the planning process, firms can take charge and shape stakeholder use and effectiveness of the use of firm and engagement metrics shared publicly. Action Items for Firms: Engage with the Investor Community : To better understand how investors will use the metrics, firms should engage more actively with the investor community. This could include attending shareholder meetings and investor calls to gain insights into what data investors prioritize when evaluating audit quality. Increase Transparency in Reporting : Firms should be transparent in explaining the context and methodology behind their metrics, helping the clients, audit committees and other stakeholders understand the full context to make informed decisions. Ensure Data Relevance : Firms should ask their clients whether the data currently being reported is sufficient, and whether additional data points might be necessary to better assess audit quality and reliability. 5. Getting Started with QC 1000 and Firm Metrics Key Insights: As firms begin implementing QC 1000 and collecting firm and engagement level metrics , they face the challenge of ensuring their existing systems are capable of tracking and reporting the required data. Many firms may need to redesign or enhance their internal controls to capture the necessary information accurately. Action Items for Firms: Align QC 1000 with Firm and Engagement Level Metrics Reporting : Firms should carefully review QC 1000’s requirements and align them with the firm and engagement level reporting requirements. Focus on the information and communication component, ensuring that data is collected and reported accurately and consistently. Evaluate Current Systems : Firms should assess whether their current systems are capable of tracking metrics such as workload and audit hours. If systems are lacking, firms should plan to either redesign or implement new controls to capture this data accurately. Implement Real-Time Monitoring : Firms should adopt real-time monitoring tools that allow them to proactively manage workload issues and other potential risks. This ensures that data is captured and analyzed continuously, improving overall quality management. Be Agile and Proactive : QC 1000 requires firms to monitor metrics and adapt to emerging issues. Firms should adopt an agile approach to quality management, ensuring that metrics are not just reported at the end of the period but are actively managed throughout the year. Conclusion: Preparing for the Future of Quality Management and Firm Metrics The new QC 1000 and firm and engagement level metrics requirements can represent a significant shift in how accounting firms track, report, and manage audit quality. By adopting these standards, firms can improve transparency, enhance accountability, and demonstrate their commitment to high-quality audits. However, the implementation of these new requirements will require careful planning and investment in both systems and processes. Firms that act now to align their systems with QC 1000, engage with stakeholders, and monitor their metrics in real-time will be better positioned to meet regulatory expectations and enhance their market reputation. As the industry moves towards more data-driven decision-making, firms that prioritize accuracy, transparency, and continuous improvement will be the leaders in delivering quality audits. For more information, please contact your JGA audit quality expert .
Key Takeaways from the 2024 AICPA SEC/PCAOB Conference: What It Means for Your Firm In December 2024, the AICPA SEC/PCAOB Conference in Washington D.C. brought together leaders from the SEC, FASB, and PCAOB to discuss critical developments in the accounting profession. The conference focused on fostering audit quality, improving the resilience of capital markets, and addressing ethical challenges. Below are the key takeaways from the conference speeches most relevant to you, including insights from Paul Munter, SEC Chief Accountant, Erica Williams, PCAOB Chair, Christina Ho, PCAOB Board Member, and Mark Uyeda, SEC Commissioner, and what these developments mean for the accounting firm clients we serve. 1. Munter’s Remarks on Upholding Independence Key Points: In his speech, Paul Munter, SEC Chief Accountant, emphasized the importance of maintaining auditor independence to preserve market integrity. Munter stressed that independence should be seen as a core professional standard, not just a compliance requirement, and urged auditors to foster a culture of skepticism and integrity. He called on auditors to ensure they challenge management when necessary to detect fraud and ensure accurate financial reporting. What This Means for Firms: The points are reminders to keep independence and objectivity at the forefront of engagement teams, despite the new technical complexities (e.g. PE deals), and general lowering our guard around these obligations: ways to continue to demonstrate this important across the firm system of QC are: 1. Reinforcing independence policies and ensure continuous training and monitoring; 2. Encouraging a skeptical mindset within audit teams to prevent ethical lapses; 3. Ensuring firm-wide commitment to independence, especially in long-term client relationships or where conflicts may arise. 2. PCAOB Chair Williams on Improvements in Deficiency Rates, and new standards Key Points: PCAOB Chair Erica Williams shared significant positive news, highlighting improvements in the aggregate deficiency rate at the largest audit firms. She attributed this progress to the firms’ increased efforts to enhance audit quality, including better risk assessment procedures and heightened transparency in reporting. Williams emphasized the importance of maintaining this momentum in order to build trust and credibility in the profession and the capital markets. Williams also discussed the newly adopted QC 1000 , the quality control standard that mandates firms to have comprehensive quality control systems to ensure that they meet PCAOB and SEC standards. She noted that this standard is designed to provide reasonable assurance that audit firms have the necessary controls in place to perform high-quality audits consistently. Additionally, she emphasized the critical role of the SEC in passing firm engagement metrics , which will help ensure that audit firms are held accountable for the quality of their engagements and provide investors with more detailed insight into firms’ performance. What This Means for Firms: Implement QC 1000 : Firms should begin preparing for the adoption of QC 1000 by reviewing and strengthening their own quality control systems. Ensure that these systems are robust enough to guarantee compliance with PCAOB and SEC standards and can provide reasonable assurance of consistent audit quality. Focus on Firm Engagement Metrics : If the SEC passes firm engagement metrics, firms will need to ensure they have clear, accurate data on their engagements, performance, and quality measures. Preparing now for these metrics will help firms stay ahead of the regulatory curve and demonstrate their commitment to transparency and high-quality audits. Enhance Risk Management and Quality Control : Firms should continue refining their risk-based audit approaches, focusing on stronger internal controls, and implementing transparent reporting practices. Continuous improvement will ensure the firm stays in line with both regulatory expectations and industry best practices. 3. PCAOB Board Member Christina Ho on Collaboration to Advance Audit Quality and Market Resiliency Key Points: In her speech, Christina Ho, Board Member of the PCAOB, stressed the need for genuine collaboration among regulators, auditors, and firms to advance audit quality and improve the resiliency of capital markets. This collaboration is essential to address emerging challenges, such as increasing regulatory expectations and the complexities of global markets. Ho highlighted that this collective effort is crucial to maintaining strong, transparent financial reporting and ensuring that audits remain effective and reliable, particularly as financial markets evolve. What This Means for Firms: Engage with regulators : Actively participate in consultations and industry forums to stay ahead of regulatory trends. Foster collaboration : Encourage open communication between audit teams, clients, and audit committees to ensure alignment on regulatory expectations. Adapt to global market changes : Firms must remain agile and ready to respond to the shifting dynamics of both domestic and international markets, ensuring that their audit processes remain resilient and effective. 4. SEC Commissioner Mark Uyeda on Crypto, and PCAOB’s Future Key Points: In his keynote, SEC Commissioner Mark Uyeda discussed the SEC's evolving role in the accounting and auditing of cryptocurrencies, noting that crypto is currently being accounted for and audited through enforcement activities. He stressed the need for greater clarity in crypto accounting and auditing standards. Uyeda also discussed the future of the PCAOB, stating that "all options are on the table." What This Means for firms: Crypto Accounting and Auditing : Firms need to stay abreast of emerging standards and enforcement actions in crypto accounting. As regulations evolve, firms must be prepared to adapt their auditing and reporting practices accordingly. Take a look at positions from other regulators or standard setters (e.g. CPAB), to inform what sufficient procedures looks like. PCAOB’s Future : The potential restructuring of the PCAOB may affect how audits are overseen in the future. Firms should monitor developments closely and assess the impact on their operations and regulatory compliance, and firm strategy. 5. Ethical Considerations and Audit Quality Throughout the conference, both SEC and PCAOB leaders emphasized the need for ethical leadership in the accounting profession. Lapses in ethics, whether intentional or inadvertent, can severely undermine trust in auditors and in financial markets. The speeches underscored the responsibility of firm leaders to uphold high ethical standards and ensure that these values are embedded in their teams’ daily practices. What This Means for Firms: Promote ethical leadership across all levels of the firm, ensuring that ethical considerations are integrated into every stage of the audit process. Invest in ongoing ethics training to reinforce the importance of upholding integrity and objectivity. Implement early detection mechanisms for identifying potential ethical lapses, ensuring timely corrective action. Conclusion: Positioning Your Firm for Success The 2024 AICPA SEC/PCAOB Conference provided crucial insights into the current and future landscape of the accounting profession. By focusing on audit quality, independence, collaboration, and ethical leadership, firms can not only meet regulatory requirements but also strengthen their reputations as trusted professionals in the marketplace. For JGA’s clients, the key takeaway is that maintaining robust quality control systems, engaging in ongoing dialogue with regulators, and staying ahead of emerging trends such as crypto accounting are critical strategies for ensuring continued success in a dynamic regulatory environment. For more information, reach out to your JGA audit quality expert.
WASHINGTON, D.C., November 26, 2024 - Johnson Global Advisory (JGA) is announcing the formation of its Strategic Leadership Council (SLC) , an initiative aimed at bolstering the firm's strategic direction and reinforcing its commitment to industry-leading advisory services. The Council, composed of executives from diverse sectors within the audit quality stakeholder ecosystem, will provide insights into the JGA leadership on industry trends, strategic decision-making, and growth opportunities. Kathleen M. Hamm, Greg Jonas, and Dave Sullivan are the first appointees to the SLC. Kathleen M. Hamm has an extensive background in financial regulation, control infrastructures, and risk management, particularly relating to fintech and cybersecurity. Her previous role as a Board Member of the Public Company Accounting Oversight Board (PCAOB) highlights her leadership in regulatory transformation and strategic policy development. "Joining JGA’s Strategic Leadership Council allows me to leverage my experience to further the Firm's mission in these transformative times," remarked Hamm. Greg Jonas is an independent consultant on auditing and business reporting matters. He served as Director of the Division of Research and Analysis at the PCAOB from 2012-2016. In addition to roles as a financial analyst at Morgan Stanley and Moody’s Investors Service, Greg spent 23 years at Arthur Andersen, serving in various roles supporting its global audit practice. “JGA serves a vital role in improving audit quality for the benefit of auditing firms and investors. I look forward to contributing to the firm’s success.” Dave Sullivan, a seasoned executive known for his strategic insight in audit quality and risk management, has over 35 years of experience from Deloitte. His leadership in global audit quality initiatives make him a pivotal addition to the council. "I look forward to collaborating with my fellow council members to propel JGA to new heights," stated Sullivan. The SLC will meet quarterly, advising JGA’s leadership team on critical business opportunities and challenges, ensuring the Firm remains at the forefront of industry innovation and strategic excellence. The first meeting of the SLC was held on Friday November 1, 2024, at JGA's Washington D.C. office. “I am proud to welcome Kathleen, Greg, and Dave to our new Strategic Leadership Council,” said Jackson Johnson, JGA President and Founding Shareholder. “Their collective expertise will be instrumental in guiding our strategic initiatives and ensuring that JGA continues to set high standards our clients expect in this sector.” About Johnson Global Advisory JGA partners with leadership of public accounting firms, driving change to achieve the highest level of audit quality. Led by former PCAOB staff, JGA professionals are enthusiastic and practical in their support to firms in their audit quality journey. We accelerate opportunities to improve quality through policies, practices, and controls throughout the firm. This innovative approach harnesses technology to transform audit quality. Our team is designed to maintain a close pulse on regulatory environments around the world and incorporates solutions which navigate those standards. JGA is committed to helping the profession in amplifying quality worldwide.
