Triennially Inspected Firms: Blessing and a Curse
In a day and age where the SEC and the PCAOB are holding auditors more accountable, audit quality is of utmost importance. Given the failures of a peer-regulated industry, in passing the Sarbanes-Oxley Act of 2002, Congress created the PCAOB, an independent audit regulator. Through the inspection process, the PCAOB has made clear its interpretations of the standards and what constitutes a quality audit. Now, more than 20 years later, the audit industry has seen significant changes and we’d argue, improvements, to audits.
Under current guidelines, firms that audit 100 or more issuers are required to be inspected by the PCAOB on an annual basis; in 2021, there were 12 annually inspected firms. For all other firms, the PCAOB performs triennial inspections.
In looking at the results of the 2021 inspection reports for the Big 4 firms (i.e. the largest of the annually inspected firms), the PCAOB inspected an average of 55 audits per firm. Approximately 16% of inspected audits had Part I.A deficiencies (or in other words, opinions that were not supported). For all firms inspected, the PCAOB found an average of 33% of audits with Part I.A deficiencies. That’s double the average for the Big 4 firms. Clearly, there is a distinct difference in audit quality between annually and triennially inspected firms. This has been the case for many years. In the 2020 inspection findings spotlight, the PCAOB commented that: “For the majority of the annually inspected audit firms, we identified fewer findings in 2020 compared to our 2019 inspections. In our triennially inspected audit firms, some improvements were noted, although deficiencies continue to remain high.”
Inspection and Remediation Process
In our view, one of the main drivers of audit improvement has been the inspection and remediation processes, through which, firms are held accountable, and accountability drives change. Logically, this makes sense. Annually inspected firms are constantly in front of the PCAOB; firm leadership has regular meetings with the Board and staff across all levels of the firm are getting constant exposure to the inspection process. Just as many associates truly learn auditing through on-the-job training, so too, do many staff learn audit quality through experience with PCAOB inspections. Inspections afford staff the opportunity to hear the types of questions PCAOB inspectors ask. They get insight into the PCAOB’s view of audit risks and what procedures are considered sufficient (or insufficient) to address those risks. Though comments are often contested, they provide direct feedback to engagement teams on the audit failures and can help teams alter planned future procedures.
Similarly, annually inspected firms are also always in the process of remediating past inspection reports. There are constant messaging and improvement efforts being made to drive change within the firm.
Firm leaders know the hot topics, can track the development of new concerns as they arise and are having perpetual remediation conversations with the Board. These conversations provide invaluable insight into what remedial actions are sufficient (or again, insufficient); the PCAOB is able to provide additional clarity around its concerns, allowing firms to further refine their remedial plans.
While we understand the additional demands and burdens that come with more frequent inspections, (in fact, many of our clients have already started to see their three-year cycles accelerated to two years), there is clearly a correlation between increased exposure to the PCAOB and increased audit quality. For those firms that are still on a triennial basis, whether smaller domestic firms or international affiliates, let’s explore some important actions that can result in perpetual audit quality improvement, without raising your hand and asking for more inspections.
Tone at the Top
Foundational to any system of quality management is the tone at the top. This is highlighted in the fact that it is one of eight quality components in the new quality management standards (including ISQM 1, SQMS 1 and QC 1000). Firm leadership must be aware of the tone at the top and how that trickles down to the engagement team level. Tone at the top consists of both the communications from firm leadership as well as the communications from engagement partners and senior managers.
Often, we see leadership kick off training programs with a note on the importance of audit quality or we’ll see firmwide emails touting the critical nature of perpetual improvement. But what about the dialogue during and after a PCAOB inspection? Do engagement teams pause to reflect on the nature of the questions and consider how they could have approached the audit differently? Or do engagement teams criticize the PCAOB inspectors and discount the questions and findings as impertinent? Are teams professional with the inspectors or are they rude and dismissive? We get it; standing by your work and defending against a potential comment form can create tension, but can we acknowledge that perhaps there is something still to be learned? As former inspectors and consultants supporting audit teams, we’ve seen the gamut in reactions from engagement teams. How partners and firm leadership react to criticism from regulators conveys a lot to everyone at the table about how the firm approaches audit quality and its commitment to quality management.
Obviously, words matter, but tone at the top is more than mere language. It’s also actions. Similarly, once an inspection is completed, does firm management jump in to perform a root cause analysis? Does the firm provide resources and/or guidance to engagement teams to help them perform remedial procedures to address the comments? Does the firm begin crafting firm-wide responses to address quality concerns? Again, we’ve seen the gamut. Waiting until the 11th month in a year-long remediation period inherently communicates a certain tone around audit quality: “It’s not the priority right now” or “It can wait.” We have always been an advocate of early remediation.
Actions extend beyond the inspection process. It includes leadership attendance and participation in audit trainings (read: not being distracted and working during presentations). It includes reading and disseminating PCAOB updates and spotlights. It includes setting priorities and aligning performance metrics with audit quality. I would venture to say that it also means firms should stop allowing differences in audit quality (and sometimes even methodology) between public and private company audits. While the risk profile is inherently differently for public company audits, the reality is that the auditing standards (PCAOB and AICPA) just aren’t that different. Tone at the top is multi-faceted, so let’s not underestimate how our words and actions convey our real thoughts about audit quality.
Intellectual and Human Resources
Another of the new quality management components is resources, including both human and intellectual. Human resources are already built into QC 20 (i.e. personnel management), but in the current war on talent, this is an important element to highlight. Firms must consciously consider who and how they are recruiting staff with the appropriate skillsets. As IT becomes increasingly pervasive across all elements of an audit, for many firms, that will mean hiring more technologically savvy auditors.
Once hired, firms need to be intentional in developing employees. Development comes from conscious assignment to jobs where new skillsets can be learned and refined; perhaps it’s learning a new industry or perhaps its obtaining additional experience in integrated audits. Certainly, for PCAOB audits, there is added value in using staff with robust PCAOB experience, but we would argue that it’s important that all staff get PCAOB experience. Again, more frequent exposure and interaction with the PCAOB seems to be correlated to better inspection results.
For international firms, it can be difficult to obtain PCAOB experience from within, depending on the country, so we encourage you to look without, such as through rotational programs abroad or pulling from network alliance firms.
In addition to human resources, under the new quality management standards, firms will also be responsible for securing the appropriate intellectual resources. This will be a mix of hiring subject matter experts and specialists as well as investing in methodology/guidance and knowledge resources. Perhaps that means hiring specific staff or engaging consultants and specialists to supplement audit teams when performing audits. It will look different for every firm, but the point is that firms need to be investing in obtaining and developing their resources.
Though not specifically the focus here, we would be remiss not to highlight the importance of investing in technological resources as well (also another component under the new quality management standards). Certainly, considering the talent shortage, technology can provide unique opportunities to simplify/automate certain audit procedures and can help coordinate human and intellectual resources.
Internal Inspections
Finally, let’s talk internal inspections. Again, under current quality control standards, firms are required to have internal firm monitoring. Traditionally, this has consisted of annual post-issuance reviews for select audits. In its 2021 observations, the PCAOB indicated that they “continue to identify deficiencies through [their] inspection procedures that were not identified through an audit firm’s internal inspection procedures directed to the same audit areas on a particular engagement.” In other words, the PCAOB’s review is identifying deficiencies that firms are failing to self-identify. This calls into question the quality of a firm’s monitoring program. This appears to correlate with the differences in peer reviews and PCAOB inspections. It seems, as an industry, we are still too lenient with one another when performing internal reviews.
But why? Part of this is attributable, again, to lack of PCAOB experience and the divergence in audit quality expectations for public and private company audits. We recommend firms use professionals with PCAOB experience to perform internal inspections, especially for monitoring over public companies. Many firms have sought to hire former PCAOB inspectors to bring that insight and knowledge into the firm and further refine monitoring programs. If you can’t hire internal, consider engaging consultants or look to network alliance firms to assist with this process.
In addition, firms should consider implementing different forms of monitoring reviews. While post-issuance reviews serve a purpose, it can sometimes feel like “too little too late.” Consider implementing in-flight reviews while the audit is being executed so that teams can learn hands-on, in the moment, as opposed to months later when the audit is no longer fresh. This also gives the audit team the chance to remediate the audit prior to the issuance of the opinion saving time and analysis later. Similar to in-flight reviews, firms could consider targeted reviews for areas with common failures, such as internal controls or estimates. Finally, perhaps the most basic message is this: we need to be more robust with our internal inspections. Again, we seem to carve out PCAOB inspections as “different” or “too detailed” but the reality is that they are identifying areas where we as an industry are still deficient and we need to push for continuous improvement.
There’s no single solution here. That’s partly why the new quality management standards have eight components. The point is we must strive for perpetual improvement. The PCAOB is driving that message home and has stated: “An audit firm’s inadequate response to address recurring deficiencies may warrant additional action, such as…potential investigation or disciplinary action for failing to comply with PCAOB standards.” While that is the role of the regulator, we also need to own our role in the process and take proactive steps to ensuring audit quality.
Key Takeaways
- While more frequent inspections is one way to get more PCAOB interaction, consider other ways management can gain PCAOB exposure through various forums such as the PCAOB Small Business Forum or attending various PCAOB open meetings / calls / trainings and reading PCAOB publications. The annual inspection observations provide all the current hot topics.
- Don’t underestimate the significance of tone at the top. Words and actions speak volumes, both from firm leadership, but also from engagement partners.
- Invest in the right human and intellectual resources. Hiring is the first step, but in the spirit of perpetual audit improvement, we should also be investing in perpetual resource development.
- Review current monitoring programs and evaluate whether the right staff (with the appropriate experience and rigor) are assigned to perform internal inspections. Also consider ways to revamp monitoring programs, such as using in-flight reviews to drive real-time change and learning.
