In a recent speech, Jay D. Hanson, a member of the PCAOB board, said that he believes the PCAOB should clarify descriptions of inspection deficiencies. He also denied that inspections of internal control over financial reporting (ICFR) are imposing more stringent audit requirements than the PCAOB’s Auditing Standard No. 5.
Hanson said that the PCAOB should use the term “audit failure” only when the audited financial statements are misstated and should provide context to the severity of audit deficiencies when discussing the deficiencies identified in inspections. Speaking on March 18, Hanson explained that the PCAOB uses the term “audit failure” whenever an auditor did not do enough audit work or gather sufficient audit evidence to support the auditor’s opinion on the financial statements or ICFR. Nevertheless, many investors, audit committees, and others understand the term to mean that a company’s financial statements were misstated or that the company’s accounting or internal controls were ineffective. Among these are the U.S. Government Accountability Office, which defined the term “audit failure” in a congressionally required study about mandatory rotation of accounting firms as “audits for which audited financial statements filed with the SEC contained material misstatements whether due to errors or fraud.”
In addition, Hanson said that reporting by the PCAOB of “rates” of audit failure “may be misleading at best and harmful at worst,” given that the risks associated with each audit and each firm’s audit practices are unique. With respect to the severity of deficiencies, Hanson suggested that the PCAOB provide information about the significance of an audit deficiency, which could be relatively minor or involve only disclosure, perhaps by classifying inspection findings by severity level.
Hanson rejected the notion that the identification in PCAOB inspections of more extensive deficiencies in audits of ICFR reflects the imposition of new auditing standards for ICFR audits through the PCAOB inspection process or a return to the superseded auditing standards for ICFR in Auditing Standard No. 2. Rather, he explained that the quality of audits of ICFR had deteriorated since the adoption of Auditing Standard No. 5 in 2007. For example, he said that “underlying many of our inspection findings in recent years is the fact that firms did not fully appreciate the way certain controls, especially entity level controls, operated or whether they fully addressed the possible risks of financial statement misstatement.” Hanson noted that, when a company’s documentation of the operation of a control is not “thorough,” the auditor may have to conduct additional steps to determine whether the control is operating effectively. Although such additional steps might be expected to result in increased audit fees, Hanson did not concede that those who believe audit costs may increase as a result of the PCAOB’s ICFR inspection process were right.