Audit Committees Encouraged to Review PCAOB Concerns on Internal Control Audits
The PCAOB wants audit committees to take note of a recent audit practice alert that it issued in light of a significant number of audit deficiencies observed in the past three years related to audits of internal control over financial reporting. Specifically, the alert indicates that audit committees might wish to discuss with their auditors the level of auditing deficiencies in this area identified in their auditors’ internal inspections and PCAOB inspections, request information from their auditors about potential root causes and ask how they are addressing the matters discussed, including inquiring about the involvement and focus of senior members of the firm on these matters.
Since 2010, the PCAOB has found that annually, about 15% of the audits covered by their inspections had failed to obtain sufficient appropriate evidence to support opinions on the effectiveness of internal controls, and an additional 16% identified other deficiencies.
These include failures to identify and sufficiently test controls that are intended to address the risks of material misstatement and test the design and operating effectiveness of management review controls that are used to monitor the results of operations. A main focus is proper risk assessment, as prior PCAOB inspection reports found that auditors tested management controls without considering whether individual components of significant accounts may have different risks, such as individual revenue categories which vary depending on the type of products and services or sales terms. In addition, multi-location engagements were not adequately addressed. Along with revenue, a partial list of where auditors failed to sufficiently test controls that address the risks of material misstatements include inventory pricing and reserves, the fair value of financial instruments and the valuation of pension plan assets.
Other deficiencies cited in inspection reports include the roll-forward of controls tested at an interim date, using the work of others and evaluating identified control deficiencies. The PCAOB urges auditors to take note of the matters discussed in the alert, in particular for the engagement partner and senior engagement team members as well as the engagement quality reviewers, and consider whether additional training for their auditing personnel is needed.