Board Reiterates Top Down, Risk-Based 404 Guidance

With a full year of audit firm inspections under their belt, auditing regulators issued a report last week offering advice on how accounting firms can audit more efficiently and effectively in the post-Sarbanes-Oxley world.

The Public Company Accounting Oversight Board acknowledged the significant challenges companies and their auditors faced in the first year of implementing Auditing Standard No. 2—its controversial standard that governs an audit of internal control over financial reporting—but said it expects the audit process and its effect to improve.

“The Board’s monitoring revealed that audits performed under these difficult circumstances were often not as effective or efficient as Auditing Standard No. 2 intends (and as the Board expects they can be in the future, given the benefits of experience, adequate time and resources),” the report says.

As was the case with guidance released by the Board on May 16, the PCAOB said auditors should plan audits with a more top-down, risk-based approach, focusing their efforts not on isolated, low-risk transactions but on areas where there’s a greater risk for misstatement. The PCAOB also re-emphasized audit firms should integrate the audit of internal controls with the financial statement audit, an approach that was not widely followed in year one at least in part because of compressed time lines to complete audit work.

The Board also urged external auditors to rely more on the work of others, such as a company’s internal auditors, take a closer look at compensating controls when they discover a control deficiency, and better test controls over financial statement disclosures.

Voicing Concerns

McDonough

Departing Chairman William McDonough said that the Board is confident audits will be more efficient and effective in future years. “These improvements are already appearing as auditors and their clients gain experience and as challenges that are unique to the first year’s implementation abate,” he said.

Last week’s report is the latest in a string of guidance the PCAOB and the Securities and Exchange Commission have issued to try to steer the implementation of internal control reporting and auditing. In May, the SEC and PCAOB issued a combined 28 pages of guidance offering much of the same advice the Board reiterated in last week’s report. The PCAOB also has published advice in a series of Q&A releases.

With year-two reporting and auditing already well under way for many firms, controversy over the standard continues to swirl. Preparers of financial statements contend it produces documentation that is of little benefit or interest to investors, at a steep cost. Even two SEC commissioners have called for a review of whether the standard is workable.

Glassman

In a speech Nov. 17, Commissioner Cynthia Glassman told a Danish conference audience she continues to be concerned about the cost-benefit relationship associated with internal control reporting. “I believe in the purpose of Section 404 to establish and maintain effective internal controls that enable reliable financial statements. I remain concerned, however, about the unintended, and unnecessary, costs associated with Section 404,” she said. “If we do not see a meaningful refocus and a downward trend in implementation costs, I believe that the Commission and the PCAOB should consider ways of making the 404 process more effective and less burdensome, including possibly revisiting the requirements of PCAOB's Audit Standard No. 2.”

Atkins

SEC’s Paul Atkins vocalized similar concerns in a separate speech in September. Reviewing costs, Atkins said the SEC projected each public company would spend less than $100,000 to implement internal control reporting requirements, but subsequent surveys showed the costs came in about 20 times greater than projected.

“What types of changes should shareholders demand?” he asked. “Complaints seem to derive not from the statute itself or our SEC rule, but center more on the implementation of the PCAOB's Auditing Standard Number 2. Investors should insist that the SEC fulfill its statutory charge and actively oversee the PCAOB's actions rather than simply rubber stamping them.”

Steep Learning Curve

Rick Brounstein, executive vice president of finance and CFO at Calypte Biomedical Corporation, said last week’s report represents a move in the right direction following the May guidance. “Six months later, people are actually starting to digest that, and hopefully it will have some beneficial impact,” he said.

INEFFICIENCIES

The excerpt below is from the PCAOB's "Report On The Implementation Of Auditing Standard No. 2, An Audit Of Internal Control Over Financial Reporting In Conjunction With An Audit Of Financial Statements," Nov. 30, 2005:

Summary Of Observations

The inefficiencies observed by the Board varied in form and degree among firms

and engagement teams. The most common reasons why audits were not as efficient as

the Board expects them to be include the following–

Some auditors did not integrate their audits of internal control with their

audits of financial statements. Consequently, the amount of reliance

placed on controls in establishing the nature, timing, and extent of

financial statement audit work was limited. The Board expects that

auditors will better integrate their audits in the future.

Some auditors did not effectively apply a top-down approach. To varying

degrees, auditors often approached the audit of internal control from the

bottom up ...

The Board

expects that auditors will use a top-down approach to a greater extent in

the future, which will make audits both more effective and more efficient.

Some auditors did not alter the nature, timing, and extent of their testing to

reflect the level of risk. Auditors often appeared to take a uniform

approach to their testing, inadequately considering the unique risk factors

within each company ...

The Board expects that auditors will tailor their procedures to focus on the

particular risks facing audit clients' systems of internal control as they gain

more experience in auditing internal control.

Some auditors performed inefficient, and sometimes ineffective,

walkthroughs of major classes of transactions because they used different

transactions to test each control separately rather than walking a single

transaction through the entire process ...

In the future, the Board expects auditors, in most

cases, to simplify their walkthroughs by following a single transaction.

Some auditors did not use the work of others to the extent permitted by

Auditing Standard No. 2 ...

The Board

expects auditors to use the work of others more consistently in the manner

intended by the Board as they gain more experience in applying the

standard.

Source:

PCAOB: "Report On The Initial Implementation Of Auditing Standard No. 2" (Nov. 30, 2005)

Brounstein, who is a member of the SEC Advisory Committee on Smaller Public Companies, said he was especially pleased to see last week’s report emphasizing that the language of AS2 is not intended to set a new, higher standard for materiality in internal controls reporting than already exists for financial statements. “That will significantly impact the amount of work that is to be done,” he said.

Brian Kerr, managing director at Accume Partners, which provides outsourced internal audit services, said auditors faced a steep learning curve in year one and in large part have already demonstrated an acceptance of the direction regulators set with their May guidance.

“As a former auditor, I can understand that auditors and company accountants like to think in terms of black-and-white, material numbers,” said Kerr. “After all, materiality is a concept that has been drilled into everyone’s head over the years.” Since the release of the May guidance, “the external auditors have warmed to a risk-based approach,” Kerr said.

Livingston

Philip Livingston, vice chairman of Approva Corporation, is the former president and CEO of Financial Executives International who sits on the audit committees of two public companies and one private corporation. He says the audit community remains focused on “transaction minutiae.” He’s looking for audit firms need to show more leadership from within to direct their field auditors to take a more top-down, risk-based approach.

From a practical standpoint, the guidance is “moving in the right direction,” said Anne Marchetti, director with Parson Consulting. However, she remains concerned that “there’s still a lot left to subjectivity.” Marchetti said the rules are still young enough that there’s no enforcement precedent to give auditors comfort about how much judgment they can safely exercise. “I think the external auditors will continue to be overly conservative,” she said.