Audit regulators are taking their first high-profile swipe at the quality control of a Big 4 firm, publishing criticisms of audit quality control dating back to 2007 at Deloitte & Touche. The Public Company Accounting Oversight Board says four years ago it observed deficiencies in the firm's quality control system that in some ways failed to assure that the firm's audit work would meet minimum standards and requirements.

The PCAOB spotted the problems during its 2007 inspection of Deloitte & Touche, but did not disclose them in the inspection report it published in 2008. Under inspection rules established under Sarbanes-Oxley, firms have 12 months to correct quality control problems to the satisfaction of the PCAOB or appeal the board's findings to the Securities and Exchange Commission before any PCAOB findings can be made public.

In the freshly updated report, the PCAOB says the number of audit deficiencies discovered during the inspection suggest the firm may have problems with the overall design of its audit methodology and audit policies. It also raised concerns regarding the lack of skepticism, audit supervision, internal enforcement of existing policies and procedures, the quality of the firm's internal training programs, and the internal consultation process on tough audit issues.

Joe Echeveria, Deloitte CEO since April 2011, said in a prepared statement that Deloitte is committed to audit quality. “We have complete confidence in our professionals and the quality of our audits, and agree that there were and always will be areas where we can improve,” he said. “In our drive for continuous improvement, we have been making a series of investments focused on strengthening and improving our practice, and will continue to do so to make Deloitte the standard for audit quality.”

The PCAOB also flagged concerns about Deloitte & Touche's relationship with international affiliates. The board said according to the parent company's internal global inspection process, U.S. engagement partners won't be notified of problems in a network firm unless they are raised by a regulator in that firm's home country. That means U.S. engagement partners have no idea when a foreign audit partner might have trouble complying with U.S. accounting, auditing or financial reporting rules. The PCAOB has made no bones about its difficulty in inspecting overseas audit firms, including overseas firms that are part of Big 4 networks feeding their audit work into U.S. capital markets via their Big 4 affiliations.

As a result of deficiencies in quality control, the PCAOB had concerns about specific audit areas that may suffer as a result, especially management estimates, income tax balances, use of the work of outside specialists, and reliance on data, reports, and internal controls. PCAOB inspectors flagged several specific engagements where those issues arose, leading inspectors to look more closely at the firm's quality control processes with respect to those issues.

By publishing an updated version of the 2007 inspection report containing eight pages of quality control criticisms, the board is signaling Deloitte has exhausted its opportunities to correct the problems and its appeals process with the SEC. “Particularly with the largest firms, which are inspected annually, the board devotes considerable time and resources to critically evaluating whether the firm did in fact make sufficient progress in that period,” the PCAOB said in a statement. “The Board can and does make the relevant criticisms public when a firm has failed to do so.”

The board declined to describe what exactly transpired behind the curtain of Sarbanes-Oxley-provided privacy over the past four years. “Beyond what appears in the portions of an inspection report published on the PCAOB Web site, the Board does not comment on inspection results or the process resulting in publication of a quality control criticism as they relate to any particular firm,” the PCAOB said.