Scott Zimmerman, Phillip Austin, Marty Baumann, Dan Sunderland, and the author discuss “Challenges Facing the Audit Profession” at the AAA’s 2018 Auditing Section Midyear Meeting.
“The new audit report is a great opportunity for the profession.” So spoke Marty Baumann, chief auditor and director of professional standards at the US Public Company Accounting Oversight Board (PCAOB), at a panel during the American Accounting Association (AAA) Auditing Section’s midyear meeting this past January.
I agree wholeheartedly with Marty.
Updating the auditor’s reporting model in the United States represents an extraordinary opportunity, as it has in the United Kingdom and elsewhere. Yet as we discussed on that January panel, with opportunities come challenges—and I have put together some strategies for addressing those challenges.
To understand the opportunities and challenges associated with updating the auditor’s report, it helps to start with the basic elements of the new PCAOB auditing standard.
The standard features a phased implementation approach. The first phase—which affects PCAOB audits of companies with fiscal years ending on or after December 15, 2017—includes disclosing auditor tenure and other changes to the form and content of the auditor’s report.
The second phase of implementation requires communication of critical audit matters (CAMs). The standard defines a CAM as any matter arising from the audit of the financial statements that meets all the following criteria:
was communicated or required to be communicated to the audit committee;
relates to accounts or disclosures that are material to the financial statements; and
involved especially challenging, subjective, or complex auditor judgment.
The effective dates for CAMs to be included in the auditor’s report are (1) fiscal years ending on or after June 30, 2019 for audits of large accelerated filers and (2) fiscal years ending on or after December 15, 2020 for audits of all other companies to which the requirements apply.
What opportunities will these changes bring? Conversation at the AAA panel covered a range of possibilities.
Possible insights for investors. Scott Zimmerman, a partner at EY and its Americas Assurance Innovation division said that each audit should result in “some type of meaningful insight.” Baumann suggested that such insights can “add to the total mix of information that investor use in making decisions,” and offered his view that the audit report could, for some investors, even become “the first place to go in a very big 10-K with a complex set of financial information.”
Differentiation via technology. As a digital expert, EY’s Zimmerman knows how technology can be a competitive differentiator for audit firms, particularly as use of data analytics and artificial intelligence grows. He noted that EY, like many firms across the profession, is examining how technology can be leveraged in the context of the CAMs that will be communicated in an expanded auditor’s report.
Future academic research. As each audit generates insights, academics can sift through the data to track broader patterns in financial reporting. Baumann noted that researchers might investigate possible correlations between CAMs and stock prices, for example, or financial disclosures.
While acknowledging the excitement around these and other opportunities, panelists also recognized challenges.
Boilerplate potential. In December 2017, US Securities and Exchange Commision Chair Jay Clayton quipped that it would be a “bummer” if CAMs devolved into boilerplate language of little or no use to investors. At the AAA meeting, panelist Dan Sunderland, chief auditor and national leader for Audit and Assurance Services at Deloitte & Touche LLP, noted that the nature of the disclosure in CAMs would be the “keys to the kingdom”—and that auditors are well aware of the importance of avoiding boilerplate.
Interference with audit committee communication. Panelist Phillip Austin, the national managing partner of Auditing at BDO USA, noted that, with the new disclosure of CAMs, some company executives might be tempted to “manage” communication between the auditors and the audit committee.
Disclosure tension. In the discussion, panelists contemplated scenarios where auditors may disclose in CAMs information that management is not obliged to disclose. “That’s going to be tricky,” said Austin. Baumann indicated this would be an area that the PCAOB would track carefully.
Strategies for Success
To make the most of the opportunities presented by the new report, panelists discussed strategies to address the challenges of implementing the new reporting models. Audit committee members should become familiar with the following strategies for success.
Maintain open dialogue between auditors and audit committees. As with many items related to the financial reporting process, strong and ongoing communication will be critical around the new auditor’s report. Baumann cited the importance of dialogue around challenging issues, such as revenue recognition or significant and unusual transactions that a company might have, that could be critical audit matters. To foster this dialogue, the Center for Audit Quality (CAQ) has produced a tool for audit committees regarding changes to the auditor’s report.
Pilot-testing. For auditors, “the critical thing is to try to pilot things in the short run,” said Sunderland. This pilot-testing should involve auditors talking through the process with the audit committee, he added.
Pay close attention to the post-implementation review. For regulators, it will be vital to monitor implementation of the standard, particularly given risks such as creeping boilerplate. Marty Baumann voiced the PCAOB’s strong commitment to robust post-implementation review, starting with the implementation of CAMs.
What challenges, opportunities, and necessities do you see regarding updating the auditor’s report? I welcome your thoughts in the comments. And be sure to visit the CAQ’s resource page on auditor reporting for more information.
Cindy Fornelli is a securities lawyer and has served as the Executive Director of the Center for Audit Quality since its establishment in 2007.
Now that the U.S. Securities and Exchange Commission (SEC) has released an order approving the Public Company Accounting Oversight Board’s (PCAOB) new rules on the auditor’s report, what items should the audit committee and shareholders look for there?
The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion and Related Amendments to PCAOB Standards, released by the PCAOB June 1 and approved by the SEC October 23, contains five main changes, including one that requires careful reading between the lines.
As NACD summarized in a recent brief to its members, the new PCAOB standard will require auditors to:
Standardize the format of the auditor’s report, placing the auditor’s opinion in the first section of the auditor’s report, followed by the basis for the opinion. This change makes the auditor’s opinion easier to find in the auditor’s report.
Disclose the auditor’s tenure, stating when the audit firm began its current service to the company. This new requirement comes in lieu of limiting audit firm tenure through mandatory audit firm rotation, a concept NACD and others have rejected in the past.
State that the auditor is required to be “independent.” This requirement is intended to strengthen shareholder confidence in the auditor’s report, possibly as an offset to the tenure disclosure, if it reveals that the auditor has been serving the client for more than a quarter century, for example.
State that the financial statements are free from material misstatements “whether due to error or fraud.” This change aligns with other recent or pending regulations on error vs. fraud, such as the proposed executive pay clawbacks rule still pending under Dodd-Frank, which mandated disgorgement of performance-based pay after financial restatements even if restatements were due to error rather than to fraud.
Report on critical audit matters (CAMs), defined as “matters communicated or required to be communicated to the audit committee and that: (1) relate to accounts or disclosures that are material to the financial statements; and (2) involved especially challenging, subjective, or complex auditor judgment.” A number of commenters said that the CAMs mandate is “redundant” with existing reports, which already reveal the required information. See for example NACD’s comment to the PCAOB or State Street’s comment.
The key letter in CAM is M, for material. For those who may wonder what may be “material” to the financial statements, join the club. The SEC has still never defined this term, leaving this job to the courts as they interpret federal securities laws.
The going definition of “material” is more than 40 years old. The SEC release cites TSC Industries v. Northway, Inc., 426 U.S. 438, 449 (1976), in which the U.S. Supreme Court states that a fact is material if there is “a substantial likelihood that the . . . fact would have been viewed by the reasonable investor as having significantly altered the ‘total mix’ of information made available.” In that same case, the Supreme Court said that determining materiality requires “delicate assessments of the inferences a ‘reasonable shareholder’ would draw from a given set of facts and the significance of those inferences to him . . .”
Such wisdom is not lost on the PCAOB and SEC. In its June 1 release, the PCAOB cites as CAMs the auditor’s evaluation of the company’s “goodwill impairment assessment” and, more broadly, the auditor’s assessment of the company’s “ability to continue as a going concern.” These two examples are material to financial statements. By contrast, the following two examples are not material to the financial statement: a loss contingency already discussed with the audit committee and “determined to be remote;” and a “potential illegal act.”
Audit committees need to ensure that their auditors are in a position to recognize critical audit matters, and to learn from those matters. But this does not mean looking for problems where there are none.
Significantly, SEC Chair Jay Clayton had this to say about the new standard:
“I would be disappointed if the new audit reporting standard, which has the potential to provide investors with meaningful incremental information, instead resulted in frivolous litigation costs, defensive, lawyer-driven auditor communications, or antagonistic auditor-audit committee relationships — with Main Street investors ending up in a worse position than they were before.
I therefore urge all involved in the implementation of the revised auditing standards, including the Commission and the PCAOB, to pay close attention to these issues going forward, including carefully reading the guidance provided in the approval order and the PCAOB’s adopting release.”
To Chairman Clayton’s point, the SEC makes this point in its approval order:
“As the [PCAOB] notes, in order to succeed, any claim based on these new statements would have to establish all of the elements of the relevant cause of action (e.g., when applicable, scienter, loss causation, and reliance). Moreover, as discussed above, CAMs could be used to defend as well as initiate litigation. …However, because of these risks and other concerns expressed by commenters, we expect the Board to monitor the Proposed Rules after implementation for any unintended consequences.“ (SEC approval order , pp. 32–33)
Shareholders and others should read between the lines of auditor’s report (appreciating the regulations behind it), but they should not expect auditors to “look under rocks” to find problems. That is the job of management, internal control, and the audit committee. The auditor’s job is to focus on the audit of the financial statements to ensure that they conform to generally accepted accounting principles (GAAP). Given the complexity of GAAP, that is a big enough job as it is.
The CAM standard can’t be mastered overnight and won’t be required any time soon. Auditors of large accelerated filers will not be required to adopt CAM changes until audits of fiscal years ending on or after June 30, 2019—with audits of all remaining filers to adopt CAM changes for fiscal years ending on or after December 15, 2020.
By contrast, all the other changes will apply to audits of fiscal years ending on or after December 15, 2017. That mean, essentially that auditors must work on this immediately, since most companies they are working with right now have fiscal years ending December 31, 2017. (According to Audit Analytics, 71 percent of public companies have a fiscal year ending December 31.)
So now is the time to prepare for the changes! In its above-cited report on the new rule, NACD prepared questions for directors to ask, along with related resources.
Questions for Boards
For which fiscal year will our auditor first be required to report on CAMs?
What areas during the audit do we anticipate our auditor will find challenging, subjective, or complex—and how can we preemptively address those concerns?
How will the auditor’s insights in the newly expanded report affect our ongoing work as we prepare the audit committee report for the proxy and review risk disclosures in the annual report on Form 10-K?
In 2013, the Securities and Exchange Commission (SEC) formed the Financial Reporting and Audit Task Force to detect fraudulent or improper financial reporting, and since then has brought more than 300 issuer reporting and disclosure cases. One area of focus is a company’s restatement of financial statements and company actions connected with the restatement.
The audit committee plays an important role in navigating a restatement—from investigating errors and their origins to overseeing the restatement process. A mishandled restatement can lead to a prolonged SEC investigation, increased exposure to liability in civil litigation, loss of confidence by lenders, and potential delisting by an exchange.
To survive a restatement, audit committees should avoid the following pitfalls.
Engaging inexperienced counsel and advisors for investigation. A restatement is commonly precipitated or accompanied by an independent investigation overseen by the audit committee. Proper investigation of accounting errors is critically important, and inexperienced counsel could fumble the investigation—and restatement—from the beginning by incorrectly scoping the investigation, failing to obtain the relevant information, or losing credibility with regulators.Four qualities are essential for counsel tasked with conducting independent investigations into accounting errors.
First and foremost, counsel must be independent from management. Counsel must not have done prior work for the company or have any significant ties to the management.
Second, counsel should be experienced with conducting independent investigations for boards and board committees.
Third, counsel should understand accounting and disclosure issues, and have experience with the nuances of accounting investigations. Nonetheless, counsel should also be expected to engage experienced, outside forensic accountants to aid in the investigation.
Finally, counsel and their team must be respected by regulators and have a reputation of conducting appropriately thorough and complete investigations.
Forming a special committee when the audit committee might suffice. While a special committee might be necessary in certain rare investigative circumstances, the board should avoid forming one if its audit committee is composed of independent and disinterested directors who are suited for the task. A special committee must be disbanded at some point (usually once the investigation is completed and before the restatement process begins), and the disbanding could become a complicated news item.In contrast, if the audit committee oversees the investigation, then, once the investigation is complete, the audit committee can pivot back to its normal role, which would include overseeing the actual restatement process. Investigations overseen by the audit committee also benefit from the positive relationship that the chair usually has with the company’s outside accounting firm.
The run-away or open-ended investigation. Incorrectly scoped investigations can lead to burdensome legal fees, continued business disruptions, and inadequate investigatory results. Importantly, an independent investigation does not mean that counsel is independent of the client. The “client”—i.e., the audit committee—should discuss the scope and budget of the investigation with outside counsel and together tailor the investigation to the circumstances.
Failing to keep auditors apprised of the investigation and errors found. Keeping auditors in the dark regarding the progress and results of the investigation could delay the restatement and result in the resignation of the auditor. The audit committee’s counsel should maintain a good relationship with the company’s auditors and keep them appropriately apprised of the investigation through periodic calls or meetings. If the auditor is conducting a shadow investigation, this dialogue will aid it in confirming that appropriate remedial measures occur (e.g., a restatement) and that the company’s professional practice group, risk, or forensic functions are informed.
Indecisiveness and inability to reach conclusions. Indecisiveness can delay the investigative process, allow misconduct to persist unchecked, and create the damaging perception among investors, regulators, and the plaintiffs’ bar that the company’s problems extend beyond financial reporting. To minimize these effects and maximize potential cooperation credit, the audit committee, in conjunction with counsel, should reach conclusions concerning accounting errors as promptly as possible.
Waiting too long to deal with wrongdoers. Once an investigation has made conclusions about individual conduct, any wrongdoers should be disciplined and, when necessary, removed from their position—either by terminating their employment or forcing their resignation. When determining cooperation credit, the SEC and Department of Justice (DOJ) will focus on whether the responsible individuals are still with the company, and, if so, whether they are still in the same positions. Removing wrongdoers clears the path for the audit committee to share investigation results with management so it can correct errors and implement remedial actions.
Not self-reporting findings to the SEC. Whenever a restatement is made, the SEC will inquire whether the underlying accounting error was intentional. It also may inquire about the root cause of the error; how, when, and by whom it was discovered; the reporting periods impacted; how the error is being corrected; and the impact on the company’s financial control environment.The SEC expects a registrant to voluntarily share the results of its investigation. If the SEC learns of misconduct from a source other than the company, or if the company fails to make its investigative findings available to the SEC, the company could become ineligible for cooperation credit associated with self-reporting. The incentives in the SEC’s whistleblower bounty program provide additional motivation for companies to be proactive in promptly and thoroughly self-reporting.
Audit committee micromanagement of the restatement. Management is ultimately responsible for financial reporting, and the audit committee must maintain its supervisory role and refrain from stepping into the role of management to correct errors. Once an accounting error has been identified, it must be assessed to determine whether the affected financial statements are materially misstated. Quantifying the errors is a critical step in determining materiality, and Staff Accounting Bulletin (SAB) 108 contains guidance.The audit committee counsel should assist management, as appropriate, in understanding the nature of the errors and how to correct them. This is also a good time for the audit committee to request that management re-evaluate the enterprise-wide risk assessment process and the design and effectiveness of internal controls over financial reporting.
Failing to remediate. If accounting errors lead to a restatement, then the company may have deficiencies in internal controls. In addition, inadequate or ineffective internal controls often raise issues that should be investigated by the audit committee relating to the certifications by the CEO, CFO, and outside auditor. Failure to remediate gaps in internal controls and to address certification issues provides the opportunity for additional misconduct and could damage the company’s credibility with regulators. The SEC in particular will focus on what steps the company took upon learning of the misconduct or control weaknesses, whether the company took immediate corrective action, and what new and more effective internal controls or procedures the company plans to adopt to prevent a recurrence. When documenting remedial actions, the company should avoid characterizing them as other than what they are—improvements in internal control procedures. This neutral approach might help to mitigate potentially harmful collateral impacts in civil litigation.
Creating an unnecessarily detailed SAB-99 materiality analysis. Shareholder class actions inevitably follow restatements. The audit committee should resist the impulse to create an unnecessarily detailed SAB-99 materiality analysis that will be discoverable in litigation against the company and could provide a roadmap for private plaintiffs. To the extent additional details regarding the materiality analysis are necessary, oral discussions with auditors are often sufficient.
Bradley J. Bondi is a partner with Cahill Gordon & Reindel LLP. He advises financial institutions and global corporations, boards of directors, audit committees, and officers and directors of publicly-held companies in significant corporate and securities matters, with particular emphasis on internal investigations and enforcement challenges, including those related to restatements. Michael D. Wheatley, a litigation associate at Cahill, assisted with this article.
Jonathan T. Marks, CPA, CFE, a managing director with Navigant Consulting, Inc. in its global disputes and investigations practice, and Michael Pesce, an associate director with Navigant, contributed to this article.