PCAOB finds common threads in ICFR audit deficiencies

Insufficient testing of controls and failure to properly evaluate control deficiencies were among the common findings that led the PCAOB to issue a summary of observations from 2010 inspections of audits of internal control over financial reporting.

The PCAOB on Monday released a 31-page report on deficiencies in firms’ audits of internal control over financial reporting. The report does not identify individual audits, but includes information summarized from inspections.

Deficiencies found under PCAOB Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated With An Audit of Financial Statements, were included in the report, which was issued to help inform auditors on common problems to avoid.

In 46 of the 309 audit engagements inspected by the PCAOB in 2010 that were referenced in the report, the PCAOB found that the firm had failed to obtain enough evidence to support its audit opinion on the effectiveness of internal control.

In an additional 50 of the 309 audit inspections, the PCAOB found what it considered to be deficiencies in firms’ quality-control systems that required remediation. Those deficiencies did not mean the audited companies had materially misstated financial statements or had inadequate internal controls. Rather, the deficiencies generally indicated failure by engagement teams to comply with their firms’ methodologies, according to the report.

The most commonly identified deficiencies named in the report were firms’ failures to:

• Identify and test controls that are intended to address the risks of material misstatement.
• Sufficiently test the design and operating effectiveness of management review controls that are used to monitor the results of operations, such as:
  • Monthly comparisons of budget and actual results to forecasts for revenues and expenses.
  • Comparisons of other metrics, such as profit margins and certain expenses as a percentage of sales.
  • Quarterly balance sheet reviews.
• Obtain sufficient evidence to update the results of testing of controls from an interim date to the company’s year end (the roll-forward period).
• Sufficiently test the system-generated data and reports that support important controls.
• Sufficiently perform procedures regarding the use of the work of others.
• Sufficiently evaluate identified control deficiencies and consider their effect on both the financial statement audit and the audit of internal control.

“These findings have increased to a point over the last couple of years where we wanted to put out this … report,” PCAOB Director of Registration and Inspections Helen Munter said last week at the AICPA Conference on Current SEC and PCAOB Developments in Washington.

Potential root causes of the deficiencies described in the report included:

• Improper application of the top-down approach to the audit of internal control as required by AS No. 5.
• Decreases in audit firm staffing through attrition or other reductions, and related workload pressures.
• Insufficient firm training and guidance, including examples of how to apply PCAOB standards and the firm’s methodology.
• Ineffective communication with the firm’s information system specialists on the engagement team.

Cindy Fornelli, executive director of the Center for Audit Quality (CAQ), said the auditing profession recognizes the need for improving performance in this area and has devoted significant resources to the effort over the past year. The CAQ is affiliated with the AICPA.

“We encourage all auditors to consider the items noted in planning and performing public company audits,” Fornelli said. “We also encourage preparers and audit committee members to familiarize themselves with the report as it may contain observations that might be useful in improving upon the design or operating effectiveness of internal control over financial reporting.”

—Ken Tysiac (ktysiac@aicpa.org) is a JofA senior editor.