Assessing audit risks during the pandemic

By Maria L. Murphy, CPA

Auditors’ assessments and responses to risks of financial statement misstatement and fraud are critical to audit quality. Risk assessments in the current environment are unlike any others, as clients are dealing with significant changes to their businesses, the work environment, and the economy overall as a result of COVID-19. Despite the added complexities, auditors must continue to focus on high-quality audits that fully comply with standards for objectivity and professional skepticism.

“We have gone back to the basics of audit risk, risk of material misstatements, and detection risk, and encouraged our practitioners to reconsider risks throughout the audit cycle,” said Jen Haskell, CPA, chief auditor at Deloitte. Some industries have been more affected than others by COVID-19 and by the economic volatility, both positively and negatively, and auditors need to be especially mindful of new or elevated risks for companies in those industries.

Since the pandemic developed in February, auditors have needed to keep their finger on the pulse of changes worldwide. In March, as many firms were completing year-end 2019 audits, there were some impacts to certain clients’ operations. As the pandemic continued, more audit procedures had to be modified for subsequent reporting cycles, and macroeconomic forecasts became increasingly important.

“Auditors have had a number of months to adapt to this environment, have conversations with clients, and assess the challenges,” said Jeff Kovacs, CPA, CGMA, assurance partner at Cohen & Company. “They cannot sacrifice audit quality despite the circumstances.”

Know your clients

To assess risk, auditors must understand the client’s industry, operations, and capital structure. “There are different risk assessments in industries like restaurants or real estate that have highly elevated risks because of the pandemic, as compared with industries like frozen foods that have benefited from it,” said Satpal Nagpal, CPA, partner and leader of the audit practice at Green Hasson Janks.

Kovacs said: “There must be a heightened awareness of clients’ daily operating environments, business models, and how revenues are generated.” A “same as last year” approach to audit planning and risk assessment is never a good strategy, and it is especially risky now. Auditors may need to reassess past management judgments, along with their audit approach. Management may no longer have reliable information that is auditable as the basis for their judgments, which affects the quality of audit evidence.

Challenges of remote work

Many auditors have not been at client locations since March. Access to client documents has changed, along with the ability to sit down with client accounting personnel, requiring more robust planning upfront. “Conversations could be more informal before, but you can’t walk down the hall to the client’s office anymore, so you must organize this from a virtual perspective,” Haskell said. However, she finds the firm’s ongoing investment in technologies made the transition easier.

Both Nagpal and Kovacs said their firms have been able to adapt, and they have been pleasantly surprised by their clients’ reactions to remote work. They attribute this to being engaged with their clients and to their staff working remotely pre-pandemic.

Changes in firm practices

Remote working has driven changes in how auditors work, regardless of office size or location.

Green Hasson Janks has a single office with 150 employees. “We have online audit planning meetings and created a remote auditing task force that has come up with consistent processes and procedures across audits, toolkits, and checklists,” Nagpal said. “Audit seniors are making recommendations about risk assessments and explaining why they are changing risk ratings, so they learn to think about risks more critically. Accountability has increased.”

At Cohen & Company, which has more than 650 professionals in 10 offices, audit teams have meetings to kick off the audit season. “Each engagement partner takes a highly active role in planning and directing audit team focus on areas that need heightened skepticism and judgment and crafting the appropriate audit response,” Kovacs said.

Staff training is especially important because employees are not in the office. Many firms are conducting training remotely, including targeted training on audit risks during COVID-19. In addition, firms are holding monthly remote audit department meetings and issuing periodic guidance to make sure all staff are up to date. “In the current environment, it’s important to remind people of the foundational principles of documenting judgments and conversations, gathering and evaluating audit evidence, and exercising professional skepticism,” Haskell said.

Technology

The transition to remote work has been made possible by leveraging technology, and firms of all sizes are investing in transformation tools and innovation technologies. “Use of technology has made our and our clients’ jobs easier,” Nagpal said. “It has been brought to the forefront, and people have been empowered.”

Auditors are using data tools to extract client general ledger data and perform analysis remotely, which takes some of the burden of providing audit support off clients. Auditors can look at large amounts of data and relationships, filter data to identify and focus on higher-risk transactions, and craft responsive audit steps.

Technology capabilities of clients and staff can be a significant challenge. Kovacs directs audit innovation at his firm and has worked to train staff “to think like data scientists.” Some clients have sophisticated systems and professionals, but others do not. “The quality of client transactional data is paramount to transforming the audit,” Kovacs said. “If the data quality is not sufficient to permit the use of transformative technology, you cannot raise audit quality.” In these situations, Kovacs and his firm help clients understand what good data looks like so they can move toward improving the data and systems used to collect it. Auditors may have to modify their procedures to work with the data they do have.

Nagpal said, “One positive thing that came out of this crazy year is that some old-school clients who did not have technology really didn’t have a choice. It was the only way to have their accounting team function and get the audit done.”

Internal control

Changes in operations and office closures as a result of the pandemic significantly affect controls and risk assessments. “Clients are doing the best they can to control and process transactions, but for many no enhancements are possible,” Kovacs said. If controls are not in place, risks are higher. “We expect the biggest risk is review of transactions,” he said. “Segregation of duties is always a significant issue, but some duties are currently not being performed. There also may be weaknesses in governance over financial reporting because of remote work and people being less engaged.”

Even when auditors are not required to test controls, they must understand the design and implementation of controls. Controls may have changed for basic processes, and auditors cannot observe the controls in operation. An example is approvals of cash disbursements. “We may need to increase the sample size for substantive testing and design additional procedures,” Nagpal said. “We can run criteria reports from general ledgers to look for new vendors and additional payments to certain vendors, but there is room for error and the risk of fraud.”

Forecasting

The ability to forecast has been challenging for clients due to uncertainty about the economy and the pandemic and creates risks in accounting areas that rely on forecasted results. “In several different forums, Deloitte has heard from companies that this has been their biggest challenge from COVID-19,” said Eric Knachel, CPA, senior partner at Deloitte.

Companies are forecasting more frequently or forecasting multiple scenarios and weighting the outcomes for probabilities. “Some companies have a bias to start with pre-COVID results as an initial target, and once pre-COVID results are achieved, assume they will resume normal growth, but this may not be reasonable if the pandemic results in a ‘new normal’ economy and business model,” Knachel said. “Companies need to be cautious about leveraging the 2008–2009 financial crisis as a benchmark to project their recovery in the current environment, because the issues are not fundamentally the same.”

Nagpal’s clients have also been challenged by forecasting. “We have a client in the retail housewares business, and most of their business came from Walmart stores,” he said. “They had to change their business model to all online sales. They had inventory on hand but not of items that were selling, and they had to forecast demand and supply from China but did not have a historic business model to use. They hired an outside consultant to help them with their forecasts.”

Challenging accounting issues in the current environment

The following accounting areas will present challenges and can be high-risk areas for upcoming audits.

Impairment: There is increased potential for tangible and intangible assets impairment. “For 8–10 years while the economy was expanding, this issue was not at the top of the risk list, but now it is a wider issue,” Nagpal said.

“Impairment accounting requires reliable client data to predict future cash flows, and auditors must apply significant skepticism when looking at client models,” Kovacs said. “These can be challenging conversations to have with clients, and once assets are written down, they cannot be written back up if things improve.” Goodwill impairment tests for calendar year-end companies frequently use an Oct. 1 date, but in this environment fourth-quarter events, including stock market changes, may require companies to revisit their impairment analysis.

Going concern: “This is a huge issue now, as companies must expect to have sufficient cash flows and liquidity one year from the report date,” Kovacs said. Auditors need to understand clients’ future operating models and assess the quality of the underlying data and forecasted cash flows.

Auditors know their clients and understand their industries and should anticipate going concern issues, along with management’s ability and willingness to assess going concern and have proactive conversations upfront. “Auditors need to be transparent and manage this issue so there are no surprises,” Kovacs said. Going concern issues can affect the type of audit opinion, which can be important to financial statement users.

Estimates: Auditors must evaluate estimates and assumptions, including the use of third-party data. “The quality of any estimate is a function of the availability, reliability, and relevance of the information management uses, and historical experience may not be that helpful in estimating for current and future periods,” Kovacs said. Clients may try to rely more heavily on auditors than in the past. “There need to be more conversations about independence, which can be a challenge if clients do not have the skills and look to their accountants for guidance in coming up with estimates,” he said.

Fraud: Fraud risk factors are increasing, and auditors should be aware of them. “If there was ever a time when management had incentives and pressures for management to commit fraud, it is now, as many businesses are struggling with revenues, cash flows, debt, and payroll,” Kovacs said. There are also economic pressures for employees and their families that change the motivation to commit fraud. “Because internal controls may not be as strong as normal, we must apply procedures that include elements of unpredictability,” Nagpal said.

Contractual modifications: Changes to contracts as a result of COVID-19 and economic pressures affect accounting for revenue, compensation, and leases. This is a complicated area with different accounting models to apply, which requires significant judgments.

Government grants: Government programs can increase risks of noncompliance. It is important to understand terms and provisions of the grants. The Coronavirus Aid, Relief, and Economic Security (CARES) Act, P.L. 116-136, and the Paycheck Protection Program have provided funds to many companies, but the program requirements are complicated and have changed over time. Countries around the world have versions of the CARES Act, and U.S. companies with operations outside the United States have to deal with their criteria and complexity.

“Many companies have not received grants before and do not have an accounting policy for them,” Knachel said. “GAAP provides flexibility in the choice of accounting model, with different accounting results.” Haskell recommends that auditors look at the client’s processes, controls, and accounting policies to assess the risk of material misstatement in this area.

Inventory observations: Since client locations are closed, auditors are using technology, including videoconferencing, Zoom, and FaceTime, to perform remote observations. This requires different planning from the past, Wi-Fi may not be available, and it is more feasible for inventories less prone to movement.

Companies should recognize that audit plans are not set in stone. “In a normal environment, auditors would reassess audit risks if there were company changes during the year,” Knachel said. “In this environment many of the changes are driven by COVID-19, but companies recognize things happen that must be evaluated and then worked through with the auditors.” Knachel advises auditors to expect the unexpected because new issues will continue to arise, including fourth-quarter events, and they may result in business changes and changes to the risk assessment and audit approach.

For more information on accounting and auditing issues amid the pandemic, consult the AICPA’s COVID-19: Audit & Assurance resources.

Maria L. Murphy, CPA, is a freelance writer based in North Carolina. To comment on this article or to submit an idea for another article, contact Kenneth Tysiac, the JofA’s editorial director, at Kenneth.Tysiac@aicpa-cima.com.

SPONSORED REPORT

Scorecard preparation templates and tips

With Workiva, we've created a PowerPoint deck that helps you create your own scorecards -- quick reference reports used across organizations to update stakeholders on the performance of defined deliverables.

100th ANNIVERSARY

Black CPA Centennial, 1921–2021

With 2021 marking the 100th anniversary of the first Black licensed CPA in the United States, a yearlong campaign kicked off to recognize the nation’s Black CPAs and encourage greater progress in diversity, inclusion, and equity in the CPA profession.