A&A Focus recap: Leveraging control testing in an audit

The most recent edition of the AICPA’s A&A Focus broadcast, held Sept. 4, provided members with updates on the latest developments in accounting, auditing, and assurance. Hosted by Bob Durak, CPA, CGMA, director of A&A Technical Services at the AICPA, and Andrew Merryman, CPA, senior manager–A&A Technical Services, the event featured expert speakers discussing topics ranging from new income tax disclosures to revenue recognition challenges and leveraging control testing in audits.

Auditing Standards Board update

First, Sara Lord, CPA, chair of the AICPA’s Auditing Standards Board (ASB) and chief auditor at RSM US, provided an update on recent ASB activities. Lord noted that the board held its most recent meeting in August and focused on two major topics: fraud and confirmations.

On fraud, the ASB is working to update AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, and considering proposals from the International Auditing and Assurance Standards Board (IAASB) as well as academic research, which includes research performed by the ASB. Some key areas under discussion include:

• Adding a requirement to understand the client’s whistleblower program as part of evaluating internal controls;
• Ensuring audit procedures to address fraud risks are not biased; and
• Potentially adding a separate “stand back” assessment specifically focused on fraud.

Unlike the IAASB proposal, the ASB is not currently planning to add specific fraud language to the auditor’s report. Instead, the board aims to address any reporting changes holistically in a separate project.

On confirmations, the ASB is evaluating recent updates to the Public Company Auditing Oversight Board’s (PCAOB’s) auditing standard on confirmations, AS 2310, The Auditor’s Use of Confirmation, to determine if similar changes should be made for private company audits. Lord noted that the ASB is considering incorporating additional guidance on what constitutes adequate alternative procedures when confirmations are not received; how to evaluate the reliability of confirmation responses, especially when using intermediaries or confirmation services; and, also, adding language clarifying how to handle incomplete confirmation responses.

Lord noted that any proposed changes to GAAS guidance on confirmations would likely be exposed for public comment in 2025, with an implementation date aligned with the updated fraud standard.

ASB meetings are open to the public, except for sessions dealing with administrative or confidential matters. Information on past and upcoming meetings is available on the ASB’s webpage.

New income tax disclosures

In the broadcast’s second segment, Brian Simpson, CPA, tax principal at Baker Tilly, joined to discuss the new income tax disclosure requirements under FASB Accounting Standards Update No. 2023-09, Income Taxes (Topic 740): Improvements to Income Tax Disclosures. The standard primarily affects public business entities, by introducing more granular breakdowns of effective tax rate reconciliations, but nonpublic business entities are also facing changes to their reporting disclosures.

For public business entities, the new requirements will be effective for annual periods beginning after Dec. 15, 2024. For entities other than public business entities, the requirements will be effective for annual periods beginning after Dec. 15, 2025.

Simpson highlighted the key changes for public entities, which include:

• Disaggregating the effective tax rate reconciliation into eight specific categories;
• Using a 5% threshold (of the statutory rate) for determining significant reconciling items;
• Reporting state and local taxes net of federal benefit;
• Disclosing which states comprise over 50% of state tax expense; and
• New disclosures around income taxes paid or refunded by jurisdiction.

For nonpublic entities, the changes are less extensive but still meaningful:

• Enhanced narrative disclosures on the nature and effect of reconciling items;
• New requirements to disclose domestic vs. foreign pretax income; and
• Breakout of income tax expense by federal, state, and foreign jurisdictions.

Simpson emphasized that while the standard provides more structure, it does not eliminate the need for judgment in determining appropriate disclosures.

Revenue recognition challenges: Principal vs. agent considerations

Next, Angela Newell, CPA, deputy managing director at BDO USA, dug deeper into a common area of confusion within FASB ASC Topic 606, Revenue From Contracts With Customers, specifically looking at the complexities of principal vs. agent determinations. This assessment, which Newell frames as part of Step 1 in the revenue recognition model, can significantly impact whether revenue is reported at gross or net amounts.

Newell noted that the key question is whether an entity controls the good or service before it is transferred to the customer and highlighted that the guidance is primarily written from the perspective of the “middleman” in a three-party transaction. However, entities often need to apply the concepts when they are the original provider of goods or services.

Newell provided two contrasting examples to illustrate the nuances. In the first example, ride-sharing entity Uber considers drivers to be their customers, as opposed to the rider, viewing themselves as providing a platform rather than transportation services. On the other hand, pharmacy benefit managers like OptumRx generally consider themselves principals in prescription drug transactions, despite never taking physical possession of the drugs.

These examples underscore that principal/agent determinations are highly fact-specific and can require significant analysis, even for seemingly straightforward arrangements.

Leveraging control testing in audits

In the last segment of the broadcast, Lyn Graham, a former ASB member, made the case for increased reliance on control testing to improve audit efficiency. He noted that many auditors, especially at smaller firms, have historically been reluctant to test controls due to perceived complexity or lack of client documentation.

Graham argued that the economics of control testing have changed since the implementation of risk assessment standards. With auditors now required to assess controls regardless, there are more opportunities to leverage that work to reduce year-end substantive testing.

He presented a quantitative example showing how even moderate levels of control testing can significantly reduce sample sizes for substantive procedures:

• No control reliance: 300 items tested;
• Moderate control reliance (seven items tested): 240 items tested (20% reduction); and
• High control reliance (23 items tested): 70 items tested (77% reduction).

Additional details of this example can be found in the archived event recording available on the A&A Focus Series landing page.

Graham emphasized that control testing can be targeted to specific accounts or cycles where it’s most efficient, rather than applied across the entire audit.

Open forum

The webcast concluded with a Q&A session addressing audience questions:

• Going concern: Lord noted that the ASB is researching potential changes to going concern reporting, including possibly adding an affirmative statement in the auditor’s report. However, no specific proposals have been made yet.
• Nonpublic entity disclosures: Simpson clarified that while nonpublic entities aren’t subject to the detailed effective tax rate reconciliation requirements, they will need to provide enhanced narrative disclosures and new breakouts of domestic vs. foreign income and tax expense.
• Undocumented controls: Graham addressed concerns about testing controls at smaller clients with limited documentation. He emphasized that lack of documentation is itself a control deficiency, but auditors can often work with clients to document key controls without excessive effort.

In other matters

In addition to the featured topical segments, the A&A Focus Series webcast provided updates across several timely emerging issues: 

• The SEC approved two new PCAOB proposals updating audit standards regarding general responsibilities of the auditor and use of technology-assisted analysis in conducting an audit.
  • Read the SEC release.
  • Read the SEC chairman’s statement on the activities.
• The PCAOB posted inspection reports for all 2023 annually inspected firms, including the six U.S. Global Network Firms. The inspection reports are accompanied by a new staff Spotlight publication, which provides an overview of staff observations from the 2023 inspections.
  • Read the PCAOB release.
  • Download the Spotlight publication.
• The IAASB released new implementation guidance for its standard on audits of financial statements for less complex entities (LCEs).
• The AICPA Center for Plain English Accounting released three new reports in August:
  • 2023 Peer Review MFCs: FASB ASC MFCs — NFP Issues;
  • Lease “Terminations” vs. Lease Modifications; and
  • Auditing Revenue More Efficiently & Effectively.
• The AICPA, in conjunction with Grant Thornton, released a white paper concerning automating control testing in audits, discussing benefits and considerations for moving from manual to automated testing processes.
• The IRS reopened its voluntary disclosure program for entities that may have improperly claimed employee retention credits (ERCs). The deadline for participation is Nov. 22, 2024.
• The AICPA Professional Ethics Executive Committee (PEEC) issued an exposure draft regarding changes to the AICPA Code of Professional Conduct related to Sec. 529 plans. If adopted as final, the changes will apply to members in public practice. Comments are due by Oct. 30, 2024, and should be emailed to ethics-exposuredraft@aicpa.org.

The webcast concluded with a preview of next month’s A&A Focus, live on Oct. 2. AICPA members are encouraged to attend these monthly events and review the accompanying newsletters for more in-depth coverage of these critical topics. Members can access archives of past sessions at the A&A Focus Series webpage.

— Dave Arman, CPA, MBA, is senior manager–Audit Quality at AICPA & CIMA, together as the Association of International Certified Professional Accountants. To comment on this article or to suggest an idea for another article, contact Jeff Drew at Jeff.Drew@aicpa-cima.com.