This past Saturday, PCAOB Board Member Jeanette M. Franzel presented a speech at the AAA Annual Meeting on current issues and trends in the audits of internal controls over financial reporting (ICFR). Relying significantly on data from Audit Analytics, Franzel’s speech discussed the impact of PCAOB inspections on these audits, trends in adverse ICFR opinions, the relationship between adverse ICFR opinions and restatements, and the relationship between PCAOB inspections and audit fees.
Audits of ICFR have been a focal point of PCAOB inspections since 2010. According to Franzel, over this time, the percentage of audits with ICFR deficiencies has risen from 16% in 2010 to 36% in 2013 of Big 4 US Domestic audit inspections. Franzel gave the following areas as the most frequent reasons for ICFR audit deficiencies in the 2014 inspection cycle:
- Selecting the appropriate controls to test, based on those that are important to the auditor’s conclusion about whether the company’s controls sufficiently address the assessed risk of misstatement (AS No. 5.39).
- Testing design effectiveness to determine whether the company’s controls satisfy the control objectives and can effectively prevent or detect errors or fraud that could results in material misstatements (AS No. 5.42).
- Testing the operating effectiveness of the controls (AS No. 5.44).
To go along with this increase in ICFR audit deficiencies, the number of ineffective ICFR opinions has also risen in recent years. Franzel suggests, “the increase in adverse opinions between 2010 and 2014 is notable.” She continues, “it is also notable that the PCAOB began putting significant focus and emphasis on audit of ICFR in its 2010 inspections,” implying the increase in adverse opinions is likely due to the PCAOB’s focus on the subject.
However, one potentially troubling trend persists. More and more companies that have to restate their financials also claimed to have “clean” – i.e., effective – ICFR opinions immediately prior to disclosing the restatement. In 2014, 80.4% of restatements were made by companies with effective ICFR. This is up from 74.2% in 2010, and the low of 72.4% in 2012. As a result, there has been a coincident increase in the number of restated ICFR opinions. This suggests that there may be a substantial number of undisclosed material weaknesses in ICFR.
Based on the results found by PCAOB inspections, the Securities and Exchange Commission (SEC) has begun to question management’s evaluation of ICFR and whether companies are properly identifying material weaknesses. One concern for the SEC is that “management rarely appears to identify a material weakness in the absence of a material misstatement,” says Franzel.
Despite the apparent need for continued emphasis on ICFR audits, some believe the consequences to be too great. In a May 29th letter from the US Chamber of Commerce’s Center for Capital Markets Competitiveness (CCMC), the CCMC questioned whether the PCOAB inspections are creating a “one-sized-fits-all” approach to auditing ICFR. They argue that “the audit should be planned and conducted to fit the controls.” They also state that “spending inordinate amounts on audits does not promote investor protection or provide the basis for an effective and sustainable system of controls.”
As Franzel states, “it is not surprising to hear concerns about the potential impact on audit fees.” In response to this criticism, Franzel cites Audit Analytics data that shows audit fees of companies with an auditors’ opinion on ICFR for both 2013 and 2014 saw a median change of 4.08 percent increase in audit fees. This included 34 percent with decreasing fees, 2 percent with no change and 64 percent with increasing fees. She goes on to state that “these rates have been generally consistent over the past four years.”
The speech covers an impressive amount of data and analysis. While problems with ICFR audits and disclosures persist, there are signs of improvement. “Ultimately,” Franzel said, “it is my hope that, as auditors become more effective at auditing the effectiveness of ICFR, they will also continue to do so efficiently and cost-effectively and possibly gain efficiencies through an appropriate risk-based focus.”