New Rules for US Auditing Firms Show That the World Has Changed
May 16, 2024
New guidance from the Public Company Accounting Oversight Board, released May 13, represents a modernizing and streamlining of the values that underlie audits and, more impactfully, introduces a dramatically different reporting system regarding quality controls within accounting firms.
As I look at the PCAOB standards, three thoughts come to mind.
First, it’s about time. The standards being replaced by the guidance titled “General Responsibilities of the Auditor in Conducting an Audit,” or AS 1000, have been in place since the founding of the PCAOB more than two decades ago.
This is also true of the standards addressed by the guidance entitled “A Firm’s System of Quality Control,” or QC 1000. Instead of just tinkering with quality control, the PCAOB has allowed events of recent years to drive their decision-making in establishing regulatory mandates.
Second, the world has changed. Both standards recognize that the public company auditing environment is fundamentally different than it was 20 years ago. The widespread adoption of cutting-edge technology by accounting firms has streamlined their ability to assimilate evidence in workpapers on a timely basis, largely free of the culling and sorting of documents necessary at the turn of the century.
As a result, with little pushback, the PCAOB has required that workpapers be finalized for both the audit and the new annual quality control assessment within 14 days. For the audit, the standard has been 45 days since the issuance of Auditing Standard No. 3 in 2004. The tighter deadline should enable a more timely PCAOB audit inspection process.
Third, the focus is on the tone at the top in both standards. AS 1000 emphasizes that due professional care responsibilities are different for engagement partners than other engagement team members and on the partners’ responsibility for the audit engagement’s performance, including planning, supervision, and review. This ultimate responsibility can’t be delegated away.
Due professional care applies to all information obtained to comply with PCAOB standards, not just evaluating what’s sufficient, appropriate evidence. This includes the process of accepting and retaining clients, as well as auditor involvement in securities filings. This is consistent with the standard’s focus on the auditing firm’s fundamental responsibility to protect investors.
Going Further
The quality control standard represents the give and take of a decade’s worth of consideration on how to improve audit quality among auditors of public companies. Though they have aligned these standards with other standard setters’ quality management standards, the PCAOB has chosen to go further.
The board explicitly cited some of the audit firms’ more egregious behaviors to justify the need for additional regulation—cheating on continuing education exams, altering workpapers, widespread independence reporting failures, and offering impermissible non-audit services. The result is a prescriptive model with eight components, two of which are process components, and six related to firm organization and operations.
Quality risks and responses must be documented and will be assessed similarly to independence threats and safeguards. And the larger firms with more than 100 public clients will have to have an outsider on their board evaluating quality control. The standard applies to all engagements where the firm serves as the lead auditor or has a “substantial role.”
The annual quality control system evaluation is meant to identify engagement deficiencies, quality control deficiencies, and major quality control deficiencies, with the evaluation done as of Sept. 30 and delivered by Nov. 30. All documentation must be completed by Dec. 14. The first evaluation is due in 2026.
The result is a self-report much like audit reports, parallel to the unqualified, qualified, and adverse opinions. A clean opinion has no unremediated quality control deficiencies. The next level report is one where there are one or more unremediated deficiencies, and the least favorable opinion has one or more major quality control deficiencies.
The PCAOB has chosen not to make these reports publicly available, though audit committees may ask to see them. These reports must be signed by the person ultimately responsible for quality control, as well as the person functionally responsible. Once again, the PCAOB’s emphasis is on the tone at the top of the audit firm considering the egregious firm behaviors of the past decade.
Accounting firms will incur significant costs to comply with QC 1000. I often tell my students, “If you don’t self-regulate, you will be regulated.” The new PCAOB quality standard is a reflection of that truth. The question is whether the regulation will change auditor behavior or improve audit quality.
The PCAOB is laser-focused on the tone at the top of auditing firms and on its impact on firm culture and investor protection. The new quality control standard makes it clear that the world has changed.
[Bloomberg Law]
