Internal Control Audit Failures Too High, PCAOB Says

Auditors are making too many mistakes in their audit of internal control over financial reporting, prompting a new warning from the Public Company Accounting Oversight Board to pay closer attention to auditing standards and the firms' own audit methodologies.

The PCAOB said in a summary of its inspection findings with respect to internal control over financial reporting that it found problems with the audit of ICFR in 15 percent of all the audits it checked in its 2010 inspection cycle, which focused on 2009 financial statements. And the failure rate is even higher -- 22 percent -- in the board's 2011 inspection cycle. Only a few days earlier, the PCAOB also issued apractice alert to auditors to call for more objectivity and skepticism in audit work.

The board is especially concerned about the audit problems with ICFR because it also found that among the 46 engagements where ICFR auditing was lacking, in 39 of those audits, or 85 percent, inspectors also found problems with the audit of the financial statements. “These numbers are too high,� said PCAOB member Jeannette Franzel in a briefing to members of the media. The data suggests auditors are giving their assurance that financial statements are sound when in fact auditors haven't done enough audit work to reach that conclusion, she said.

The board said it noted deficiencies in six separate areas that auditors need to address: identifying and testing controls that speak to the risk of material misstatement, testing the design and operating effectiveness of management review controls, obtaining sufficient evidence to test controls from an interim date to the year-end date, testing system-generated data and reports that support key controls, performing adequate procedures on the work of others, and evaluating identified control deficiencies to consider what effect they might have on the financial statement audit and the audit of internal control.

With respect to ICFR audit problems, the board said it found the greatest number of failures in checking controls around revenue, inventory, fair value of financial instruments, and valuation of pension plan assets. The board attributes the problems with ICFR audit failures to a failure on the part of specific auditors to exercise a top-down approach to auditing ICFR, a decrease in audit firm staffing, a lack of training and guidance for auditors in the field, and ineffective or inadequate communication between auditors and the specialists they rely on, such as valuation specialists. Franzel and PCAOB member Hanson said the failures it finds are not the result of inadequate audit practices and policies at the firms, but inadequate application of those practices by auditors in the field. 

The PCAOB adopted the current standard for the audit of internal control over financial reporting, Auditing Standard No. 5, to take effect with the audits of 2007 financial statements,replacing an earlier standard that was regarded as overly prescriptive. The PCAOB's newest report covers the concerns discovered in 2009 financial statement audits and notes the concerns continued to be present in 2010 audits as well. The PCAOB is just publishing its findings now, nearly three years after the problem apparently first surfaced, after an “arduousâ€� internal process to summarize inspectors' findings and issue warnings, said Hanson at the media briefing.

The board is working on other warnings as a result of its inspection findings, said Hanson, one expected early in 2013 that will focus on problems at smaller audit firms. Another report will focus on various concerns with the audits of financial statements generally, but Hanson said the board can't predict when that report will be final. “It's an enormous effort to get them (the reports) out,� he said.