The CPA Journal

The Report of the Panel on Audit Effectiveness: Recommendations and Implications

By Brian W. Carpenter and Daniel P. Mahoney .

In Brief

Expanded Responsibilities, Strengthened Governance, Empowered Leadership

The second major initiative of SEC Chair Arthur Levitt’s crusade for improved financial reporting bore fruit on June 6, when the Panel on Audit Effectiveness released an exposure draft of its report to the public. It contains the results of the group’s lengthy look into, in the words of panel Chair Shaun O’Malley, the “way audits are performed and … the effects of recent trends in auditing on the public interest.” It is now up to the SEC, POB, standards setters, self-regulatory organizations, AICPA, and audit firms themselves to decide how the panel’s recommendations will be implemented.

The panel’s findings should come as no surprise: It found that, on the whole, independent audits are being performed effectively and properly. However, there is room for improvement. Foremost among their suggestions are a strengthened and independent POB, a reorganized ISB with increased public representation, expanded and modernized guidance from the Auditing Standards Board, increased focus on the peer review process, and renewed commitment to the audit by the profession’s leadership. The full text of the report can be found at www.pobauditpanel.org.

On September 28, 1998, SEC Chair Arthur Levitt delivered the “Numbers Game” speech at New York University, in which he expressed great concern over the “earnings management” practices of many corporations. Citing the misleading financial statements that result from these practices, Levitt outlined a far-reaching 10-point action plan designed to enhance the integrity of the corporate financial reporting process. Included in the action plan was the formation of two special panels, each of which was called upon to develop recommendations aimed at the enhancement of corporate financial reporting. The specific charge of the first panel, the “Blue Ribbon Committee,” was to develop recommendations for strengthening the role of corporate audit committees in their oversight of the financial reporting process. (A discussion of those recommendations appeared in the August 1999 CPA Journal.)

The specific charge of the second panel, the “Panel on Audit Effectiveness,” was to assess whether independent audits of public companies adequately serve the interests of investors. It focused on the appropriateness of the “audit risk model,” as emphasized by SEC Chief Accountant Lynn Turner in a letter to the chair of the Public Oversight Board (POB):

The primary focus of our concern … is whether today’s audit model, with its emphasis on risk assessments and analyses instead of more intensive fact checking and verification of the numbers, can continue to assure investors that appropriate steps have been taken to provide them with reliable financial information.

The Panel on Audit Effectiveness was made up of eight representatives from industry, public accounting practice, and academia. Following a lengthy and detailed study into the quality and efficacy of the audit risk model, the panel released its recommendations in its Report and Recommendations Exposure Draft in June. The potential implications of the report’s recommendations are conveyed in an accompanying cover letter addressed to the POB:

The panel believes the recommendations in this report will result in more effective audits that improve the reliability of financial statements, enhance their credibility, contribute to investors’ confidence in the profession, and improve the efficiency of the capital markets. Implementation will require the efforts, support, and cooperation of the profession, various standards-setting and oversight bodies, and the SEC.

The recommendations offered by the Panel on Audit Effectiveness, like those of the Blue Ribbon Committee, offer significant implications not only to independent auditors, but also to corporate accountants and executives, audit committees, standards setters, the SEC, and anyone that plays a role in corporate financial reporting.

The Methodology

“The purpose of this project is to make a comprehensive review and evaluation of the way independent audits are performed and assess the effects of recent trends in auditing on the public interest,” panel Chair Shaun O’Malley stated, in a letter to the POB written at the inception of the panel’s work. To arrive at its conclusions, the panel conducted a “quasi–peer review” (QPR) of actual audit engagements, a process involving primarily in-depth reviews of the audits of 126 SEC registrants in 28 offices of the eight largest audit firms. (In 1999, these eight firms collectively audited approximately 82% of the public registrants in the United States.) Specific engagements were selected based on risk profiles established by the panel for the purposes of

1) assessing the quality of the audit work performed in specific key areas;
2) determining whether the individuals that performed and reviewed the work had the necessary knowledge, skills, and experience;
3) determining whether the audit work was performed in an appropriate manner and reviewed on a timely basis; and
4) developing ideas for enhancing audit effectiveness.

In carrying out its charge, the panel also distributed a survey entitled “Request for Opinions on Issues of Audit Effectiveness Addressed to Thought Leaders and Key Stakeholders” to more than 500 individuals and organizations. The panel also met with the leaders of the eight accounting firms, SEC representatives, and various private-sector bodies involved in the governance of the profession. Additionally, the panel reviewed the circumstances that led to recent SEC accounting and auditing enforcement releases (AAERs); analyzed the audit methodologies, policies, and guidance materials used by the eight largest firms; and utilized several other approaches to audit quality assessment.

The Recommendations

The panel’s findings formed the basis for recommendations addressed to its many constituencies. In a broad sense, the findings were favorable in that the audit risk model was found to be generally appropriate. The findings “did not support the view that audits are being conducted in an ineffective manner;” however, the panel did admit that the audit risk model needs to be updated and enhanced. In particular, the panel concluded that, despite the promulgation of enhanced auditing standards, the redesign of audit methodologies may have led independent auditors to reduce the scope of their audits. The many recommendations stemming from this conclusion were categorized into five groups:

Conduct of audits, including the auditor’s responsibility for the detection of fraud (including earnings management that constitutes fraud)

Leadership and practices of the audit firms

Effects on auditor independence of nonaudit services provided to audit clients

Governance of the auditing profession

Strengthening the auditing profession internationally.

Each of the five categories was broken down into a number of subcategories (See Exhibit 1), and included within the subcategories were more than 200 specific recommendations addressed to the Auditing Standards Board (ASB), audit firms, SEC Practice Section (SECPS) Peer Review Committee(PRC), SEC, FASB, and various other groups. In nearly every case, the panel emphasized the integral role of the SECPS in implementing and enforcing its various recommendations. Specifically, the panel called for peer reviewers to evaluate and assess the panel’s recommendations during peer reviews and to report their evaluations to the SECPS Peer Review Committee.

Conduct of Audits

Of the panel’s more than 200 individual recommendations, more than half pertain to the conduct of independent audits.

Assessing engagement risk. “Engagement risk” is the risk of loss or injury to an audit practice as a result of litigation, adverse publicity, or other events arising in connection with audits of financial statements. Consideration of engagement risk should be an integral part of a firm’s decision to accept a client and should be used to avoid involvement with management lacking integrity. The panel found that some firms were very effective in considering items related to this risk; for example, some of the eight firms included in the QPR portion of the study were found to employ highly developed computer systems that quantitatively assessed engagement risk. These favorable observations led to the following recommendation:

Audit firms should consider the use of sophisticated, computerized systems as part of an effort to quantitatively measure the level of engagement risk, as well as qualitative judgments about the prospective client, including potentially derogatory information regarding the entity, its owners, and management.

Assessing inherent risk. Inherent risk, as defined by SAS No. 47, pertains to the “susceptibility of an assertion to a material misstatement, assuming that there are no related controls.” The panel observed that in recent years audit firms have increased the amount of industry and entity-specific information provided to audit personnel. Firms have also increasingly emphasized interacting with personnel outside of the accounting and finance functions to enhance understanding of the entity’s business. To improve the assessment of inherent risk, the panel recommended that—

the ASB require auditors to make inherent risk assessments for account balances and classes of transactions;

the ASB provide additional guidance regarding the factors affecting inherent risk;

audit firms review and ascertain the adequacy of their policies, guidance, and training material with regard to the proper assessment of inherent risk; and

audit firms require the more active participation of partners in the assessment of inherent risk, especially for clients considered high risk.

Multilocation audits. SAS No. 47, Audit Risk and Materiality in Conducting an Audit (as amended by SAS No. 82, Consideration of Fraud in a Financial Statement Audit), provides guidance with respect to auditing the financial statements of firms that have multiple locations or components. More specifically, SAS No. 47 requires the auditor to consider the extent to which audit procedures should be performed at selected locations or components. The panel noted that the auditor’s identification of the appropriate locations or components is “an important result of the risk assessment process.” In view of the significance of this process, the panel recommended that the ASB promulgate “more specific, demanding, and definitive standards for multilocation audits” that would address the level of knowledge and participation required by the auditor responsible for selecting locations and assigning key personnel.

Assessing control risk. The panel offered the following recommendations with regard to assessing the risk that the client’s internal control system would fail to prevent or detect, on a timely basis, a material financial reporting misstatement:

The ASB should provide specific guidance pertaining to the auditor’s required level of knowledge and understanding about internal control, as well as the nature and extent of documentation necessary to support the auditor’s consideration of internal control in planning the audit.

Audit firms should place a “high priority on enhancing the overall effectiveness of auditors’ work on internal control” (i.e., audit firms should increase the time allotted to assessment of the client’s controls and enhance staff training in the area of internal control and its various components).

Communicating and reporting on internal control. Noting that its focus group discussions identified a “significant gap” between the beliefs of investors, management, and audit committees regarding auditor involvement with an entity’s internal control, the panel recommended that—

audit committees obtain from management a written report on the effectiveness of internal controls over financial reporting and

the SEC require either external auditor reporting on the effectiveness of internal controls or an explicit statement by management that the external auditors are not expressing an opinion with regard to internal controls.

Linking the risk assessments to substantive tests. In the process of conducting its QPRs, the panel identified various ways in which the nature, timing, and extent of substantive tests were inconsistent with the auditors’ risk assessments (i.e., where a proper “linkage” between risk assessment and substantive testing did not exist). Failure to perform confirmation testing, inadequate resolution of confirmation exceptions, and insufficient documentation concerning the resolution of issues were among the noted cases of deficient substantive testing. Accordingly, the panel recommended that—

the ASB “develop more definitive authoritative guidance” on the linkage between risk assessments and the nature, timing, and extent of substantive tests and conduct research aimed at the development of more effective confirmation methods and other means of obtaining evidence from third parties and

audit firms require an individual of at least an “experienced audit manager” level to review the resolution of all exceptions noted in the audit.

Analytical procedures. The panel’s QPR created some doubt as to the effectiveness of the analytical review process performed in the final stage of the audit. SAS No. 56, Analytical Procedures, requires the use of analytical procedures not just in audit planning, but also in the overall review stage of the audit. While the analytical procedures used in the 126 engagements were generally found to be appropriate, the QPR identified instances in which the adequacy of inquiries and the corroboration of explanations were questionable. Additionally, an absence of sufficient documentation was noted in 25% of the engagements. As a result, several recommendations were offered, among them the recommendation that both the ASB and audit firms provide more specific and definitive guidance on the use of analytical procedures in differing circumstances.

Auditing revenue. In developing recommendations pertaining to proper recognition of revenues, the panel referred to the 1999 report of the Committee of Sponsoring Organizations of the Treadway Commission, which identified numerous cases of improper revenue recognition during the period1987-1997. The panel also referred to similar findings in a separate study of SEC enforcement actions and recommended that—

the ASB require auditors to test the cutoff of revenue in instances where inherent or control risks over revenue transactions are “other than low” and to “specifically state when there is a high level of sales transactions or individually significant sales transactions near the end of the reporting period;”

the ASB “give the highest priority to completion of its proposed audit guide for revenue recognition;” and

FASB add the issue of revenue recognition to its agenda.

Auditing estimates and judgments. The panel’s report points out that financial statements generally contain numerous estimates and judgments, and that concerns have been expressed (e.g., by Levitt in his 1998 speech) about the use of estimates and judgments to “manage” earnings. The panel noted that the auditability and specificity of accounting standards are directly related to audit effectiveness. Accordingly, the panel recommended several measures, including the following:

The ASB should provide detailed guidance concerning the auditing of reserves.

The ASB and FASB should establish a “formal protocol” for the purpose of evaluating the auditability of proposed standards before they are issued.

FASB should reconsider the accounting treatment of contingencies.

Audit committees should evaluate the nature of a company’s reserves.

Materiality, waived adjustments, and analysts’ expectations. In his “Numbers Game” speech, Levitt acknowledged the pressures faced by many companies in meeting analysts’ earnings forecasts and expressed concern that these pressures might lead companies to “manage” their earnings. Additionally, he voiced concern that instead of challenging the earnings management practices of their client companies, auditors have been known to “waive” potential misstatements on the basis of their being immaterial. Interestingly, the panel’s analysis generally indicated that auditors’ waived adjustments did not affect the ability to meet earnings forecasts, although it is still recommended that the ASB—

“provide additional authoritative guidance” to aid auditors in assessing the materiality of identified misstatements and

require auditors to consider the published reports and forecasts of analysts in assessing risks of the client’s business and industry and the materiality of identified misstatements.

Going concern considerations. When an auditor has substantial doubt about the entity’s ability to continue as a going concern for a “reasonable period of time” (not to exceed one year beyond the date of the financial statements), SAS No. 59, The Auditor’s Consideration of an Entity’s Ability to Continue as a Going Concern, requires the auditor to expand audit testing and obtain evidence about management’s plans to mitigate the effects of the identified conditions. Auditors are also required to assess the likelihood that management’s plans can be implemented effectively. The panel’s analysis indicated that auditors were alert to issues regarding an entity’s ability to continue as a going concern and that the auditors reached supportable conclusions; however, the following were identified as areas of potential improvement:

The ASB and audit firms should provide expanded guidance with respect to the performance of additional audit procedures and evidence to be obtained when considering management’s plans for mitigating the adverse effects of conditions and events that raised the auditor’s substantial doubt about the entity’s ability to continue as a going concern.

FASB should challenge SAS No. 59’s “one-year time horizon” and recognize its importance to auditors in structuring their audit reports.

Internal auditors. SAS No. 65, The Auditor’s Consideration of the Internal Audit Function in an Audit of Financial Statements, requires the independent auditor to obtain an understanding of the client’s internal audit function and consider the extent to which the work of the internal auditors affects the nature, timing, and extent of audit tests. While the panel’s QPR reviewers found that independent auditors were largely adhering to SAS No. 65 requirements, some expressed concern about the sufficiency of the engagement teams’ reviews of the internal auditor’s direct-assistance work. Consequently, the panel offered several recommendations, including that—

the ASB “revise SAS No. 65 to establish more definitive and specific criteria and requirements for testing the work performed by internal audit” and

audit firms review their policies requiring auditors to test the work of internal auditors and consider whether they are relying too heavily on the work of internal auditors.

Communicating with audit committees. The QPR reviewers found that audit committees were in place for all but five of the 126 public entities whose audits were reviewed. They noted 16 additional cases in which the audit committee held no meetings during the year or the number of meetings was inadequate. Additionally, certain important topics were not communicated to the audit committees. Accordingly, the panel recommended that—

the ASB expand the standards and guidance regarding communications with audit committees to require “more responsive and substantive communications by auditors” and that audit firms expand their own guidance regarding these communications and

audit committees conduct a minimum of two “face-to-face” meetings with the external auditors each year and a minimum of one executive session with the internal and external auditors (i.e., without management present).

Establishing auditing standards. The panel’s recommendations pertaining to the establishment of auditing standards are aimed largely at making auditing standards more specific and definitive and improving their clarity. In particular, the panel recommended that the ASB evaluate the guidance offered in SAS No. 47, Audit Risk and Materiality in Conducting an Audit, and SAS No. 41, Working Papers. The panel also cited the need for clearer guidance from those that perform, document, and review audit work.

Earnings management and fraud. If fully implemented, the panel’s recommendations concerning the auditor’s responsibility for detecting fraud would significantly change the requirements of SAS No. 82, Consideration of Fraud in a Financial Statement Audit:

The risk assessment and response process called for by SAS No. 82 falls short in effectively deterring fraud or significantly increasing the likelihood that the auditor will detect material fraud, largely because it fails to direct auditing procedures specifically toward fraud detection.

The following were among the panel’s recommendations:

The ASB should “develop stronger and more definitive auditing standards to effect a substantial change in auditors’ performance and thereby improve the likelihood that auditors will detect fraudulent financial reporting.” Specifically, a “forensic-type fieldwork phase” should be introduced to audits, in which auditors would be required to replace their current “neutral concept of professional skepticism” with a presumption of the possibility of management fraud. Auditors would be required to ask themselves, “Where is the entity vulnerable to financial statement fraud if management were inclined to perpetrate it?”

The ASB, as part of its requirement for a “forensic phase” of fieldwork, should require the use of “retrospective audit procedures” in which auditors would assess how various issues involving accounting estimates and judgments in previously issued financial statements were resolved.

Audit firms should be required to discuss with audit committees the entity’s vulnerability to financial reporting fraud and exposure to asset misappropriation.

Audit Firm Leadership and Practices

The panel’s focus groups expressed their concern that much like the audit clients, the engagement partners often “treat the audit negatively--as a commodity.” The firms’ emphasis on offering their clients revenue-enhancing and other ideas has increasingly made the audit appear to have less intrinsic value in and of itself. The panel recommended that audit firms emphasize to all audit personnel the “importance of performing high-quality professional work” and that the AICPA emphasize the value of audited financial statements to users of financial information.

Professional development. Professional development within the audit profession is of paramount importance. In recognition of the increasingly complex business world, the panel recommended that audit firms “make increased knowledge and skills a high priority for all experience levels,” with particular emphasis on audit performance and fraud detection.

Personnel management. The panel noted the concern that the performance of high-quality audits may not receive proper recognition in promotion and retention decisions. Accordingly, it recommended that audit firms review performance measures for audit personnel of all experience levels in order to ensure that “performing high-quality audits is appropriately recognized as the highest priority in performance evaluations and compensation, promotion, and retention decisions.”

Time pressures. Noting the long-held concern that time pressures lead to substandard audits, the panel made the following recommendations:

Audit firms should ensure that the audit process includes inquiries “about possible time pressures on specific engagements that could create an environment in which audit quality might be compromised.”

Audit firm partners should provide guidance on managing time pressures.

Smaller firm considerations. The panel noted that smaller firms frequently lack the resources of larger firms and recommended that the AICPA-- increase its audit-related assistance to small firms and assist these firms in assessing engagement risk through software and other appropriate tools.

Nonaudit Services Provided to Audit Clients

The panel’s report contained significant debate concerning the appropriateness of providing nonaudit services to audit clients. Panel members agreed that independence is essential for “promoting public confidence in the audit process” and that as long as firms offer nonaudit services to audit clients, concerns about independence will remain a contentious issue. The panel also noted that there has been “explosive growth” in such services and that “in their zeal to emphasize the array of services that CPAs offer, accounting firms and the AICPA scarcely acknowledge auditing services in the public images that they portray.”

Nevertheless, the panel’s report reflected its members’ highly polarized opinions concerning the provision of nonaudit services to audit clients. Due to this divided sentiment, the panel decided to withhold a recommendation for a proposed “exclusionary rule” that would have restricted the provision of nonaudit services to audit clients. However, the panel agreed that--

the Independence Standards Board (ISB) should “identify factors to be considered by auditors, audit committees, and client management … when determining whether a specific nonaudit service is appropriate” and

audit committees should specifically approve nonaudit services that exceed a predetermined amount.

In deliberating the subject of “former firm personnel in client management,” the issue of independence again became the focal point. Interestingly, neither the focus group participants nor the survey respondents viewed this subject as a major concern, and the panel offered no recommendations regarding it.

Governance of the Auditing Profession

Citing the limitations posed by the auditing profession’s current system of voluntary self-regulation, the panel made the following recommendations:

The auditing profession should unify its system of governance by having a strengthened and independent POB to oversee the profession’s activities with respect to standards setting, monitoring, discipline, and special reviews.

A formal charter should establish term limits, acknowledge the POB’s responsibilities and power, and recognize it as the sole authority to determine its budget and financial and other resources.

The ISB should “reconstitute its membership to include four members representing the public and three members representing the public accounting profession” (currently, the membership is four and four), thus providing for majority representation by the public at large.

Under this proposed system of governance (illustrated in Exhibit 2), the SEC would retain its ultimate authority over auditor independence with regard to SEC registrants.

Enhancing peer reviews. The peer review process is an integral part of ensuring ongoing quality of the audit process. However, the panel believes that improvements can be made to the current process and recommended that—

the SECPS make substantial improvements to the peer review process by implementing all of the recommendations offered by its peer review task force’s January 2000 report,

the SECPS emphasize to the peer review teams that it is the POB--not the firm under review--that is the primary client,

the SECPS and the ASB “review the quality control standards and make them more specific, definitive, and rigorous,” and

the SEC require all firms auditing SEC registrants to be “enrolled in a peer review program that includes public oversight.”

Enhancing the disciplinary process. The panel noted that the auditing profession’s disciplinary process is significantly limited because of the lack of financial resources devoted to these matters by state boards of accountancy and the lack of effective enforcement actions available to the AICPA. Additionally, it was noted that the AICPA ethics division has limited investigative powers, and because of the confidential nature of its disciplinary proceedings, the public cannot determine the reasons for imposed sanctions. The panel indicated that formal legislation significantly enhancing its enforcement powers would be the most appropriate response to these perceived deficiencies but is unlikely in the foreseeable future. Accordingly, the panel made the following recommendations:

When an audit comes under investigation, the SECPS, the AICPA, and the POB should jointly require the audit firm to “conduct an internal review of the subject engagement to evaluate the performance of the senior management personnel” as soon as is reasonably possible, following the commencement of civil litigation against (or criminal investigation of) the firm.

Pending the termination or completion of the litigation or public-regulatory investigation, the ethics division should require the firm to discipline the engagement partner in one of the following ways:

1) termination or retirement,
2) removal from all public company audit engagements, or
3) an additional second partner review of all public company audit engagements completed by the partner in the 12 months prior to the deferral.

Following a two to three-year period, the efficacy of the above measures should be reviewed, and if the measures are found to be deficient, legislation should be sought “to achieve the protections necessary to make the disciplinary process more effective.”

The SEC should devote additional resources to its enforcement activities directed at allegations of audit failures.

Strengthening the Auditing Profession Internationally

Since the late 1970s, the International Federation of Accountants (IFAC) has sought uniformity in global auditing standards. As part of this effort, IFAC formed the International Auditing Practices Committee (IAPC), whose mission is to establish international auditing standards. The panel cited the importance of “financial information that is reliable and comparable, regardless of country of origin” to an effective and efficient global capital market. Toward this goal, the panel recommended the following steps:

IFAC should ensure that the self-regulation of the international auditing profession includes a global oversight body to

1) encourage monitoring and reporting on the activities of national self-regulatory organizations,
2) impose minimum guidelines for self-regulation,
3) evaluate the adequacy of IFAC’s ethics standards,
4) assess IFAC’s process for evaluating the education and training of auditors of individual countries, and
5) establish a framework for monitoring the accounting profession to guide the national self-regulatory organizations. • Audit firms should implement uniform audit methodologies throughout the world.

The Next Step

Concerns regarding the efficacy of the current audit risk model were the basis for the POB’s creation of the Panel on Audit Effectiveness. The panel concluded that the current audit risk model is generally appropriate but improvements could and should be made in response to current concerns, and the exposure draft offers many recommendations addressing a variety of audit effectiveness issues. Noting the “unusually tense” relationship between the auditing profession and the SEC and the belief that recent changes in the auditing profession have not been in the public’s best interest, the report emphasized the need for a “strengthened POB as an effective oversight body to whom the SEC, the accounting profession, and the public can look for leadership.”

The deadline for comment on the exposure draft was July 21 (The panel’s website is located at www.pobauditpanel.org). Based upon the response, the panel will release its final recommendations, and implementation will fall to the SEC, POB, standards setters, self-regulatory organizations, AICPA, and audit firms themselves. Given the relative speed with which the SEC and self-regulatory organizations were able to implement the recommendations of the Blue Ribbon Panel, the profession should prepare itself for quick action on the part of the SEC and POB that could lead to increased scrutiny of audit effectiveness and expanded disciplinary measures for noncompliance.

In the “Numbers Game” speech, Levitt said: “I need not remind auditors they are the public’s watchdog in the financial reporting process.… The integrity of that information must take priority over a desire for cost efficiencies or competitive advantage in the audit process.… We cannot permit thorough audits to be sacrificed for reengineered approaches that are efficient, but less effective.” The panel’s recommendations are the next step toward strengthening public interest in the audit process and restoring public confidence in financial reporting.

Brian W. Carpenter, PhD, CMA, is a professor of accounting, and
Daniel P. Mahoney, PhD, CFE, CPA, an associate professor of accounting, both at the Arthur J. Kania School of Management, University of Scranton.

The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.

Visit the new cpajournal.com.