By Brian W. Carpenter and Daniel P. Mahoney .
Expanded Responsibilities, Strengthened Governance, Empowered Leadership
The second major initiative of SEC Chair Arthur Levitt’s crusade for improved financial reporting bore fruit on June 6, when the Panel on Audit Effectiveness released an exposure draft of its report to the public. It contains the results of the group’s lengthy look into, in the words of panel Chair Shaun O’Malley, the “way audits are performed and … the effects of recent trends in auditing on the public interest.” It is now up to the SEC, POB, standards setters, self-regulatory organizations, AICPA, and audit firms themselves to decide how the panel’s recommendations will be implemented.
The panel’s findings should come as no surprise: It found that, on the whole, independent audits are being performed effectively and properly. However, there is room for improvement. Foremost among their suggestions are a strengthened and independent POB, a reorganized ISB with increased public representation, expanded and modernized guidance from the Auditing Standards Board, increased focus on the peer review process, and renewed commitment to the audit by the profession’s leadership. The full text of the report can be found at www.pobauditpanel.org.
On September 28, 1998, SEC Chair Arthur Levitt delivered the “Numbers Game” speech at New York University, in which he expressed great concern over the “earnings management” practices of many corporations. Citing the misleading financial statements that result from these practices, Levitt outlined a far-reaching 10-point action plan designed to enhance the integrity of the corporate financial reporting process. Included in the action plan was the formation of two special panels, each of which was called upon to develop recommendations aimed at the enhancement of corporate financial reporting. The specific charge of the first panel, the “Blue Ribbon Committee,” was to develop recommendations for strengthening the role of corporate audit committees in their oversight of the financial reporting process. (A discussion of those recommendations appeared in the August 1999 CPA Journal.)
The specific charge of the second panel, the “Panel on Audit Effectiveness,” was to assess whether independent audits of public companies adequately serve the interests of investors. It focused on the appropriateness of the “audit risk model,” as emphasized by SEC Chief Accountant Lynn Turner in a letter to the chair of the Public Oversight Board (POB):
The primary focus of our concern … is whether today’s audit model, with its emphasis on risk assessments and analyses instead of more intensive fact checking and verification of the numbers, can continue to assure investors that appropriate steps have been taken to provide them with reliable financial information.
The Panel on Audit Effectiveness was made up of eight representatives from industry, public accounting practice, and academia. Following a lengthy and detailed study into the quality and efficacy of the audit risk model, the panel released its recommendations in its Report and Recommendations Exposure Draft in June. The potential implications of the report’s recommendations are conveyed in an accompanying cover letter addressed to the POB:
The recommendations offered by the Panel on Audit Effectiveness, like those of the Blue Ribbon Committee, offer significant implications not only to independent auditors, but also to corporate accountants and executives, audit committees, standards setters, the SEC, and anyone that plays a role in corporate financial reporting.
The panel believes the recommendations in this report will result in more effective audits that improve the reliability of financial statements, enhance their credibility, contribute to investors’ confidence in the profession, and improve the efficiency of the capital markets. Implementation will require the efforts, support, and cooperation of the profession, various standards-setting and oversight bodies, and the SEC.
“The purpose of this project is to make a comprehensive review and evaluation of the way independent audits are performed and assess the effects of recent trends in auditing on the public interest,” panel Chair Shaun O’Malley stated, in a letter to the POB written at the inception of the panel’s work. To arrive at its conclusions, the panel conducted a “quasi–peer review” (QPR) of actual audit engagements, a process involving primarily in-depth reviews of the audits of 126 SEC registrants in 28 offices of the eight largest audit firms. (In 1999, these eight firms collectively audited approximately 82% of the public registrants in the United States.) Specific engagements were selected based on risk profiles established by the panel for the purposes of
1) assessing the quality of the
audit work performed in specific key areas;
2) determining whether the individuals that performed and reviewed the work had the necessary knowledge, skills, and experience;
3) determining whether the audit work was performed in an appropriate manner and reviewed on a timely basis; and
4) developing ideas for enhancing audit effectiveness.
In carrying out its charge, the panel also distributed a survey entitled “Request for Opinions on Issues of Audit Effectiveness Addressed to Thought Leaders and Key Stakeholders” to more than 500 individuals and organizations. The panel also met with the leaders of the eight accounting firms, SEC representatives, and various private-sector bodies involved in the governance of the profession. Additionally, the panel reviewed the circumstances that led to recent SEC accounting and auditing enforcement releases (AAERs); analyzed the audit methodologies, policies, and guidance materials used by the eight largest firms; and utilized several other approaches to audit quality assessment.
The panel’s findings formed the basis for recommendations addressed to its
many constituencies. In a broad sense, the findings were favorable in that the
audit risk model was found to be generally appropriate. The findings “did not
support the view that audits are being conducted in an ineffective manner;”
however, the panel did admit that the audit risk model needs to be updated and
enhanced. In particular, the panel concluded that, despite the promulgation
of enhanced auditing standards, the redesign of audit methodologies may have
led independent auditors to reduce the scope of their audits. The many recommendations
stemming from this conclusion were categorized into five groups:
Each of the five categories was broken down into a number of subcategories (See Exhibit 1), and included within the subcategories were more than 200 specific recommendations addressed to the Auditing Standards Board (ASB), audit firms, SEC Practice Section (SECPS) Peer Review Committee(PRC), SEC, FASB, and various other groups. In nearly every case, the panel emphasized the integral role of the SECPS in implementing and enforcing its various recommendations. Specifically, the panel called for peer reviewers to evaluate and assess the panel’s recommendations during peer reviews and to report their evaluations to the SECPS Peer Review Committee.
Conduct of Audits
Of the panel’s more than 200 individual recommendations, more than half pertain to the conduct of independent audits.
Assessing engagement risk. “Engagement risk” is the risk of
loss or injury to an audit practice as a result of litigation, adverse publicity,
or other events arising in connection with audits of financial statements.
Consideration of engagement risk should be an integral part of a firm’s decision
to accept a client and should be used to avoid involvement with management
lacking integrity. The panel found that some firms were very effective in
considering items related to this risk; for example, some of the eight firms
included in the QPR portion of the study were found to employ highly developed
computer systems that quantitatively assessed engagement risk. These favorable
observations led to the following recommendation:
Assessing inherent risk. Inherent risk, as defined by SAS
No. 47, pertains to the “susceptibility of an assertion to a material misstatement,
assuming that there are no related controls.” The panel observed that in recent
years audit firms have increased the amount of industry and entity-specific
information provided to audit personnel. Firms have also increasingly emphasized
interacting with personnel outside of the accounting and finance functions
to enhance understanding of the entity’s business. To improve the assessment
of inherent risk, the panel recommended that—
Multilocation audits. SAS No. 47, Audit Risk and Materiality in Conducting an Audit (as amended by SAS No. 82, Consideration of Fraud in a Financial Statement Audit), provides guidance with respect to auditing the financial statements of firms that have multiple locations or components. More specifically, SAS No. 47 requires the auditor to consider the extent to which audit procedures should be performed at selected locations or components. The panel noted that the auditor’s identification of the appropriate locations or components is “an important result of the risk assessment process.” In view of the significance of this process, the panel recommended that the ASB promulgate “more specific, demanding, and definitive standards for multilocation audits” that would address the level of knowledge and participation required by the auditor responsible for selecting locations and assigning key personnel.
Assessing control risk. The panel offered the following recommendations
with regard to assessing the risk that the client’s internal control system
would fail to prevent or detect, on a timely basis, a material financial reporting
Communicating and reporting on internal control. Noting that
its focus group discussions identified a “significant gap” between the beliefs
of investors, management, and audit committees regarding auditor involvement
with an entity’s internal control, the panel recommended that—
Linking the risk assessments to substantive tests. In the
process of conducting its QPRs, the panel identified various ways in which
the nature, timing, and extent of substantive tests were inconsistent with
the auditors’ risk assessments (i.e., where a proper “linkage” between risk
assessment and substantive testing did not exist). Failure to perform confirmation
testing, inadequate resolution of confirmation exceptions, and insufficient
documentation concerning the resolution of issues were among the noted cases
of deficient substantive testing. Accordingly, the panel recommended that—
Analytical procedures. The panel’s QPR created some doubt as to the effectiveness of the analytical review process performed in the final stage of the audit. SAS No. 56, Analytical Procedures, requires the use of analytical procedures not just in audit planning, but also in the overall review stage of the audit. While the analytical procedures used in the 126 engagements were generally found to be appropriate, the QPR identified instances in which the adequacy of inquiries and the corroboration of explanations were questionable. Additionally, an absence of sufficient documentation was noted in 25% of the engagements. As a result, several recommendations were offered, among them the recommendation that both the ASB and audit firms provide more specific and definitive guidance on the use of analytical procedures in differing circumstances.
Auditing revenue. In developing recommendations pertaining
to proper recognition of revenues, the panel referred to the 1999 report of
the Committee of Sponsoring Organizations of the Treadway Commission, which
identified numerous cases of improper revenue recognition during the period1987-1997.
The panel also referred to similar findings in a separate study of SEC enforcement
actions and recommended that—
Auditing estimates and judgments. The panel’s report points
out that financial statements generally contain numerous estimates and judgments,
and that concerns have been expressed (e.g., by Levitt in his 1998 speech)
about the use of estimates and judgments to “manage” earnings. The panel noted
that the auditability and specificity of accounting standards are directly
related to audit effectiveness. Accordingly, the panel recommended several
measures, including the following:
Materiality, waived adjustments, and analysts’ expectations. In
his “Numbers Game” speech, Levitt acknowledged the pressures faced by many
companies in meeting analysts’ earnings forecasts and expressed concern that
these pressures might lead companies to “manage” their earnings. Additionally,
he voiced concern that instead of challenging the earnings management practices
of their client companies, auditors have been known to “waive” potential misstatements
on the basis of their being immaterial. Interestingly, the panel’s analysis
generally indicated that auditors’ waived adjustments did not affect the ability
to meet earnings forecasts, although it is still recommended that the ASB—
Going concern considerations. When an auditor has substantial
doubt about the entity’s ability to continue as a going concern for a “reasonable
period of time” (not to exceed one year beyond the date of the financial statements),
SAS No. 59, The Auditor’s Consideration of an Entity’s Ability to Continue
as a Going Concern, requires the auditor to expand audit testing and obtain
evidence about management’s plans to mitigate the effects of the identified
conditions. Auditors are also required to assess the likelihood that management’s
plans can be implemented effectively. The panel’s analysis indicated that
auditors were alert to issues regarding an entity’s ability to continue as
a going concern and that the auditors reached supportable conclusions; however,
the following were identified as areas of potential improvement:
Internal auditors. SAS No. 65, The Auditor’s Consideration
of the Internal Audit Function in an Audit of Financial Statements, requires
the independent auditor to obtain an understanding of the client’s internal
audit function and consider the extent to which the work of the internal auditors
affects the nature, timing, and extent of audit tests. While the panel’s QPR
reviewers found that independent auditors were largely adhering to SAS No.
65 requirements, some expressed concern about the sufficiency of the engagement
teams’ reviews of the internal auditor’s direct-assistance work. Consequently,
the panel offered several recommendations, including that—
Communicating with audit committees. The QPR reviewers found
that audit committees were in place for all but five of the 126 public entities
whose audits were reviewed. They noted 16 additional cases in which the audit
committee held no meetings during the year or the number of meetings was inadequate.
Additionally, certain important topics were not communicated to the audit
committees. Accordingly, the panel recommended that—
Establishing auditing standards. The panel’s recommendations pertaining to the establishment of auditing standards are aimed largely at making auditing standards more specific and definitive and improving their clarity. In particular, the panel recommended that the ASB evaluate the guidance offered in SAS No. 47, Audit Risk and Materiality in Conducting an Audit, and SAS No. 41, Working Papers. The panel also cited the need for clearer guidance from those that perform, document, and review audit work.
Earnings management and fraud. If fully implemented, the panel’s recommendations concerning the auditor’s responsibility for detecting fraud would significantly change the requirements of SAS No. 82, Consideration of Fraud in a Financial Statement Audit:
The risk assessment and response process called for by SAS No. 82 falls short in effectively deterring fraud or significantly increasing the likelihood that the auditor will detect material fraud, largely because it fails to direct auditing procedures specifically toward fraud detection.
The following were among the panel’s recommendations:
Audit Firm Leadership and Practices
The panel’s focus groups expressed their concern that much like the audit clients, the engagement partners often “treat the audit negatively--as a commodity.” The firms’ emphasis on offering their clients revenue-enhancing and other ideas has increasingly made the audit appear to have less intrinsic value in and of itself. The panel recommended that audit firms emphasize to all audit personnel the “importance of performing high-quality professional work” and that the AICPA emphasize the value of audited financial statements to users of financial information.
Professional development. Professional development within the audit profession is of paramount importance. In recognition of the increasingly complex business world, the panel recommended that audit firms “make increased knowledge and skills a high priority for all experience levels,” with particular emphasis on audit performance and fraud detection.
Personnel management. The panel noted the concern that the performance of high-quality audits may not receive proper recognition in promotion and retention decisions. Accordingly, it recommended that audit firms review performance measures for audit personnel of all experience levels in order to ensure that “performing high-quality audits is appropriately recognized as the highest priority in performance evaluations and compensation, promotion, and retention decisions.”
Time pressures. Noting the long-held concern that time pressures
lead to substandard audits, the panel made the following recommendations:
Smaller firm considerations. The panel noted that smaller firms frequently lack the resources of larger firms and recommended that the AICPA-- increase its audit-related assistance to small firms and assist these firms in assessing engagement risk through software and other appropriate tools.
Nonaudit Services Provided to Audit Clients
The panel’s report contained significant debate concerning the appropriateness of providing nonaudit services to audit clients. Panel members agreed that independence is essential for “promoting public confidence in the audit process” and that as long as firms offer nonaudit services to audit clients, concerns about independence will remain a contentious issue. The panel also noted that there has been “explosive growth” in such services and that “in their zeal to emphasize the array of services that CPAs offer, accounting firms and the AICPA scarcely acknowledge auditing services in the public images that they portray.”
Nevertheless, the panel’s report reflected its members’ highly polarized
opinions concerning the provision of nonaudit services to audit clients. Due
to this divided sentiment, the panel decided to withhold a recommendation
for a proposed “exclusionary rule” that would have restricted the provision
of nonaudit services to audit clients. However, the panel agreed that--
In deliberating the subject of “former firm personnel in client management,” the issue of independence again became the focal point. Interestingly, neither the focus group participants nor the survey respondents viewed this subject as a major concern, and the panel offered no recommendations regarding it.
Governance of the Auditing Profession
Citing the limitations posed by the auditing profession’s current system
of voluntary self-regulation, the panel made the following recommendations:
Under this proposed system of governance (illustrated in Exhibit 2), the SEC would retain its ultimate authority over auditor independence with regard to SEC registrants.
Enhancing peer reviews. The peer review process is an integral
part of ensuring ongoing quality of the audit process. However, the panel
believes that improvements can be made to the current process and recommended
Enhancing the disciplinary process. The panel noted that the
auditing profession’s disciplinary process is significantly limited because
of the lack of financial resources devoted to these matters by state boards
of accountancy and the lack of effective enforcement actions available to
the AICPA. Additionally, it was noted that the AICPA ethics division has limited
investigative powers, and because of the confidential nature of its disciplinary
proceedings, the public cannot determine the reasons for imposed sanctions.
The panel indicated that formal legislation significantly enhancing its enforcement
powers would be the most appropriate response to these perceived deficiencies
but is unlikely in the foreseeable future. Accordingly, the panel made the
1) termination or retirement,
2) removal from all public company audit engagements, or
3) an additional second partner review of all public company audit engagements completed by the partner in the 12 months prior to the deferral.
Strengthening the Auditing Profession Internationally
Since the late 1970s, the International Federation of Accountants (IFAC)
has sought uniformity in global auditing standards. As part of this effort,
IFAC formed the International Auditing Practices Committee (IAPC), whose mission
is to establish international auditing standards. The panel cited the importance
of “financial information that is reliable and comparable, regardless of country
of origin” to an effective and efficient global capital market. Toward this
goal, the panel recommended the following steps:
1) encourage monitoring and
reporting on the activities of national self-regulatory organizations,
2) impose minimum guidelines for self-regulation,
3) evaluate the adequacy of IFAC’s ethics standards,
4) assess IFAC’s process for evaluating the education and training of auditors of individual countries, and
5) establish a framework for monitoring the accounting profession to guide the national self-regulatory organizations. • Audit firms should implement uniform audit methodologies throughout the world.
The Next Step
Concerns regarding the efficacy of the current audit risk model were the basis for the POB’s creation of the Panel on Audit Effectiveness. The panel concluded that the current audit risk model is generally appropriate but improvements could and should be made in response to current concerns, and the exposure draft offers many recommendations addressing a variety of audit effectiveness issues. Noting the “unusually tense” relationship between the auditing profession and the SEC and the belief that recent changes in the auditing profession have not been in the public’s best interest, the report emphasized the need for a “strengthened POB as an effective oversight body to whom the SEC, the accounting profession, and the public can look for leadership.”
The deadline for comment on the exposure draft was July 21 (The panel’s website is located at www.pobauditpanel.org). Based upon the response, the panel will release its final recommendations, and implementation will fall to the SEC, POB, standards setters, self-regulatory organizations, AICPA, and audit firms themselves. Given the relative speed with which the SEC and self-regulatory organizations were able to implement the recommendations of the Blue Ribbon Panel, the profession should prepare itself for quick action on the part of the SEC and POB that could lead to increased scrutiny of audit effectiveness and expanded disciplinary measures for noncompliance.
In the “Numbers Game” speech, Levitt said: “I need not remind auditors they are the public’s watchdog in the financial reporting process.… The integrity of that information must take priority over a desire for cost efficiencies or competitive advantage in the audit process.… We cannot permit thorough audits to be sacrificed for reengineered approaches that are efficient, but less effective.” The panel’s recommendations are the next step toward strengthening public interest in the audit process and restoring public confidence in financial reporting.
The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.
©2009 The New York State Society of CPAs. Legal Notices
Visit the new cpajournal.com.