The Public Company Accounting Oversight Board is likely to issue guidance on the use of blockchain and data analytics technology as more auditing firms weigh the benefits and drawbacks of them.
Speaking at the National Association of State Boards of Accountancy annual meeting in New York on Tuesday, PCAOB member Jeanette Franzel discussed the need for auditing firms and regulators to get a better grasp on blockchain and data analytics. Blockchain was originally developed for the virtual currency bitcoin as a way to securely and verifiably record transactions, but the distributed ledger technology has proven useful for other applications. Auditing firms see the potential for automating some of their processes and preserving an audit trail. The PCAOB has started to take notice.
“We’ve dedicated a fair amount of resources to this and we’ve got some staff really doing a deep dive on this,” said Franzel. “And even at the board level, we’re getting regular updates and briefings. We’ve told the firms that if they think that our standards are impeding them or holding them back, we want to hear about that right away. We’ve had a very open dialogue with the firms about what they are doing and how they are developing.”
She drew a distinction between the financial reporting side, which has been working on ways to report bitcoin transactions under the current standards, and how blockchain technology itself has an impact on the financial reporting process.
“I think about blockchain as a new way of reporting transactions,” said Franzel. “It’s very efficient and accurate, and it carries a level of assurance that we don’t have right now with our transaction processing systems. That’s very disruptive when you think about internal controls and what kinds of audit procedures are needed. I do think that some of the blockchain applications are very seriously going to disrupt how we typically think about the role of management, internal audit and external audit.”
Data Analytics and AI
Franzel also believes that some of the things firms are doing on the audit side will challenge those boundaries, particularly in the areas of data analytics, artificial intelligence and automated testing of transactions and controls.
“That raises a whole lot of questions about standards as well as the business model for audits,” said Franzel. “Think about the pyramid structure of auditing, with a whole lot of low-level staff doing routine types of testing, which can now be done by a computer very quickly. How does that change the types of staff and the numbers of staff that you need on an audit? How does that change the skills that those staff need, including the partner signing that audit report?”
The PCAOB added such topics to its research agenda last December, but even before that the board has been getting up to speed on the evolving use of data analytics technology in audits so it will be ready to respond.
“We’ve got an interdivisional team performing research and outreach, looking at everything out there on this, to consider alternatives,” said Franzel. “What should we do? Should we set new standards, or should we issue new guidance? The problem with setting standards is it takes a very long time and—guess what—it might be outdated by the time we finally get around to it. We don’t want that to happen.”
The PCAOB discussed the topic at an annual meeting in April with the American Accounting Association and received input from accounting professors and academics. The board then discussed emerging auditing technologies at a meeting of its Standing Advisory Group in May. It has also been doing outreach with the global auditing firms as well as the Financial Reporting Council, the auditing regulator in the United Kingdom, along with the American Institute of CPAs, the Center for Audit Quality, Rutgers University and NASBA.
W. Michael Fritz, who chairs NASBA’s Regulatory Response Committee and moderated the panel discussion where Franzel spoke, said NASBA has met with a leading university to discuss developing tools for dealing with emerging technologies such as data analytics. “Even at NASBA, we’ve been thinking about how we can educate state boards,” he said. “What tools can we provide in this area?”
Roger O’Donnell, global head of audit data and analytics at KPMG, said his firm has also been working with universities to develop a Masters of Accounting degree in data and analytics. “We looked at it in terms of the students that we recruited,” he said. “We talked about it with the universities and we saw a tremendous diversity in terms of what schools are doing. Moreover we also saw that it was undermining the master’s degree. Students are just trying to find credit hours that they could use to complete in the most cost effective way because the cost of higher education has only gotten higher. From the standpoint of looking at all of those issues and thinking about where we are headed, not just as a firm, but as an industry and as a profession, and recognizing the degree of technology and how that was going to influence financial reporting preparers and auditors, we felt we need to do something to counteract the trends that we saw developing. There was just too much diversity in thinking around what are the right skills for the auditors. That was not necessarily university driven, but the students themselves.”
Technology is coming to dominate the audit process. “The distinction between tech audit and non-tech audit is blurring,” said A. Michael Smith, a partner and internal audit technology services leader at PwC.
Guidance on the Way
The PCAOB is likely to start developing some guidance for firms on the use of data analytics and AI before it turns to blockchain technology.
“Our current emphasis is on data analytics and artificial intelligence,” said Franzel. “I think blockchain will come later. If I had to predict what we’re going to do (and again, I’m speaking for myself), I think we probably will lean toward guidance and there have been several areas where necessary guidance has been identified.”
One of those areas is terminology. “When we say data analytics, what are we talking about? For different types of data analytics, that can mean different things in an audit,” said Franzel. “What are outliers, and how much work do you have to do if you find outliers when you’re doing an analysis? How much analysis do you have to do for it to count as substantive testing versus a planning procedure or a risk assessment procedure? How much credit can an auditor take if they push a button on a computer and the computer spits out the results? Are you done with your audit? Or what else do you need to do?”
She believes guidance will be helpful in such areas. The PCAOB plans to take up the matter at the next meeting of its Standing Advisory Group at the end of this month.
Meanwhile, the PCAOB inspection staff is already taking a look at what firms are planning to do on audits with the technology in terms of quality control. “This will be extremely important, that firms have the right controls and the right expertise for the people designing and operating the tools and the engagement teams,” said Franzel. “What kinds of quality controls do firms have to make sure that the engagement team is effectively using these tools as they do this type of analysis? What kind of training has the staff had and how are the firms working to get their staff trained up? Finally, are teams sticking with the core values of due care, professional skepticism, etc., when using these tools? It’s all wrapped up in this cool technology, but you have to remember the fundamentals of what we’re trying to accomplish in financial reporting and auditing.”
Franzel believes firms will need to provide the right training. “How can antiquated approaches to CPE be reformed to promote lifelong learning and professional development in this context? What kind of training are we all going to need in the next two years so that in the next three to five years we can all be effectively dealing with these technologies and supervising the staff to assist with the work? In some cases, I think firms will be using data scientists and engineers to run the tools, but then accountants and auditors are going to need to be interpreting and trying to understand what that means,” she said. “How do we talk to these folks and ensure that we are continuing to employ professional skepticism, ethics, and integrity, in a trusted professional way? If we don’t do this right, the CPA brand really could be at stake.”
