PCAOB releases CAMs guidance for auditors of small firms

The Public Company Accounting Oversight Board is rolling out a new series of staff publications targeted at auditors of small public companies, starting with one on critical audit matters, as board members face the likelihood of a deregulatory emphasis under the incoming Trump administration and probable changes in board composition.

The PCAOB released the first of the new series of staff publications, "Audit Focus: Critical Audit Matters," which aims to provide easy-to-digest information to auditors, especially those who audit smaller public companies. With an eye toward protecting investors and improving audit quality, each edition of Audit Focus reiterates applicable auditing standards and staff guidance and offers reminders and good practices tailored to PCAOB-registered auditors of smaller public companies. 

The PCAOB staff is continuing to identify a great many deficiencies related to critical audit matters. CAMs are a relatively new requirement from the PCAOB. A CAM is defined as any matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee and that relates to accounts or disclosures that are material to the financial statements, and involved especially challenging, subjective or complex auditor judgment.  

This edition of Audit Focus highlights key reminders on determination, communication and documentation of CAMs, along with the PCAOB staff's perspectives on some of the common deficiencies, such as not accurately describing how a CAM was addressed in the audit, plus good practices that the staff has observed related to CAMs, such as use of practice aids.

PCAOB board members George Botic and Christina Ho discussed the recent inspection findings during a panel discussion Wednesday at Financial Executives International's Current Financial Reporting Insights virtual conference.

"When you think about where our inspectors see repeated observations — deficiencies, if you will particularly in Part I.A, which are for the firms not obtaining sufficient appropriate audit evidence — things like revenue recognition, inventory, allowance for credit losses in the financial sector, areas around business combinations, allowance for allocation of purchase price, as well as long-lived assets, goodwill, intangibles and valuation, those are some of the more frequent areas," said Botic. "ICFR certainly is one as well in the internal control space. But those areas, those themes, really haven't changed. Sometimes we'll see more of one versus another."

During its inspections last year, the PCAOB saw some improvements at the largest firms, even though audit deficiency rates still appear to be high, with 46% of the engagements reviewed in 2023 having at least one deficiency significant enough to be included in Part I.A of the inspection report, excluding broker-dealer audit inspections, according to a staff spotlight publication that was released in August.

"There appears to be some improvement in terms of the deficiency rate trend for the largest firms," said Ho. "It's probably too soon to tell whether that is going to be the ongoing trend. Also for triennial firms, the spotlight also highlighted the fact that the deficiency rates are not improving."

She pointed out that financial restatements are another way to look at the situation. "Obviously, the deficiency rate is not the only measurement of audit quality," said Ho. "We also look at restatements, which I think for many of the preparers and audit committees that I talk to, and even investors, they focus on that metric a lot. The multiple metrics paint a picture."

Botic sees advantages in having several such metrics. "The audit process is one of the most complex processes probably in business," said Botic. "When you think about all the judgments that you all go through for your financial statements and preparing them, then the auditor makes his or her own risk assessment judgments, it's an incredibly complex process. So I agree, not one metric necessarily is the only metric for sure. We're inspecting the audit, so our inspectors are looking at what the auditor did or didn't do, as the case may be, and as part of that, we may identify the accounting was wrong. That is one possibility, as Christina mentioned, the categorization of the reports. But in my view and from my prior life as well, and spending a lot of time in inspections, I actually think that the spread from the inspection deficiency rates for the filers that we looked at compared to the restatement number, I think that's actually … reflective of the success of our inspection program."

Ho recently found herself singled out in a letter from Senate Democrats Elizabeth Warren of Massachusetts and Sheldon Whitehouse of Rhode Island for painting an overly rosy picture of the problems plaguing auditing firms, and she complained in a LinkedIn post that they were "persecuting" her and trying to "stifle" her from  "expressing views inconsistent with their false narrative."

Accounting Today asked Ho during a press conference after the FEI CFRI session about the political pressure she faced, especially with President-elect Trump's administration coming in and perhaps replacing PCAOB board members as happened during his first administration as well as the Biden administration.

"Like I said in my LinkedIn post, I'm not a political person," Ho responded. "When I was at Treasury, I worked under two different administrations as a career person, and I always feel like accounting shouldn't be political. But obviously elections have consequences, and I'm not living in a cocoon that I'm not aware of what's going on. I really do think that it's in the best interest of the capital markets for political influence to be minimized to technical areas that require expertise, and that's how I operate, whether I was in Treasury or even at the board here. I often feel like the areas we work in, auditing and accounting, are specialized and require expertise, and I hope that the experts can always be allowed to voice their views and also do their job well."

The PCAOB has been facing pushback on some of its proposed standards, such as the so-called NOCLAR standard on the auditor's responsibility to detect noncompliance with laws and regulations, as well as proposed standards on firm and engagement metrics. The Securities and Exchange Commission has already approved and adopted one of the PCAOB's more far-reaching standards, on a firm's quality control system, Ho pointed out. However, she recognizes the criticisms that the PCAOB has been hearing about some of the other proposed standards, even though NOCLAR and the other standards are still scheduled to be finalized on the agenda this year.

"One of the really important things that regulators should do is to listen," said Ho. "We should take comments very seriously and we should not rush into adopting standards or rules when we don't have enough evidence to support the benefits and also the effectiveness of those proposals." 

She acknowledged that the increased risks and responsibilities of auditors, as well as the potential penalties, may be one factor that's making it harder to attract young people to the accounting and auditing profession.

"I have certainly heard many anecdotal comments about the regulatory environment making the profession less attractive," said Ho. "I've heard from people who talk about how they don't want to do public company audits because of the inspections, and also our posture on enforcement. If you are not allowed to get indemnified as an individual, if something happened and you are sanctioned, certainly people consider that as an increased risk for what they do. I think these things have an impact on the attractiveness of the profession and certainly impact talent. That is some of the anecdotal information I've heard. I've also heard from smaller firms that they are trying to stay under the 100 number because that will move them into annually inspected, so that they can stay under 100 so they don't have to be inspected every year. Those kinds of comments certainly concern me because I don't think this audit marketplace can afford less competition and less talent. These are things that I think about and I'm concerned about."

The PCAOB typically inspects each firm either annually or triennially (once every three years). If a firm provides audit opinions for more than 100 issuers, the PCAOB inspects them annually. If a firm provides audit opinions for 100 or fewer issuers, the PCAOB, in general, inspects them at least every three years. 

Ho was also asked about the PCAOB's relationship with the Institute of Internal Auditors after the two organizations clashed over the PCAOB's exposure draft for its audit confirmation standard. The PCAOB draft initially seemed to blame internal auditors before it was revised following a protest by the IIA. Ho met with the IIA and has established a better understanding.

"I have a good relationship with the IIA organization, and I actually have been an internal auditor before," said Ho. "I understand what they do and their values and why it's important. I certainly think that they play a key role in fostering the trust of the capital markets, because they are in the company."

External auditors tend to focus more on the financial statements and the internal control over financial reporting, she noted. "Their scope is limited to that, whereas the internal auditors are covering the entire company and the operations, and they have access to much more information and people than external auditors, so they play a key role in facilitating the trust," said Ho.

The IIA, like the PCAOB, has also been focusing lately on modernizing its standards. "They have done that, and then they have been really focusing on AI as well," said Ho. "I think that it's important to make sure that all the key players in the financial report ecosystem are working together so that we can collectively ensure the quality of the financial reporting and the audit."

Accounting Today also asked about the role of artificial intelligence and data analytics programs in auditing and if they could be degrading audit quality without the human element being present.

Ho pointed out that the PCAOB has published a staff spotlight report on generative AI. "What the staff is seeing from the firms and the issuers in terms of their use of AI, based on that, it's pretty clear, and based on my understanding too, that the use of AI in the audit and financial reporting is still very much focused on repetitive tasks and very low-level areas that do not involve human judgment," she said. "And everything they were doing using AI still requires human supervision. At this point, I don't see right now that AI is off doing its own thing. I know that the firms are making significant investments, and AI is evolving, and more and more companies are using them. There will be more maturity. And I think that there is an opportunity, which is why it's very important for regulators to stay on top of that, to make sure that we're proactive in thinking and to ensure that we put guardrails if needed to make sure that there is a responsible use of AI, but at the same time, not keep people from using technology to make audits more effective and efficient."