By Tom Hanlon
February 14, 2013 Lyceum
When Greg Scates joined the Public Company Accounting Oversight Board in 2003, there were fewer than 40 employees, and everyone worked out of one office in Washington, DC.
The PCAOB, created out of the Sarbanes-Oxley Act of 2002, has experienced significant growth since then. Headquarters remain in Washington, but there are numerous offices around the country, and the Board employs approximately 800 people to oversee the audits of public companies, with the intent of protecting investors and the public interest.
Scates, Deputy Chief Auditor at the PCAOB, told students at a recent Department of Accountancy Lyceum that the Board inspects approximately 850 firms that audit issuers and that the Board’s inspection process “Takes the lion’s share of our budget.”
Scates took students through the inspection process, from determining what audit engagements to inspect to issuing comment forms to evaluating responses from the firms and drafting and finalizing inspection reports. The PCAOB is required to conduct annual inspections for firms that regularly provide audit reports for more than 100 issuers, and to inspect at least every three years the firms that regularly provide audit reports for 100 or fewer issuers.
A risk-based approach
“The inspection field work is a big part of the program,” he told the students. “We do an enormous amount of planning with the large firms, as you can imagine.” He added that the PCAOB uses a risk-based approach – one that calculates risk in the industries and countries that the firms are involved in, rather than getting a representative sample of audit engagements to inspect.
“We’re looking for potential problems that may reflect issues with a firm’s quality controls,” he continued. “We’re going to take the list of a firm’s audit clients and decide where the risks are and then we tell the firm that we’ve identified these engagements at these particular offices and these are the ones we want to inspect.
Scates noted that while the firms are aware ahead of time what engagements they are asked to provide information on, the inspectors may ask, on site, for additional engagements to inspect.
While the PCAOB is primarily focused on higher-risk situations, they also may select some lower-risk engagements while performing their inspections. Asked if the Board would ever consider doing random inspections, Scates didn't rule that out as a possibility, and said “Our inspection process and program is evolving. We’re changing our approach as we learn. But we’re still going to be risk-biased.”
Watching for patterns
He noted that during the inspection process, the inspectors use a “pulled thread approach”: “If we find a problem in an engagement, a pattern where an engagement partner seems to be having a number of deficiencies in audits, and they appear to be serious to the inspectors, they will select or pull more engagements with that partner to see if there is a pattern. If there’s a pattern, we’ll look further.” When that “pulled thread” leads to a discovery that a pattern appears to exist, he said, then “we immediately have discussions with the firm.”
When inspectors detect a possible issue, they communicate with the firm immediately. What can be most concerning about a detected issue, Scates said, is that it took the PCAOB to uncover the issue. “If there’s an office not complying with firm methodology or firm controls,” he said, “why did the firm not find it earlier? They shouldn’t be waiting on us to detect it. The PCAOB is not part of any firm’s quality control system. We’re outside overseers.”
He told the students how inspectors communicate during the inspection process. “They interview the engagement team and talk about the particular audit engagement, the risks, how did you respond to the risks, what problems you encountered, did you solve those problems, did you meet with management or the audit committee to resolve the problems, and things like that,” he said.
Then, he continued, the inspectors examine the work papers and issue a comment form spelling out what they found and citing any deficiencies. Common areas of concern in inspection findings include:
- Internal control over financial reporting
- Revenue recognition
- Substantive analytics
- Management estimates
- Fair value measurements and disclosures
- Consideration of fraud
Comment forms are sent to the firm, which responds in writing back to the PCAOB. Potential responses from firms include that their audit engagement team did the work but failed to document it, or that they failed to do the actual work. Speaking of the latter situation, Scates said that was the “worst-case scenario.”
“You never want to get into litigation,” he said, “but if you do, the best course of action is to have a good set of work papers. You can say, ‘Here’s what I did, here’s the rationale, here’s the professional judgment I displayed, here’s the evidence….’ That’s the best place you can be in for your firm, showing exactly what happened.”
Inspection reports contain public and private portions, and what is on the PCAOB website is just the public portion. But the full report is seen by the PCAOB, the SEC, the firm, and the appropriate state regulatory body.The remediation cycle
The final inspection report, Scates said, triggers a 12-month remediation cycle during which the firm is expected to remediate quality control deficiencies noted in the report. During this cycle, the Board looks at the firm’s progress and decides whether it remediated to the Board’s satisfaction. If it didn’t, the Board publishes the previous private portion of the report that discusses the particular quality control criticism of the firm, not remediated to the Board’s satisfaction.
Firms can appeal PCAOB decisions to the SEC. “The SEC can accept what the PCAOB says or reconsider based on what the firm is saying,” Scates said.
Scates told the students that over 2,300 firms are registered with the PCAOB, from 85 countries. In addition, the PCAOB is currently unable to conduct inspections of firms located in 16 jurisdictions, including China and some member states of the European Union, because the PCAOB is denied access to the information necessary to conduct inspections of these firms. The PCAOB is trying to negotiate agreements to inspect in these jurisdictions.
He also noted that the PCAOB typically hires people who have experience with accounting firms. In addition, the PCAOB has an intern program.