Current Issues, Trends, and Open Questions In Audits of Internal Control over Financial Reporting

Note: The graph titled, “Figure 2: Financial Restatement Activity of Issuers with ICFR Opinions,” and the graph titled, “Figure 3: ICFR Opinions of Issuers that Announced a Financial Restatement,” (and the corresponding data in the body of this speech) originally included in this speech have been updated to reflect a refined methodology used for the 2016 analysis and included in Board Member Franzel's presentation on August 6, 2016. In the process of making these updates, the data in the graph titled, “Figure 1: ICFR Audit Opinions 2010 to 2014,” and the table titled, “Table 2: Percentage of Adverse ICFR Opinions 2010-2014,” (and the corresponding data in the body) has also been updated to include filings with the SEC for years 2013 and 2014 received after December 31, 2014.

I am honored to participate in today's panel on "COSO 2013 Framework Implementation: One Year Later."

The PCAOB plays an important role in promoting confidence and integrity in the capital markets by overseeing the auditors of public companies and brokers and dealers registered with the Securities and Exchange Commission.

We share a common interest with investors, audit committees, and business leaders in strong internal controls and their role in achieving reliable financial reporting.

Effective internal control over financial reporting (ICFR) requires something of all participants in the financial reporting and auditing chain. It's the job of management to establish a strong internal control system and assess its effectiveness. Auditors are tasked with assessing management's work.

And it is the PCAOB's role to assess the compliance of auditors with applicable standards and requirements in this important area. PCAOB inspections include an emphasis on the firms' work in auditing the effectiveness of ICFR.

Academics, too, play an important role in effective internal control and efficient capital markets by identifying and analyzing issues, relationships, and trends. We often rely on your work to enhance our theoretical and practical understanding and application of these issues, relationships and trends.

It is in that context that I would like to discuss today what we are seeing in PCAOB inspections of ICFR audits and what the data show about ICFR audit opinions. Also, I want to explore the possible effect of ICFR audits and inspections on audit fees and highlight potential areas for research and inquiry in these areas.

But before I go further, I must tell you that the views I express today are my own and do not necessarily reflect the views of the Board, other Board members, or the staff of the PCAOB.

* * *

Let's start with a look at the regulatory landscape for ICFR. I have called this the "perfect storm" of ICFR — the confluence of the implementation of the 2013 COSO Internal Control Framework,^[1] with the steps being taken by many external audit firms to respond to deficiencies noted in PCAOB inspections related to their audits of internal control.^[2]

I can still say that we are weathering the storm well, as auditors have focused on improving the quality of their audits of ICFR while companies have focused on adopting the 2013 COSO framework.^[3] However, we continue to see significant challenges with ICFR across the system.

I hope that our discussion today will spur your thinking on important issues relating to ICFR, including the following points that I will discuss in more detail:

• ICFR audit deficiencies continue to be the most frequent inspection findings, which is a concern. Yet, we may be seeing the beginning of a positive trend line, and I am hopeful that the number and nature (severity) of ICFR findings will continue to decline.
• The data on adverse opinions on ICFR are "noisy" in several respects and present opportunities for additional inquiry and study. For instance, the data show an apparent contradiction that would benefit from additional inquiry: an overall increase in the percentage of adverse opinions on ICFR while, at the same time, an overall increase in the percentage of "clean ICFR" opinions for issuers that announce a restatement.
• The data does not indicate any systemic impact on audit fees that could be attributable to recent changes in ICFR auditing or inspections. However, there are variations in audit teams' and firms' effectiveness in implementing changes to their ICFR audit procedures, which may be impacting the amount of audit work for some issuers. Keep in mind that sometimes audit fees are impacted by the simple fact that issuers have inadequate controls.

PCAOB Inspection Findings Related to ICFR Audits

First, PCAOB inspections of ICFR audits: It is generally accepted that effective audits of ICFR can have a positive impact on public companies and, ultimately, investors and the public at large.^[4] They promote effective management practices and can provide transparency into material weaknesses to help audit committees and investors with their decision-making.[5] Among other things, ICFR audits that comply with PCAOB standards should increase the likelihood that material weaknesses in internal control will be found before they lead to material misstatements in the financial statements.^[6]

Beginning primarily in the 2010 inspections cycle, PCAOB inspections included a heightened focus on whether firms had obtained sufficient audit evidence to support audit opinions on the effectiveness of ICFR. ^[7]

The number and significance of deficiencies in firms' audits of ICFR in the 2010 and 2011 inspections were high. In December 2012, the Board issued a report, Observations from 2010 Inspections of Domestic Annually Inspected Firms Regarding Deficiencies in Audits of Internal Control over Financial Reporting.^[8] The report provides information about the nature and frequency of deficiencies in firms' audits of internal control detected during the PCAOB's 2010 inspections of eight domestic registered firms that have been inspected every year since the PCAOB's inspection program began.

The Board's subsequent inspections continued to identify high levels of deficiencies in the audits of internal control, which led to the issuance of Staff Audit Practice Alert No. 11, Considerations for Audits of Internal Control over Financial Reporting, on October 24, 2013.^[9] The practice alert discusses the application of certain requirements of AS 5 and other PCAOB standards to specific aspects of the audit of internal control that had been frequently cited as deficient in PCAOB inspection reports. The practice alert also discusses potential root causes of the deficiencies, and provides guidance for auditors in various aspects of auditing ICFR.

Table 1 below shows the increasing numbers of audit deficiencies related to ICFR reported in PCAOB inspection reports for the U.S. domestic Big 4 firms.

Table 1: Inspection Findings for U.S. Domestic Big 4 Firms, 2010-2013

U.S. Domestic — Big 4 Firms[10]
Inspection Year	Total Audits Inspected, U.S. Big Four Firms	Inspected Audits with Deficiencies in the Public Inspection Report	Total Integrated Audits Inspected, U.S. Big Four Firms	Integrated Audits ICFR Deficiencies in the Public Inspection Report	% of Integrated Audits with ICFR Audit Deficiencies in the Public Report
2013	219	85	211	76	36%
2012	208	76	197	64	32%
2011	225	80	213	48	23%
2010	250	79	236	38	16%

Although firms have been making some progress in their remediation efforts in this area, some firms still have significant work to do to meet the requirements of PCAOB auditing standards in this area.

During the 2014 inspection cycle, the most frequent areas of ICFR audit deficiencies were in the following areas:^[11]

• Selecting the appropriate controls to test, based on those that are important to the auditor's conclusion about whether the company's controls sufficiently address the assessed risk of misstatement (AS No. 5.39).
• Testing design effectiveness to determine whether the company's controls satisfy the control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements (AS No 5.42).
• Testing the operating effectiveness of the controls (AS No. 5.44).

Audit engagement teams often did not obtain an understanding of a company's flow of transactions in order to identify and select the appropriate controls to test. In certain other cases, inspections staff observed that auditors selected controls to test that were not responsive to the fraud risks that they had identified.

In addition, audit engagement teams continue to struggle with the testing of management review controls in that they often did not evaluate whether the management review controls operated at the necessary level of precision that would address the assessed risk of material misstatement.

Inspections staff have also seen engagement teams rely on management review controls to compensate for other identified deficiencies without fully understanding or appropriately testing whether that management review control operated effectively at the necessary level of precision.

Although the results of PCAOB's 2014 inspections of audit firms indicate that some improvements have been made in the area of auditing ICFR, deficiencies by audit firms in the audits of ICFR continued to be the most frequent findings in the 2014 inspections.

I should also note that beginning with the 2013 inspection reports (generally issued in 2014), PCAOB inspections staff began to include references in the Part I inspection findings to the specific, applicable auditing standard, as well as summary tables of the findings by specific auditing standards. This information should be useful to academics and researchers who are interested in tracking trends and developments in PCAOB inspection findings.

The 2015 inspection cycle is currently in process, and it is too early to identify trends. While our staff has seen more examples where auditors have gotten the auditing of ICFR right, they also continue to identify frequent findings in this area.

I am hopeful that the number and nature (severity) of findings will continue to decline, and that this may be the beginning of a positive trend in PCAOB inspection results related to audits of ICFR.

ICFR Audit Opinions

As you know, effective audits of ICFR are an important accountability mechanism to help promote effective internal control while also providing transparency into any material weaknesses that exist. The auditor's objective in an audit of ICFR is to express an opinion on the effectiveness of the company's internal control over financial reporting.^[12]

So let's look at the population of issuer audits, and issuer ICFR audits, in particular. Of the approximately 9,067 active issuers as of December 31, 2014,^[13] approximately 3,874 had an audit report that included an auditor's opinion on ICFR for a fiscal period ending during 2014.^[14]

Of these, 231 audit reports contained an auditor's adverse opinion on the company's ICFR in which the auditor reported at least one material weakness in ICFR, meaning that the company's ICFR was ineffective.^[15]

In other words, about 6 percent of issuers filing an auditor's ICFR audit opinion in 2014 received an adverse audit opinion on ICFR. This reflects an upward trend in the percentage of audits with an adverse opinion on ICFR over the past five years, as shown in figure 1 below:

Figure 1: ICFR Audit Opinions 2010 to 2014^[16]

 

In my view, the increase in opinions between 2010 and 2014 is notable, going from 138 to 231, as seen in table 2, and representing a significant increase. It is also notable that the PCAOB began putting significant focus and emphasis on audits of ICFR in its 2010 inspections—a focus that has continued since then.

Table 2: Percentage of Adverse ICFR Opinions 2010 - 2014

Despite this trend of increasing numbers of adverse ICFR opinions, there is other data that also suggest there may be room for improvement in identifying and disclosing material weaknesses.

For example, a restatement of prior period financial statements to correct a material misstatement is an indicator of a material weakness in ICFR,^[17] and the rate of restatements continues to exceed the rate of opinions with material weaknesses.

In 2014, approximately 438 (or 11.3 percent) of the 3,874 companies with audit opinions on ICFR restated their financial statements from prior years.^[18] The rate of financial restatements among companies with ICFR opinions has increased in recent years, from 7.0 percent in 2010 to over 11 percent, as shown in figure 2 below:

Figure 2: Financial Restatement Activity of Issuers with ICFR Opinions

On an overall basis, the rate of restatements (figure 2) exceeds the rates of adverse ICFR opinions (figure 1) for those companies that receive ICFR opinions.

When looking more specifically at the companies with financial restatements, the data show additional complexity. The vast majority of companies restating prior year financial statements received a "clean" audit opinion on ICFR in the year in which the restatement was announced. Figure 3 below shows that in 2014, more than 76 percent of such restating companies received an ICFR opinion from their auditor that their ICFR was effective in the year in which the restatement was announced.^[19] 

Figure 3: ICFR Opinions of Issuers that Announced a Financial Restatement

The data show that, often, a material weakness is not identified even when a known misstatement occurs, and suggests that there may be undisclosed material weaknesses in ICFR.^[20]

Another interesting data point is the number of clean ICFR audit opinions that are subsequently withdrawn and replaced with adverse opinions on ICFR (restating from clean opinions to adverse opinions).

A restatement of a clean ICFR audit opinion happens when, subsequent to the issuance of the ICFR audit opinion, the following two conditions occur: (1) the auditor becomes aware that one or more material weakness existed at the report date that would have affected the auditor's opinion on ICFR had the auditor been aware of it; and (2) the previously issued ICFR audit opinion is being relied upon. Because the ICFR opinions are issued annually, this "reliance period" is generally from the date the opinion is issued until the date of the issuance of the subsequent year's ICFR audit opinion.

Figure 4 shows that although the numbers of restated ICFR opinions are small (likely due in part to the fact that ICFR opinion restatements only occur if the erroneous opinion is still being relied upon because a subsequent year's ICFR opinion has not yet been issued), they have been increasing in number over the past few years.

For 2013 filings, issuers filed 33 restated ICFR audit opinions, which represents a significant increase over the 22 restated ICFR audit opinions associated with 2011 filings.

The 33 restated ICFR audit opinions are included in the total number of adverse ICFR opinions in Table 2, and are significant in relation to the totals. For instance, the 33 restated ICFR opinions in 2013 represent approximately 18 percent of the 186 adverse opinions initially filed for 2013. (See figure 1.) Notably, a number of these restated opinions arose during or after a PCAOB inspection.^[21]

Figure 4: Number of ICFR Audit Opinions Restated from "Clean" (effective ICFR) to "Adverse" (ineffective ICFR)

Recently, SEC staff has publicly questioned "whether all material weaknesses are being properly identified and disclosed."^[22] In particular, SEC staff suggested "that at least some of the PCAOB's inspection findings related to the audits of internal control over financial reporting are likely indicators of similar problems with management's evaluations of ICFR, and thus potentially also indicative of risk for unidentified material weaknesses."^[23]

Along those lines, SEC staff has expressed surprise that management rarely appears to identify a material weakness in the absence of a material misstatement.^[24]

The SEC staff have also stated that "efforts throughout the SEC pertaining to the ICFR requirements are ongoing, coordinated, and increasingly integrated into our routine consultation, disclosure review and enforcement efforts."^[25]

For example, informed by recent work of the SEC's Division of Corporation Finance in reviewing issuer disclosures, SEC staff has paid considerable public attention to the evaluation of control deficiencies by company management.^[26]

The recent inspection results in audits of ICFR and data relating to the issuance of clean or adverse ICFR opinions may provide opportunities for future research to explain the reasons behind the trends and the apparent contradiction between an overall increasing percentage of adverse opinions on ICFR and the overall increasing percentage of "clean ICFR" opinions for issuers that announce a restatement.

The following inquiries and questions may be of interest to academic researchers.

1. What is driving the increases in adverse audit opinions on ICFR shown in Table 1? Is there a subset of issuers with year-after-year adverse opinions driving these numbers? Is there a relationship between the increases in adverse ICFR opinions and PCAOB's increased focus on inspecting ICFR audits, which began in 2010? How does the implementation of COSO 2013 factor into the increase in adverse ICFR audit opinions? To what extent might these trends continue?

2. Why do the vast majority of issuers with financial restatements receive a clean audit opinion on ICFR? Is this simply a timing issue or are there other underlying causes? Have there been undisclosed material weaknesses in this group of issuers?

3. I've heard anecdotally that it is difficult for auditors to convince an audit client that a material weakness exists in the absence of a material misstatement. To what extent does this pressure exist and potentially cause underreporting of material weaknesses?

4. What are the circumstances that lead to audit firms discovering the need to restate ICFR audit opinions from clean to adverse, and how can this information be useful in improving ICFR audits?

5. Does the current level of management and auditor disclosure of material weaknesses reasonably reflect the state of ICFR among issuers? In particular, are all material weaknesses being properly identified and disclosed? Are there areas of improvement needed across the system?

Trends in Audit Fees

In light of the significant number of inspection findings and the increasing range of responses of audit firms to remediate deficiencies and related quality control issues, it is not surprising to hear concerns about the potential impact on audit fees.

Some issuers may be seeing additional ICFR audit work being conducted by audit firms as a result of deficiencies identified through a PCAOB inspection of their own audits and/or as a result of systemic changes being made in response to deficiencies found in multiple ICFR audits conducted by the firm.

Other issuers simply may not be well-prepared for their audits in that their controls are not as strong as they should be and/or those controls are not supported by strong documentation and evidence. These situations can also lead to more audit costs, as well as more costs to the issuers if controls need to be improved.

At the same time, I've heard anecdotal accounts about auditors adding work that is potentially not value-added, while driving up audit fees, in response to PCAOB inspection findings. We've also heard that constructive and productive communication is sometimes lacking between auditors and audit clients, with the engagement teams simply telling an audit client that certain work must be done in a particular way "because of PCAOB inspections."

I believe that there probably are some cases out there where auditors are doing too much work or not the right kind of work in an attempt to respond to or avoid a PCAOB inspection finding, and that communication between the auditors and clients on these matters has not been productive.

To the extent that this is happening, "we" collectively, including the firms, audit teams, issuers, and the PCAOB, need to get a handle on this, so that valuable audit resources are not being diverted from areas that are high risk.

On the other end of the spectrum, there are a number of cases in which the auditors did not do sufficient work and got the opinion on ICFR wrong. As I mentioned, there have been instances where, as a result of performing more work in response to PCAOB inspection findings on ICFR, the auditors needed to issue an adverse opinion on ICFR to replace the original clean opinion.

Then we have what I hope is a large category "in the middle." These are audits in which the engagement teams perform effective and appropriately efficient audits of the issuer's ICFR, with sufficient audit work and evidence to support the opinion on ICFR.

This is not to say that these audits will be tension-free. In my view, there should always be some level of tension in this process if it is effective. Such tension is a natural outgrowth of an auditor's effective application of professional skepticism and due care in questioning management's assertions and results.

In order to determine whether any systemic trends were emerging regarding audit fees, and in particular, fees paid by issuers that received opinions on ICFR, the PCAOB's Office of Research and Analysis (ORA) performed in-depth analysis of audit fees from 2010 through 2014. The analysis focused on issuers with reported market capitalization greater than $0 and, separately, the subset of issuers from that group receiving ICFR audit opinions.

Of the approximately 9,067 active issuers on December 31, 2014,^[27] about 5,853 reported audit fees for both 2013 and 2014, and also reported market capitalization greater than $0.[28] These issuers reported paying approximately $12.1 billion in audit fees for fiscal year 2014.^[29]

In 2014, these companies reported a median change of 2.92 percent increase in audit fees over the prior year.^[30] Of these companies, 36 percent reported a decrease in audit fees; 5 percent reported no change; and 59 percent reported an increase. These rates, both the median change and percentage breakdown of issuers, have been largely consistent over the past four years.

Among issuers with ICFR opinions, the results are similar, with the median percentage change in audit fees being slightly higher and the proportion of issuers reporting increases also slightly higher.

Among the 3,863 issuers that filed financial reports that contained an auditors' opinion on ICFR, 3,652 issuers also reported audit fees for both 2013 and 2014.^[31] These companies reported a median change of 4.08 percent increase in audit fees over the prior year. Of these companies, 34 percent reported a decrease in audit fees; 2 percent reported no change; and 64 percent reported an increase. Similar to the larger group of issuers referred to above, these rates have been generally consistent over the past four years.

We know that many factors influence the amount of audit fees an issuer will report for an external audit in any year, such as significant changes in the size of a company, a sizable acquisition or divestment, existing financial reporting problems, or an auditor change.

The analysis indicates that approximately half of the issuers experienced one of these major events that could result in significant changes in audit fees.^[32] The distribution of changes in audit fees shows that a clear majority of issuers (61 percent) with a major event reported changes in audit fees greater than +/-10 percent; while a majority of issuers (58 percent) with no major event reported changes in audit fees within the range of -10 percent to +9 percent.

This observation was similar among the two groups of issuers when considering the presence or absence of a major event.

The take-away from this analysis is that the audit fee data from the past four years for all issuers, including those with ICFR opinions, show relatively stable increases in the median percentage change in fees since 2011.^[33] And when issuers do report large changes in their audit fees, it is most likely related to factors other than ICFR audit work.

Therefore, it does not appear that there are systemic impacts on audit fees that can be attributed to recent changes in ICFR auditing that firms may have implemented in the wake of PCAOB inspection results for ICFR audits.

Of course, there may be variations in the impact on fees charged to individual issuers with ICFR audits, depending on the facts and circumstances. Examples include the quality of their auditor's ICFR-related work in prior years and the timing or nature of the improvements being implemented by the issuer's firm.

We will continue to monitor both the timing and nature of remediation activities of the firms in this important audit area, as well as the potential impact on audit effort and fees.

***

In conclusion, I am pleased that there appears to be some preliminary evidence that PCAOB inspection findings related to ICFR have begun to decrease.

This, together with what I hear from leaders in the profession, makes me optimistic that the audit work in the area of ICFR may be improving, though questions remain about whether auditors appropriately recognize and act on all material weaknesses as required by applicable standards.

And these improvements, of course, may come at a cost. While we have not yet seen any systemic, unexpected increases in audit fees among issuers with ICFR audits, this is something we will continue to monitor.

Ultimately, it is my hope that, as auditors become more effective at auditing the effectiveness of ICFR, they will also continue to do so efficiently and cost-effectively and possibly gain efficiencies through an appropriate risk-based focus.

I look forward to continuing this discussion with you. I am always interested in ideas for academic research that can provide insights into these and other issues of interest to the PCAOB, to help improve audit quality and achieve the assurance that investors and our markets need on the quality of financial reporting and the effectiveness of internal control over financial reporting.