PCAOB Sets New Audit Report Format

Compliance and audit executives, set your countdown clocks: a new type of audit report will be arriving at your organization three years from now.

Today the Public Company Accounting Oversight Board finally adopted a new standard for the report, which will require more disclosure of “critical audit matters” that weigh on the mind of your auditor as he or she performs the annual financial statement audit.

That will lead to more conversation between your audit firm and your audit committee, which will probably lead to more conversation between you and your audit committee. So let’s discuss among ourselves, too.

The new standard’s chief requirement is that the audit report must include a discussion of critical audit matters, henceforth forever known as “CAMs.” What is a CAM, exactly? Any matter the audit firm communicates to the audit committee, related to accounts or disclosures that are material to the financial statements, “and involved especially challenging, subjective, or complex auditor judgment.”

For large accelerated filers, that requirement will go into effect for audits performed on fiscal years ending after June 30, 2019—that is, for most companies, the audit reports that investors will receive in early 2020. For all other filers, it goes into effect for fiscal years ending after Dec. 15, 2020. (The SEC does need to give the new standard its final blessing, but the PCAOB has worked closely with the agency on the new report model and says approval is likely.)

One important caveat: filers that qualify as Emerging Growth Companies are exempt from the CAMs requirement. This is a dubious idea, which we will explore later. Broker-dealers are also exempt.

The is the first overhaul of the audit report since World War II, and it’s long overdue. The current report talks much more about what management is responsible for reporting and what the audit firm is responsible for auditing, rather than, ya know, what the auditors actually found. That part usually gets shoehorned into the end of the report, and usually it says everything seems fine.

Then comes a financial restatement or a bankruptcy, prompting investors to scream, “Where were the auditors?” That’s a fair question to ask, especially after systemic failures like the stock market meltdown of 2002 or the financial crisis of 2008. So the PCAOB has been tinkering with a new report standard since 2010, and at long last, we have one.

Prepare for Talks

Compliance and audit executives should zero in on the definition of a critical audit matter. As you can see above, runs heavy on theory and light on specifics. A person can grasp the general concept, that a CAM will be something the auditor considers highly subjective or fraught with uncertainty—but what does that actually mean?

That will vary by company, which is the whole point of the standard: the PCAOB wants auditor reports that are specific to the audit of the individual company, not the boilerplate we see so often today. Which means the auditor will need to talk to the audit committee much more often, to define and explain critical audit matters.

That will carry implications for you as you work with the audit committee, to ensure effective systems of compliance and internal control over financial reporting.

For example, this new approach could drive up your audit fees, because the engagement partner may need to meet with your audit committee more often, and the engagement partner’s billable rates are always the highest. (Audit committee members also get paid by the meeting, and those folks aren’t cheap either.)

The PCOAB’s cost-benefit analysis of the standard is rather fuzzy, both on the costs and the benefits. Staff did study what happened in the United Kingdom, which adopted a similar audit report standard several years ago. Fifty-three percent of companies reported no increase in audit fees after the new report when into effect; of those who did see fees go up, the average increase was 5 percent.

Higher audit fees will bring more griping from your CFO about keeping costs down. That feeds into another implication for in-house compliance and audit executives: the audit committee will likely direct you to focus your efforts on those critical audit matters identified by the auditor, to keep those billable hours as low as possible. (Don’t forget, in addition to more talks with the audit committee, the auditors may also run more procedures, collect more evidence, test more controls, and so forth.)

The key point about critical audit matters is that they involve complex subjects with significant amounts of judgment or uncertainty; or they rely on management estimates that involve significant judgment or uncertainty. Examples might be fair value estimates that rely entirely on mathematical models (“Level 3” estimates); goodwill impairment; or many of the disclosures required in the new revenue recognition standard.

So for you, the compliance or audit executive on the inside—your mission will be to reduce the amount of judgment needed, on inherent uncertainty, around those items at your company that might fit the profile of a CAM. Think about how you might do that.

The Report in Practice

Let’s be honest: we don’t know how all this will really work in practice. The four current PCAOB members voted for the new audit report standard unanimously, but they did voice concern that some audit firms (probably the Big 4) will be tempted to standardize the critical audit matters they report.

That’s exactly what the PCOAB does not want to see. As board member Lew Ferguson phrased it, the goal instead is “to create a much richer environment of disclosures.”

Will that actually happen? The financial reporting community won’t know for years: not until the new standard goes into effect in 2019, and the PCAOB starts inspecting audits after that. So we’re into the 2020s at the earliest—and almost certainly under new PCAOB leadership—before we understand whether this report makes much difference to investors.

There’s also this business of Emerging Growth Companies being exempt from the CAMs requirement. That idea is iffy at best, since young, fast-growing companies are typically the ones with the most risks and the most subjective judgments lurking in their financial reports. (EGCs were excluded because the PCAOB wasn’t sure it had the legal authority to include them, but we do have a caveat: auditors of EGCs can still disclose critical audit matters if they choose; they’re simply not required to do so.)

The compliance and internal control community will have lots more to ponder about the new audit report in years to come. Just remember: the clock is ticking.