New Audit Report Format Approved

Auditors and corporate reporting professionals everywhere, prepare yourselves: The SEC has approved the new, more detailed format for external auditors’ reports!

The new standard, drafted by the Public Company Accounting Oversight Board after seven years of negotiations, requires audit firms to disclose “critical audit matters” (CAMs) they find while auditing your financial statements. That approach ends decades of a pass-fail format for audit reports, which pretty much everyone agreed did not bring much insight to investors.

What is a CAM, exactly? Any matter the audit firm communicates to the audit committee, related to accounts or disclosures that are material to the financial statements, “and involved especially challenging, subjective, or complex auditor judgment.”

For large accelerated filers, the new format goes into effect for audits performed on fiscal years ending after June 30, 2019—that is, for most large filers, the audit reports that investors will receive in early 2020. For all other filers, it goes into effect for fiscal years ending after Dec. 15, 2020. Broker-dealers are exempt from the new requirement, as are Emerging Growth Companies.

While the new format is a much-needed advance over the current pass-fail structure, it had no shortage of critics, who say CAM disclosures could put audit firms in the position of reporting concerns to investors that a company’s management had not disclosed. So those critics had pressured the SEC to reject the new audit format—which would have been an unprecedented rebuke of PCAOB.

Well, somewhat to my surprise, that didn’t happen. The three sitting SEC commissioners unanimously approved the standard Monday afternoon. They made their decision without a press release or other fanfare, although each commissioner did put out his or her own statement about the new format.

“We believe the communication of CAMs should add to the total mix of information available to investors,” the commissioners said in their adopting statement, “by eliciting more information about the audit itself, which is uniquely within the perspective of the auditor, irrespective of the financial reporting responsibilities of management.”

The new format also requires a statement disclosing the year in which the auditor began serving consecutively as the company’s auditor; plus a few tweaks to the report’s language to help investors understand how independent from the client company the auditor truly is. Those changes all go into effect next year.

CAMs and Internal Control Fights

My question is whether we might see weaponized CAMs. That is, your auditor calls you and says, “That control you have there for effective ICFR? I don’t like it. You have to change it.”

Actually, no you don’t. If you can defend the design and effectiveness of a control with a straight face, you could always tell your auditor to buzz off. The auditor might then raise a stink and declare the control deficient, but you don’t need to roll over every time the auditor complains about an internal control’s design.

Now replay that conversation under the new report format. If you do tell the auditor to buzz off, he can return fire: “Either you change that internal control, or I’ll declare it a significant deficiency and report it to your audit committee, and then it becomes a CAM and gets disclosed.”

That would be an awkward conversation among you, your CFO, and the audit committee. So you’re much more likely just to change the internal control and be done with it, rather than stand your ground.

I’ve proposed that scenario several times to auditors and audit regulators. They usually pause and tell me, “I don’t think things will ever happen that way.” I’ve also proposed this scenario to in-house financial reporting executives. They always tell me immediately: “Yes. It will happen exactly that way.”

Significant Deficiencies, CAMs, and Skepticism

According to the PCAOB standard, it’s not supposed to happen that way. The language specifically says: “the determination that there is a significant deficiency in internal control over financial reporting, in and of itself, cannot be a critical audit matter.” Significant deficiencies and CAMs are not supposed to be the same thing, so the threat outlined above isn’t supposed to be possible.

Rather, auditors are supposed to disclose CAMs and describe the considerations that led them to conclude something was a critical audit matter—and those considerations generally would be one or more significant deficiencies that, taken together, qualify as a critical audit matter. Or as the standard also says, “A significant deficiency could, however, be among the principal considerations that led the auditor to determine that a matter is a critical audit matter.”

That strikes me as a lot of room for strong-arming internal audit or corporate finance departments. To get ahead of that potential threat, in-house financial reporting executives will need to spend a lot of time talking with auditors ahead of the audit, to determine exactly what controls are in scope for an audit and to review how your ICFR is supposed to work. You might also want to talk with your audit committee quite a bit to prep them on this, since they will play the role of West Berlin in any Cold War that might erupt between you and your audit firm.

None of the standard’s potential unintended consequences are lost on the SEC commissioners. The PCAOB has promised to conduct a post-implementation review of the new report format, and SEC chairman Jay Clayton noted that in his statement yesterday:

“Depending on the findings of this analysis, including an evaluation of unintended consequences, the [PCAOB] should be open to making changes, if necessary, to the revised auditing standards, including to the effective date for companies other than large accelerated filers.”

We should also note that the SEC is moving to replace almost the entire five-person board of the PCAOB, including a new chairman, since four of the five board members are currently serving beyond their formal terms. Clayton will have enormous power to propose new board members. So when he encourages the PCAOB to “be open to making changes,” he has the ability to put people there who will do exactly that.

And let’s also remember, this new audit report format is a big deal. Yes, an overhaul of the current format was much needed, and we owe the PCAOB a big thank you for getting us this far. But Clayton is right to watch for unintended consequences. Let’s see what happens.