July 14, 2014
Volume 21, Issue 18

by Jennifer Burns, Deloitte LLP; and Anthony Mosco, Deloitte & Touche LLP

Introduction

At the June 24–25, 2014, PCAOB Standing Advisory Group (SAG) meeting, the PCAOB gave an update on recent developments, including an overview of its current and future standard-setting activities. In addition, the PCAOB and SAG discussed:¹

• Initiatives to improve audit quality, using root cause analysis, audit quality indicators, and quality control standards.
• Cybersecurity issues and potential implications for financial reporting and auditing.
• The new revenue recognition accounting standard and related audit considerations.
• The new going-concern accounting standard and related audit considerations.

The next SAG meeting is scheduled for November 20–21, 2014.

Recent PCAOB Developments

Chairman James Doty summarized recent PCAOB activities and policy initiatives that have been completed or are in progress, including:

• The release on May 15, 2014, of staff guidance on economic analysis in PCAOB standard setting. Chairman Doty indicated that the staff would apply this guidance in a manner similar to the way the SEC’s economic guidance is applied. The PCAOB guidance gives the staff an “analytical framework” for determining the potential economic impact of proposed PCAOB standards that are presented for the Board’s consideration. Chairman Doty stated that there are currently 9 economists at the PCAOB and that the Board plans to double that number to 18 over the next year.
• Deepening inspection analysis and reporting on results. As described in the PCAOB’s most recent strategic plan, the PCAOB is interested in improving the “timeliness, content and readability of inspection reports and general reports . . . to improve the usefulness of reports.” Chairman Doty envisions inspection reports that are more substantive and meaningful to a larger group of stakeholders without being more technical.
• Continued efforts to develop cross-border arrangements for the PCAOB to conduct joint inspections outside the United States. According to Chairman Doty, internationally, the PCAOB oversees 240 non-U.S. based audit firms in 50 jurisdictions that issue reports on U.S. issuers, and the PCAOB is working closely with authorities in those countries to inspect audit work papers. The PCAOB has bilateral agreements with over 15 of those jurisdictions. Non-U.S. inspections are important because of the wide variety of audit regulators and the high rate of investment growth in these markets. On May 24, 2013, the PCAOB announced that it had entered into a Memorandum of Understanding (MoU) on enforcement cooperation with the China Securities Regulatory Commission and the Ministry of Finance.² Chairman Doty said the PCAOB subsequently presented two inspection alternatives to Chinese representatives: (1) the PCAOB can go to China to perform inspections there with individuals from China or (2) China can send individuals and work papers outside the country. Chairman Doty expects there to be additional developments on this matter after July of this year.
• Enforcement matters. The PCAOB has a robust enforcement program that consists of careful case selection and coordination with the SEC, including working with its newly created Financial Reporting and Audit Task Force and the Microcap Fraud Task Force. Chairman Doty recapped that since the last SAG meeting in November 2013, the PCAOB has settled 11 disciplinary orders, deregistered 7 audit firms, and barred or suspended 9 individuals for a range of misconduct, including misleading inspectors and providing false document trails.
• Matters related to audits of brokers and dealers. On August 19, 2013, the PCAOB released its second report on the Progress of the Interim Inspection Program Related to Audits of Brokers and Dealers. Chairman Doty highlighted that the PCAOB inspected 60 audit firms and found that smaller audit firms tended to prepare the books and records for broker-dealers (22 of 60 audits), which is prohibited under SEC independence requirements. The PCAOB expects to issue its third required interim inspection report on broker-dealer audits in the next few weeks.
• To help auditors with the transition to PCAOB standards,³ on June 26, 2014, the PCAOB released staff guidance for auditors of SEC-registered broker-dealers (see Deloitte’s October 28, 2013, journal entry). The guidance is intended to help such auditors plan and perform audits in accordance with PCAOB standards. It also discusses how an audit can be scaled under PCAOB standards depending on the size and complexity of the broker-dealer. (For more information, see Deloitte’s October 28, 2013, Banking & Securities Spotlight.)
• Enhanced outreach to audit committees. Chairman Doty reiterated the importance of this priority. The PCAOB’s strategic plan includes two goals for 2014 related to this endeavor: (1) enhance interaction with audit committees (e.g., by developing materials with information on PCAOB activities and hosting forums to engage in a dialogue) and (2) enhance the usefulness of the PCAOB’s Web site for dissemination of information about registered firms.
• Standard-setting activities. Chairman Doty described this year as an important one for standard setting. On June 10, 2014, the PCAOB issued its standard on related parties⁴ (the first PCAOB standard developed since the JOBS⁵ Act), which contains significantly more economic analysis than previous standards. (For more information, see Deloitte’s June 23, 2014, Heads Up.) He expressed strong hopes that the Board’s proposed audit transparency standard (requiring disclosure of the engagement partner and certain audit participants) will be issued by the end of the summer. (For more information, see Deloitte’s January 6, 2014, Heads Up). The section below provides more details about the Board’s standard-setting agenda.

Standard-Setting Agenda

Martin Baumann, chief auditor and director of professional standards, provided an update on the PCAOB’s various standard-setting activities and reviewed its standard-setting agenda. As adapted from the PCAOB’s Web site, the following table outlines the current status of PCAOB projects:

Initiatives to Improve Audit Quality

Office of Research and Analysis Director Greg Jonas, Division of Registration and Inspections Director Helen Munter, and Office of the Chief Auditor Deputy Chief Auditor Keith Wilson provided introductory remarks about three PCAOB interrelated initiatives to improve audit quality:¹⁰

• Root cause analysis — an initiative of the PCAOB’s Division of Registration and Inspections to improve firms’ overall systems of quality control by analyzing measures or indicators of audit quality to further improve and sustain audits.
• Audit quality indicators (AQIs) — an initiative of the PCAOB’s Office of Research and Analysis to develop a portfolio of measures of audit quality that may provide information and tools to generate greater insight into audit quality.
• Quality control standards — an initiative of the PCAOB’s Office of the Chief Auditor to consider enhancements to PCAOB quality control standards to improve firms’ quality control systems.

SAG members then participated in nonpublic breakout sessions on the three initiatives. In addition, they were asked to complete a “Survey of SAG Member Views on Possible Usage of AQI Data” before the meeting and to further refine their survey responses during the breakout sessions. The survey asked the group to (1) rank the usefulness of AQI data for stakeholders (audit committees, investors, audit firms, the PCAOB and other regulators, company management, and academic researchers); (2) react to a list of possible near-term actions to promote usage of AQI data (including voluntary discussions between engagement teams and audit committees, making AQI reporting required, and publishing firm-level data); and (3) react to a list of possible long-term actions to promote use of AQI data (including the PCAOB’s publication of a periodic report on the state of audit quality based partly on AQI data and average AQIs for audits in particular industries, as potentially developed by the PCAOB).

On the second day of the SAG meeting, the staff summarized feedback from the breakout sessions and survey. While feedback reflected the background and viewpoints of the various SAG members (e.g., audit professionals, academics, audit committee members, investor groups), a key theme was the interrelationship of the three projects and the importance of considering them together. For example, the use of a root cause analysis could be viewed as a “bottom up” approach that helps in the validation of AQIs, while use of AQIs could be viewed as a “top down” approach that helps in the monitoring of quality. The quality control standards could be viewed as the overall mechanism used to design an audit firm’s quality control system. Overall, SAG members expressed support for the initiatives and provided the following feedback about each:

• Root cause analysis:
  • SAG members acknowledged the importance of the PCAOB’s identification of positive quality indicators in addition to negative ones. They also suggested that the PCAOB publicly report related information it has already gathered to help audit firms, audit committees, and other stakeholders.
  • Members also cautioned that since PCAOB inspections are risk based, root causes may not apply to other audit engagements. Also, some may extrapolate metrics to engagements to which they do not apply or without understanding the precise issues.
  • SAG members discussed the complexity of new accounting standards that require the use of more estimates and judgment and the effect of that complexity on root causes. One SAG member suggested that a root cause analysis should include root causes outside the control of a firm (e.g., improvements to accounting and auditing standards, or issuer guidance on maintaining books, records, and controls). The potential for unintended consequences associated with the risk of attributing a result to the wrong cause was also discussed.
  • It was suggested that the quality of the audit committee could be part of the root cause of a deficiency, especially if the committee does not include a financial expert. One SAG member expressed support for updating the SEC’s rules regarding involvement of financial experts in audit committees.¹¹
• AQIs:
  • SAG members generally supported moving forward with this project but stressed the importance of considering potential challenges and unintended consequences.
  • Members generally believed that AQIs (both engagement level and firm level) would be most useful for regulators, auditors, and audit committees and less useful for investors and academics. However, some believed that the information would allow investors to make more informed decisions when voting for ratification of the auditor. Generally, SAG members believed that firm-level AQIs were likely to be less useful to investors than engagement-level AQIs, whereas firm-level AQIs were likely to be more useful to academics.
  • Strong support was expressed for industry AQIs, and there was some support for office-level AQI data.
  • Some SAG members suggested that empirical evidence and field testing are needed before AQIs are implemented. Others expressed the view that there is general consensus on the four or five measures that indicate quality and noted that audit committees and auditors can start now to discuss the indicators they find most useful.

• • It was also suggested that implementing AQIs in phases would offer reduced risk for unintended consequences by allowing the PCAOB, firms, and audit committees to gain experience and learn from earlier phases (e.g., initially reporting AQIs on a voluntary basis to only audit committees or the PCAOB). It was also suggested that the PCAOB could monitor implementation and revise its approach over time as experience is gained from using and analyzing the AQIs. One SAG member stated that phased implementation would be acceptable, provided that the end result was the public reporting of meaningful AQI data.
  • Potential challenges of implementing AQIs include the following:
    • Unintended consequences, including managing to the wrong data, and taking comfort in averages and in being in the middle, which may stifle firms’ innovation.
    • If data are publicly reported, misunderstanding or overreacting to them.
    • Quantitatively measuring important aspects of how quality is reinforced, including tone at the top, professional skepticism, and incentive structures within firms.
    • The need for scalability across large and small firms and for specialized kinds of audits.
    • Liability concerns.
  • Broad support was expressed for the PCAOB’s preparation of a periodic report on the state of audit quality, which could be based on the AQI data.
• Quality control standards:
  • SAG members supported updating the quality control standards to reflect concepts related to a firm’s tone at the top, risk assessment, and monitoring; however, members affirmed that the time-tested elements and concepts in the current standards should not be discarded. In addition, the quality control standards should be scalable and adaptable to a dynamic environment.
  • It was suggested that the importance of the audit practice should be reinforced through the tone at the top and firm culture, especially as firms are engaging in other business such as consulting.
  • It should be clear in the quality control standards that tone at the top is to be applied consistently across the firm and that people should be held accountable for noncompliance with the firm’s policies and procedures. This practice should be reinforced through incentives and compensation. SAG members suggested that the PCAOB leverage other guidance and authoritative literature such as the COSO framework, the U.K. audit firm governance code, and the AICPA professional ethics code when reconsidering the quality control standards.
  • Robust risk assessments should be reinforced as an important element in the quality control system. A firm’s own use of AQIs should be an important aspect of the firm’s risk assessment and management processes, since, as one SAG member noted, a firm cannot run a practice without considering relevant risks.
  • Information from the root cause analysis and AQIs should be used by the audit firm in monitoring the quality control system. Audit firms should try to adopt real-time monitoring processes so they can make corrections as needed. Since audits are annual events, modifying approaches can be more challenging than, for example, making changes in a manufacturing setting, which can be done more frequently.

Cybersecurity

A panel consisting of David Burg, a principal specializing in cybersecurity threats at PricewaterhouseCoopers LLP; Charles Elson, an academic specializing in corporate governance; and William Platt, national managing partner — quality and professional eminence at Deloitte & Touche LLP, discussed cybersecurity issues and potential implications for financial reporting and auditing. (For more information, see the related SAG meeting briefing paper on the PCAOB’s Web site as well as the following Deloitte publications: March 20, 2014, Heads Up; June 2, 2014, and August 1, 2013, Audit Committee Brief newsletters; and Changing the Game on Cyber Risk: The Imperative to Be Secure, Vigilant, and Resilient.)

As outlined in the PCAOB’s briefing paper for the meeting, the discussion focused on the following topics:

• Current trends in cyber risks;

• Significant cyber events and industry responses;

• How companies evaluate and respond to cyber risks and cyber incidents;

• Perspectives of audit committee members on cyber risks;

• Implications of cyber risks and cyber incidents for financial reporting, including disclosure obligations in filings with the SEC; [footnote omitted] and

• Auditor responsibilities related to cyber risks and cyber incidents.

Mr. Burg provided an overview of the dramatic changes in the cybersecurity risk landscape. He explained that because of changes in the way businesses operate — including the use of smart phones and tablet computers for business processes by consumers (e.g., online banking) and employees (e.g., performing their job functions remotely) — and survey predictions that application development on mobile devices will exceed that for personal computer devices, evaluating cybersecurity threats is becoming more critical to businesses. Five years ago, hackers posed less of a threat than they do now (i.e., typically they were one-off opportunists trying to earn money from information they obtained). However, today’s hackers are more prevalent, capable, sophisticated, and able to penetrate cybersecurity programs. Mr. Burg shared his view that cybersecurity should encompass three layers of information and business process protection: (1) information technology, (2) operational technology, and (3) consumer technology.

Professor Elson offered his views on cybersecurity from a governance perspective, suggesting that related risk considerations might end up in the purview of the audit committee. This generated some debate among SAG members and panelists about whether the consideration of cybersecurity risks (1) is a board-level responsibility given its critical nature as an enterprise-wide risk and its potentially broad-reaching impacts or (2) should be (or would be by default) delegated to the audit committee or, potentially, to a compliance committee.

Mr. Platt provided an overview of the auditor’s considerations regarding cybersecurity in the context of an integrated audit. He explained that the audit’s objectives focus on the financial statements and internal control over financial reporting. Therefore, the auditor needs to understand and evaluate cybersecurity risks that could affect financial reporting, internal control over financial reporting, or both. As part of the audit, preventive and detective general information technology controls are considered, including information security controls such as user provisioning and authentication controls, system security settings, administrative access, and user access reviews. Mr. Platt also suggested referring to the CAQ alert Cybersecurity and the External Audit, which discusses auditor responsibilities related to this matter.

Various SAG members asked questions and offered reactions to the panel’s presentation, including:

• Cybersecurity is an evolving issue, and systems and processes for evaluating the risks and establishing appropriate controls will continue to be developed.
• Companies should be considering how the risks and events related to cybersecurity can indirectly affect financial reporting, including how accounting and disclosure may be affected by a breach of cybersecurity.
• It is impossible for a company to prevent all breaches, and it is therefore important for companies to have a plan for response and recovery.
• One SAG member questioned whether cybersecurity issues can also arise in back-up systems, to which Mr. Burg responded affirmatively and noted that the Framework for Improving Critical Infrastructure Cybersecurity by the National Institute of Standards and Technology mentions that companies should be able to “restore any capabilities or services that were impaired due to a cybersecurity event.”
• One SAG member mentioned that the U.K. government released a Cyber Essentials Scheme, which outlines the basic controls all organizations should implement to mitigate the risk from common Internet-based threats, within the context of the U.K.’s 10 Steps to Cyber Security.

Revenue Recognition

Jay Hanson, PCAOB Board member, hosted a panel discussion with Larry Smith, FASB Board member; Philip Santarelli, chief risk officer at ParenteBeard LLC; and Alison Spivey, partner at Ernst & Young LLP. The panel discussed the FASB’s and IASB’s new joint revenue recognition standard and related audit considerations. In addition, Dan Murdock, deputy chief accountant at the SEC, provided his views. (For more information on this project, see the PCAOB slides, FASB slides, and presenter slides on the PCAOB’s Web site as well as Deloitte’s May 28, 2014, Heads Up.)

As outlined in the PCAOB slides, the discussion focused on the following topics:

• A high level overview of the newly adopted standard with an emphasis on, and illustrations of, areas of significant change and judgment

• Audit considerations under the newly adopted standard from the perspective of both a larger and smaller audit firm

• Discussion with SAG members to obtain their preliminary input on what, if anything, the PCAOB should do regarding the issuance of audit guidance, amendments to its existing standards, or development of a new auditing standard given the issuance of this new accounting standard.

In addition, as outlined in the presenter slides, the following aspects of the new standard would require the use of significant judgment:

• Identifying the contract/performance obligations

o Contract modifications

o Promises (explicit and implicit) to a customer

o Customer credit risk

o Legal interpretations

• Determining the transaction price

o Reasonably possible outcomes and appropriate estimation method

o Likelihood of significant revenue reversal

• Allocating the transaction price

o Standalone selling price

o Variable consideration and discounts can be allocated to one or more (but not all) performance obligations

• Determining when control transfers to the customer

o Affects timing of revenue recognition

The panel members discussed the need for companies to update their revenue recognition processes and related controls. They also noted that the new revenue standard affects income taxes and compensation arrangements, which are driven by revenue-based metrics. Further, they observed that since companies are expected to have significantly more disclosure requirements, some of which will involve data outside their financial reporting systems, management should consider appropriate disclosure controls and procedures.

Auditors will also need to consider the standard’s effect on risk assessment, testing internal controls, and substantive procedures regarding all aspects of revenue recognition. The group noted that auditors may face challenges associated with auditing additional management estimates and judgments made as a result of the new standard (highlighted above), obtaining sufficient evidence, and preparing adequate documentation. There was some discussion about whether auditing issues were appropriately considered during the development of the revenue recognition standard. Panelists mentioned that the PCAOB and FASB have regular meetings and discussions and that the audit firms and other stakeholders raised questions regarding auditability throughout the process of developing the new standard. Further, there was discussion about whether the PCAOB should, to help with various auditing considerations, develop a separate auditing standard related to auditing revenue or whether it should consider issues related to auditing revenue as part of its project to modify its standard on auditing accounting estimates. In addition, there was some debate about the optimal timing of additional guidance from the PCAOB. Mr. Baumann commented that the PCAOB has not decided what actions, if any, it should take, but that it would consider (1) developing staff guidance; (2) amending its standards, including its standard on auditing estimates; and (3) creating a new standard (although he believed this would be unlikely). Mr. Baumann noted that since IFRSs permit early adoption of this standard, auditors of foreign private issuers (that are subject to PCAOB standards) may need guidance sooner on auditing revenue under the new standard.

Mr. Smith also pointed out that a joint transition resource group (TRG) for revenue recognition has been created by the FASB and IASB to identify practice issues before implementation of the new standard and that its first meeting is scheduled for July 18, 2014. The TRG, which consists of members of 16 industry groups, will meet at least quarterly with the PCAOB (the PCAOB is an official observer at TRG meetings) and will discuss accounting, auditing, and internal control matters.

Going Concern

During the panel discussion on going concern, Mr. Smith and Mr. Wilson commented on the FASB’s upcoming Accounting Standards Update (ASU) on going concern, which would be effective for annual periods beginning after December 15, 2015, and interim periods thereafter. (For more information on this project, see the slides on the PCAOB’s Web site as well as Deloitte’s June 27, 2013, Heads Up on the proposed ASU¹³ and Deloitte’s November 8, 2013, March 28, 2014, and May 8, 2014, journal entries on subsequent tentative decisions reached by the FASB).

The PCAOB’s slides contain the following comparison of key provisions of AU Section 341,¹⁴ the FASB’s future ASU, and IAS 1:¹⁵

In addition, the slides note the following potential auditor reporting alternatives being considered by the PCAOB: 

• Maintain the current [auditor reporting] requirements

• Adopt auditor reporting requirements that parallel US GAAP or IFRS disclosure requirements

• Adopt a new auditor reporting threshold

• Adopt one of the preceding alternatives, and require emphasis paragraphs under certain conditions

SAG members generally supported either the first or second approach above, noting that a benefit of maintaining the current auditor reporting requirements (the first approach) is that the “probable” threshold in the ASU is generally seen as a higher threshold than the current “substantial doubt” threshold used in current auditor reporting requirements, and investors prefer an earlier warning rather than a later warning. A panelist also stated his belief that the auditing literature should be consistent with the accounting literature. In addition, there was considerable debate about the meaning and interpretation of the word “probable” and whether the actions taken by the FASB (and potentially by the PCAOB) will be viewed as sufficient by stakeholders that want earlier going-concern warnings and view the probable threshold as too high.

____________________

1 PCAOB presentations and nonpublic breakout sessions were held on June 24. The PCAOB staff presented a summary of the nonpublic breakout discussions to the entire SAG on June 25.

2 The MoU establishes a cooperative framework between the parties for the production and exchange of audit documents relevant to investigations in both countries’ respective jurisdictions. More specifically, it provides a mechanism for the parties to request and receive from each other assistance in obtaining documents and information in furtherance of their investigative duties.

3 In July 2013, the SEC amended Exchange Act Rule 17a-5 to require, among other things, that audits of broker-dealers be conducted in accordance with PCAOB standards. In October 2013, the PCAOB adopted an auditing standard and two attestation standards that apply to broker-dealer audits. In February 2014, the SEC issued an order approving the PCAOB’s new auditing and attestation standards for audits of broker-dealers. The SEC amendments and PCAOB standards are effective for fiscal years ending on or after June 1, 2014. Before the effective date, broker-dealer audits were performed under the AICPA’s generally accepted auditing standards.

4 PCAOB Release No. 2014-002, Auditing Standard No. 18 — Related Parties, Amendments to Certain PCAOB Auditing Standards Regarding Significant Unusual Transactions, and Other Amendments to PCAOB Auditing Standards.

5 Jumpstart Our Business Startups.

6 In the future, the PCAOB expects to similarly reorganize its staff guidance and practice alerts.

7 Mr. Baumann indicated that before moving ahead with the proposal, the Board would issue a staff consultation paper to obtain comments from the public. The staff will consider input from the SAG Pricing Sources Task Force as well as developments on auditing estimates under the FASB’s new revenue recognition standard. Mr. Baumann explained that the Board wants to fully understand firm practices, use of centralized pricing desks, the use of third-party pricing sources, and other aspects of auditing estimates.

8 See the Going Concern section below for the potential impact of the FASB’s project on the auditing standards.

9 International Standard on Auditing (UK and Ireland) 700, The Independent Auditor’s Report on Financial Statements.

10 For more information, see the related SAG meeting briefing paper on the PCAOB’s Web site and Deloitte’s June 25, 2013, and December 10, 2013, Heads Up newsletters.

11 In a May 20, 2014, speech, SEC Chair Mary Jo White said that the SEC will focus on updating audit committee disclosures to provide more transparency into the audit’s committee’s activities and financial reporting oversight role.

12 For more information about the project on audit quality, see the International Federation of Accountant’s Web site.

13 FASB Proposed Accounting Standards Update, Disclosure of Uncertainties About an Entity’s Going Concern Presumption.

14 PCAOB AU Section 341, The Auditor’s Consideration of an Entity’s Ability to Continue as a Going Concern.

15 IAS 1, Presentation of Financial Statements.

16 FASB Accounting Standards Codification Topic 450, Contingencies.

Download