The overseer of U.S. auditing firms, the Public Company Accounting Oversight Board (PCAOB), released a report Monday outlining deficiencies in audits of the internal control over financial reporting at public companies.
The report indicates that the PCAOB is “concerned about the number and significance of deficiencies identified in firms’ audits of internal control”. It says that it’s also worried that the rate of these deficiencies has since increased.
It says that, in 46 of the 309 integrated audit engagements (15%) that were inspected in 2010, it found that the firm, at the time it issued its audit report, had failed to obtain sufficient evidence to support its audit opinion on the effectiveness of internal control.
And, in 85% of those 46 cases, the audit firm also failed to obtain sufficient audit evidence to support the financial statement audit opinion, it reports.
Additionally, in another 50 of the 309 audits, PCAOB staff identified deficiencies in the auditing of internal control that did not involve findings of such significance that they indicated a failure to support the firm’s internal control opinion. However, it says these deficiencies did require remediation.
The PCAOB notes that the deficiencies do not mean the issuer’s financial statements were materially misstated or that the issuer’s internal controls were inadequate. But, deficiencies in the testing and assessment of internal control may increase the risk of the auditor failing to identify a material misstatement, the report notes. Generally, the deficiencies related to execution issues on the part of individual engagement teams where those teams did not meet the requirements of the firms’ methodologies, it says.
The most pervasive deficiencies identified in auditing internal control related to firms’ failures to: identify and sufficiently test controls that are intended to address the risks of material misstatement; sufficiently test the design and operating effectiveness of management review controls; obtain sufficient evidence to update the results of testing of controls; sufficiently test system-generated data and reports that support important controls; perform procedures regarding the use of the work of others; and, sufficiently evaluate identified control deficiencies and consider their effect on both the financial statement audit and on the audit of internal control.
The report suggests that potential causes of the deficiencies include: improper application of the top-down approach to the audit; decreases in audit firm staffing; insufficient firm training and guidance; and, ineffective communication with firm’s information system specialists on the engagement team.
“Based on the inspections staff’s analyses of the deficiencies identified, it appears that firms need to perform more thorough analyses of both the risk of material misstatement and the approach taken to auditing internal control,” the report says.
“Deficiencies in the auditing of internal control are continuing to occur, and firms should take note of the matters identified in this report in planning and performing their audits,” it adds.