by Cydney Posner
Yesterday, as anticipated, the PCAOB adopted, subject to SEC approval, a new auditing standard for the auditor’s report that, while retaining the usual pass/fail opinion, will require auditors to include a discussion of “critical audit matters,” that is, “matters communicated or required to be communicated to the audit committee and that: (1) relate to accounts or disclosures that are material to the financial statements; and (2) involved especially challenging, subjective, or complex auditor judgment.” The new CAM disclosure requirement will apply (with some exceptions) to audits conducted under PCAOB standards, including audits of smaller reporting companies and non-accelerated filers (although at a later phase-in date), but will not apply to emerging growth companies. Here are the press release and related fact sheet.
SoapBox: I don’t think I’d be going too far out on a limb if I predicted that we might see some disputes erupt over CAM disclosure. Essentially, the concept is intended to capture the matters that kept the auditor up at night, so long as they meet the standard’s criteria. But will auditors’ judgments about which CAMs were the real nightmares be called into question? Will the new disclosure requirement precipitate many auditor-management squabbles over the CAMs selected or the nature or extent of the disclosure? And just how enthusiastic will the CFO be about the prospect of the auditor’s sharing with the investing public the convoluted nature or opacity of the company’s policies or the struggles involved in performing the audit or reaching conclusions about the financials? Although the adopting release suggests that the process will be an iterative one between management and the auditors, how much input will auditors really allow audit committees or managements in reviewing the auditors’ selection or disclosure? Will auditors’ use the new disclosure requirement as leverage to compel managements to include disclosure in the notes or MD&A that management may not view as necessary? Because the trigger for CAM consideration is whether a matter has been or is required to be communicated to the audit committee, will the new requirement have the effect of chilling communications among auditors, audit committees and managements, a concern often mentioned in comments on the proposal? Or will the new standard ultimately end up just producing more boilerplate, as auditors (and companies) find comfort in conformity?
Notably, the PCAOB expects little chilling effect: “For matters required to be communicated to the audit committee, the Board believes there should not be a chilling effect or reduced communications to the audit committee because the requirements for such communications are not changing. It would seem that any chilling effect would more likely relate to matters that are not explicitly required to be communicated to the audit committee, although given the broad requirements of [the relevant standard], the Board believes that there may be few, if any, relevant communications affected by that possibility.”
In addition, the report will include other disclosures designed to enhance its usefulness, including:
- auditor tenure;
- a statement that the auditor is required to be independent;
- a requirement to address the report to the board and shareholders;
- standardization of the format; and,
- in describing the auditor’s responsibility to obtain reasonable assurance about whether the financial statements are free of material misstatements, inclusion of the phrase “whether due to error or fraud.”
The changes will be phased in as follows:
- “New auditor’s report format, tenure, and other information: audits for fiscal years ending on or after December 15, 2017
- Communication of CAMs for audits of large accelerated filers: audits for fiscal years ending on or after June 30, 2019
- Communication of CAMs for audits of all other companies: audits for fiscal years ending on or after December 15, 2020”
Background: You certainly couldn’t argue that the PCAOB rushed heedlessly into adoption of this new standard – it has been engaged in discussion and outreach on the concept of an enhanced audit report since 2010. Following the financial crisis of 2008, the fact that clean audit reports were given to a number of failed or failing companies, together with the lack of transparency in the current form of audit report, led to a demand for a new look at whether the pass/fail report model might be improved; the current model has long been disparaged as just boilerplate that doesn’t really convey to investors any of the auditor’s insight into judgment calls and business risks. In 2011, the PCAOB sought to address this concern in a Concept Release by floating various alternatives, principle among them the “auditor’s discussion and analysis.” (See this Cooley news brief.) But the ADA concept was widely criticized because, among other things, it was viewed as “fundamentally changing the auditor’s current role from attesting on information prepared by management to providing an analysis of financial statement information,” thus causing the auditors to step into a role of management.
Then, in 2013, the PCAOB issued a new proposal that required disclosure of CAMs (see this Cooley news brief), but that concept was not without controversy of its own. As PCAOB member Steven Harris explained in 2013, the “challenge of this project is to find a way to balance the need for a different, more useful and communicative, model of the auditor’s report with the need not to change what auditors do, but to change how they report on what they do.” While smaller audit firms and companies raised objections, reactions by some large audit firms at the time to the PCAOB’s proposal were surprisingly positive. (However, that may well have been because of what the PCAOB didn’t propose as opposed to what it did. The absence from the proposal of the controversial ADA must certainly have allowed audit firms to breathe a sigh of relief, although it may not have been a full-blown exhale.)
In 2016, the PCAOB issued a reproposal (see this PubCo post) that attempted to tackle these issues. For example, among other things, the reproposal would:
- Limit the source of potential CAMs to matters communicated to the audit committee – even if not required – or required to be communicated – even if not actually communicated (as opposed to just “addressed during the audit”)
- Add a materiality component to the definition of CAM – they must relate to accounts or disclosures that are material to the financial statements, such as the auditor’s evaluation of the company’s goodwill impairment assessment – an element of “goodwill” account – or the auditor’ s evaluation of the company’ s ability to continue as a going concern, which has a pervasive effect
- Narrow the definition to only those matters that involved “especially challenging, subjective or complex auditor judgment”
The Final Standard
CAMs: The final standard adopts without change the reproposed narrower definition of CAM, as described above. The standard indicates that CAMs “will likely be identified in areas that investors have indicated would be of particular interest to them, such as significant management estimates and judgments made in preparing the financial statements; areas of high financial statement and audit risk; significant unusual transactions; and other significant changes in the financial statements.”
SideBar: Commenters expressed some concern that auditors would be driven to overkill on disclosure of CAMs to protect themselves or that they would fall into overly standardized prose. However, a PCAOB staff study of expanded auditor reporting in the UK did not find that result, at least for the first year of implementation: “On average, the auditor’s reports in the first year of implementation included descriptions of four risk topics, with total risk topics ranging from one to eight. Additionally, the descriptions of the risks of material misstatement in the auditor’s reports in the first year of implementation were not presented in standardized language, but included variations in content length, description, and presentation. The most frequently described risk topics related to revenue recognition, tax, and goodwill and intangible assets.”
Factors in determining CAMs: Under the final standard, identification of CAMs will be a principles-based inquiry. Once the auditor identifies a matter communicated or required to be communicated to the audit committee that relates to material accounts or disclosures, the auditor, in determining whether a matter involved especially challenging, subjective or complex auditor judgment, would take into account a nonexclusive list of factors, including the following:
- “The auditor’s assessment of the risks of material misstatement, including significant risks;
- The degree of auditor judgment related to areas in the financial statements that involved the application of significant judgment or estimation by management, including estimates with significant measurement uncertainty;
- The nature and timing of significant unusual transactions and the extent of audit effort and judgment related to these transactions;
- The degree of auditor subjectivity in applying audit procedures to address the matter or in evaluating the results of those procedures;
- The nature and extent of audit effort required to address the matter, including the extent of specialized skill or knowledge needed or the nature of consultations outside the engagement team regarding the matter; and
- The nature of audit evidence obtained regarding the matter.”
Depending on the matter, the auditor’s determination might be based on only one factor or a combination of these or other factors. The final standard does not include two factors from the 2013 proposal that received substantial criticism and were not included in the reproposal: the severity of relevant control deficiencies and the nature and significance of corrected and uncorrected misstatements.
Communication in the auditor’s report: The requirements regarding the communication of CAMs have been modified slightly from the reproposal. The required introductory language will expressly state that the communication of CAMs does not alter the auditor’s opinion on the financials as a whole, nor is the auditor, by communicating CAMs, providing separate opinions on the CAMs or on the related accounts or disclosures. In addition, the auditor would identify the CAM, describe the principal considerations that led the auditor to determine that the matter is a CAM, describe how it was addressed in the audit, and refer to the relevant financial statement accounts and disclosures.
The release provides that the “auditor’s description of the principal considerations should be specific to the circumstances and provide a clear, concise, and understandable discussion of why the matter involved especially challenging, subjective, or complex auditor judgment. It is expected that the communication will be tailored to the audit to avoid standardized language and to reflect the specific circumstances of the matter.” (As stated in note 47, although illustrative examples were included in the reproposal (see this PubCo post), there are none in the adopting release because the PCAOB “believes auditors should provide tailored, audit-specific information when
communicating critical audit matters in the auditor’s report.”)
The final standard includes a note incorporating four alternatives regarding the description of how the CAM was addressed: the auditor could describe “(1) the auditor’s response or approach that was most relevant to the matter; (2) a brief overview of procedures performed; (3) an indication of the outcome of the auditor’s procedures; and (4) key observations with respect to the matter, or some combination of these elements.” To help readers, the release suggests limiting the use of highly technical accounting and auditing terms. If there were no CAMs (considered to be a rather unlikely event), the auditor would state that in the auditor’s report.
A note in the final standard indicates that language that could be viewed as disclaiming or qualifying the auditor’s responsibility for CAMs or the auditor’s opinion on the financial statements is not permitted.
To address concerns regarding potential disclosure of confidential information, the final standard explains that the “auditor is not expected to provide information about the company that has not been made publicly available by the company unless such information is necessary to describe the principal considerations that led the auditor to determine that a matter is a critical audit matter or how the matter was addressed in the audit.” Auditor reporting of “original information” is not prohibited, but it is limited to “areas uniquely within the perspective of the auditor: describing the principal considerations that led the auditor to determine that the matter is a critical audit matter and how the matter was addressed in the audit.” In addition, the release observes that “as the auditor determines how best to comply with the communication requirements, the auditor could discuss with management and the audit committee the treatment of any sensitive information.”
SideBar: This exception regarding confidential or original information may not be so easy to apply. Some commenters on the reproposal contended that the exception effectively instructs the auditor to make the disclosure, and some argued that the revised CAM definition continues to intrude on the responsibility of management and the board for the financial statements by making the auditor’s report a primary source of a company’s financial information. As discussed in this Bloomberg BNA article, both the Center for Audit Quality and the Institute of Management Accountants suggested that the PCAOB eliminate the exception because it “could lead to auditors having to report company information initially” and “blurs the line between whether management or auditors have primary responsibility for disclosures.” (See this PubCo post.)
However, one commenter cited in the adopting release observed that “concerns regarding ‘original information’ were misplaced because the iterative process [between management and the auditor] would reduce the likelihood that the auditor would be a source of original information since critical audit matters would likely overlap with increased management disclosure.” The PCAOB determined that the provision was necessary to ensure that “the fact that management did not provide a disclosure would not prevent the auditor from communicating a critical audit matter.”
Documentation: The auditor would document the basis for its determination of whether each matter that both: (1) was communicated or required to be communicated to the audit committee; and (2) relates to accounts or disclosures that are material to the financial statements, involved especially challenging, subjective, or complex auditor judgment.
Liability considerations: In the adopting release, the PCAOB acknowledged that including CAMs in the auditor’s report could affect potential liability. Some commenters on the reproposal had expressed the concern that CAM disclosure would provide roadmaps to baseless litigation and encouraged the PCAOB and the SEC to protect companies and audit firms through introduction of a safe harbor related to CAMs. They did not succeed, however, in convincing the PCAOB of the necessity of a safe harbor. The PCAOB concluded that, while it took seriously the prospect of potential increases in auditors’ or companies’ liability, it believed that it had “appropriately addressed commenters’ concerns regarding liability in a manner compatible with the objectives of this rulemaking, and in view of the rulemaking’s anticipated benefits.” The PCAOB expects to monitor the effects of implementation of the final standard.
SideBar: A recent academic study found that disclosure of CAMs may actually reduce legal exposure for auditors if a misstatement were subsequently discovered in the CAM area. See this PubCo post.)
International standards: The adopting release notes that enhancements to the auditor’s report have been adopted globally: “While their underlying requirements for expanded auditor reporting differ in the details, there is a common theme in these initiatives: communicating information about audit-specific matters in the auditor’s report.”
SideBar: In the UK, where similar enhanced audit report requirements have been in place for several years, a 2016 study found that the enhancements had a positive effect: readability of the audit report improved, and the report reflected increases in “negative and uncertain tone,” indicating, to the author of the study, that the underlying risks were conveyed. The study also found that analyst forecast dispersion decreased, which the author interpreted to lend support to the contention that the expanded audit report did affect the behavior of financial statement users. (See this PubCo post.)
SEC approval: The new standard is subject to approval by the SEC. As noted in this PubCo post, a PCAOB member indicated that, once he was sworn in, new SEC Chair Jay Clayton would be briefed on the new rule before its release. According to the WSJ, PCAOB Chair Jim Doty is not expecting any hiccups: “Mr. Doty said the board always consults with the SEC on such matters, and he was optimistic there won’t be any problems. ‘This is not a partisan issue….We think we have done a good job of making this practical and rigorous.’”
