Audit Deficiencies Related to Internal Control

Testing of design or operating effectiveness of controls.

The PCAOB inspection reports document numerous deficiencies in the testing of design of controls or operating effectiveness of controls of various accounts. AS 5 and AS 12, Identifying and Assessing Risks of Material Misstatement, require auditors to first obtain an understanding of internal controls designed to prevent and detect material misstatements, which should then help them select relevant controls to test for the identified risk. AS 5 cautions that auditors cannot infer effectiveness because no misstatements were detected by substantive procedures; instead, they should obtain direct evidence about a control’s operating effectiveness. The PCAOB identified several cases where auditors did not perform important assessments. Furthermore, the PCAOB has indicated that auditors sometimes fail to test all the relevant assertions of significant accounts and disclosures (PCAOB Staff Audit Practice Alert 11).

Management review controls.

In some cases, the inspection reports have disclosed audit deficiencies related to design or operating effectiveness of management review controls. Management reviews are usually performed to compare actual results with forecasted or budgeted revenues and expenses and to investigate significant differences from expectation. Auditors often test management review controls in internal control audits to obtain evidence about the controls’ design and implementation to prevent or detect misstatements. The PCAOB points out that CPA firms have placed undue emphasis on testing management review control in some instances without considering whether these controls adequately addressed the risks of material misstatements (PCAOB Staff Audit Practice Alert 11).

Roll-forward procedure of controls.

In other cases, the PCAOB has disclosed audit deficiencies related to roll-forward of controls tested at an interim date. The board noted instances where firms did not perform any testing or used inquiry alone for assessing the effectiveness of roll-forward procedures, despite high inherent or fraud risks associated with these controls. AS 5 requires auditors to perform roll-forward procedures to update the results of interim testing to year end. It also notes that inquiry might be a sufficient roll-forward procedure for low-risk situations but is unlikely to be sufficient when the evaluation of the above-mentioned factors suggests otherwise. This is particularly true when—

• the control is related to items that are high risk, complex, subjective, or not tested extensively at the interim date;
• exceptions were identified in the interim testing;
• the roll-forward period is long; or
• significant changes occurred during the roll-forward period.

The findings suggest that auditors should perform more thorough evaluations of the design and operating effectiveness of management review controls. In particular, such evaluations should assess and draw inferences about procedures involved in resolving significant differences from expectations, the competence and authority of the person who performs related test controls, and the conclusions reached by the reviewer. Furthermore, auditors need to assess the risk associated with roll-forward procedures and use evaluation approaches that go well beyond mere management inquiries when an auditor considers risk to be high. Such closer attention to high-risk rollovers is consistent with AS 5, which requires auditors to use more persuasive evidence as risk increases.

Top-down risk-based approach.

AS 5 requires the use of a top-down risk-based approach for the internal control audit. This approach, which is important for performing effective internal control audits, refers to the sequential thought process that auditors should employ in identifying risks. A top-down risk-based approach begins at the financial statement level and focuses on entity-level controls, then on significant account–level controls, and account-level controls. Examples of entity-level controls include controls of the control environment, risk-management process, monitoring control, and period-end financial reporting processes (AS 5).

PCAOB inspection reports have identified many audit deficiencies in the auditors’ use of a top-down risk-based approach. Disclosure examples show that auditors failed to test entity-level controls and period-end financial reporting processes. In addition, several auditors failed to properly assess the risk of misstatements in various accounts.

Risk assessment is a key element of the audit of internal control: identifying the risks of material misstatement is essential for the auditor in planning and selecting relevant controls to test and in appropriately evaluating those controls (PCAOB Staff Audit Practice Alert 11). The risk assessment process includes understanding the company, its business processes, and related internal control and assessing the likely sources, the types, the likelihood, and magnitude of potential misstatements based on the identified risks (AS 12; PCAOB Staff Audit Practice Alert 11). Employing a top-down mindset is challenging because an auditor frequently performs an audit in distinct steps built around financial statement components and might not develop the mindset to think sequentially about risk, starting at the highest level and working down to specific assertions that might point to the likelihood of material misstatements.

IT consideration.

Many companies rely on IT, such as enterprise resource planning (ERP) systems to process accounting data—and the role of IT is even more important in internal control audits. Auditors should identify IT risks and assess general and application IT controls as an integral part of the top-down risk-based approach used in the financial statement audit. The PCAOB expects auditors to understand how IT affects a company’s flow of transactions and “obtain an understanding of specific risks to a company’s internal control over financial reporting resulting from IT” (AS 15, Audit Evidence, para B4).

Inspection reports have identified several audit deficiencies related to the IT consideration. According to the PCAOB in Staff Audit Practice Alert 11, some audit firms failed to 1) “test information technology general controls (ITGC) that are important to the effective operation of the applications that generated the data or reports,” 2) “test the logic of the queries (or parameters) used to extract the data or reports,” or 3) “address control deficiencies that were identified with respect to the ITGCs over either the applications that process the data used in the reports or the applications that generated the reports.”

The use of work of others.

Auditors can more extensively use the work of competent and objective third parties in low-risk areas because as the risk decreases, the necessary level of competence and objectivity decreases (AS 5). On the other hand, auditors should perform more extensive testing of the work done by third parties in high-risk areas involving significant judgment and fraud risk, particularly when the competency of those third parties is judged to be low.

The PCAOB disclosed several audit deficiencies related to the use of the work of others (e.g., internal auditor and service auditor). These auditors relied on tests of controls performed by third parties without a sufficient basis for using these works. The PCAOB commented, in some instances, “the extent to which firms used the work of internal audit in higher risk areas involving significant judgment, such as aspects of revenue and the valuation of complex, hard-to-value investment securities, was inappropriate” (PCAOB Staff Audit Practice Alert 11). The board also noted that some auditors did not redo any of the tests of controls performed by the clients’ internal auditor and did not have documentation of the nature, timing, and extent of that control testing. In addition, the PCAOB reports disclosed that some auditors did not perform sufficient tests of controls of service organizations when relying on the service auditor’s report and did not assess an interaction between a service organization’s control and a company’s control.

Evaluating identified control deficiencies.

Auditors should perform sufficient evaluations to determine whether audit findings related to the substantive procedures in the financial statement audits are indicators of the existence of control deficiencies. They should also evaluate the severity of identified control deficiencies to the existence of material weaknesses of internal controls and the related magnitude of material misstatements.

PCAOB inspections indicate that auditors fail to evaluate the severity of identified control deficiencies. The PCAOB provided examples of failure in evaluating identified control deficiencies, including that auditors did not 1) “sufficiently evaluate whether audit adjustments and exceptions identified from substantive procedures were indicators of the existence of control deficiencies”; 2) “consider all of the relevant risk factors that should have affected the determination of whether there was a reasonable possibility that a deficiency, or a combination of deficiencies, could result in a material misstatement”; 3) “consider all of the relevant factors that should have affected the determination of the magnitude of potential misstatements”; or 4) “sufficiently evaluate compensating controls, including identifying and testing those controls and determining whether they operated at a level of precision that would prevent or detect a mis-statement that could be material” (Staff Audit Practice Alert 11).