Since the last economic downturn, attention has turned to the auditor’s report, which had remained largely unchanged for decades. In response to a perceived desire for more information and judgment from auditors, regulators—at first internationally and then in the United States—added significant new requirements and disclosures. The authors provide a comprehensive look at both U.S. and international standards for “critical/key audit matters,” and discuss the challenges and potential benefits of implementation.
* * *
In the wake of the 2008 global financial crisis, many investors and others called for the auditor’s report to be made more informative—in particular by having auditors provide more relevant and useful information about the financial statement audit without imposing requirements beyond the auditor’s expertise or mandate. Consequently, the form and content of the auditor’s report is about to change in many jurisdictions.
On June 1, 2017, the Public Company Accounting Oversight Board (PCAOB) adopted a new standard, The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion, Release 2017-001, which supersedes portions of the extant AS 3101, Reports on Audited Financial Statements, and makes related amendments to other PCAOB standards. The new standard will impose significant changes to the existing auditor’s report. In particular, the auditor’s report will now include a description of “critical audit matters” (CAM), explaining the especially challenging, subjective, or complex concerns pertaining to the financial statement accounts and disclosures examined. As approved by the SEC on October 23, 2017, the updated AS 3101 only affects audits conducted under PCAOB standards. The AICPA’s Accounting Standards Board (ASB) has, however, already proposed a provision in its new audit report akin to the CAM, which might be either optional or required under certain circumstances.
In 2014, the International Auditing and Assurance Standards Board (IAASB) adopted International Standard on Auditing (ISA) 701, Communicating Key Audit Matters in the Independent Auditor’s Report, which included a new requirement for auditors to communicate “key audit matters” (KAM) selected from among the most significant matters communicated to those charged with governance, such as the audit committee. This requirement became effective for audits of financial statements of listed companies for periods ending on or after December 15, 2016.
In 2014, the European Union adopted new extended audit report (EAR) requirements for audits of public-interest entities to include a description of the most significant assessed risks of material misstatements, including those due to fraud, and the auditor’s responses. Also required are a statement that the auditor remained independent of the audited entity and a disclosure of auditor tenure. The Financial Reporting Council (FRC) in the United Kingdom incorporated the EU and IAASB requirements in its 2013 auditor reporting rules. The FRC has supported EARs mainly as “a response to the post-2008 financial crisis and the need to enhance confidence in financial reporting and auditing” (Extended Auditor’s Reports: A Further Review of Experience,January 2016, http://bit.ly/2AUdAeP). The FRC adopted the IAASB’s definition of key audit matters and stipulated that risks of material misstatement, as determined under both its existing requirements and those of the EU, are key audit matters under that definition.
This article examines these similar disclosures, their application in their respective jurisdictions, and the early effects of their implementation.
Background of the Auditor’s Reporting Model
The purpose of an audit is to enhance the intended financial statement user’s degree of confidence. In the United States, the form of the auditor’s report has changed little since the 1940s; it describes the nature of the audit and addresses whether the financial statements are fairly presented or not, in accordance with an applicable financial reporting framework. For years, changes have been urged (e.g., the Cohen Commission in 1974, the Treadway Commission in 1985) to improve overall communication to financial statement users, but the only resulting change has been the addition of a paragraph explaining the scope of the audit in greater detail. For public companies, there have been two changes to the standard auditor’s report applicable to most SEC issuers since the 1980s: the adoption of the PCAOB’s Auditing Standard 1, and the establishment of requirements for auditors to report on internal control over financial reporting, as directed by sections 103 and 404 of the Sarbanes-Oxley Act of 2002. The PCAOB has found, however, that “many investors indicated that auditors have unique and relevant insight based on their audits and that auditors should provide information about their insights in the auditor’s report to make the report more relevant and useful” (PCAOB Release 2013-005, Aug. 13, 2013, http://bit.ly/2mu3Q6H). The board also acknowledged that one of the most frequently suggested areas for additional auditor reporting to investors is “matters in the financial statements, such as significant management judgments, estimates, and areas with significant measurement uncertainty” (Release 2017-001, http://bit.ly/2D4FQ3E).
AS 3101 retains the pass/fail opinion of the existing auditor’s report, but significantly changes its form and content—most importantly, expanding it to include CAMs. Items that would be reportable as CAMs include the allowance for sales returns (revenue recognition), the valuation allowance for deferred tax assets, and the fair value of fixed maturity, not actively traded securities held as investments (Release 2013-005); other CAMs might relate to goodwill impairment, accounting for acquisitions, the allowance for loan losses, the valuation of defined-benefit plan pension assets and liabilities, the effects of new accounting standards, or the going concern assessment. The standard also requires disclosure of auditor tenure, as well as other perceived improvements that clarify the auditor’s role and responsibilities, provide additional information about the auditor, and make the auditor’s report easier to comprehend (Release 2017-001).
The standard will generally apply to audits conducted under PCAOB standards; however, communication of CAMs will not be required for audits of emerging growth companies; brokers and dealers; investment companies other than business development companies; and employee stock purchase, savings, and similar plans. All provisions other than those related to CAMs will take effect for audits of financial statements for fiscal years ending on or after December 15, 2017. Provisions related to CAMs will take effect for fiscal years ending on or after June 30, 2019, for large accelerated filers, and for fiscal years ending on or after December 15, 2020, for all others.
Enhancing the “pass/fail” model in the proposed standards by having auditors report on CAMs represents the most significant change in auditor reporting in decades. Many have urged the PCAOB to work together with other regulators and standards setters to achieve international convergence. Although the auditor reporting requirements of other regulators and standards setters—such as the IAASB and the FRC—differ in certain details, in many respects the initiatives are similar to the PCAOB’s final standard and will result in essentially similar enhancements. In a parallel fashion, despite jurisdictional differences in the processes of identifying a CAM/KAM, the commonalities in the underlying criteria could result in similar outcomes (PCAOB Release 2016-003, May 11, 2016, http://bit.ly/2AUu7iS). Deciding which matters to highlight as CAM/KAMs, and what auditors should say about them, will be critical in achieving the intended improvements.
Defining a CAM/KAM
The definition of a CAM/KAM leaves what auditors may consider to be critical or key largely to judgment. Under AS 3101, CAMs are matters arising from the audit of the financial statements that have been communicated or were required to be communicated to the audit committee, are “related to” auditing accounts or disclosures that are material to the financial statements, and involve especially challenging, subjective, or complex auditor judgment. The final standard was modified to limit it to matters that are material to the financial statements, in response to concerns that auditors might otherwise be required to communicate information that management is not required to disclose. Some commenters stated that communicating immaterial matters would lead management to revise its disclosures to include a discussion of any matter identified as critical, regardless of materiality, or weaken and obscure the auditor’s opinion because such matters would be irrelevant to investors and other financial statement users. “Related to” clarifies that a CAM could be an element or aspect of an account or disclosure in the financial statements and does not necessarily need to correspond to the entire account or disclosure. For example, the auditor’s evaluation of the company’s goodwill impairment assessment could be a CAM; it would relate to goodwill because impairment is an aspect of that account. In addition, a CAM does not need to relate to a single account or disclosure, but could relate to several, or have a pervasive effect on the financial statements as a whole. Thus, the auditor’s evaluation of the company’s ability to continue as a going concern would be a CAM.
Conversely, a matter that does not relate to accounts or disclosures that are material to the financial statements cannot be a CAM. For example, a potential loss contingency that was communicated to the audit committee but determined to be remote and not disclosed in the financial statements, a potential illegal act for which no disclosure was required, or the determination that there is a significant deficiency in internal control over financial reporting could not be a CAM.
The IAASB adopted a more principles-based approach to the definition of a KAM than the PCAOB did in defining a CAM, although the frameworks for determining a CAM/KAM are substantially similar and begin with those matters communicated or required to be communicated to the audit committee. Under ISA 701, KAMs are defined as those matters that, in the auditor’s professional judgment, were of most significance in the audit of the financial statements of the current period. Although materiality is not included in the definition of a KAM, paragraph A29 of ISA 701 notes that the importance of the matter to the intended users’ understanding of the financial statements as a whole, and in particular its materiality to the financial statements, may be relevant to determining the relative significance of a matter communicated with those charged with governance, and therefore whether such a matter is a KAM.
Determining Whether a Matter Is a CAM/KAM
Determining which, and how many, matters in an audit report required especially challenging, subjective, or complex auditor judgment is itself a matter of professional judgment. According to the PCAOB, a CAM is determined using a principles-based framework, and the level of auditor effort will depend on the nature and complexity of the audit. This would in turn depend on the complexity of the operations and the company’s accounting and control systems. In general, the greater the number of matters initially perceived as being CAMs, the more auditors may need to reconsider whether each of these matters actually meets the definition.
The final PCAOB standard does not specify any items that would of necessity constitute CAMs. For example, the standard does not provide that all matters determined to be “significant risks” under PCAOB standards would be CAMs, as not every significant risk would involve especially challenging, subjective, or complex auditor judgment. Similarly, not all material related-party transactions or matters involving the application of significant judgment or estimation by management will constitute CAMs. Disclosure of a CAM must be informative, will reflect differences in auditors’ experiences and competencies, and should limit the extent to which expanded auditor reporting could duplicate management’s report. To the extent that CAMs are to be cited, this decision in itself should also be informative.
A KAM should be specific to the entity and consistent with the audit having been performed in order to provide relevant and meaningful information to users. Therefore, ISA 701 includes a two-step process using a judgment-based framework to help auditors determine which matters are KAMs. This framework was developed to focus auditors on areas about which investors and other users have expressed interest, in particular on areas that involve the most significant or complex judgments by management and areas of auditor focus in accordance with the risk-based approach embraced by the ISAs (The New Auditor’s Report: A Comparison between the ISAs and the U.S. PCAOB Reproposal, May 2016, http://bit.ly/2FsXSuJ).
For the most part, the specific factors and other considerations underlying an auditor’s determination of which matters are CAMs/KAMs are similar under both approaches. In addition to the factors in Exhibit 1, which auditors are specifically required to take into account in determining a KAM, ISA 701 provides substantial guidance to support auditors’ decision making. In accordance with the IAASB’s standards, this application and other explanatory material is relevant to the proper application of the requirements.
Determining a CAM/KAM
Source: AS 3101 para. 12, ISA 701 paras. 9, 10
Communicating a CAM/KAM
Because the determination of a CAM/KAM is linked to principles-based requirements and relies on auditor judgment, both the IAASB and PCAOB have set out specific requirements to assist auditors in documenting those judgments. AS 3101 requires CAMs to be communicated for audits conducted under PCAOB standards, with the exceptions noted above. Auditors are required to communicate in the auditor’s report any CAM arising from the current period’s audit, or state that the auditor deter mined that there are no CAMs. Additionally, auditors may include a CAM for prior periods when they decide it is appropriate.
Under ISA 701, auditors of financial statements of listed entities are required to communicate KAMs. Laws, regulations, or auditing standards in a particular jurisdiction may extend the requirement to communicate KAMs to other entities, such as public interest entities, public sector entities, entities in a particular industry, or all entities. The ISAs also allow for auditors to communicate KAMs for entities other than listed entities, even absent a requirement to do so.
The communication of CAMs/KAMs should be tailored to the facts and circumstances of the individual audit engagement, as seen in Exhibit 2. The number of CAMs/KAMs that will be communicated may be affected by the complexity of the entity, the nature of the entity’s business and environment, and the facts and circumstances of the audit engagement. Under both approaches, there will likely be at least one CAM/KAM communicated in the auditor’s report; however, both the IAASB and PCAOB acknowledge that there may be circumstances where there are no CAM/KAMs to report, and both require a statement to that effect in the auditor’s report in such cases. Both the IAASB and PCAOB require the communication of CAM/KAMs only for the audit of the current period, but guidance for both standards indicates that it may also be useful for auditors to consider whether a CAM/KAM in the prior period continues in the current one.
Communicating a CAM/KAM
Source: AS 3101, para. 14; ISA 701, para. 13
Benefits and Challenges
According to the PCAOB, the disclosure of CAM/KAMs will benefit the market directly, by allowing market participants to make better-informed decisions, as well as indirectly, because some reporting parties may change their behavior in positive ways after information is disclosed.
Auditor communication of CAM/KAMs should reduce the information asymmetry between investors and auditors, which should in turn reduce the information asymmetry between investors and management, about the company’s financial performance, thereby reducing the cost of acquiring information for financial statement users and enhancing the following:
- Communication between auditors and investors, as well as management
- Transparency, audit quality, and information value
- Attention by management and financial statement preparers to disclosures referencing the auditor’s report
- User understanding, consumption, and confidence in audit reports and financial statements
- Long-term investors’ understanding of the company
- Support for investor decisions on ratification of the auditor
- Ability of investors to monitor management and the board of directors’ stew-ardship of the company.
Increased disclosures should also provide some auditors, management, and audit committees with additional incentives to change their behavior in ways that may enhance audit quality, and ultimately financial reporting quality, in the public interest. The selection and wording of CAM/KAMs, however, require the highest level of judgment from the audit team and will likely be subject to multiple levels of internal review by audit firms. This will likely add significant costs and delivery time to audit reports, thus pushing deadlines and putting additional pressure on auditors to finish early enough to ensure timely filings. Thus, potential challenges include the following:
- Increased audit costs
- Increased liability for auditors
- Effects of increased attention to CAMs/KAMs (certain investors may misinterpret discussion of these issues as an indication of a problem, even if the audit results in a clean opinion)
- A “first mover” disadvantage when CAM/KAMs reported by later filers in the same industry are omitted
- More time needed to issue the auditor’s report, and commensurate filing deadline pressures
- The risk of disclosing information not disclosed by management
- A chill in communication between auditors, management, and the audit committee if there are disagreements on what a CAM is
- Impact on management disclosure and discrepancies between management’s disclosures and CAMs
- Overstandardization of CAM/KAMs, which would nullify their purpose.
Experience in the United Kingdom
The FRC has reviewed a number of extended audit reports over the first two years of implementation of ISA 701 and observed that investors greatly value the information provided in those reports, even identifying certain descriptions of risks that they found to be more useful than others. Investors value reports that avoid the use of boilerplate language and provide information about the specific outcomes of the audit work, the audit findings, and the mandatory descriptions of the audit process. Materiality, however, is still a challenging area.
A U.K. association of investment managers has recognized in an annual awards ceremony the most innovative auditor’s reports. A 2017 ICAEW report cautions, however, that these achievements are still fragile and that the whole system needs support and encouragement to avoid boilerplate and promote further enhancements. Moreover, media, legal and disciplinary reactions to scandals such as Rolls-Royce will affect the development of EAR in the future (The Start of a Conversation: The Extended Audit Report, ICAEW, http://bit.ly/2ECsRTV).
The Rolls-Royce 2014 audit report, published by KPMG, won the Investment Association award for the disclosure of the risk of material mis-statements. The 2015 report, which included an audit risk map for the first time, has been identified as a leading example of innovative development of the audit report. Nevertheless, in January 2017, Rolls-Royce agreed to pay £671 million in penalties to settle bribery and corruption charges, and the FRC began investigating KPMG’s conduct with respect to its audit of Rolls-Royce’s financial statements between 2010 and 2013.
In 2014, KPMG considered that there was adequate disclosure in the financial statements on the matter of corruption, but nevertheless decided to recognize a bribery and corruption KAM. Could the EAR with KAMs result in more harm than benefit to the enterprise, shareholders, and society? The KAM for bribery and corruption reported by KPMG was arguably written with a view to the company’s legal interests rather than what an investor would want to be informed about by a truly independent representative with privileged access.
Expanding the audit report with communication of CAMs/KAMs is expected to increase competition among audit firms, and thereby to enhance the value of the audit to investors and elevate the overall level of confidence in audited financial reports.
The FRC has stated that the two purposes of EARs are to inform investors and to give them greater confidence in the audit. To the contrary, the bribery and corruption KAM failed to significantly inform investors (while giving the impression of doing so), encouraging a misplaced confidence in view of the roughly $1 billion in fines and claw-backs mandated by the Rolls-Royce deferred prosecution agreements of January 2017 (ICAEW 2017; Julia Kollewe, “Accounting Watchdog to Investigate KPMG over Rolls-Royce Audit,” Guardian, May 4, 2017, http://bit.ly/2nbKoev).
Notwithstanding such scandals, no noticeable effect of recognition of KAMs has yet been seen on these reports. The risk appears to be, in many respects, not dissimilar to that which has long existed for a short-form report, and disclosure of KAMs may indeed help auditors manage their risks in auditing large companies. This concern deserves ongoing monitoring and possible reassessment.
Enhancing Audit Quality
Many believe that it is long overdue for auditors to provide meaningful information about audits to the investing public. Extensive regulation of audit practice has arguably been accompanied by commoditization of the audit and contributed to extensive auditing failures (Shyam Sunder, “Minding Our Manners: Accounting as Social Norms,” British Accounting Review,December 2005, http://bit.ly/2myy888). Audit committees and investors should have an understanding of the auditor’s perspective on the financial statements, including significant issues that arose in the audit and how they were resolved, areas of greatest risk, significant estimates and judgments, restatements, and materiality assessments.
Reducing the level of information asymmetry between management and investors could result in more efficient capital allocation and lower the average cost of capital. In addition, expanding the audit report with communication of CAMs/KAMs is expected to increase competition among audit firms, particularly in the area of professional skepticism, and thereby to enhance the value of the audit to investors and elevate the overall level of confidence in audited financial reports.
The determination of CAMs/KAMs is highly dependent upon auditor judgment, which is the application of relevant training, knowledge, and experience—within the context provided by auditing, accounting, and ethical standards—in making informed decisions about the appropriate courses of action under the circumstances of the audit engagement. The decision as to which matters in the audit are “challenging, subjective, or complex” or “most significant” will necessarily be made by the engagement team, especially the engagement partner. One engagement partner with extensive knowledge and experience might not view certain matters as reportable CAMs/KAMs, while another might. Both the PCAOB and the IAASB provide extensive guidance for deciding which matters to highlight as CAMs/KAMs and what auditors should say about them.
Many believe that, in order to strengthen and improve global audit standards, the PCAOB should align its auditing standards with the IAASB standards to the maximum extent possible (comment letter to PCAOB Release 2016-003, California State Teachers’ Retirement System, Aug. 12, 2016, http://bit.ly/2ECp6h8; comment letter to PCAOB Release 2016-003, Institute der Wirtschaftsprfer, Aug. 15, 2016, http://bit.ly/2DDUsYO). Although the PCAOB standard is similar to the IAASB standard, some of the terms and definitions differ. Based on auditor judgment and professional skepticism, this could result in two different reporting models and divergent views in some instances with respect to what key matters are disclosed. The IAASB’s definitions of materiality are also broader and not consistent with the legal concept of materiality in the United States adopted by the PCAOB and FASB and embedded in the definition of a CAM. Because the definition of a CAM/KAM will affect auditors’ behavior and attitude, the inclusion of a materiality consideration in the definition of a CAM may result in a narrower population of candidate matters than under the IAASB’s standards or approaches in other jurisdictions.