Ensuring Integrity: COVID-19 and Client Risk Profile

Impact on Risk Profiles

Susan Jones kicked off the panel by asking participants how COVID-19 affected the risk profile of their audit clients. “What we’re seeing is that some companies have to change controls because their workforce is working remotely,” Diane Larsen began. “Perhaps they’ve had some changes in roles and responsibilities. We’re asking our teams to understand how the control environment has changed.”

“When companies have been affected by increased revenues or decreased revenues or changed profitability, not only will the auditors have a change in materiality, but companies may have to look at their controls,” Jim Burton added. “When they’re performing the tests of controls, an entirely different set of transactions may come into certain types of controls. Is this control still designed correctly for those types of transactions? … It’s not just that we are doing this control differently; we also should change the design of the control.”

Burton noted that the pandemic led to an “all hands on deck” approach to typical control responsibilities. “There have been some internal audit groups that have gotten involved in executing controls or even management functions, simply because of availability of people,” he said. “That will affect the oversight of the control environment. Maybe the monitoring of the controls could even affect auditors’ ability to use internal audit work because they are no longer objective relative to the transactions.” Kathleen Karatas added that she has had be very careful about how to structure consulting arrangements with clients that wouldn’t have the bandwidth to handle such items under the best of circumstances.

“We had to get a little creative in how our audit execution will happen,” Diane Larsen began on the topic of segregation of duties. “When looking at a significant estimate, or maybe an impairment review, that used to happen in a meeting, and there was a lot of evidence and a lot of detail as to questions being raised and follow-up points. Now that’s happening over Zoom. You’re dialing in as the auditor and observing that control happening.”

Changing Communications

Jones asked whether participants are finding communicating using new technologies in the COVID-19 paradigm to be satisfactory. “I think it connects a lot of us more because we wouldn’t normally wouldn’t be able to drive out to see our client,” Kathleen Karatas replied. “Now we’re able to talk to them more frequently. Everyone’s been isolated. When you talk to somebody on Zoom, it’s not the same—but it does bring in another human element that I think people are lacking in this environment. So I would say, for the most part, it has improved it.”

“We caution our teams that we have had some clients who have been reluctant to get on camera. We really want to get discussions on camera,” Larsen said. “If your client is reluctant to get on camera, is there something that we should be concerned about? Is it raising your skepticism?” Alan Skinner replied that even as things get “back to normal,” there will continue to be a role for videoconferencing and other tools, because they are easy to use and will limit travel costs.

“We’ve had some discussions with some of our external regulators who said, ‘This is the new normal. You can do an audit this way forever.’ Why would we ever go back to anything else?” Larsen said. “And we were saying—time out, I’m not sure this is the ideal situation. I’m not sure this is the new normal.”

Skinner discussed whether the challenges clients have had in executing internal controls should raise auditors’ concerns about fraud. “Why was the office closed? Was it because of local mandate, or did management have discretion about closing—and was that possibly overriding controls? Either way,” he said, “controls have been overridden, so you have to think about what management has access to.”

“Journal entry testing is such an important step,” Larsen added. “If they’ve changed the controls over those journal entries, it’s really critical, whether you’re auditing a small company or a company that has millions of journal entries. The ability to think about where that risk of management override can happen is super-critical.”

When it comes to the motivations for fraud, Larsen noted, “there are a lot of companies who are struggling this year. There are certain industries that have actually benefited from COVID, but there are many, many industries that have been adversely impacted.” She continued: “If you happen to be a public company where that financial team’s compensation is heavily tied to the performance of the organization, whether it be through stock options or additional bonus arrangements, you’re going to be saying, ‘How can we try and turn this really challenging year into something salvageable?’”

“If you’re a management team looking at your compensation and saying, ‘I’m going to be adversely impacted, my compensation isn’t going to be where it used to be’—your bias could influence some of the judgments and estimates that are sitting in those underlying assumptions relative to cash flow. I think understanding what motivates management is the first step,” Larsen explained. “We remind our teams to think about what will motivate the management team—what are the key performance indicators that they are obligated to achieve for stakeholders?” She also challenges her audit teams to think about their interactions with management over the past 12 months and how they might have changed.

“A lot of people think about fraud from the perspective of somebody trying to salvage a bad situation and make it better, and that happens quite frequently. But one of the things that we’ve been reminding our teams of is to also think about situations where things are going well and make sure they’re not creating ‘cookie jar’ reserves,” Burton noted. “Look at those estimates from the perspective of whether they are potentially too conservative, whether it be an impairment decision or other estimate. This can be a risk on both sides—not just entities that are negatively affected, but ones that are doing okay. We’re warning teams to pay attention to that as well.”

The Pandemic Environment

When the discussion turned to the federal Paycheck Protection Program (PPP), Karatas said that “one of our largest consulting arrangements is in the PPP loan forgiveness, There are a lot of estimates that that go into the full-time equivalents and helping people sort that out.”. She added that “you have to keep up with the SBA [Small Business Administration] because they’re changing their mind every time the rules are changing.”

“I feel like the level of surety as COVID keeps going on is declining. There’s so much volatility,” Larsen stated. “I think there could be an opportunity for bias and, maybe, potential management manipulation.”

“Going concern is probably as difficult as ever for certain companies in certain industries,” according to Skinner. “It’s because of revenue uncertainty, just not knowing what the next 12 months will look like.” He continued: “What will the new normal look like for that company? There’s an inability to rely on historical revenue for projections, so you don’t have the benchmarks or historical point of reference that you had before. It opens up a new level of uncertainty in terms of forecasting revenue and the assumptions that go along with that.”

Skinner said that engagement teams could face three scenarios. “You get the point where you say management’s forecast and assumptions are reasonable when they’re in the ballpark. … You can get to a point where the judgments are so difficult and the information is so sparse, and there’s so much uncertainty, that engagement teams may find themselves in a place where they’re not prepared to issue a report, so delayed issuance may be an option. Finally,” he said, “where it’s very difficult or the auditor can’t get to where management is, we may have a scope limitation. So we would modify our report in some fashion. Those are really the three spots where I can see us ending up depending again on the industry and the specifics of the client, in the way that management has really evaluated the uncertainty and dealt with it.”

The panel turned to the conversations auditors are having about the disclosure of risks and uncertainties with clients. According to Burton, “we’re seeing our clients really want to understand what are other entities in their industry disclosing. We’ve created a couple of tools for our teams.” He continued, “It’s created good dialogues with clients in terms of what other entities are describing, and how they’re doing it, because you know there’s not a lot of entities, whether they be public entities or private entities, that want to be the first ones out there making disclosures. Sometimes, auditors have to play that kind of negotiator role, and say, ‘This is pretty common in your industry, and these are some of the challenges you should be thinking about.’”

Questions from the Audience

An audience member asked how auditors know that the evidence they are getting is reliable in the current environment. “It’s a very big issue, and you know we always have an obligation to assess the evidence that we’re receiving,” Larsen said. “If you’re dealing with an area of significant risk of fraud risk, there’s additional effort that has to be put forth to validate the authenticity of that audit evidence. We’ve come up with a series of steps and reminders for our team, in particular when we’re dealing with those areas where there’s a risk of material misstatement. It’s a big issue; it should be a real concern for each our teams.”

“The standards contain language that says auditors do not need to be experts on document authenticity, and that’s important,” Burton added. “But that doesn’t mean that we’re blind to authenticity issues or the reliability questions of the evidence.”

Another question concerned whether COVID-19 would feature in upcoming critical audit matters (CAM). “On its own, COVID is unlikely to be a CAM, but it definitely can change the dynamic in terms of what’s communicated with the auditor, what becomes especially challenging or complex within the audit, and what has material effects on the financial statements,” Burton said. “So the COVID environment may definitely alter some of the perspectives on the typical CAM subjects.”

The discussion concluded on the changes in the work environment caused by the pandemic. Jones posed the question of whether some of the new communication tools make it easier to meet with clients more frequently, and whether young auditors are more comfortable meeting electronically. Larsen agreed to some extent, but confessed, “I think there is this fatigue element that goes with constantly being on screen, and trying to remain engaged and really actively listening.” Although Larsen appreciates adapting online under these circumstances, “I still think, in my heart of hearts, if somebody’s been auditing a long time, I think it’s difficult to replace that on-thejob coaching that you get when you’re sitting in a room together.”