If approved by the SEC, the PCAOB’s new auditor’s reporting model will follow international trends by giving investors insights into the key judgments made by the outside auditor – a glimpse of the deliberations behind the pass/fail veil.
On June 1, 2017, the Public Company Accounting Oversight Board voted to adopt a new auditing standard that, if approved by the Securities and Exchange Commission, will significantly expand the current auditor’s report.[i] The new report will augment the traditional pass/fail opinion with a discussion of “critical audit matters” (CAMs), disclosure of the auditor’s tenure and certain other information. The revised report also will have a new format. The adopted standard, AS 3101, is substantially the same as the standard reproposed by the PCAOB in May 2016.
The new standard will apply to all audits conducted under PCAOB standards, although, as discussed below, certain companies will be exempt from the CAM disclosure requirement. Subject to any changes by the SEC, the standard will be phased in to give auditors, audit committees and senior management time to prepare for the challenges of CAM disclosure. For calendar-year companies, all provisions of the new standard, except those relating to CAM disclosure, will apply to their auditor’s report on the 2017 financial statements. Unless exempt, calendar-year large accelerated filers will first encounter CAM disclosure in their auditor’s report on the 2019 financial statements. All other calendar-year, non-exempt companies will have a reprieve from CAM disclosure until their auditor’s report on the 2020 financial statements. AS 3101 is the product of a nearly eight-year PCAOB standard-setting process involving public outreach and consultation with the SEC’s Chief Accountant and other members of the senior SEC accounting staff. It is unclear at this point, however, how the SEC will proceed under SEC Chair Clayton’s leadership. The SEC is expected to seek public comment on AS 3101 to inform its consideration of whether to approve that standard in the form adopted by the PCAOB.
The proposed phase-in of effective dates will give independent auditors and their registrant audit clients a long runway during which to reflect on and prepare for the most sweeping of the new auditor reporting changes – identification and disclosure of “especially challenging, subjective, or complex” aspects of the audit. Audit committees overseeing ongoing management efforts to comply with new generally accepted accounting principles (GAAP) on the near horizon – including those relating to revenue recognition, leases and financial instruments – should factor in the enhanced level of critical auditor scrutiny that AS 3101 portends with respect to management judgments and assumptions made in applying the new GAAP. It may be helpful, in this regard, for audit committees to consider the experience of London-listed companies dealing with the third year of a similar auditor reporting model.
Highlights of the New Standard
If approved by the SEC substantially in the form adopted by the PCAOB, AS 3101will update the form and content of a standard auditor’s report that has remained essentially the same since the 1940s. The key change will be to require a description of CAMs, providing audit-specific information about “especially challenging, subjective, or complex” aspects of the audit. In addition, the standard will require disclosure of auditor tenure, and make a number of other substantive changes intended to clarify the auditor’s independence requirement and role and responsibilities in the audit of financial statements, and to make the auditor’s report easier to read.
According to the PCAOB, the new auditor’s report will give investors and other users of financial statements additional insight into the underlying key judgments that a company’s outside auditor has made and communicated to the audit committee – thereby reducing “the information asymmetry between investors and auditors, which should, in turn, reduce the information asymmetry between investors and management about the company’s financial performance” and lead to more efficient capital allocation. The PCAOB also pointed out that enhanced auditor reporting is in keeping with international trends.
Against the backdrop of the PCAOB inspection process, auditors may be expected to take a conservative approach in the first year or two of CAM identification and disclosure.
Critical Audit Matters
Under the new audit reporting standard, an auditor will continue to opine on whether a company’s financial statements do, or do not, fairly present the company’s financial position and results of operations in accordance with GAAP (the traditional pass/fail model). However, the auditor’s report will also present information the PCAOB believes will give investors and other users of financial statements at least a glimpse of the deliberations that occur behind the pass/fail veil. The report must disclose any CAMs arising from the current period’s audit of the financial statements, or state that the auditor determined that there were no CAMs.
The new standard defines a CAM to mean a matter communicated, or required to be communicated, by the auditor to the audit committee that both (1) “relates to accounts or disclosures that are material to the financial statements;” and (2) involves “especially challenging, subjective, or complex auditor judgment.” CAM disclosures are intended to provide tailored, audit-specific information rather than a discussion of generic risks. With respect to each CAM, the report will be required to:
- identify the particular CAM;
- describe the principal considerations that led the auditor to identify the CAM as such;
- describe how the CAM was addressed in the audit; and
- refer to the relevant financial statement accounts or disclosures.
The new standard calls for the determination of a CAM to be made using a principles-based, facts-and-circumstances analytical framework. CAMs are not limited to the critical accounting estimates identified in a company’s MD&A. Instead, all required audit committee communications,[ii] and any made voluntarily, are fair game to be the source of a CAM – the PCAOB intends to “scope in” the “broadest population of audit communications” without requiring the auditor to determine which are required and which are not. To be a CAM, however, the communication must meet the two-pronged test discussed in more detail below.
Under the first prong of the test, the matter must “relate to accounts or disclosures that are material to the financial statements.” The PCAOB noted that “relates to” means that the CAM could be a component of a material account or disclosure, rather than the entire account or disclosure (e.g., an evaluation of the company’s goodwill impairment assessment if goodwill is material, even if there is no impairment). Alternatively, a CAM could have a pervasive effect on the financial statements rather than relate to a single account or disclosure (e.g., an evaluation of the company’s ability to continue as a going concern).[iii]
If the materiality prong of the test is met, the standard includes a non-exclusive list of factors for the auditor to take into account, together with audit-specific factors, to determine whether the matter involved “especially challenging, subjective, or complex auditor judgment” and therefore constitutes a CAM:
- the auditor’s assessment of the risks of material misstatement, including significant risks;
- the degree of auditor judgment related to areas in the financial statements that involved significant judgment or estimation by management, including estimates with significant measurement uncertainty;
- the nature and timing of significant unusual transactions and the extent of audit effort and judgment related to such transactions;
- the degree of auditor subjectivity in applying audit procedures to address the matter or in evaluating the results of those procedures;
- the nature and extent of audit effort required to address the matter, including the extent of specialized skill or knowledge needed or the nature of consultations outside the engagement team regarding the matter; and
- the nature of audit evidence obtained regarding the matter.
Potential Impact on Audit Committees and Senior Management
The standard is intended to apply only to auditors; the PCAOB does not have authority to regulate the conduct of audit committees or management. As comments submitted to the PCAOB in connection with the May 2016 reproposal make clear, however, there will be an inevitable “spill-over” onto the work of corporate audit committees and preparers of financial statements. AS 3101 will require the auditor to discuss a draft of its report with the audit committee, and the audit committee will have the opportunity to use its side of the “two-way dialogue” to question the auditor about the judgments it has made in identifying any CAMs, and the disclosure it proposes to make about them in its report. A potentially sensitive topic of discussion likely will be whether the auditor’s report reveals “original” and/or “confidential” information not previously disclosed to the public by the company. According to the final standard, the “auditor is not expected to provide information about the company that has not been made publicly available by the company unless such information is necessary to describe the principal considerations that led the auditor to determine that a matter is a critical audit matter or how the matter was addressed in the audit.” That said, the PCAOB contemplates that, “as the auditor determines how best to comply with the communication requirements, the auditor could discuss with management and the audit committee the treatment of any sensitive information.”
The auditor’s identification of one or more CAMs for disclosure in the auditor’s report may have implications for the company’s own disclosure, which both the audit committee and senior management will need to address before the Form 10-K and financial statements are completed. Areas of the company’s Form 10-K that may be implicated include various portions of the MD&A (such as critical accounting estimates disclosure or discussion and analysis of material “known trends, events and uncertainties”), risk factors, financial statement footnotes and/or the evaluation of disclosure controls and procedures and internal control over financial reporting (ICFR). The year-end reporting calendar will need to be set so as to ensure the audit committee and senior management have adequate time to consider all of these issues well in advance of the company’s proposed Form 10-K filing date.
It remains to be seen whether the auditor’s disclosure of CAMs in future audit reports will prompt audit committees to provide more detailed information in their own report, published in the proxy statement, about the substance of communications with the auditor. While the SEC now requires that the audit committee report disclose whether or not the independent auditor has discussed with the audit committee those matters prescribed by relevant PCAOB standards and rules, the audit committee report need not disclose these matters, some of which may be what AS 3101 defines as CAMs. Few companies have chosen to volunteer these disclosures, whether in the audit committee report or elsewhere in the proxy statement, despite the encouragement provided in a 2015 SEC concept release.[iv] We believe it is unlikely that the SEC itself will propose mandating such disclosures given the present deregulatory environment.
The auditor’s report will be required to disclose the year in which the auditor began serving consecutively as the company’s auditor (which could precede the company’s IPO). The impact of tenure on auditor independence is an increasing focus of investor scrutiny, and the new requirement may lead more companies to articulate the benefits and independence safeguards that their audit committees considered in deciding to reappoint a long-tenured auditor.
In addition to the changes to the auditor’s report discussed above, the new standard will also:
- require that the auditor’s report include a statement that the auditor is required to be independent;
- change certain standardized language in the report, including adding the phrase “whether due to error or fraud,” when describing the auditor’s responsibility under PCAOB standards to obtain reasonable assurance about whether the financial statements are free of material misstatements;
- reorder the standard form of auditor report so that the opinion will appear in the first section;
- add section titles to the report; and
- require that the report be addressed to the company’s shareholders and board of directors or equivalents (additional addressees also are permitted).
Timing and Applicability
The PCAOB took a phased approach to the effective date of the new requirements, thus allowing auditors, audit committees and senior management ample time to prepare for implementation of the CAM disclosure requirements. Subject to any changes by the SEC, the effective dates are as follows:
- new format, tenure, and other information requirements: audits for fiscal years ending on or after December 15, 2017;
- disclosure of CAMs for audits of large accelerated filers: audits of fiscal years ending on or after June 30, 2019; and
- disclosure of CAMs for audits of all other companies: audits of fiscal years ending on or after December 15, 2020.
However, the PCAOB allows for early application by auditors once the SEC approves the final version of the standard.
With specified exceptions, the final standard will apply to all audits conducted under PCAOB standards. CAM disclosure will not be required for auditor’s reports on the financial statements of “emerging growth companies” (EGCs), brokers and dealers, investment companies (other than business development companies) and employee stock purchase, savings and similar plans. Auditors of these entities may choose to include CAMs in the auditor’s report voluntarily.
Lessons from Abroad
For UK companies with a financial year-end of 31 December, this is the third year in which expanded audit reports have been required. Companies with shares listed on the London Stock Exchange (LSE) are subject to a number of overlapping statutory and regulatory requirements, which now result in an audit report usually running to some ten pages with the following contents:
- the opinion on the accounts, which contains a statement that the accounts give a “true and fair view” and a statement that they have been “properly prepared” under the relevant rules;
- a statement as to which parts of the annual report have been audited;
- a description of the audit approach, which includes areas of focus or key risks examined in the audit (for example, for a company which relies on long term contracts, this might refer to issues such as revenue recognition). This is equivalent to CAMs. This will also describe how the audit was approached in a more practical sense (which entities were audited, how much of the company’s business they represent, which teams did the audit, the extent of reliance on other auditors etc.);
- a statement as to the materiality benchmark used. This is usually a percentage of profits;
- the outcome of the auditor’s review of a statement by the directors required to be included in the annual report by the Listing Rules of the LSE as to whether the company is a “going concern” (usually, that they have nothing further to report beyond what the directors have said);
- a statement as to the consistency of certain other sections of the annual report with the audited financial statements; and
- a statement as to whether the report on the directors’ remuneration meets the applicable legal standards.
Typically, auditors also include some paragraphs which delineate the respective responsibilities of the directors and the auditors in preparation of financial statements.
Over the three years since these requirements have been introduced in the UK, investors have become more interested in the “areas of focus” or “key risks” disclosure, and have pressed companies and auditors to ensure that this is specific to the company and its business. Investors expect a clear explanation of the reasons for choosing a particular area of focus, and an explanation of how the risk could have a financial effect on the company. For example, in a recent annual report relating to a chemicals company, one of the key risks disclosed relates to environmental liabilities and the audit report discloses the specific steps which the auditors took in order to assess whether the company’s provisions for these liabilities are adequate. In the case of another highly acquisitive company, the audit report describes what procedures the auditors used to test the company’s views as to the allocation of the purchase price for acquired businesses.
Most LSE-listed companies now include in their annual report a report from their audit committee. It has become common practice for these reports to include reference to the “key risks” identified by the auditors, and to state what additional work the audit committee has done to investigate and assess these risks, as well as the extent of the interaction between the auditors and the audit committee on these specific matters.[v]
What to Do Now
In our view, it is unrealistic to expect that the SEC public notice-and-comment process that lies ahead will result in substantial modifications to the PCAOB’s final auditor report standard. Accordingly, audit committees and senior management should take steps now to consider how, in the relatively near future, AS 3101 is likely to affect their companies’ financial reporting controls and procedures and, in the final analysis, its disclosures.
Perhaps the best way to prepare is to consider SEC expectations with respect to companies’ readiness for adoption of new GAAP – most notably, revenue recognition, leases, and financial instruments – and related ICFR changes. SEC Chief Accountant Wesley Bricker and his staff have been using the bully pulpit repeatedly in recent months to advise audit committees on their oversight responsibilities with respect to making a timely and smooth transition to the new GAAP. Today’s discussions between and among audit committees, senior management and the outside auditors provide a useful forum for exploring whether, were AS 3101 in effect, a matter currently being communicated to the audit committee would have the hallmarks of a CAM and, if so, the type of disclosure that might be triggered. As part of preparation, audit committees and senior management should keep in mind that the PCAOB’s staff will be shining a light during the annual inspection process on the implementation of AS 3101, as a potential gauge of the outside auditor’s degree of professional skepticism.
As to the audit committee’s responsibilities for oversight of the independence and performance of the company’s outside auditor, many investors have joined the SEC staff in scrutinizing the impact of auditor tenure on both independence and audit quality. Recognizing these concerns, some large companies have begun to address the length of the outside auditor’s tenure in their proxy statements, for example, in disclosures relating to management proposals to ratify the audit committee’s engagement of the outside auditor, and/or the type and amount of audit and non-audit fees paid in the preceding fiscal year.
[ii] As identified in the PCAOB Adopting Release (at p. 17), mandatory communications include those prescribed by AS 1301, Communications with Audit Committees, other PCAOB rules and standards (e.g., AS 2410, Related Parties) and applicable law.
[iii] The PCAOB also offered the following examples of communications that would not constitute CAMs: (1) a loss contingency determined to be remote and therefore not recorded in the financial statements; (2) a potential illegal act if an “appropriate determination” had been made that no disclosure in the financial statements was required; or (3) a significant deficiency in internal control over financial reporting (although the existence of the significant deficiency might be an important consideration under the second prong of the test).
[iv] See Possible Revisions to Audit Committee Disclosures, SEC Rel. No. 33-9862 (July 1, 2015). See, e.g., Ernst & Young Center for Board Matters, Audit Committee Reporting to Shareholders in 2016 (September 2016) (E&Y survey relating to “voluntary” audit committee and auditor-related disclosures; only 6% of the Fortune 100 companies responding to the survey indicated that they disclosed matters discussed by the audit committee with the auditor).