In December of 2012, the PCAOB issued a report summarizing the findings from their review of the 2010 audits for eight registered accounting firms [1]. The report specifically identified that an area of deficiency among the firms was the testing of internal controls during their audits. In response, auditors have been investing significant effort into performing walk-throughs of the design of processes and testing of the operating effectiveness of controls.
Given the additional scrutiny on controls from an audit perspective, we examined filings of companies with a market cap between $100 million and $1 billion from January 1, 2013 to July 31, 2013 to identify recent trends in the deficiencies that these companies identified as material weaknesses. The breakdown of these material weaknesses by category is shown in the chart on the preceding page. Two of the top areas where material weaknesses were identified continue to be within financial reporting and tax provision preparation and disclosure.
Key controls within the financial reporting process may include:
- Monthly comparisons of budget and actual results to forecasts for revenues and expenses;
- comparisons of other metrics, such as profit margins and certain expenses as a percentage of sales;
- and quarterly balance sheet reviews.
These review controls were identified within the PCAOB report as one of the most pervasive deficiencies in public accounting firm’s auditing of internal control. As a result of the PCAOB findings, these review controls have received heightened scrutiny during the early part of 2013.
Deficiencies in management review controls typically arise from:
- Insufficient level of precision of review;
- Improper application of judgment; and
- Lack of proper follow up, resolution and documentation for investigated items.
Management review is frequently identified as a compensating control in other areas where control deficiencies already exist. Therefore, further stressing the importance of having adequate review controls operating effectively with a sufficient level of precision and documentation is critical to an effective control environment.
Testing these types of controls presents a challenge, not just for the company, but also for its auditors. Evaluating and assessing the effectiveness of management review and judgments is a complex process given the difficulty involved in corroborating the adequacy of these activities with other evidence. To reduce the occurrence of deficiencies and address increased audit scrutiny around review controls, companies should implement a process to thoroughly document:
- Control processes;
- accounting guidance applied;
- judgments made by management;
- considerations identified through the review process;
- items investigated; and
- the results and conclusions of the review.
Companies may implement checklists to assist management in documenting the actions taken, but should avoid a “check the box” mentality that does not adequately investigate key judgments and areas of risk.
Auditing Standard No.5 (“AS No. 5”) prescribed a top-down approach to implementing a risk-based control structure. Companies’ application of AS No. 5 could increase the risk of not designing controls, specifically management review controls, to a level of precision sufficient to identify misstatements. This exposes companies to control deficiencies. As these controls will become subject to a more detailed level of audit examination, we recommend that all companies, whether subject to the requirements of Sarbanes-Oxley or not, assess whether their management review controls are sufficient to address the applicable risk, specifically with the onset of the year-end process for many companies.
[1] “Observations from 2010 Inspections of Domestic Annually Inspected Firms Regarding Deficiencies in Audits of Internal Control over Financial Reporting” PCAOB Release Number 2012-006, December 10, 2012.