November 11, American Institute of CPAs 1211 Avenue of the Americas New York, NY Re: Enhancing Audit Quality

Transcription

1 Deloitte & Touche LLP 10 Westport Road Wilton, CT USA November 11, 2014 American Institute of CPAs 1211 Avenue of the Americas New York, NY Re: Enhancing Audit Quality Deloitte & Touche LLP ( D&T ) is pleased to respond to the request for comments from the American Institute of CPAs (the AICPA ) on its Enhancing Audit Quality Plans and Perspectives for the U.S. CPA Profession (the EAQ discussion paper ). EXECUTIVE SUMMARY Audit quality is a topic of critical importance to the integrity of the financial reporting system, and we support the AICPA s efforts to improve audit performance and address quality issues related to financial statement audits of private entities. Audit quality needs to keep pace with emerging economic, business, financial and regulatory conditions. The AICPA has an important role to play in supporting the efforts to maintain and improve audit quality and to protect the public interest, and we stand ready to assist the AICPA. In response to the AICPA s invitation to submit comments, we undertook an effort to explore additional steps that could be considered by the AICPA in connection with the EAQ discussion paper. We recognize that the proposed and planned changes described in the EAQ discussion paper represent both near and longer-term efforts being considered by the AICPA. As a result, our recommendations herein focus on the areas of near-term enhancements that have been put forth by the AICPA (Phase 1). We acknowledge that the AICPA will publish a concept paper detailing proposed changes to the peer review program that will be focused on longer-term improvements (Phase 2). We look forward to providing additional feedback and suggestions with respect to the Phase 2 proposed changes once they are issued for public comment. Our recommendations in this letter are intended to offer constructive suggestions to help ensure that the changes the AICPA adopts improve: Audit quality; The clarity of auditor and peer review responsibilities; and The tools necessary to enhance learning and information sharing. 1

2 However, in order to meet these objectives, more can, and should, be done in connection with enhancing audit quality and the peer review program. Of our recommendations included herein, we believe the most significant improvements could be achieved by: Establishing a required accreditation program for auditors performing audits in certain specialized industries (e.g., employee benefit plans and governmental audits); Requiring engagement quality control reviews for all attest engagements; Enhancing the required skills of those performing peer reviews; Analyzing peer review trends for root causes at the profession level (i.e., through the AICPA) and sharing such information with the profession in order to enhance audit performance; and Creating a council comprised of various boards and committees at the AICPA (e.g. Auditing Standards Board ( ASB ), Peer Review Board ( PRB ), the Financial Reporting Executive Committee ( FinRec )) to provide a mechanism for sharing information and creating a continuous feedback loop between the groups. Such a group would help to foster dialogue regarding issues as they arise, assist in determining appropriate responses, and help to enhance audit quality. We discuss these recommendations as well as additional suggestions for consideration in the Enhancing Audit Quality section below. ENHANCING AUDIT QUALITY Competence and Due Care We support the AICPA s efforts to reinforce the critical importance of due care, competence, and diligence discussed in the EAQ discussion paper. In particular, we support the following: Aligning the CPA exam with real-world practice for newly licensed CPAs so that candidates who pass the exam demonstrate the audit competencies the marketplace demands. Ensuring that all CPAs who perform financial statement audits adhere to the requirements in the AICPA Code of Professional Conduct (the Code ), including but not limited to competence and due care. In addition, we offer the following suggestions to reinforce and enhance the focus on appropriate competence and due care: The AICPA should consider establishing further accreditation or certification programs in certain specialized industries that require additional skill and/or knowledge (e.g., employee benefit plan and governmental audits), such that: o Audit firms demonstrate that their partners/staff have the required skills and knowledge to perform audits in certain specialized industries. The AICPA should develop an accreditation program similar to other professions where individuals must demonstrate the appropriate level of training and experience and credentials before conducting audits in certain specialized industries. 2

3 Auditing and Quality Control Standards We support the AICPA s initiative related to enhancing auditing and quality control standards as discussed in the EAQ discussion paper, including: Monitoring the need for new or revised auditing and attestation standards, considering the need for additional supplemental guidance and providing additional education and tools, as deemed necessary and useful. We also continue to support the objective of the ASB to converge its standards with the International Auditing and Assurance Standards Board ( IAASB ), while avoiding unnecessary differences with the Public Company Accounting Oversight Board ( PCAOB ). o We believe that because the standards are principles-based, implementation guidance and leading practice examples are most useful to guide practitioners in the application of the standards. Identifying and better understanding where and how audit deficiencies occur and their root causes so revisions can be made to the appropriate standards and/or guidance. Identifying ways to leverage technology to deploy new methodologies that will contribute to the effectiveness, timeliness and efficiency of the audit process. In addition, we offer the following suggestions to further enhance the standards of the AICPA: Continue to improve the interaction of the ASB with the PRB and enhance the feedback loop between peer review and standard setting. As discussed previously, we believe this could be achieved by establishing a council comprised of various boards and committees of the AICPA to help share trends in emerging issues and peer review findings and develop appropriate responses as issues arise. o As mentioned in the Practice Monitoring section below, one of the PRBs initiatives is to analyze findings identified in peer reviews in order to pinpoint industries and risk areas (such as risks of material misstatement, engagement and quality control risks) that require particular attention. We also believe this analysis should be shared with auditors so they can work on improving the quality of their performance during the audit process (rather than such information being used by peer reviewers after the audit has been completed). For example, this information could be disseminated in industry and risk alerts. Require mandatory engagement quality control reviews ( EQCR ) for all attest engagements. o We believe that engagement quality control reviews provide significant benefits by having an individual or individuals objectively review the work performed by the engagement team, challenge the conclusions reached on significant matters, and consider the appropriateness of the report to be issued by the firm. The reviews encourage discussion of diverse views, and resolution of differences of opinion. In addition, engagement quality control reviews enable a 3

4 firm to manage the familiarity threat that exists when an engagement team or practitioner-incharge has spent a number of years working on an engagement. The EQCR should be performed by a qualified person who is not part of the engagement team with sufficient and appropriate experience to evaluate judgments made and conclusions reached by the engagement team. o If no such person is employed by the audit firm, require the audit firm to hire an outside third party to perform the EQCR review. Although requiring such a review on every engagement may seem overly burdensome to smaller firms or smaller engagements, we believe that the benefits of an engagement quality control review apply regardless of the size of a firm or the size of an engagement. Further strengthen quality control standards to improve audit quality: o We support the ASB s plan to consider the need for more specificity in the quality control standards particularly those regarding engagement acceptance, engagement team competency, engagement quality reviews and firm s monitoring and inspection of its system of quality controls. Both the IAASB 1 and the PCAOB 2 have current projects related to quality control, and we would encourage the AICPA to continue to monitor these projects and consider potential ways to leverage the outcomes, as appropriate. o Consider encouraging firms to leverage the COSO Internal Control-Integrated Framework in designing policies and procedures to effectively apply quality control standards to their practice. o In considering both improvements to the quality control standards and encouraging use of the COSO Framework, the AICPA should also provide for sufficient flexibility to allow firms of all sizes to decide the best way to apply quality control standards to their practice. Clear assignment of quality control responsibilities: o Consider requiring firms to appoint a person responsible within the firm (e.g., a quality control officer) with authority, responsibility, and resources to effectively monitor and oversee the firm s quality control system, including engagement acceptance and continuance, assignment of partners and EQCR to specific engagements based on their knowledge and experience. 1 The IAASB has included a quality control initiative as part of its work plan, including possible revisions of International Standard on Quality Control 1, Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements and International Standard on Auditing 220, Quality Control for an Audit of Financial Statements. 2 The PCAOB has a standard setting project on its agenda related to Quality Control Standards, Including Assignment and Documentation of Firm Supervisory Responsibilities. In addition, the PCAOB has an Audit Quality Indicators initiative underway which seeks to develop a portfolio of measures of audit quality that may provide information and tools to generate greater insight into audit quality, which is related to audit quality more generally (rather than the quality control standards directly). 4

5 Guidance, Tools, Learning and Resources We support the AICPA s initiative related to guidance, tools, learning and resources discussed in the EAQ discussion paper, including: Enhancing curricula, content and methods of instruction to support the major topical areas the profession serves, including challenging areas such as employee benefit plan audits, governmental audits and financial reporting. Considering and developing a profession-wide competency framework which will allow professionals to understand their current level of competency in a particular area as well as areas where growth or improvement is needed. Developing additional and updating the currently available resources that provide implementation guidance for audit, attest and compilation and review standards based upon the findings uncovered in peer reviews. In addition, we offer the following suggestions to further enhance guidance, tools, and resources available to auditors: We support requiring all firms that perform audits of employee benefit plans or governmental audits to be members of the applicable AICPA Audit Quality Center so that they have ready access to the guidance and resources available for performing audits in these specialized areas. This would also ensure that the AICPA is informed of the firms performing these types of audits and has a mechanism in place for providing updates to these practitioners on a proactive basis and in a timely manner. o The AQ Centers can be an important vehicle to provide guidance and updates necessary for its members to stay current on the issues relevant to the services they perform; however, some practitioners are not aware of the AQ Centers and/or the resources that are available therein. Therefore, in addition to creating an AC Center membership requirement, the AICPA should also be more active in promoting the resources available at the AQ Centers. For example, the AICPA should have communication guidelines in place to ensure that the alerts published by the AQ Centers regarding updates to guidance and/or standards are sent to an appropriately identified individual within each AC Center member firm, and that the firm contact has accepted the responsibility and agreed to further disseminate the information to all the auditors within the firm that perform audits of employee benefit plans or governmental audits. Similar to the suggestion above to improve the interaction between the ASB and the PRB, we also recommend continuing to improve the interaction between the PRB and the AICPA groups that develop and provide tools to audit practitioners. This may also be accomplished through establishing the council of AICPA boards and committees as previously discussed. 5

6 o One of the examples of where the feedback loop between peer review and auditors could be improved is through leveraging the AICPA peer review checklist for governmental audits. We note that this peer review checklist is more extensive than the tools typically being used by some of the practitioners performing governmental audits. We suggest that some of the elements from the peer review checklist be incorporated into the guidance provided to auditors. Consider requiring practitioners that perform audits in specialized industries to focus their learnings in those industries rather than satisfy a general hours-based education requirement. From our experience, we have found that training by industry designation has been the most effective learning approach to improve competencies and share leading practices. We believe the Audit and Accounting industry guides that are published by the AICPA continue to be a helpful resource. We support continued issuance of such guides to provide timely and relevant information to auditors. o Consider leveraging the findings from peer reviews and related root cause analysis of audit deficiencies when Audit and Accounting guides are updated and incorporating lessons learned as a way to further enhance the usefulness of these guides. The AICPA annually issues audit alerts that provide developments for auditors to be aware of generally and for specific industries/areas. We continue to support the issuance of these alerts. o Similar to the above, consider leveraging the findings from peer reviews and related root cause analysis of audit deficiencies when issuing audit alerts to further enhance the usefulness of these alerts. o Ensure that the guidance discussed in the risk alerts is consistent across the various industries, when appropriate and applicable. We also support the AICPA exploring other formats for communicating key issues (e.g. new risks identified due to changes in the economic environment) throughout the year in order to provide guidance in the timely manner. For example, the AICPA should consider having a system in place to issue updated alerts and/or develop online training to quickly respond to issues and/or changing requirements rather than wait for the annual updates to the Audit and Accounting guides discussed above. Practice Monitoring We support the AICPA s initiative related to near-term improvements to practice monitoring discussed in the EAQ discussion paper, including: Enhancing the quality of peer reviewers by introducing a streamlined process for barring reviewers who do not meet required performance criteria. However, we also suggest that the required performance criteria be clearly defined. 6

7 Requiring that all reviewers of must-select 3 engagements should come from firms that are members of the applicable AICPA AQ Center. Developing a framework under which the reviewers of must-select engagements would attend industry-specific training that would incorporate a learning assessment. Requiring all new team captains to participate in an AICPA peer reviewer curriculum that would include interactive web-based education divided into topical modules with a competency exam at the conclusion of each module. If significant audit deficiencies continue to be identified after implementing mandatory EQCR (as described above), we would support consideration of further actions including the following: o As suggested by the AICPA, requiring firms that fail to conform to applicable professional standards in all material respects on a significant portion of the audits reviewed in a mustselect category to engage a third party to perform pre-issuance reviews on future audits with respect to the particular industry where deficiencies were identified. These pre-issuance reviews would be performed until the deficiencies have been remediated. Note, we do not believe this should be limited to the firms performing five or fewer audits in a must-select category (as suggested in the EAQ discussion paper), as it should be applicable to all firms that have a pattern of material findings of noncompliance in their industry practice in a must-select category. However, similar to the above, we believe other options such as accreditation and required mandatory EQCR should be implemented first, and this further action considered only if those options do not result sufficient improvements in quality. Requiring a post-issuance review of an engagement in a new (for the firm) must-select industry that was not covered by its most recent peer review and requiring corrective action if the firm failed to comply with applicable professional standards. However, similar to the above, we believe a consideration should be given to other options first (e.g. accreditation and a required mandatory EQCR). Focusing firms and peer reviewers on high-risk audit areas and certain industries using a combination of training and robust reviews. In addition, as discussed in Auditing and Quality Control Standards section above, we believe that the PRB analysis of environmental trends, standards changes, and issues identified in peer reviews of risk areas that require particular attention from peer reviewers should be used by auditors to improve audit quality rather than in the first instance be used by peer reviewers. 3 In a system review, the peer reviewer must select for review at least one of each type of engagement subject to Government Auditing Standards (GAS) or that involve, Employment Retirement Income Security Act (ERISA), the Federal Deposit Insurance Corporation Improvement Act (FDICIA), carrying broker-dealers, or Service Organization Control (SOC) 1 or 2 reports. Additionally, if the firm performs engagements of entities subject to OMB Circular A-133, at least one such engagement must also be selected for review. 7

8 Establishing systems to facilitate the identification of the firm and engagement populations subject to peer review. Taking action when an investigation reveals a firm has failed to provide the AICPA Peer Review Program with a complete list of engagements that should be subject to review. Having a national group of technical experts reporting directly to the PRB perform surprise evaluations (i.e. re-inspections) of must-select engagements after the peer review has been performed, but before it has been finalized (accepted and issued). o We believe that this group of technical experts could be comprised from a dedicated pool of experienced professionals meeting accreditation criteria who are all AICPA members and that volunteer 1-2 weeks a year to assist with re-performing peer reviews. Evaluating results of the above referenced re-inspections to determine whether corrective action should be required of the reviewed firm and if there were any issues with the performance of the peer reviewer by comparing the results and findings to the original peer review. o If deficiencies are identified during the re-inspection process, that original peer reviewer would be required to analyze the results and respond with the reasons for the differences and any deficiencies. This could result in remediation and development of a quality improvement plan as well as the firm being disqualified from performing peer reviews, until such time as the firm and/or relevant reviewers could attend further industry-specific training and pass the related competency exam. As mentioned in our suggestions below, we support forming a research and analysis group and tasking this group of experts with identifying the root causes of non-compliance with professional standards and communicating the issues identified to the appropriate division of the AICPA or training providers. Exploring ways in which peer review reporting can better articulate the information users find meaningful. To achieve this, the AICPA should identify the key users of the peer review reports and evaluate what information would be most meaningful to them. Based on this analysis, the AICPA should explore the best ways to convey and report the peer review results. In addition, we offer the following suggestions to enhance practice monitoring: As discussed previously, consider requiring audit firms that perform audits in certain specialized industries to be accredited in those industries. We believe that such an accreditation program must first be addressed in the quality control standards and then tested in peer review. As discussed previously, require mandatory EQCR for all attest engagements. Once such requirement is included in the standards, compliance with the standards would be tested through peer review. 8

9 We believe it would be appropriate to enhance the focus in peer reviews on certain high risk areas; however, we also believe peer reviewers should continue to evaluate all areas of an audit engagement. We do not support revising the peer review approach to only focus on areas of particularly high risk, as deficiencies are often identified in other areas of the audit. Further, if the reviewer were to focus only on areas of high risk, we do not believe enough work would be performed to be enable a reviewer to properly conclude with respect to the outcome of the peer review. Consider assigning an electronic ID number to each AICPA firm member and require that all attestation reports issued be linked to the specific firm s electronic ID number. Consider creating a filing database accessible to the companies, auditors and other parties such that audit reports issued could be verified. Consider using the research and analysis group (mentioned above) to analyze peer review trends and areas of repeat findings for all types of engagements, and provide insights to the profession regarding the deficiencies identified in all peer reviews and related root causes (in order to share knowledge and improve quality overall). The AICPA should also consider coordinating with the CAQ and the PCAOB and other regulators to bring together all parties interested in continuous improvements for the profession. Consider establishing a process to share information regarding overall trends in audit practice challenges and leading practices with others (e.g. PCAOB, Department of Labor) in order to improve the quality of all audit engagements. Consider establishing within peer review standards a more formal remediation process when engagement deficiencies in peer review have been identified. For example: o Provide more structure with respect to remediation plans and the process to evaluate progress towards remediation plans. o Perform a review of remediation working papers to ensure deficiencies have been addressed. Consider providing additional transparency regarding peer review by creating a requirement for auditors to communicate with those charged with governance: 1) whether the firm has been subject to peer review in the particular industry/specialized area and 2) the results of peer reviews. * * * D&T appreciates the opportunity to provide our perspectives on these important topics. Our comments are intended to assist the AICPA in analyzing the relevant issues and potential impacts. We encourage the AICPA to engage in active and transparent dialogue with commenters as proposed changes are 9

10 considered. If you have any questions or would like to discuss these issues further, please contact Joseph Ucuzoglu at or William Platt at Very truly yours, Deloitte & Touche LLP 10