In remarks at an accounting conference, PCAOB officials stated that economic volatility due to the COVID-19 pandemic has presented difficulties for management in estimating loan loss provisions. Officials also gave updates on inspection observations about internal controls over financial reporting (ICFR), CECL implementation, and remediation of deficiencies.
The panel took place September 20, 2021, at the Conference on Banks & Savings Institutions hosted by the American Institute of Certified Public Accountants (AICPA) and the Chartered Institute of Management Accountants (CIMA). The panel was presented by two PCAOB officials: Barbara Vanich, acting chief auditor and director of professional standards, Office of the Chief Auditor, and Glenn Tempro, associate director, Division of Registration and Inspections.
2020 results. According to Tempro, the PCAOB inspected more than 150 audit firms in 2020, and reviewed portions of approximately 650 audits of publicly public companies. Of those inspections, approximately 20 percent related to financial institutions audits, which is within the traditional range of between 17 and 20 percent.
In response to a question why 20 percent of the inspections were of banks when only 1 percent of issuers are banks, Tempro said that risk-based selection has historically driven the emphasis, as banks are a very large portion of the market cap of the public float.
In 2020, the PCAOB refined its inspection procedure to increase focus on areas most likely to be affected by the pandemic and related economic uncertainty. This included leadership communications, consultation requirements, client acceptance and continuance procedures, real time monitoring and pressure interviews.
Errors and deficiencies. The most common errors selected in audit reviews continue to relate to loans and the associated allowance for loan loss estimates and investment securities, including derivatives, said Tempro. The PCAOB issued the highest number of comments in relation to these areas. This is consistent across U.S. and non-U.S. inspections of global network firms and non-affiliated firms.
The most common deficiencies relate to auditors not sufficiently testing significant inputs and assumptions, said Tempro. This includes instances where auditors did not evaluate evidence that supported changes or lack of changes or test the accuracy and completeness of the information used to develop the allowance for loan loss estimates. For example, in testing the allowance for loan loss in most instances, auditors typically reviewed management's memorandum describing assumptions used in determining the allowance. However, in some cases, the auditors did not evaluate evidence supporting any assumption changes from the prior year, or a lack of changes, when evaluating the reasonableness of such assumptions.
The PCAOB observed deficiencies related to the auditor's procedures to evaluate the reasonableness of certain assumptions used to determine the fair value collateral of loans that were individually evaluated for impairment. The agency also observed deficiencies related to the audit procedures to evaluate significant inputs and assumptions used in developing the loan loss estimate component related to loans collectively evaluated for impairment. Examples include probability of default loss given default and historical defaults and loss information.
According to Tempro, in most instances, the auditor's procedures are limited to reading documents prepared by the financial institution, such as Model Validation Reports, testing the mathematical accuracy of the allowance calculation, comparing certain amounts to supporting documentation, and comparing the allowance balance to the general ledger. The auditors did not always explore how these inputs and assumptions were developed or sufficiently test the reasonableness of the important inputs and assumptions used to calculate the allowance.
Internal controls over financial reporting (ICFR). Another recurring audit deficiency relates to testing of ICFR, said Tempro. The PCAOB noted that some auditors did not test the design and operate operating effectiveness of controls that include a review element; identify and select controls for testing that address risks of material misstatement; and test controls over the accuracy or completeness of issues or prepared data or reports using the operation of the controls.
For example, the PCAOB noted instances where the authors did not evaluate the scope of the review activities performed by the control owners in order to ensure the appropriateness of credit risk grades and the collateral used; whether the judgments in performing those activities were reasonable and supportable; the criteria used by the owners to identify matters for investigation when performing those activities; and the ultimate resolution of such items.
In the area of investment securities, the PCAOB noted instances where the auditors did not test the aspect of the control over obtaining an understanding of the methods and assumptions used in the valuation of available for sale securities. Another deficiency was the failure to test a control that addresses the observability of pricing inputs at the individual security, at the individual instrument level related to the determination of the classification of its financial instruments within the fair value hierarchy.
2021 inspections: shift in approach and focus. According to Tempro, the PCAOB believes that the way the agency selects engagements to review and the areas it focuses on may have become increasingly predictable. As a result, the PCAOB aimed to enhance the overall unpredictability of inspections by significantly increasing the percentage of audits selected randomly. The agency also selected more non-traditional focus areas for review.
In addition, as part of the PCAOB’s goal of achieving a more preventative regulatory approach, the agency has continued its enhanced focus on firms’ quality control systems. The PCAOB’s procedures in this area include gaining or updating an understanding of the design of a firm's quality control system through inquiry and reviewing documented policies and procedures. The PCAOB is also gathering information on changes that firms are making to their quality control systems, which may be in response to new or changing regulatory, environmental or firm specific factors.
Focus on COVID-19 pandemic. The PCAOB has continued to conduct inspections remotely due to the COVID-19 pandemic, and in general that has gone fairly well, said Tempro. He expects that to continue through the end of the 2021 inspections. In future years, he does not envision the PCAOB continuing to operate in a fully remote environment, particularly for some of the larger, more challenging audit reviews. But there may be the possibility of a hybrid model going forward, with staff being out in the field for shorter periods of time.
Tempro observed that PCAOB designed its 2021 inspection to directly focus on the effects of the pandemic on public companies’ financial reporting.
- The PCAOB selected audits for review in industries experiencing particularly significant disruption due to the pandemic, such as transportation, entertainment, hospitality, manufacturing, certain aspects of the retail segment, and commercial real estate, including REITs.
- Inspections this year have focused on certain financial statement items and other reporting matters that have been particularly affected by the pandemic, such as impairments, going concern assessments, the allowance for loan loss, and the increased risk of fraud as a result of the pandemic.
Based on what the PCAOB has seen and repeatedly heard from engagement teams, auditors and financial institutions appeared to have put in the necessary work to get ready for CECL. Most of the challenges the PCAOB has noticed in this year's inspections generally do not relate to CECL implementation.
The COVID-19 pandemic has posed the main challenge for management in estimating the loan loss provision. The impact of pandemic considerations such as the government relief programs have caused many financial institutions to experience significant volatility and provision levels over the course of the year. The PCAOB also observed instances where financial institutions had to rely much more heavily on qualitative adjustments to the model outputs than perhaps they had in the past, again due to the pandemic.
Remediating deficiencies. Tempro noted that staff guidance about the remediation process is available on the PCAOB website. Staff looks at five criteria in evaluating how a firm proposes to address a quality control criticism in part two of their inspection report.
One criteria is relevance, said Tempro. To identify relevant remedial actions, firms should perform a root cause assessment to determine why the deficiencies occurred. The assessment should evaluate positive as well as negative occurrences to understand how or why in those cases, the engagement team was able to perform the audit in accordance with PCAOB standards and firm policies.
The PCAOB has seen firms enhance their risk assessment process in several ways:
- Firms are identifying more specific risks tailored to the particular issue or being audited, as opposed to more general risks that might be developed from a drop-down menu in a template.
- Some firms have established new policies requiring engagement partners to take a more active and timely role in the development and review of those risk assessments.
- Firms are focusing on enhancing their understanding of the issuer's important processes, through better walkthrough procedures and documentation, including the use of flow charts along with narrative memorandums, as opposed to very long detailed narrative-type memos.
- Some firms have implemented guidance requiring engagement leadership to be more involved in this process, including more active involvement in planning for these walkthroughs, such as participating in key meetings involving the walkthroughs.