On October 23, 2017, the Securities and Exchange Commission ("SEC") unanimously approved1 the Public Company Accounting Oversight Board's ("PCAOB") proposal to adopt a new auditing standard, AS 3101, The Auditor's Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion, and related amendments to other auditing standards (collectively, the "New Standard")2.
This project began in 2010, with PCAOB staff outreach to investors, auditors, preparers of financial statements, audit committee members, and other interested parties, which was followed by the June 2011 concept release to seek public comment on potential changes to the auditor's reporting model. The New Standard reflects the PCAOB's position that auditors review a significant amount of information during the audit process, while they ultimately disclose very little of that to investors. The New Standard marks the first major change to the standard form of auditor's report in 70 years and will significantly revise the auditor's report by: (i) requiring communication of critical audit matters ("CAMs") (as described below), and (ii) implementing additional content requirements and formatting changes to improve the utility, organization and readability of auditor's reports.
The changes regarding the new auditor's report format, auditor tenure, auditor independence, and other information (excluding communication of CAMs) will become effective for all audits relating to fiscal years ending on or after December 15, 2017. CAM requirements will be phased-in for large accelerated filers for audits relating to fiscal years ending on or after June 30, 2019 and for all other companies for audits relating to fiscal years ending on or after December 15, 2020. Auditors may voluntarily comply early. CAMs requirements will generally apply to all audit reports filed with the SEC, including by foreign private issuers, but will not apply to audit reports of emerging growth companies, certain brokers and dealers, investment companies other than business development companies and benefit plans. However, the New Standard permits voluntary inclusion of CAMs in the auditor's report for such entities. Furthermore, all other provisions of the New Standard apply to the audits of such entities.
This client alert summarizes the new requirements and outlines certain practical considerations in preparation for compliance.
Critical Audit Matters
The New Standard will require an auditor's report to disclose any CAMs arising from the current period's audit, or to state that the auditor determined that there were no CAMs for that period. A CAM is defined as any matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee and that: (i) relates to accounts or disclosures that are material to the financial statements; and (ii) involved especially challenging, subjective, or complex auditor judgment. In determining whether a matter rises to the level of a CAM due to its involving especially challenging, subjective, or complex auditor judgment, auditors are directed to take into account:
- the auditor's assessment of the risks of material misstatement, including "significant risks" 3 ;
- the degree of auditor judgment related to areas in the financial statements that involved the application of significant judgment or estimation by management, including estimates with significant measurement uncertainty;
- the nature and timing of significant unusual transactions and the extent of audit effort and judgment related to these transactions;
- the degree of auditor subjectivity in applying audit procedures to address the matter or in evaluating the results of those procedures;
- the nature and extent of audit effort required to address the matter, including the extent of specialized skill or knowledge needed or the nature of consultations outside the engagement team regarding the matter; and
- the nature of audit evidence obtained regarding the matter.
For any CAMs, the auditor must include disclosure in its auditor's report that identifies the CAM, describes the principal considerations that led the auditor to determine that the matter is a CAM, describes how the CAM was addressed in the audit, and refers to the relevant financial statement accounts or disclosures. As a result of these requirements, the auditor's report may now contain a substantial discussion of the most sensitive issues relating to the financial statements, and may thereby provide a valuable insight into the most pertinent aspects of the audit process.
In response to comments to its proposed rules, the PCAOB clarified that (i) the determination that there is a significant deficiency in internal control over financial reporting, in and of itself, cannot be a CAM (as it does not relate to an account or disclosure that is material to the financial statements, even though it might involve especially challenging, subjective or complex judgement); (ii) a potential illegal act, if an appropriate determination had been made that no disclosure of it was required in the financial statements, would not meet the definition of a CAM; and (iii) a potential loss contingency that was communicated to the audit committee, but that was determined to be remote and was not recorded in the financial statements or otherwise disclosed under the applicable financial reporting framework, would not meet the definition of a CAM.
Content and Formatting Changes to the Audit Report
The New Standard also includes a number of other changes to the auditor's report that are primarily intended to clarify the auditor's role and responsibilities related to the audit of the financial statements and to revamp the report's organization and formatting to make it easier to read. These changes include, among other things:
- Auditor tenure—Audit Reports must include a statement disclosing the year in which the auditor began serving consecutively as the company's auditor. While there is already a growing trend of voluntary disclosure, such disclosures are not included for a significant number of audits, are not uniform and are not always included in the same place; therefore, mandating inclusion of this information could make it more readily available, especially for retail investors. Auditor tenure under the New Standard includes the years the auditor served as the company's auditor both before and after the company became subject to SEC reporting obligations;
- Independence—Audit Reports must include a statement regarding the requirement for the auditor to be independent, for example that "the auditor is a public accounting firm registered with the PCAOB (United States) and is required to be independent with respect to the company in accordance with the US federal securities laws and the applicable rules and regulations of the SEC and the PCAOB";4
- Addressee—The report will be addressed to the company's shareholders and board of directors or equivalents (additional addressees are also permitted);
- Amendments to basic elements—Changes to certain standardized language in the report, including adding the phrase "whether due to error or fraud," when describing the auditor's responsibility under PCAOB standards to obtain reasonable assurance about whether the financial statements are free of material misstatement; and
- Standardized form of the auditor's report—Requiring the opinion to appear in the first section of the auditor's report, and adding section titles to guide the reader.
Practical Considerations for Management and Audit Committees
Overall, the New Standard is designed to elicit tailored, audit-specific information from the auditor's point of view in order to make the auditor's report more relevant and useful to investors and other market participants in assessing a company's financial reporting and making capital allocation and voting decisions. While some commenters were concerned that the disclosures could be duplicative, contradictory or boilerplate, the PCAOB clarified that CAMs “aim to provide investors with the auditor's unique perspective on the areas of the audit that involved the auditor's especially challenging, subjective, or complex judgments. Limiting critical audit matters to these areas should mitigate the extent to which expanded auditor reporting could become standardized. Focusing on auditor judgment should limit the extent to which expanded auditor reporting could become duplicative of management's reporting.”
In preparation for compliance, given the complexity and sensitivity of the issues involved, companies should consider taking the following steps:
- Begin a Dialogue with Auditors—Start discussions with auditors now with respect to how the New Standard will be applied. For certain companies listed internationally, audit firms are already required to communicate information similar to CAMs, and this could provide a guideline for implementation.
- Establish Procedures to Assess Potential CAMs—Begin audit committee assessment of what types of matters could be considered CAMs. In advance of implementation, management and audit committees may want to initiate a dialogue with auditors to better understand how the auditors expect to approach the CAM requirements in the context of their particular company, what matters may merit this designation and what disclosures the auditors would anticipate making in their auditor's reports. A hypothetical review of the prior year's audit could be informative in this respect.
- Establish CAM Notification Procedures—Audit committees should establish with their independent auditors a process for receiving timely notification of any intention to disclose a CAM and the information that the auditor intends to include in its report about the matter. Once the New Standard is implemented, additional time should be allocated for the audit committee, other executives and legal counsel to discuss and review the auditor's report.
- Monitor Potential Disclosure Discrepancies—Be cognizant of the possibility that the disclosure of a CAM by the auditor in the auditor's report could result in disclosure of original information, which may compel the company to provide its own disclosure. Management should pay close attention to any differences between the CAM disclosures in the auditor's report and management's disclosures in its filed documents concerning the same matters in the management discussion and analysis, notes to the financial statements, risk factors, evaluation of disclosure controls and procedures and internal controls over financial reporting disclosures. In addition, given that the new auditor's report discussion will reflect the auditor's perspective, which is inherently different from management's perspective, in some cases management may wish to revise or supplement its own disclosures on a matter in order to ensure that an accurate and complete picture is disclosed.
- Consider Enhanced Proxy Disclosure—In light of the requirement to disclose auditor tenure, companies with long-tenured auditors may consider enhanced disclosure in their proxy statements addressing the benefits of having a long-term relationship with their auditor, such as institutional knowledge and higher quality audits, as well as how the audit committee monitors auditor independence.