Public Accountants Continue To Overwork Internal Control Testing

May 2007

One does not often hear a government regulator say that too much effort is being spent following its requirements. But, that continues to be the message from the Securities Exchange Commission and the Public Company Accounting Oversight Board (PCAOB). Unfortunately, this is not the first time that this message has been delivered. (For example, see PCAOB and SEC Continue to Blame Auditors for the High Cost of Section 404. This was written a year ago.)

The PCAOB issued a 13-page report in April 2007 that assessed the second-year implementation of the PCAOB’s Auditing Standard 2 (AS2). AS2 addresses how to perform an audit of internal controls over financial reporting, and implements Sections 103 and 404 of the Sarbanes-Oxley Act (SOX).

It would appear that the auditors who are performing the unneeded work are just making too much money to stop. The lack of competition among the largest accounting firms is preventing management from better controlling these costs.

The PCAOB’s current inspection report reviewed portions of 275 audits conducted in the second year after implementing AS2. The report mentioned that improvements occurred over the first year (which was generally viewed as an inefficient mess). However, the report was critical of auditors for incurring time (and of course, earning money in the process) on unneeded tasks. Although the PCAOB had a longer list of suggestions, the PCAOB listed the following items as being most important:

1. Some auditors did not integrate their audits of financial statements with the audit of internal accounting controls, effectively performing two separate engagements, sometimes even using two separate teams.

2. Some auditors failed to apply a top-down approach to testing controls. A top-down approach addresses company-level controls, and then “works-down” to significant areas. This allows the auditor to address important matters early that can have an impact on subsequent decisions and testing.

3. Some auditors assessed the level of risk at too low a level of detail, resulting in spending more effort testing areas of low risk.

4. Some auditors could have relied on the work already performed by others who are sufficiently competent and independent. In so doing, reliable existing conclusions were ignored.

Section 404 of the Sarbanes-Oxley Act continues as a big gift to the large accounting firms, who get to audit management’s assessment of financial reporting controls. Not surprisingly, the public accountants have not been interested in giving up this rich source of work. Having only four realistic alternatives of accounting firms for this work hampers competition for clients that would more rapidly bring the large accounting firms into line. Therefore, the regulators are left with jawboning the large accounting firms into a more reasonable position. Consequently, the PCAOB continues to place the efficient implementation of SOX section 404 as a high priority.

Because of the high cost of SOX Section 404 testing, the SEC has allowed smaller public companies (those with less than $75 million in market capitalization) to delay Section 404 compliance. In the short run, it is a good idea to delay implementation until the public accountants can get it right. However, in the long run, small public companies need to be held to a higher standard. Investors appropriately view the smaller companies who do not have the additional testing and controls as being more risky. This reduces the small companies’ already restricted access to capital markets.

Because of problems with the cost of controls testing, the PCAOB proposed a new auditing standard, which has commonly been referred to as AS5. The revised standard is expected to be approved by the SEC in the next two months.


Fulcrum Inquiry is a forensic accounting firm. We regularly provide financial and economic expert testimony.