PCAOB Advice for Audit Committees on CAMs
By Dan Goelzer
On July 11, the Public Company Accounting Oversight Board released Critical Audit Matters: Insights for Audit Committees to assist audit committees in understanding the new requirement that auditors include a discussion of critical audit matters (CAMs) in their audit reports. While it does not break any new interpretive ground, Insights for Audit Committees is a short, understandable overview of some of the basic issues that audit committees should be aware of regarding CAM reporting. The paper includes sample questions as a catalyst for an audit committee dialogue with the auditor about CAM implementation.
Beginning for large accelerated filers with fiscal years ending on or after June 30, the auditor’s report must include a discussion of CAMs identified during the audit. With some exceptions (such as emerging growth companies, broker-dealers, and investment companies), the CAM requirement takes effect for all other companies that are required to file an auditor’s report with the SEC for fiscal years ending on or after December 15, 2020. A CAM is any matter arising from the audit of the financial statements that (i) was communicated or required to be communicated to the audit committee, (ii) relates to accounts or disclosures that are material to the financial statements, and (iii) involved especially challenging, subjective, or complex auditor judgment.
Insights for Audit Committees begins with a discussion of the basics of CAM disclosure, including the definition, effective dates, exceptions to the CAM requirement, and the period covered by CAMs. Part of this background information is a decision tree that illustrates graphically how the auditor determines whether an audit matter is a CAM. The paper then discusses twelve FAQs that the PCAOB believes may be of interest to audit committees. Examples of these questions and the PCAOB’s responses include:
· Does the audit committee have a role in determining and approving CAM communications? No. CAMs are the sole responsibility of the auditor. It is up to the auditor to decide how to comply with the requirement — that is, what should be said in the CAM about the underlying audit issue. However, “the auditor could discuss with management and the audit committee the treatment of any sensitive information.”
· Does the communication of a CAM indicate a misstatement in the financial statements or deficiency in management’s process? No. The existence of a CAM does not indicate that the auditor found a misstatement or deficiencies in internal control over financial reporting. CAMs “are not necessarily meant to reflect negatively on the company.”
· Are CAMs expected to be the same each year? No. The auditor must determine CAMs based on the current audit. “Depending on the circumstances, some matters may be considered CAMs each year, while others may not.” For example, a new accounting standard might be a CAM in the first year of implementation, but not in subsequent years.
· If a public company experiences a significant event, such as a cybersecurity breach, will that be a CAM? Not necessarily. The CAM requirements are principles-based, and their application depends on the facts and circumstances. In evaluating a significant event, such as a cyber security breach, to determine whether it resulted in a CAM, the auditor’s focus will be on the impact on the audit, which, in turn, “will largely depend on the nature and extent of the audit response required to address any affected accounts and/or disclosures.”
· What is the relationship between CAMs and a company’s disclosures regarding critical accounting estimates? MD&A should include a discussion of critical accounting estimates and assumptions that are material to the financial statements and that involve high levels of subjectivity. Critical accounting estimates disclosure in MD&A may overlap with CAM disclosure, but the two are not the same. All matters communicated or required to be communicated to the audit committee are potential CAMs, not just critical accounting estimates. Conversely, not all critical accounting estimates discussed in MD&A will be CAMSs.
· What is the interaction between CAMs and company disclosures outside of the financial statements? In describing a CAM, the auditor is required to refer to the relevant financial statement accounts or financial statement disclosures. Disclosures outside of the financial statements may, however, also be relevant to a CAM. In a CAM description, the auditor is generally not expected to provide information about the company that has not been made publicly available by the company. In this context, information a company has made publicly available includes “all means of public communication, whether within or outside the financial statements, including SEC filings, press releases, and other public statements.”
Insights for Audit Committees also includes five examples of questions audit committees may want to consider asking their auditor regarding CAM implementation:
· What has the audit firm done to prepare for the identification and communication of CAMs in the auditor’s report?
· Does the audit firm have a methodology, practice aids, or other training available to its auditors?
· Has the audit firm done any dry runs? If so: What did the audit firm learn as a result of the dry runs? Were there any matters considered to be “close calls,” but ultimately not identified as a CAM during the firm’s dry run? What was the thought process behind the final determination?
· Were our CAMs similar or different from our industry peers? What is the nature of the differences (or similarities)?
· Has the audit team discussed with management how and by whom any investor or stakeholder question regarding CAMs will be addressed?
The first two questions seem rather pro forma. The large firms that audit public companies have undoubtedly engaged in extensive staff training and created practice aids to support their professionals in identifying and drafting CAMs. For audit committees of companies that use the services of smaller audit firms, delving into the nature of the firm’s CAM preparation may be of some value.
Dry runs of CAM reporting are certainly desirable. However, in most cases, the auditor would naturally discuss the dry run process and results with the audit committee, and it would not be necessary for the committee to raise the issue. Understanding CAM close calls and the auditor’s reasoning should routinely be part of the audit committee’s procedures.
As the PCAOB suggests, audit committees should ask the auditor (and management) to compare the company’s CAMs to those of industry peers. This type of information would be part of understanding whether a CAM reflects an inherent challenge in the company’s financial reporting (such as a subjective assumption underlying a critical accounting estimate) or a curable weakness (such as a control deficiency).
Finally, as to stakeholder questions regarding CAMs, a communications plan seems highly desirable. It remains to be seen how much investor interest there will be in CAM disclosures. However, it would be prudent for the management to think through in advance how it will respond to inquiries, particularly for CAMs that seem to signal a reporting or control issue that is not shared with others in the same industry.
An earlier version of this post appeared in the July 2019 edition of Dan Goelzer’s Audit Committee and Auditor Oversight Update available here.
Follow the AUDIT blog on Twitter @BlogAuditor.
