(Photo: Audit Report by Nick Youngson CC BY-SA 3.0 ImageCreator)
The Center for Audit Quality has issued some much-needed guidance on critical audit matters (CAMs), a new reporting requirement that external auditors will need to start including in their audit reports as early as next year. While the new requirements pertain to external audit reports, they could have some important implications for internal auditors.
The auditing standard, which is part of an overhaul of audit reports adopted by the Public Company Accounting Oversight Board last year, requires audit firms to list and describe CAMs in their reports beginning as early as July 2019 for large accelerated filers. CAMS are defined as “any matter communicated or required to be communicated to the audit committee that relates to material accounts or disclosures and involves especially challenging, subjective, or complex auditor judgment.”
The requirement is causing some consternation among audit committees, internal auditors, external auditors, financial executives, investors, and others involved in the reporting process for two reasons: One is that it is still unclear how auditors will determine where to draw the line on what is and isn’t considered a critical audit matter. The second is that it could force external auditors to air some of the company’s dirty laundry that has not before been aired publicly in financial reports or anywhere else.
The second issue is particularly troubling, since most stakeholders buy into the idea that external auditors should not be disclosing new information, only offering an opinion on the accuracy and reliability of what the company itself discloses.
“The communication of critical audit matters represents a significant change in the information required to be communicated in the auditor’s report,” said CAQ Executive Director Cindy Fornelli. “The CAQ is committed to promoting an ongoing dialogue among auditors, management, audit committees, and others to support implementation of this new requirement.”
So What, Exactly, Is a CAM?
The publication from CAQ, Critical Audit Matters: Key Concepts and FAQs for Audit Committees, Investors, and Other Users of Financial Statements, offers some thoughts on how external auditors might make determinations around CAMs and what companies need to consider about how the reporting of CAMs will affect their own financial disclosures.
According to the CAQ paper, the auditor should take into account, alone or in combination, the following factors:
- The auditor’s assessment of the risks of material misstatement
- The degree of auditor judgment related to areas in the financial statements that involved the application of significant judgment or estimation by management, including estimates with significant measurement uncertainty
- The nature and timing of significant unusual transactions and the extent of audit effort and judgment related to these transactions
- The degree of auditor subjectivity in applying audit procedures to address the matter or in evaluating the results of those procedures
- The nature and extent of audit effort required to address the matter, including the extent of specialized skill or knowledge needed or the nature of consultations outside the engagement team regarding the matter
- The nature of audit evidence obtained regarding the matter
Are Control Deficiencies CAMs?
The report also addressed an issue that has been of particular concern to internal auditors: Could a significant deficiency in internal control over financial reporting automatically constitute a critical audit matter that auditors will have to disclose under the new auditing standard? To that question, CAQ answers “no,” since internal controls themselves are not accounts or disclosures.
Yet the true answer is more complex than that. “However, a significant deficiency could be among the principal considerations that led the auditor to determine a matter is a CAM. For example, if a significant deficiency was among the principal considerations in determining that revenue recognition was a CAM, then the auditor could describe the relevant control-related issues over revenue recognition in the broader context of the CAM without using the term ‘significant deficiency,’ ” the CAQ writes in its analysis.
Start the Conversation Now
This gets back to the issue of the external auditor disclosing new information that hasn’t been released publicly before. The PCAOB standard says that the auditor is not expected to provide information about the company that has not been made publicly available by the company, “unless such information is necessary to describe the principal considerations that led the auditor to determine that a matter is a CAM.” Therefore that information about internal control deficiencies could find its way into the public audit report if it tipped the scales for the auditor to determine that an issue was a CAM.
The CAQ’s advice for those involved in the reporting process—particularly management, audit committee members, and external auditors—is to start having discussions on these issues now. Indeed, some audit firms, including EY and Grant Thornton are providing dress rehearsals for when the standards take effect. They are using prior-year audit results to identify potential CAMs, draft sample documentation to support CAM conclusions, review the related disclosures, and discuss the implications with audit committees. The trial runs could go a long way to helping companies and auditors prepare for the new audit reporting standard and the uncertainty surrounding CAMs. 
(Photo: Audit Report by Nick Youngson CC BY-SA 3.0 ImageCreator)
Joseph McCafferty is Editor & Publisher of Internal Audit 360°
Did you enjoy this article? Consider making a small donation to support independent business journalism at Internal Audit 360°. Click Here!
And much thanks to those who have already donated. Our success depends on it.
Related article:
Companies Push to Automate Financial Reporting Controls