The Auditing Standards Committee of the Auditing Section of the American Accounting Association is Pleased to Provide Comments on PCAOB Staff Consultation Paper No. 2015-01, The Auditor's Use of the Work of Specialists

Abstract

SUMMARY On May 28, 2015 the Public Company Accounting Oversight Board (hereafter, the Board) issued Staff Consultation Paper No. 2015-01 (hereafter, the Staff Consultation Paper) to seek information and input on the potential need to improve standards related to the auditor's use of the work of specialists. The Board requested input from investors, accounting firms, specialists, companies, and others (such as academics) about (1) current practices, (2) the potential need for changes, and (3) possible alternative regulatory approaches, and any associated economic implications, for potential improvement in standards related to oversight and assessing the objectivity of employed and engaged specialists. The comment period ended July 31, 2015. This commentary summarizes the contributors' views on selected questions posed in the Staff Consultation Paper. Data Availability: The invitation to comment (through July 31, 2015), with links to the Consultation Paper, is available at: http://www.pcaobus.org/Standards/Pages/SCP_Specialists.aspx

Audit Firm Assessments of Cyber-Security Risk: Evidence from Audit Fees and SEC Comment Letters

“…However, while cyber-security incidents represent an obvious threat for breached firms, they also carry risks for external auditors (CAQ, 2014;Joe et al, 2015). External auditors provide objective and independent assurance with respect to the quality of a firm's financial reporting and are responsible for auditing financial statements and internal controls over financial reporting (ICFR) (Christopher, Sarens, & Leung, 2009;Stefaniak, Houston, & Cornell, 2012;CAQ, 2014;Kajüter, Klassmann, & Nienhaus, 2016;Frino, Palumbo, & Rosati, 2017).…”

“…Cyber-security risk can materialize in the form of so called "more-thanreporting" control weaknesses (Feng, McVay, & Skaife, 2014) (e.g., IT control weaknesses), or as "financial reporting-only" weaknesses (Hogan & Wilkins, 2008). As such, external auditors must carefully evaluate and understand the strengths and weaknesses of firms' information technology and incorporate those in their risk assessment (PCAOB, 2013;Joe et al, 2015). Finally, auditors face growing pressure from standard setters to play a more active role in preventing and assessing the consequences of cyber-security incidents (CAQ, 2014;PCAOB, 2018).…”

“…More specifically, auditors are held accountable for testing and monitoring the access controls their auditees implement and evaluating cybersecurity threats in their audit risk model. The financial statement audit, and the audit of ICFR, include procedures with respect to a company's financial reporting systems and evaluating the risks of material misstatement resulting from unauthorized access to such systems (CAQ, 2014;Joe et al, 2015;PCAOB, 2010). Personal interviews with senior IT auditors in the Big 4 audit firms 3 provided further confirmation on this point.…”

The Auditor-Valuation Specialist Coopetitive Alliance in the Fair Value Audit of Complex Financial Instruments

“…Generally, the auditor and specialist units are separately accountable to and evaluated on performance by the firm. Audit firms commonly separate these units functionally, whereby specialists are a part of the firm's advisory practice (Joe et al 2015). However, even when both practice areas reside within the audit function, firms can evaluate their performance separately.…”

“…2 The preparation of some FVMs requires sophisticated valuation techniques that are highly susceptible to management bias (e.g., Hilton and O'Brien 2009). As a result, auditors increasingly rely on the work of specialists (e.g., PCAOB 2015a, 2017a, 2017b) because auditors typically lack the valuation expertise needed to evaluate the reasonableness of FVMs (Martin, Rich, and Wilks 2006;Joe, Janvrin, Barr-Pulliam, Mason, Pitman, Rezaee, Sanderson, and Wu 2015;Glover, Taylor, and Wu 2017). The increased need for specialist involvement in financial reporting and auditing, as well as the post-Financial Crisis regulatory scrutiny, of FVMs reported in the financial statements created an 'exogenous shock' that compelled two professional groups (auditors and specialists), who have different histories, to collaborate on the audit of FVMs (Barr-Pulliam, Mason, and Sanderson 2020).…”