Managing Partner: Your Firm Is Facing Its First PCAOB Inspection. Are You Ready?

Your accounting firm is PCAOB registered. You audit two SEC issuers. And now, for the first time, your firm is facing the prospect of a PCAOB inspection.

Do not make the mistake of thinking that being a small firm with only two issuer clients makes the inspection less important.

It may make preparation even more important.

Two Issuers Means a Concentrated Risk

A registered public accounting firm that regularly provides audit reports for 100 or fewer issuers generally falls within the PCAOB's triennial inspection cycle.

But "triennial" should not be confused with "low risk."

With only two SEC issuer engagements, your firm's issuer practice is highly concentrated.

A significant deficiency identified in one engagement may cause inspectors to consider whether the problem is isolated—or evidence of a broader weakness in the firm's system of quality control.

That is where an engagement-level problem can become a firm-level problem.

The Inspection Is Not Just About the Audit File

The PCAOB inspection process can examine selected issuer audit engagements as well as aspects of the firm's quality control system.

For the managing partner, that distinction is critical.

Suppose inspectors determine that the firm did not obtain sufficient appropriate audit evidence over a significant estimate.

The issue may not end with the engagement workpapers.

Inspectors may want to understand:

• Why did the engagement team miss it?

• Why didn't the engagement partner identify it?

• Why didn't the engagement quality reviewer identify it?

• Was the firm's audit methodology adequate?

• Did the firm provide appropriate technical resources?

• Was the engagement properly staffed?

• Did the firm's monitoring process identify similar problems?

That is the difference between reviewing an audit and evaluating an audit firm's system for producing quality audits.

Areas I Would Review Before the PCAOB Arrives

If I were advising the managing partner of a two-issuer firm preparing for its first PCAOB inspection, I would perform a rigorous internal review of both issuer engagements. This is to gain knowledge to position the managing partner to interact with the PCAOB. It is not to enhance the workpapers, they are locked down.

Particular attention should be given to:

• Auditor independence

• Client acceptance and continuance

• Audit planning and risk assessment

• Fraud risk assessment

• Revenue recognition

• Management override and journal-entry testing

• Accounting estimates and fair values

• Related parties

• Significant unusual transactions

• Audit sampling

• Sufficiency and appropriateness of audit evidence

• Going-concern considerations

• Engagement partner supervision and review

• Engagement quality review

• Audit committee communications

• Critical Audit Matters, when applicable

• Audit documentation

• Consultation on difficult accounting and auditing matters

The question should not simply be, "Did we perform the procedure?"

The better question is:

"Does the audit file demonstrate why we performed the procedure, how we performed it, what evidence we obtained, how we evaluated contradictory evidence, and why that evidence supports our conclusion?"

That distinction matters enormously in an inspection.

QC 1000 Changes the Conversation

Managing partners should also recognize that PCAOB quality-control expectations have changed significantly.

QC 1000 requires firms to take a systematic, risk-based approach to quality control.

That puts greater emphasis on areas such as governance and leadership, ethics and independence, acceptance and continuance, engagement performance, resources, information and communication, and monitoring and remediation.

For a small firm, the challenge is particularly significant.

You may have fewer people, fewer specialists and fewer layers of review than a national accounting firm.

That does not eliminate the requirement for effective quality control.

Your firm's size changes how you implement quality controls. It does not eliminate the need for them.

The Managing Partner Owns the Tone

Your first PCAOB inspection should not be treated as an engagement-partner problem.

It is a firm leadership issue.

The managing partner should know the answers to some basic questions before inspectors arrive:

• Can we demonstrate compliance with PCAOB independence requirements?

• Are our two issuer engagements inspection-ready today?

• Are our engagement quality reviews defensible?

• Where are the highest-risk areas in each audit?

• What recurring deficiencies have PCAOB inspectors identified at other firms?

• Have we compared those deficiencies against our own workpapers?

• What deficiencies has our own monitoring process identified?

• Have those deficiencies actually been remediated?

• Can we demonstrate that remediation was effective?

Those are management questions—not merely audit documentation questions.

Conduct Your Own Inspection First

The worst time to discover a PCAOB audit deficiency is when a PCAOB inspector finds it.

Before the inspection, conduct a mock inspection.

Do not have the original engagement team simply reread its own files and declare them adequate. Use someone capable of looking at the engagement through the eyes of an experienced PCAOB inspector.

Start with the PCAOB's inspection priorities and recurring deficiencies.

Then select the high-risk portions of each issuer engagement and challenge the audit evidence.

Ask:

• What assertion were we testing?

• What risk were we responding to?

• Why was this procedure sufficient?

• What evidence supports the conclusion?

• What contradictory evidence existed?

• Where is the professional skepticism documented?

• Could an experienced auditor with no previous connection to the engagement understand what we did and why?

If those questions cannot be answered from the audit documentation, you have identified an inspection-readiness problem.

Your First Inspection Establishes a Baseline

A first PCAOB inspection is more than a regulatory event.

It is an independent test of whether your firm's public-company audit practice operates the way management believes it operates.

For a firm with only two SEC issuer clients, the stakes are substantial. Those two engagements represent the firm's entire issuer audit practice.

Treat both accordingly.

Do not wait for the PCAOB to perform your first serious inspection of your own work.

Inspect yourself first.

• Find the weaknesses.

• Determine the root causes.

• Fix the system.

And make sure your firm's audit documentation demonstrates that your opinions are supported by sufficient appropriate audit evidence.

When the PCAOB arrives, that preparation may prove to be one of the most valuable investments your firm has made in audit quality.