PCAOB Audit Tradecraft: The Essential Skills Every External Auditor Needs to Deliver High-Quality Audits
Why Understanding PCAOB Standards Is Only the Beginning of Becoming an Effective External Auditor
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | External Auditing, PCAOB Standards, and Audit Quality
Knowing the Public Company Accounting Oversight Board (PCAOB) auditing standards is essential for every external auditor working on audits subject to PCAOB requirements.
But knowing the standards is not the same as knowing how to perform an effective audit.
An auditor may understand the requirements for audit planning, risk assessment, internal control evaluation, and audit evidence yet struggle to apply those requirements to a complex organization.
The difference is audit tradecraft.
Audit tradecraft combines technical knowledge, professional judgment, analytical thinking, communication, documentation, and the practical skills needed to obtain sufficient appropriate audit evidence.
It is the difference between following an audit checklist and understanding whether the evidence actually supports the audit opinion.
Corporate Compliance Seminars (CCS) addresses these challenges in its two-day, 12-CPE training event, PCAOB Audit Tradecraft for the External Auditor.
The program combines PCAOB auditing standards with practical audit planning, COSO, internal control over financial reporting (ICFR), client documentation, control testing, and the professional behaviors that distinguish effective auditors.
1. What Is Audit Tradecraft?
Audit tradecraft refers to the practical skills and professional behaviors an auditor uses to plan, execute, document, and communicate an audit effectively.
Technical knowledge is the foundation, but effective auditing requires much more.
An experienced auditor must understand the client's business, identify financial reporting risks, evaluate internal controls, recognize contradictory evidence, and determine whether management's explanations are supported by reliable information.
The auditor must also know how to ask questions, evaluate responses, exercise professional skepticism, and document conclusions.
Consider two auditors assigned to evaluate revenue recognition.
The first auditor obtains the revenue schedule, selects transactions, examines supporting documents, and completes the audit program.
The second auditor begins by understanding the company's revenue-generating activities, contractual arrangements, transaction processing, relevant controls, and potential incentives to misstate revenue.
Both auditors may complete the required workpapers.
However, the second auditor is better positioned to recognize unusual transactions, unsupported assumptions, and weaknesses in the client's financial reporting process.
Audit tradecraft is about knowing why an audit procedure is necessary, what evidence it should produce, and how to interpret the results.
2. PCAOB Auditing Standards Establish the Foundation
The PCAOB establishes auditing and related professional practice standards for registered public accounting firms performing audits within its jurisdiction.
These standards establish requirements for planning, performing, supervising, documenting, and reporting on audits.
Several standards are particularly important to external audit tradecraft.
PCAOB standard | Importance to external auditors |
AS 1105 — Audit Evidence | Evaluating the sufficiency and appropriateness of audit evidence |
AS 1201 — Supervision of the Audit Engagement | Directing, supervising, and reviewing engagement work |
AS 1215 — Audit Documentation | Documenting procedures, evidence, and conclusions |
AS 1301 — Communications with Audit Committees | Communicating significant audit matters to those charged with governance |
AS 2101 — Audit Planning | Establishing an appropriate overall audit strategy |
AS 2110 — Identifying and Assessing Risks of Material Misstatement | Understanding the company and identifying financial reporting risks |
AS 2201 — Audit of Internal Control Over Financial Reporting | Evaluating ICFR in integrated audits |
AS 2301 — The Auditor's Responses to the Risks of Material Misstatement | Designing procedures responsive to assessed risks |
AS 2315 — Audit Sampling | Selecting and evaluating audit samples |
AS 2810 — Evaluating Audit Results | Assessing findings and determining their implications |
Understanding how these standards work together is essential.
An auditor cannot properly design substantive procedures without understanding the assessed risks.
The auditor cannot determine whether sufficient evidence has been obtained without understanding the relevant assertions and risks.
And the auditor cannot support the audit opinion without documenting the procedures performed and conclusions reached.
The CCS training program helps participants understand how these requirements fit together within a complete audit engagement.
3. Audit Planning Begins With Understanding the Business
One of the most important tradecraft skills is understanding the client's business model.
PCAOB AS 2101 addresses audit planning, while AS 2110 requires auditors to identify and assess risks of material misstatement.
Effective risk assessment begins with understanding how the organization generates revenue, incurs expenses, manages assets, and finances its operations.
An auditor should understand the company's products, customers, suppliers, geographic markets, information systems, and significant business risks.
For example, a manufacturing company may face risks involving inventory valuation, production costs, revenue recognition, and long-term customer contracts.
A financial institution may face risks involving loan valuation, credit losses, investment securities, and regulatory compliance.
A technology company may face risks involving complex revenue arrangements, software capitalization, and estimates.
The audit strategy should reflect these differences.
A standardized audit program should not substitute for understanding the specific risks of the company being audited.
Questions effective auditors ask
How does the company make money?
What business activities create significant accounting estimates?
Which transactions involve unusual complexity?
Where does management exercise significant judgment?
What incentives could influence financial reporting?
Which controls address the identified risks?
What changes occurred in the business during the year?
These questions help auditors identify where material misstatements are most likely to occur.
4. Understanding the COSO Internal Control Framework
The COSO Internal Control–Integrated Framework provides a foundation for understanding and evaluating internal control over financial reporting.
The framework includes five integrated components:
Control Environment.
Risk Assessment.
Control Activities.
Information and Communication.
Monitoring Activities.
These components are supported by 17 principles.
A critical tradecraft skill is understanding how the components and principles interact.
For example, an organization may have detailed transaction approval procedures.
But those procedures may be ineffective if management routinely overrides them.
Similarly, an organization may have strong access controls but inadequate procedures for identifying new financial reporting risks.
Effective ICFR evaluation requires auditors to consider both entity-level controls and process-level controls.
Entity-level controls
Entity-level controls influence the organization as a whole.
Examples include Board and Audit Committee oversight, ethical leadership, risk assessment, management accountability, and monitoring.
Process-level controls
Process-level controls operate within specific business activities.
Examples include revenue processing, purchasing, payroll, inventory, and financial close procedures.
The auditor must understand how these controls work together to address the risks of material misstatement.
5. The Client Owns the Internal Control Framework
One of the most important distinctions in external auditing concerns responsibility for internal controls.
Management owns the design, implementation, operation, and assessment of the company's internal control over financial reporting.
The external auditor does not own the client's controls.
In an integrated audit, the external auditor independently evaluates ICFR and expresses the applicable opinion.
This distinction is fundamental to auditor independence.
Management should understand its financial reporting risks, document its controls, evaluate their design and operation, and address identified deficiencies.
The external auditor should not become responsible for preparing management's control documentation or performing management's assessment.
The CCS course addresses the client's approach to Sarbanes-Oxley documentation and the auditor's separate responsibilities.
This is particularly valuable for auditors who need to understand how management's ICFR documentation supports the external audit process.
6. How Should a Client Document ICFR?
A well-designed ICFR documentation program should demonstrate how management identifies financial reporting risks and establishes controls to address them.
Common documentation includes:
Financial reporting risk assessments.
Significant account and disclosure analyses.
Process narratives and flowcharts.
Risk and control matrices.
Entity-level control documentation.
Control ownership and responsibility assignments.
Evidence of control execution.
Management testing results.
Identified deficiencies and remediation plans.
The objective is not simply to produce documentation.
It is to establish a reliable connection between financial reporting risks, management's controls, and evidence demonstrating that the controls operate effectively.
For example, management may identify the risk that fictitious vendors could be established and used to process unauthorized payments.
A control matrix should identify the relevant control activities, responsible personnel, frequency, and evidence retained.
The external auditor can then evaluate whether the controls are appropriately designed and, where required, test their operating effectiveness.
7. Evaluating the Design of Internal Controls
A control may exist without being adequately designed to address its intended risk.
Suppose a company requires a supervisor to approve all vendor banking-information changes.
At first glance, the control appears reasonable.
However, if the supervisor simply approves the change without independently authenticating the request, the control may not effectively address the risk of fraudulent payment diversion.
The auditor should therefore evaluate whether the control, if performed as prescribed, would prevent or detect the relevant misstatement on a timely basis.
This requires understanding the control objective, associated risk, control activity, responsible personnel, and evidence.
Effective auditors do not assume that a control is properly designed merely because management has documented it.
8. Testing the Operating Effectiveness of Controls
After evaluating control design, the auditor may need to determine whether the control operated effectively during the relevant period.
This involves obtaining evidence that the control was performed by an appropriately authorized and competent person, at the required frequency, and with sufficient precision.
For example, a monthly account reconciliation control might require the preparer to reconcile the general ledger to supporting records and an independent reviewer to investigate significant differences.
The auditor should determine whether the reconciliations were completed, whether discrepancies were investigated, and whether the review was sufficiently precise to identify material misstatements.
Simply observing a reviewer's signature may not provide sufficient evidence of the quality of the review.
Effective control testing evaluates what the control actually accomplished, not merely whether a document contains an approval.
9. Professional Skepticism: The Most Important Auditor Behavior
Professional skepticism is central to effective external auditing.
It involves a questioning mind and a critical assessment of audit evidence.
An auditor should not automatically accept management's explanations.
Nor should the auditor presume that management is dishonest.
The auditor should evaluate the evidence objectively.
For example, management may explain that an unusual year-end journal entry was necessary to correct a timing difference.
The auditor should understand the explanation and examine the supporting documentation.
Questions might include:
Why was the entry necessary?
Who prepared and approved it?
What evidence supports the adjustment?
Does the entry affect significant accounting estimates?
Is the treatment consistent with the applicable accounting framework?
Does other evidence contradict management's explanation?
Professional skepticism becomes especially important when evaluating estimates, unusual transactions, related-party arrangements, and potential management override.
10. Audit Evidence: Sufficiency and Appropriateness
PCAOB AS 1105 addresses audit evidence.
Two concepts are central.
Sufficiency concerns the quantity of audit evidence obtained.
Appropriateness concerns its quality, including relevance and reliability.
Obtaining more evidence does not necessarily compensate for poor-quality evidence.
For example, selecting 100 invoices from a report generated by an unreliable system may not provide sufficient appropriate evidence if the auditor has not evaluated the reliability of the underlying information.
Similarly, a management explanation may be relevant but insufficiently reliable without corroboration.
Auditors must understand the source of evidence, how it was generated, and whether it supports the relevant financial statement assertion.
This requires analytical thinking rather than mechanical completion of audit procedures.
11. Audit Documentation Must Tell the Story
PCAOB AS 1215 establishes requirements for audit documentation.
High-quality workpapers should allow an experienced auditor with no previous connection to the engagement to understand the procedures performed, evidence obtained, and conclusions reached.
A workpaper should clearly explain:
The audit objective.
The relevant financial reporting risk.
The procedures performed.
The population and items examined.
The evidence obtained.
Any exceptions identified.
How exceptions were evaluated.
The conclusion reached.
A statement such as "No exceptions noted" is not enough when the workpaper does not demonstrate what was tested.
Similarly, documenting that management provided an explanation does not establish that the explanation was adequately corroborated.
An audit workpaper should demonstrate the auditor's reasoning, not merely record the completion of a task.
12. Why PCAOB Inspection Findings Matter
PCAOB inspections provide important information about recurring audit quality issues.
Inspection findings may involve deficiencies in risk assessment, audit evidence, control testing, accounting estimates, and audit documentation.
External auditors should use inspection observations to identify weaknesses in their methodologies and professional practices.
A significant inspection finding does not necessarily mean that the client's financial statements were misstated.
It may indicate that the auditor did not obtain sufficient appropriate evidence to support a conclusion.
This distinction is important.
The audit objective is not merely to reach the correct answer.
It is to perform the procedures necessary to support that answer with appropriate evidence.
The CCS training event addresses typical PCAOB inspection issues and the practical steps auditors can take to strengthen audit quality.
13. The Human Side of Audit Tradecraft
Technical knowledge alone does not make an effective auditor.
The CCS course also emphasizes professional behaviors that improve audit performance.
Intellectual curiosity
Effective auditors want to understand why transactions occur and how business processes work.
They investigate unusual conditions rather than dismissing them.
Analytical thinking
Auditors must connect information from different sources and recognize inconsistencies.
They should understand relationships among financial results, business activities, and internal controls.
Ethics and integrity
Auditors must maintain independence, objectivity, confidentiality, and professional integrity.
Empathy and understanding
An auditor who understands the client's operational environment can ask better questions and obtain more useful explanations.
Empathy does not mean accepting unsupported assertions.
It means understanding the circumstances surrounding the information being evaluated.
Communication skills
Auditors must explain technical issues clearly and discuss concerns without creating unnecessary conflict.
Adaptability
Auditors must adjust their procedures when risks, systems, business conditions, or evidence change.
These skills distinguish experienced professionals from individuals who simply complete standardized audit programs.
14. Artificial Intelligence and the Future of PCAOB Audit Tradecraft
Artificial intelligence is changing how auditors research accounting requirements, analyze transactions, identify anomalies, and prepare documentation.
AI can assist with organizing information, identifying unusual patterns, developing preliminary risk analyses, and summarizing complex documents.
However, AI-generated information is not automatically reliable audit evidence.
Auditors must evaluate the completeness, accuracy, relevance, and reliability of information used in the audit.
They must also protect confidential client information and comply with firm policies, professional standards, and applicable security requirements.
For example, an auditor might use an approved AI-enabled analytics tool to identify unusual journal entries.
The resulting list of transactions could help direct audit attention.
But the auditor must still determine whether the analysis is complete, whether the underlying data is reliable, and what additional procedures are necessary.
AI can improve audit efficiency.
It does not replace professional skepticism, judgment, or responsibility for the audit opinion.
15. Practical Example: Auditing a Company's Revenue Process
Consider a hypothetical public company reporting $500 million in annual revenue.
Management has implemented an automated revenue recognition system.
The auditor identifies risks involving contract terms, manual adjustments, and the timing of revenue recognition.
A tradecraft-based approach would include understanding the company's business model, identifying significant revenue streams, evaluating relevant controls, and designing procedures responsive to the assessed risks.
The auditor would also examine the reliability of system-generated reports and evaluate whether manual journal entries could override automated controls.
Where the auditor plans to rely on controls, appropriate tests of operating effectiveness would be necessary.
Substantive procedures would address the relevant assertions and identified risks.
The auditor would then evaluate exceptions and determine whether sufficient appropriate evidence had been obtained.
The important point is that the procedures should form an integrated response to the company's risks.
They should not be disconnected activities performed solely because they appear on an audit checklist.
16. Ten Questions Every External Auditor Should Be Able to Answer
Before concluding an audit engagement, the auditor should be able to explain:
What are the company's significant business and financial reporting risks?
Which financial statement assertions are affected?
How were those risks identified and assessed?
What controls has management established to address them?
Which controls were evaluated or tested, and why?
What substantive procedures were performed in response to the risks?
How was the reliability of audit evidence evaluated?
How were exceptions and contradictory evidence resolved?
Does the documentation support the significant conclusions?
Has sufficient appropriate evidence been obtained to support the audit opinion?
If these questions cannot be answered clearly, the auditor may need to reconsider the completeness or quality of the audit work.
17. Why Firms Should Invest in Audit Tradecraft Training
CPA firms face increasing demands involving complex accounting, evolving business risks, technology, regulatory requirements, and audit quality.
Training that focuses exclusively on technical standards may not fully prepare staff to exercise effective professional judgment.
Audit tradecraft training helps bridge that gap.
It connects auditing standards with the practical skills needed to understand business processes, identify risks, evaluate controls, obtain evidence, and communicate findings.
For newer staff, it provides a structured understanding of how audit procedures fit together.
For experienced auditors, it reinforces professional skepticism and encourages a more risk-focused approach.
For engagement managers and partners, it supports stronger supervision, documentation, and audit quality.
Conclusion: Great Auditors Understand the Standards and Know How to Apply Them
PCAOB auditing standards establish the requirements for high-quality external audits.
But compliance with those requirements depends on the auditor's ability to apply them effectively.
Audit tradecraft brings together technical knowledge, business understanding, risk assessment, internal control evaluation, professional skepticism, evidence analysis, documentation, and communication.
An effective external auditor does more than follow procedures.
The auditor understands the risks, evaluates the evidence, challenges unsupported assumptions, and reaches defensible conclusions.
The objective of PCAOB audit tradecraft is not simply to complete an audit program.
It is to obtain sufficient appropriate evidence to support an audit opinion that investors and other stakeholders can rely upon.
That is the foundation of audit quality.
Earn 12 CPE Credits: PCAOB Audit Tradecraft for the External Auditor
Corporate Compliance Seminars offers a comprehensive two-day training program designed to strengthen the technical and practical skills required for high-quality external audits.
The program combines PCAOB auditing standards with practical instruction covering audit planning, risk management, COSO, ICFR documentation, control testing, audit workpapers, and the professional behaviors essential to effective auditing.
What participants will learn
How PCAOB auditing standards fit together.
Common issues identified during PCAOB inspections.
Effective audit planning and risk assessment.
The five components and 17 principles of COSO.
Entity-level controls involving the control environment and risk assessment.
Management's responsibilities for documenting and evaluating ICFR.
The external auditor's approach to testing entity-level and process-level controls.
How to prepare audit documentation that supports defensible conclusions.
Essential tradecraft skills involving professional skepticism, analytical thinking, ethics, and communication.
Event details
CPE credits: 12
Fields of study: Auditing and Business Ethics
Program level: Basic
Prerequisites: None
Format: Live, interactive online seminar (Group Internet-Based)
Schedule: Wednesday–Thursday, offered approximately every eight weeks
Time: 9:00 a.m.–3:00 p.m. Central Time, with a 30-minute lunch break each day
Private group training: Available for two or more participants.
Who should attend?
External auditors, CPA firm associates, senior auditors, audit managers, engagement partners, and compliance professionals seeking a stronger understanding of PCAOB auditing standards and their practical application.
Register for PCAOB Audit Tradecraft Training
Invest in the skills that improve audit quality, strengthen professional judgment, and support more effective external auditing.
Visit Corporate Compliance Seminars for additional PCAOB, SOX, COSO, internal control, and audit assurance CPE programs.
Comments