Will CAMs Get the Shaft from the ‘New’ PCAOB?
In recent years I have presented an update on the activities of the PCAOB at the annual meeting of the Association of Audit Committee Members. From that experience — particularly this past year — I can tell you that audit committees are not happy with PCAOB rulemaking. Much of it feels to them kind of like we all feel when taking off our shoes for the TSA: because of one misguided and inept soul (pun intended), everyone pays a price. To add insult to injury, we have absolutely no idea whether our collective acts of compliance do anything to make us safer.
The most recent source of audit committee resentment of the PCAOB is the overhaul and expansion of the standard auditor’s report — most especially the requirement that the auditors communicate information about “critical audit matters,” or CAMs.
Two exposure drafts plus an extended period of deliberations by the SEC generated lots of comments, clearly divided along battle lines of the Accounting Establishment versus investor interests. The former argued that CAM disclosures will rapidly devolve to boilerplate. Nowithstanding, they would not materially add to the information already available to investors. CAM disclosures, the Accounting Establishment argued, might even diminish audit quality because auditors would respond by limiting communications with a client’s audit committee in reaction to a perception of a new source of liability exposure. Finally, and as an aside and for reasons that totally escape me, it argues that management should be the sole source of information in SEC filings.
Investors on the other side of the argument say that CAM disclosures would in fact provide useful information. They base their comments in part on similar rules already in effect in Europe (more on that later) and numerous interesting audit reports that have been produced as a result. Moreover, some commenters believe that better information from auditors about CAMs could have more clearly signaled the deteriorations in bank balance sheets that precipitated the 2008 Financial Crisis. As to consideration of the effect on audit quality, even if CAM disclosures devolved to boilerplate, disclosure per se could positively affect how CAMs will actually be audited.
I won’t bore you with the official definition of a CAM. For the purpose of this post, we need only agree that they are basically about the parts of the audit that keeps the auditor awake at night. As an example of what is not a CAM, the Parmalat financial fraud is instructive. One aspect of that fraud was falsifying cash balances. Although the auditor may have missed something they should have caught, auditing cash would not have risen to the level of a CAM.
The Boilerplate Question
In October 2017, I wrote a post celebrating the long-awaited SEC approval of the PCAOB’s required CAM communications. But, I didn’t at that time adequately consider the possibility that the disclosures would devolve into boilerplate; hence, the motivation for this post.
For each CAM communicated in the auditor’s report, the auditor will be required to identify the CAM, describe the principal considerations that led the auditor to determine that the matter is a CAM, describe how the CAM was addressed in the audit, and refer to the relevant financial statement accounts and disclosures to which it relates. Unfortunately, I now think that this is a recipe for boilerplate — because the required communications don’t go far enough.
During the PCAOB’s deliberations, some investors suggested further enhancements to the auditor’s report such as including an assessment of the significant accounting judgments and management estimates and requiring auditors to describe specific insights and findings related to each CAM. These are similar to the requirements that are already in place in Europe, and the fact that the PCAOB acceded to the Accounting Establishment on this point essentially dooms their efforts.
To see why, we need not look beyond the PCAOB’s 2016 re-proposal, which, unlike the final release, provides a couple of illustrative examples of CAM communications. In the final rule making release, the Board reasoned that examples would be inconsistent with the principles-based nature of the rules, which should lead to communications tailored to each engagement. Nonetheless, the PCAOB failed to hold the high ground. I would expect that auditors will carefully study these examples and squeeze every ounce of boilerplate that they can from them.
Which should not be too difficult to do. Each illustration is cleanly divided into three parts that map directly onto the letter of the rules: (1) Identifying the CAM; (2) Setting forth the principle considerations in determining the CAM; and (3) Describing how the CAM was addressed in the audit.
One example involved a hypothetical regional bank that in the most recent period added a new loan product – a 9-year auto loan in addition to their 3 and 5-year products. The principal considerations identified by the auditor (i.e., #2, above) were that it was a new product, the historical data on defaults of existing products would be of limited use, and that loan impairment on these products “involved complex and subjective judgment” (language straight out of the standard no less!).
Regarding #3, how the audit of the loan loss reserve was addressed, the first thing the example states is that the auditor tested controls and the historical data that was used by management as inputs. For every CAM communication I have seen (which admittedly is limited at this point), they all start that way. But after that, things get to a point where we can understand why the Accounting Establishment is squirming. The auditor reports that it evaluated the qualitative adjustment to the historical loss rate, including the basis and significant assumptions. No matter who is doing that — management, the auditor, or a “specialist” — this is a highly speculative exercise. It could well be that the auditor’s best protection here is to communicate as little as possible beyond tried and tested boilerplate.
Loan loss reserves should be a fairly common CAM disclosure, but there is no way to put a good face on them. The subjectivity of the accruals raise questions like whether audits of loan loss reserves based on current GAAP can provide reasonable assurance under any circumstances beyond plain vanilla. It would seem that the PCAOB sensed this, because the example communication mentioned that a “specialist” was involved in the estimate of the loan loss reserve. But, I wonder what kind of specialist they were envisioning? If the standard called for measurement of the loan portfolio at fair value, then I could imagine a specialist contributing in a substantive way, but for me, I don’t know whether a specialist’s crystal ball is any better for predicting future default rates than anyone else’s, without actually trying to value the portfolio, which is not required by GAAP.
My Take
I would not be surprised if the Accounting Establishment has a number of concerns that they were not willing to express publicly during the PCAOB and SEC deliberation phases. For example, there is the high likelihood that readers will take CAMs to be signals about the reasonableness of management estimates and audit quality before the ink is even dry on the auditor’s report. In this loan loss reserve example, an analyst might claim that based on a review of market prices for similar assets, the current value of the audited loans could well be much lower than indicated by management’s estimate of the allowance; and that the auditors might not have weighted this information properly before concluding that the bad debt allowance is reasonable.
That kind of threat to the auditors, leads me to predict that CAM communications will be boilerplate right out of the box. The PCAOB will have egg on their face, and they will deserve it. The real, boilerplate-defeating information about CAMs is the auditor’s own assessment of management’s estimates. Because the Board acceded to the Accounting Establishment on this point, U.S. financial reporting will look tarnished as compared to the European approach to CAM communications.
If I were on the Board that approved this rule, I would not have supported caving on the communications of the auditor’s assessments. But, if I were on the current Board, I would not give CAMs the shaft, even if I became convinced that they are a recipe for pure boilerplate. Even though the optics would be very embarrassing, communication of CAMs really should deter superficial audits. Like taking our shoes off at the airport, we will have no way of knowing for sure whether CAM communications will reduce the incidence of auditor failures, but that is a fact of life regulators must accept when promulgating in good faith securities laws for the protection of investors.
* * * * * * * *
I would also like to believe that once auditing of the management estimates required under current GAAP is exposed as the dicey proposition that it is, maybe we will see improvements to GAAP: like more current value and less crystal ball.