Comprehensive Study Guide on Professional Auditing Standards, GAAS, and Regulatory Oversight

Historical Development and Sources of Auditing Standards

• Early History and Auditing Regulation (Pre-1939):

  • Auditing regulation was kept to a minimal standard prior to $1939$.
  • The McKesson & Robbins case ($1938$) served as a landmark catalyst for regulatory reform when auditors from PriceWaterhouse accepted management's false assertions regarding inventory and accounts receivable (A/R) without performing independent verification.

• AICPA Auditing Standards Board (ASB):

  • Formed to establish formal guidance following financial reporting failures.
  • Issued Statements on Auditing Procedure from $1939$ to $1972$
  • Issued Statements on Auditing Standards (SAS) from $1972$ to the present.

• The Public Company Accounting Oversight Board (PCAOB):

  • Established following major waves of financial reporting scandals in the early $2000s$
  • Issues Auditing Standards (AS) applicable specifically to public entities (issuers) from $2003$ to the present.

• Regulatory Standard-Setting Division Between Entity Types:

  • Audits of Public Entities (Issuers that issue stocks to the general public):
  • PCAOB Auditing Standards (AS) govern all current public entity audits.
  • AICPA Statements on Auditing Standards (SAS) issued prior to April $2003$ apply only if they have not been amended or superseded by PCAOB standards (referred to as Interim Standards).
  • Audits of Nonpublic Entities (Non-issuers that do not issue stocks to the general public):
  • All current Statements on Auditing Standards (SAS) issued by the Auditing Standards Board (ASB) of the AICPA govern nonpublic entity audits.
  • PCAOB Auditing Standards are not applicable to nonpublic entities.

Hierarchy and Structure of Generally Accepted Auditing Standards (GAAS)

• Components of GAAS and Their Authoritative Hierarchy:

  • Fundamental Principles (Most Authoritative): Guide the overall conduct of audit engagements.
  • PCAOB Auditing Standards and ASB Statements on Auditing Standards: Provide specific requirements supporting the fundamental principles.
  • Interpretive Publications (Least Authoritative): Provide procedural guidance on the application of GAAS.

• Objectives of GAAS Audits:

  • Identify necessary qualifications and characteristics of auditors and guide audit execution.
  • Obtain reasonable assurance about whether financial statements are free of material misstatement, whether caused by fraud or error.
  • Report on financial statements and communicate auditor findings in accordance with established standards.

• Alignment of Fundamental Principles with 10 Basic Auditing Standards:

  • Responsibilities Principle (Replaces General Standards):
  • Basic Standard 1: Training and proficiency.
  • Basic Standard 2: Independence in mental attitude.
  • Basic Standard 3: Due professional care.
  • Core Responsibilities: Auditors must maintain competence and capabilities, satisfy ethical requirements (independence and due care), and exercise professional skepticism and professional judgment.
  • Performance Principle (Replaces Standards of Field Work):
  • Basic Standard 1: Planning and supervision.
  • Basic Standard 2: Understanding of entity and environment to assess risk of material misstatement.
  • Basic Standard 3: Obtain sufficient appropriate evidence.
  • Core Performance Activities: Plan work and supervise assistants, determine and apply materiality levels, identify and assess risks of material misstatement, and obtain sufficient appropriate audit evidence to achieve reasonable assurance.
  • Reporting Principle (Replaces Standards of Reporting):
  • Basic Standard 1: Financial statements presented in accordance with GAAP.
  • Basic Standard 2: Consistent application of GAAP (explicit report required only if inconsistent).
  • Basic Standard 3: Adequacy of disclosures (explicit report required only if inadequate).
  • Basic Standard 4: Express or disclaim an opinion.
  • Core Reporting Activities: Express an opinion (or state that an opinion cannot be expressed) based on the financial statements' conformity with the applicable financial reporting framework.

Fundamental Principle of Responsibilities

• Competence and Capabilities:

  • Requires formal education, expertise, and practical auditing experience.

• Ethical Requirements:

  • Independence:
  • Independence in Fact: The auditor's actual state of mind and unbiased mental attitude.
  • Independence in Appearance: The perception of independence by informed third parties.
  • Scenarios of Independence Failure:
    • Auditor possesses independence in fact but lacks independence in appearance.
    • Auditor possesses independence in appearance but lacks independence in fact.
  • Potential Compromises to Independence:
    • Financial relationships with audit clients.
    • Managerial relationships with audit clients.
    • The auditor-client revolving door issue (employment transitions between firms and clients).
  • Due Professional Care:
  • The level of diligence, skill, and care expected of a prudent auditor.
  • Benchmark standard defined by the level of performance of a reasonable auditor acting in similar circumstances.

• Professional Skepticism and Professional Judgment:

  • Professional Skepticism:
  • Defined as maintaining a questioning mind and a critical assessment of audit evidence.
  • Presumption rule: The auditor assumes management is neither inherently dishonest nor perfectly honest.
  • Operational requirement: All management assertions must be corroborated using objective evaluation of evidence.
  • Professional Judgment:
  • The application of relevant training, knowledge, and experience in making informed decisions throughout the audit.
  • Necessary because audit decisions are rarely cut-and-dry.
  • Overall quality of auditor professional judgment depends directly upon auditor competency and independence.

Fundamental Principle of Performance

• Goal of Performance Principle:

  • Provide reasonable assurance that financial statements are free of material misstatements.

• Inability to Provide Absolute Assurance:

  • Nature of Financial Reporting: Financial statements inherently rely on subjective estimates, management assumptions, and complex facts.
  • Nature of Audits: Auditors rely on selective audit evidence and sampling methods rather than evaluating $100\%$ of transactions.
  • Statutory Time and Cost Constraints:
  • Audits must be completed within strict regulatory deadlines following fiscal year-end:
    • Large Accelerated Filers: $60\text{ days}$
    • Accelerated Filers: $75\text{ days}$
    • All Other Public Entities: $90\text{ days}$
  • Audits are conducted within realistic financial cost considerations.

• Major Activities of the Performance Principle:

  • Planning and Supervision: Developing a comprehensive written audit plan and properly overseeing engagement team assistants.
  • Materiality Determination: Establishing quantitative and qualitative thresholds that influence user decisions; considered continuously throughout the audit process.
  • Risk Assessment: Gaining a detailed understanding of the entity and its environment (including internal controls) to evaluate risks of material misstatement and determine the nature, timing, and extent of substantive testing.
  • Evidence Collection: Gathering appropriate and sufficient audit evidence.

• Characteristics of Audit Evidence:

  • Appropriateness (Quality of Evidence):
  • Relevance: Evaluates whether specific evidence directly addresses the financial statement assertion being tested.
  • Reliability: Measures trustworthiness based on evidence origin (ranked from highest to lowest quality):
    1. Auditor's direct personal knowledge (Highest reliability)
    2. External documentary evidence obtained from third parties outside the client
    3. Internal documentary evidence generated internally by the client (Lowest reliability)
  • Sufficiency (Quantity of Evidence):
  • Measures the volume of audit evidence collected (number of transactions or components evaluated).
  • Dependent on internal control effectiveness:
    • Effective Internal Controls $\rightarrow$ Lower Control Risk $\rightarrow$ Evaluates less audit evidence.
    • Ineffective Internal Controls $\rightarrow$ Higher Control Risk $\rightarrow$ Evaluates more audit evidence.
  • Detection Risk Relationship:
  • Detection risk is the risk that audit procedures fail to detect an existing material misstatement.
  • Detection risk decreases as the auditor collects higher quality (appropriate) and greater quantity (sufficient) audit evidence.

Fundamental Principle of Reporting

• Reporting Directives:

  • Formally express an opinion (or state that an opinion cannot be expressed) on the entity's financial statements.
  • Evaluate financial statements against an established financial reporting framework.
  • A financial reporting framework is the set of criteria used to measure, recognize, present, and disclose material items.
  • Examples include U.S. Generally Accepted Accounting Principles (GAAP), International Financial Reporting Standards (IFRS), or special purpose frameworks (e.g., cash basis or tax basis accounting).

• Major Sections of a Standard Public Company Auditor's Report:

  • Title: Must explicitly state "Report of Independent Registered Public Accounting Firm".
  • Addressee: Addressed to the Stockholders and Board of Directors of the client firm.
  • Opinion on Financial Statements Section: Explicitly states the audited financial statement titles, dates, periods covered, and the formal opinion regarding fair presentation in conformity with GAAP.
  • Basis for Opinion Section:
  • Outlines management responsibility for financial statements and auditor responsibility for expressing an opinion.
  • Identifies registration with the PCAOB and independence compliance under U.S. federal securities laws, SEC rules, and PCAOB regulations.
  • States that audits were conducted in accordance with PCAOB standards and provided a reasonable basis for the opinion.
  • Critical Audit Matters (CAMs) Section:
  • Reports matters arising from the current audit communicated (or required to be communicated) to the audit committee that:
    1. Relate to accounts or disclosures material to the financial statements.
    2. Involved especially challenging, subjective, or complex auditor judgments.
  • Note: Communication of CAMs does not alter the overall financial statement opinion or provide separate opinions on the individual CAMs.
  • Engagement Sign-off Details: Signature of audit firm, city/state of audit office, report issuance date, and explicit disclosure of auditor tenure year.

• Typology of Audit Opinions:

  • Unmodified (used for nonpublic entities) / Unqualified (used for public entities): Financial statements present fairly in conformity with GAAP.
  • Qualified: Financial statements present fairly in conformity with GAAP except for limited, specific items.
  • Adverse: Financial statements do not present fairly in conformity with GAAP.
  • Disclaimer: Auditors explicitly state that they do not express an opinion on the financial statements.

System of Quality Control and Firm Monitoring

• Rationale for Quality Control:

  • Auditing is an intangible service whose quality is unobservable to financial report users prior to suffering financial losses.
  • Firms must establish systematic internal mechanisms to guarantee professional execution.

• Purpose of Quality Control Systems:

  • Provide the accounting firm with reasonable assurance that firm personnel comply with professional standards and legal/regulatory requirements while issuing appropriate reports.

• Six Key Elements of Quality Control Systems:

  1. Leadership responsibilities for quality within the firm ("tone at the top").
  2. Relevant ethical requirements.
  3. Acceptance and continuance of client relationships and specific engagements.
  4. Human resources.
  5. Engagement performance.
  6. Monitoring.

• PCAOB Monitoring & Inspection Mandates:

  • Annual Inspection: Mandated for public accounting firms auditing more than $100$ public entities.
  • Triennial Inspection: Mandated every $3\text{ years}$ for accounting firms auditing $100$ or fewer public entities.
  • PCAOB Inspection Report Structure:
  • Part I: Publicly reports identified audit performance deficiencies where the firm failed to obtain sufficient appropriate evidence to support its opinion.
  • Part II: Addresses internal quality control deficiencies of the inspected firm; published publicly ONLY IF the firm fails to remediate Part I quality control issues within $1\text{ year}$.

Empirical Deficiencies, Scandals, and Enforcement Cases

• Madoff Ponzi Scheme Case:

  • Approximately one year prior to being arrested for embezzling $50\text{ billion}$ from investors, money manager Bernard Madoff stated: "In today's regulatory environment, it's virtually impossible to violate rules."

• BF Borgers CPA PC Audit Fraud Case (May 2024):

  • Lakewood, Colorado-based public accounting firm shut down permanently by federal regulators in May $2024$ for "massive fraud".
  • Prior to closure, ranked among the top $10$ most active U.S. auditing firms by client volume (specializing in small public issuers), with its highest-profile client being Trump Media & Technology Group.
  • SEC Findings:
  • Labeled a "sham audit mill" that fabricated documentation, conducted nonexistent work, and held fake audit planning meetings.
  • Managing partner Benjamin Borgers routinely instructed staff to copy prior-year audit workpapers, change dates, and present them as current workpapers.
  • Scope & Impact:
  • Affected more than $1,500$ SEC regulatory filings between January $2021$ and June $2023$.
  • A prior regulatory review revealed a $100\%$ deficiency rate across firm files.
  • Regulatory Sanctions & Penalties:
  • Lifetime practice ban before the SEC for both the audit firm and Benjamin Borgers.
  • Audit firm paid $12\text{ million}$ in civil penalties; Benjamin Borgers paid $2\text{ million}$ in civil penalties.
  • Forced over $110$ public company clients to immediately dismiss the firm and secure new PCAOB-compliant auditors.

• Global Inspection Deficiencies (IFIAR & PCAOB Data):

  • International Forum of Independent Audit Regulators (IFIAR) Findings ($2018$ Report):
  • Reported that $40\%$ of all global inspected audits contained at least one deficiency finding.
  • Inspection deficiency trends: $47\%$ ($2014$), $40\%$ ($2017$), and $38\%$ ($2018$).
  • Top $5$ deficiency areas globally: accounting estimates, internal control testing, audit sampling, group audits, and revenue recognition.
  • PCAOB Part I.A Audit Deficiency Rates ($2020$–$2024$ Reports):
  • Percentage of reviewed audits with a Part I.A deficiency (insufficient evidence to support opinion):
    • $2020$: $29\%$
    • $2021$: $34\%$
    • $2022$: $40\%$
    • $2023$: $46\%$
    • $2024$: $39\%$
  • Share of Part I.A Deficiencies by Cited PCAOB Standard ($2022$ Analysis):
  • AS 2201 (ICFR Audit / Integrated Audit): $27\%$
  • AS 1105 (Audit Evidence): $20\%$
  • AS 2301 (Responses to Assessed Risks): $18\%$
  • AS 2501 (Accounting Estimates / Fair Value): $13\%$
  • AS 2810 (Evaluating Audit Results): $7\%$
  • Financial Statement Areas with Deficiencies in $2024$ ($312$ Engagements Inspected Across $6$ U.S. Global Network Firms):
  • Revenue and related accounts: $36$
  • Inventory: $12$
  • Allowance for credit losses: $10$
  • Business combinations: $7$
  • Goodwill and intangibles: $6$

• KPMG PCAOB Inspection Leak Scandal ($2017$–$2018$):

  • Incident Overview: Scott Marcello (KPMG U.S. Vice Chair of Audit), four other partners, and one employee were terminated/departed due to illegal receipt of confidential PCAOB inspection target data.
  • Mechanism: A former PCAOB employee hired by KPMG passed advance confidential inspection notices to KPMG personnel. KPMG internal staff alerted firm management, who subsequently reported the leak to the PCAOB.
  • Enforcement Actions (January $2018$):
  • Five KPMG partners were charged with conspiracy and wire fraud.
  • A sixth KPMG employee pled guilty to conspiracy and received a permanent ban from public financial statement auditing.
  • Three of the six involved individuals were former PCAOB employees.
  • Regulatory Response: PCAOB initiated formal internal reviews of its IT infrastructure, security controls, and ethical protocols.