Yet ANOTHER Annual Interim Inspection Report
By Charles Pagano and Mark Aaron
The Public Company Accounting Oversight Board (“PCAOB”) issued yet another PCAOB Annual Report on the Interim Inspection Program Related to Audits of Brokers and Dealers (the “Eighth Inspection”).
The industry had anticipated that subsequent to the prior year’s August issuance of the Seventh Inspection, the permanent inspection program would have been announced. However, this was not the case. Can this be the year that a permanent program is finally implemented? The time appears right.
Trump administration personnel moves have changed the decision makers. During 2017, Jay Clayton was named Chairman of the Securities and Exchange Commission (“SEC”), and in 2018 three new Commissioners rounded out the five-person Board. In December 2017, five new Board members were appointed to the PCAOB, followed by considerable turnover in staff in 2018, and 2019.
The new Board almost immediately stated its intention to obtain timely formal and informal feedback on the broker-dealer inspection process. The desire for feedback can be seen in the Eighth Inspection in the form of a survey link. This year’s inspection also saw a significant change in presentation of the report, as a revamped format made it more concise, clearer and helpful, including the addition of commentary entitled “Example of Effective Procedures” for each deficiency area noted. Unfortunately, the inspection disclosed many of the same results as previous iterations.
Importance of the Eighth Inspection
It is important to review the current inspection report as published in PCAOB Release No. 2019-002, August 20, 2019, as this may be a considerable indicator of where the permanent inspection may land. Open questions include types of broker-dealers to be examined, frequency of review of the audit firm and potential sanctions of auditing firms. The Eighth Inspection was issued on August 20, 2019, with many of the same comments and high deficiency rates found in the preceding seven inspection reports. Clients and auditors should discuss the key areas emphasized in the report to understand the audit implications of their business activities.
Annual Inspection Report Selection
For the fiscal year ended March 31, 2018, the population consisted of 435 audit firms who audited 3709 broker-dealers. As a matter of comparison, the last two inspections included 475 audit firms who audited 3,829 broker-dealers for the Seventh Inspection, and 531 audit firms who audited 3,933 broker-dealers for the Sixth.
Since the initial interim inspection covering the 2011 fiscal year, there has been a downward trend in both the number of broker-dealers and the firms auditing them. The First Report reflected approximately 800 audit firms, and 4400 broker-dealers. Is regulation and audit risk contributing to contraction?
Source: Data from PCAOB Annual Reports on 2011-2017 Inspections (https://pcaobus.org/Pages/BrokerDealers.aspx) and PCAOB Release 2019-002
The PCAOB selection for the Eighth Inspection encompassed 67 auditing firms and 105 audits, a comparable number to previous years. Interestingly, of the 435 audit firms that audit broker dealers, nearly 397 audit 1583 broker-dealers, an average of 4 per firm compared to 38 audit firms that audit 2126 broker-dealers, an average of 56 per audit firm.
The PCAOB utilized both a risk-based methodology and a random selection methodology that incorporated the following factors:
- The number of broker-dealer audits performed
- Whether the firm audits issuers
- Whether the firm conducted examination engagements
- Previous inspection results
- History of the firm and firm personnel in auditing broker-dealers
- Existence of disciplinary actions against the firm or engagement partner.
The PCAOB’s selection process, since the inception of the interim inspection program, resulted in 338 audit firms and 735 audit engagements inspected. Some firms were inspected multiple times, and a significant number of auditors were not inspected.
Due to the decrease in auditors each year, and some auditing firms being inspected multiple times, it is difficult to ascertain how many firms have not been inspected. However, we estimate approximately 100 audit firms, predominately those who audit a smaller number of broker dealers, have not yet been inspected. The statistics show as of this past inspection year, that there were 140 auditors who audited only 1 broker-dealer, and 257 auditors who audited 2-20 broker-dealers.
The Eighth Inspection noted 77% of the engagements inspected with a deficiency, similar to the prior year’s inspection.
The engagements inspected had the following rates of deficiency:
- Independence (5% from 8%)
- Revenue (60% from 73%)
- Risks of material misstatements due to fraud (47% from 64%)
- Engagement quality review (65% from 59%)
Other deficiency areas included net capital, customer protection, fair value measurement, review of exemption and examination of compliance reports, and related party activity. Interestingly, these deficiencies are similar to those noted in the first interim inspection. The PCAOB statistics show that there is a significantly lower deficiency rate for those auditors who audit a greater number of broker-dealers, and for those who audit issuers.
Clients should discuss with their auditors the results of the auditor’s inspections. Auditors should be able to perform a quality audit, and the client needs to perform due diligence to ascertain the auditor’s ability to execute. Inquiring regarding various relevant audit quality indicators such as firm leadership, audit experience of the partners and staff, training, workload, the monitoring process, and ability to keep abreast with the ever-changing landscape enables the client to distinguish one auditor from another.
Although the deficiency rate decreased considerably over the years, independence remains the foundation of all audits. SEC Rule 17a-5 requires that an auditor must be independent in accordance with Rule 2-01 of SEC Regulation S-X. Currently, certain carve outs exist under PCAOB standards for non-issuer broker-dealers. The carve outs include partner rotation and the ability to perform tax compliance services for those in financial reporting roles.
Considerations where a mutual or conflicting interest may exist, or where the accountant is placed in the position of auditing his or her own work, or acts in a management capacity, or an accountant advocates for the client are all prohibited pursuant to SEC Rule 2-01.
The Eighth Inspection revealed, as in prior inspections, instances where the auditor prepared or assisted in the preparation of the financial statements or supplemental information or provided bookkeeping services. While editorial suggestions and educational materials can be supplied to the client, it is important to realize that the auditor is not the decision maker in the financial reporting process. Additionally, audit engagement letters cannot include an indemnification clause.
Independence is essential in the auditing profession. An auditor who performs audits of broker-dealers and is not complying with the independence rules is doing a disservice to the client, as the audit cannot be relied upon, and may subject the broker-dealer to re-audit, and the auditor to sanctions. Clients should question the auditing firm as to what systems are in place to monitor independence. Appropriate communication to management regarding independence should occur, at a minimum, annually. A SEC Rule 3526 Letter needs to be sent, by the accounting firm, yearly to those changed with governance, disclosing any possible conflicts and reaffirming independence.
The PCAOB points out that the deficiency rate in this area has gone slightly down to 60% (from 65% in the previous inspection). With ASC 606 fully implemented after this inspection period, one might expect that future inspections might show an increase in future deficiencies (note that those engagements inspected were for years prior to ASC 606 being fully implemented). Clients and auditors should review their procedures to ensure compliance with the revenue recognition aspects of ASC 606, as well as the disclosures.
The PCAOB notes instances where auditors did not properly perform procedures (47%) in accordance with AS 2110, Identifying and Assessing Risks of Material Misstatement. An auditor needs to document their understanding of the client’s revenue streams, and internal controls over financial reporting, including controls at the service organization, such as the clearing broker for any material stream of revenue. Revenue sources that are grouped together in the financial statements need to be separately analyzed.
For example, if the commission line consists of products which are processed differently, one would have to sufficiently understand and test each material revenue stream. If separate clearing brokers are used for a product, one would also have to understand and test those processes. Other considerations might include a change in personnel where processes may also change. It’s important for the auditor to gain this understanding as early as possible, preferably in the planning stages.
The PCAOB noted instances where sampling procedures were not appropriately designed, sampling was not representative of the population, all items did not have a chance at selection, and not enough items were sampled.
Clients need to establish controls to get comfort that what they are inputting to the clearing broker is being properly captured. Simply accepting what the clearing firm has recorded without procedures in place does not give the auditor comfort that all transactions are being properly recorded.
The Eighth Inspection also notes deficiencies where the extent of testing was insufficient, and not in accordance with AS 2301, The Auditor’s Responses to the Risks of Material Misstatements. In addition to the insufficient testing of various revenue streams discussed above, there were instances of insufficient sample sizes, inappropriate sample selection, samples not representative of the population, and remaining material balances left untested.
Much of the cost associated with auditing a broker-dealer is contingent upon the number and processes involved in the revenue steam. Effective planning through understanding of the aspects of the broker-dealer’s business can make the audit more cost efficient and effective, especially when considering the Revenue Recognition accounting standards.
Ineffective planning resulting in insufficient audit procedures can cause the audit to be deficient, which could result in a re-audit and regulatory oversight or action for both the broker-dealer and auditor.
Once again, the PCAOB found numerous instances where the auditor did not properly evaluate the service auditor’s report (“SOC-1” report). When an auditor relies on controls at the clearing organization with the purpose of decreasing substantive testing, the auditor needs to consider several procedures. First, the auditor must consider testing the operating effectiveness of the user controls as noted in the SOC- 1 report. If a sub-service provider is mentioned in that report, the auditor must also consider that sub-service provider’s user controls.
In previous inspections, the PCAOB noted that where the period included in the service organization report does not coincide with the audit period, the auditor would have to perform substantive work for that uncovered period. The effect of the above could conceivably make the auditor conclude that substantive procedures and, therefore, increased testing, is the practical approach, and not rely on a service provider’s SOC-1 reports.
Clients who prepare documentation and perform procedures to ensure that they maintain the user entity controls prescribed in their agreement with the service provider protect themselves and their customers. Ensuring that their internal control environment intertwines with the service provider’s control environment enhances their risk management program and heightens the protection of their customers’ assets.
In addition, sharing this documentation with the auditors enables the auditors to connect the dots to thoroughly understand the control environment in place at the client. This understanding is required under PCAOB auditing standards, regardless of whether the auditor can perform tests of controls that could decrease the amount or type of substantive testing. Always remember that tests of controls alone are not sufficient audit procedures.
Assessing and Responding to the Risks of Material Misstatements Due to Fraud
This area saw a 47% deficiency rate, compared to 64% last year.
In last year’s inspection report, the PCAOB noted, “when identifying and assessing the risks of material misstatement due to fraud, the auditor should presume that there is a fraud risk.” The presumption is that improper revenue recognition is always a fraud risk.
When the auditor concludes that improper revenue recognition is not a fraud risk, the rationale supporting this conclusion must be thoroughly documented. The PCAOB has commented on numerous occasions that collaboration of others beyond the CEO is essential in identifying and assessing the risks of material misstatement.
Clients and auditors need to discuss what keeps the client up at night related to fraud risks. While journal entry testing can shed light on fraud risks, it is imperative for the auditor to go beyond the accounting department.
Seeking input from management and non-management personnel from all areas of a broker-dealer, including compliance, trading, and back office operations, diversifies the information the auditor processes during the planning and execution of the engagement. The auditor needs to identify fraud risk and address management override of controls. Journal entry testing should include the following considerations:
- Include a sample not only during the year, but at the end of the reporting period
- Comfort that there are controls in place that are not overriding controls
- Perform inquiries of management and document such procedure
- Include tests of detail of the journal entry testing
- Design testing to specifically address fraud risks
Engagement Quality Review (“EQR”)
The Eighth Inspection noted a 65% deficiency rate existed in EQR review.
The engagement quality review (“EQR”) process is, often, the last control an accounting firm utilizes to ensure a quality audit. While in a few cases there was no evidence of any EQR being performed, a substantial portion of the deficiencies were due to an insufficient review being performed, whether the individual did not have sufficient expertise, did not challenge the engagement team or had not taken a two-year cooling-off period after leaving the engagement partner role.
The EQR should include reviewing the report and work papers that are essential in developing an opinion, evaluating the audit response to identified risks, reviewing for compliance with independence, and reviewing the engagement completion document. In other words, step into the engagement partner’s shoes and perform a thorough review to gain comfort that sufficient work has been performed to issue an audited report.
The EQR responsibility of challenging the engagement team demands that the person in this role possesses the requisite knowledge, experience, and fortitude to take and maintain a position as deemed necessary.
Clients need to gain comfort that the firm engaged has sufficient expertise and resources to ensure that a qualified EQR will be conducted by a person with the appropriate qualifications, as discussed above in relation to assessing the qualifications of the engagement team. Smaller firms who may not have a suitable in-house partner, or the equivalent, for this role, may need to farm out this function to a qualified individual.
Financial Responsibility Rules
The auditor is required to test controls over compliance with the financial responsibility rules in those audits where a broker-dealer is not exempt form SEC Rule 15c3-3. Those rules require that the auditor understand, and test controls.
Deficiencies in this area included:
SEC Rule 15c3-1, Net capital Rule and SEC Rule 15c3-3, Customer Protection Rule
- Tests of accuracy and completeness of information produced by the broker dealer and/or service organization used were not performed
- Procedures to evaluate whether the amounts used were in accordance with rules
- Tests to determine whether the broker-dealer maintained a Special Reserve Bank Account for the Exclusive Benefit of Customers
SEC Rule 17a-13, Quarterly Security Count Rule
- The appropriate client staff did not perform the count
- Insufficient evidence of the count
FINRA Rule 2231, Account Statement Rule
- Statements are complete and accurate
- Delivered to all customers in accordance with the rule
The auditors understanding of the processes and controls for these rules must be documented, and procedures performed by inquiry, reperformance and written audit evidence. A broker’s controls should include review by an appropriate person. The auditor needs to understand and document what is being reviewed by the appropriate person, and what would cause that person to question the computations and procedures.
The inspection report also notes that engagement teams sometimes established materiality levels that were too high and determined sample sizes to be too small. This emphasizes the importance of the engagement team performing due diligence and proper planning gaining an understanding of the risks of material misstatement to determine the audit approach and ensure a proper risk assessment.
The Future of The Audit Landscape
Last year also saw The Small Business Audit Correction Act of 2018 proposed and seemingly lose momentum as the new 116th Congress began. The legislation would have exempted most broker-dealers from PCAOB auditing standards, reverting us to the days of auditing under AICPA Generally Accepted Auditing Standards (“GAAS”).
Both the House and Senate bills called for those non-custodial broker-dealers, with less than 150 registered persons, in good standing, to be exempt from the PCAOB standards. Although auditing under both AICPA or PCAOB standards is substantially the same, some cost savings may be realized under modified requirements, including no longer needing an Engagement Quality Reviewer (“EQR”).
On September 16, 2019, Paige Pierce, President of the Pierce Group, an industry consulting firm, who has been leading the initiative summarized the status noting the following:
- A new organization was formed, the National Association of Small Brokers to promote the legislation
- Meetings continue with the House Financial Services Committee, legislators and organizations that support the bills
- Language is being amended in bills to address Democratic concerns
This may be a lengthy process. Even if passage of the bill gains momentum the process of amending SEC Rules 17a-5 will take some time also.
Two points are important to note. First, the cost of audits remains a major concern, for smaller broker-dealers.t. Second, the finalization of the permanent inspection program may result in additional effects on the market, whether it be contraction of the number of auditors, or the exception of certain engagements from inspection.
Finally, we note that FINRA is considering the possibility of implementing an automatic 30-day extension without cause into the annual audit filing deadline.
As the number of qualified auditors continue to shrink, and standards continue to evolve, broker-dealers need to be even more diligent in auditor selection. Further contraction in the number of auditors is certainly possible.
As we wait to see whether the inspection program will become final, auditors and broker-dealers should be aware that quality audits are important not only to avoid regulatory issues but to maintain high standards in the industry.