PCAOB Inspection Findings and Trends: What Auditors Must Learn

Understanding PCAOB Inspections

The Public Company Accounting Oversight Board (PCAOB) conducts regular inspections of registered public accounting firms to evaluate their compliance with PCAOB standards, rules, and applicable professional standards. For CPA AUD candidates, understanding the common findings from these inspections provides valuable insight into the areas where auditors most frequently fall short and where the exam is likely to focus its questions.

PCAOB inspections serve two primary purposes: to assess the quality of individual audit engagements and to evaluate the firms quality control systems. When inspectors identify deficiencies, the firm has the opportunity to remediate quality control criticisms before they become public. However, engagement-specific findings are included in the public inspection report and provide a detailed picture of common audit failures.

Recurring Engagement-Level Deficiencies

Revenue Recognition Testing

Revenue recognition consistently ranks among the most common areas with inspection deficiencies. Inspectors frequently find that auditors fail to perform sufficient testing of the occurrence and accuracy of revenue transactions, do not adequately evaluate the appropriateness of managements revenue recognition policies under ASC 606, and do not sufficiently address fraud risks related to revenue. These deficiencies reflect the inherent complexity of revenue recognition and the significant judgment involved in applying the five-step model.

CPA candidates should understand not just the accounting for revenue under ASC 606 but also the audit procedures that address revenue recognition risks, including tests of controls over the revenue cycle, substantive analytical procedures comparing revenue to expectations, and detail testing of specific transactions for proper timing, amount, and classification.

Internal Control Testing

Deficiencies in the audit of internal controls over financial reporting (ICFR) are another persistent finding. Common issues include insufficient testing of the design and operating effectiveness of controls, overreliance on inquiry as an audit procedure without corroborating evidence, failure to evaluate the severity of identified control deficiencies, and inadequate testing of information technology general controls (ITGCs) that support key financial reporting applications.

For integrated audits, the PCAOB requires auditors to obtain sufficient evidence about both the design and operating effectiveness of controls. Inspectors frequently find that auditors selected controls that did not adequately address the risks of material misstatement or that the nature, timing, and extent of testing was not responsive to the assessed risks.

Estimates and Fair Value Measurements

The audit of accounting estimates, including fair value measurements, is an area of increasing regulatory focus. PCAOB inspectors have found that auditors sometimes fail to evaluate the reasonableness of managements assumptions, do not sufficiently test the data underlying estimates, and do not consider the potential for management bias. Given that estimates involve significant judgment and are susceptible to manipulation, robust audit procedures in this area are critical.

Quality Control System Deficiencies

Beyond individual engagement findings, PCAOB inspections evaluate the firm system of quality control. Common quality control deficiencies include weaknesses in the firm monitoring processes, insufficient training on emerging audit standards and complex accounting topics, inadequate supervision and review of engagement team work, and deficient policies for engagement partner assignment that do not adequately consider the complexity and risk of the engagement.

The PCAOB has emphasized that a strong quality control system should prevent engagement-level deficiencies from occurring. When the same types of engagement deficiencies recur across multiple inspections, it suggests that the firm quality control system is not effectively identifying and addressing root causes.

Trends in Inspection Findings

Increased Focus on Technology Risks

As companies increasingly rely on complex IT systems, the PCAOB has heightened its focus on how auditors address technology risks. This includes evaluating whether auditors properly identify IT-dependent controls, test ITGCs such as access controls, change management, and IT operations, and consider the impact of ITGC deficiencies on the reliability of reports generated by the system.

Audit Firms Use of Data Analytics

The PCAOB has also examined how firms use data analytics in their audits. While data analytics can enhance audit quality by enabling more comprehensive testing, inspectors have identified instances where firms did not adequately design or execute data analytics procedures, did not properly evaluate the completeness and accuracy of the data used, or used data analytics as a supplement without reducing the risk of material misstatement to an acceptably low level.

Key Lessons for CPA Candidates

• Revenue recognition, internal controls, and accounting estimates are the most frequently cited areas of deficiency and are heavily tested on the CPA exam.
• Understand the difference between deficiencies in the audit of financial statements and deficiencies in the audit of internal controls over financial reporting.
• Know that the PCAOB evaluates both engagement quality and firm-level quality control systems.
• Recognize that technology risks, including ITGCs and data analytics, are areas of increasing focus for both regulators and the CPA exam.
• Use PCAOB inspection trends as a study guide to identify the audit topics most likely to appear on the AUD section.

PCAOB inspection findings represent real-world audit failures. Studying these findings helps CPA candidates understand not just what the right answer is, but why auditors sometimes get it wrong and how to avoid those pitfalls in practice.