Comments of the Auditing Standards Committee of the Auditing Section of the American Accounting Association on International Auditing and Assurance Standards Board Exposure Draft, Proposed International Standard on Auditing 220 (Revised): Quality Management for an Audit of Financial Statements

We commend the Board on its actions to encourage proactive management of audit quality at the engagement level, which have resulted in the publication of Exposure Draft, Proposed International Standard on Auditing 220 (Revised): Quality Management for an Audit of Financial Statements (ED-220). ED-220 explicitly requires the engagement partner to demonstrate sufficient and appropriate involvement in all phases of the audit, it describes certain activities that must be performed by the audit engagement partner, and it explicitly acknowledges the role of audit firm-level policies and procedures and the changing complexity of audit engagement teams.

While we believe the proposed enhancements substantially achieve the Board's intent, in addition to the question-specific commentary provided below, we have an overarching concern. ED-220 requires fulfillment of its requirements be documented (paragraph 38), and many of the requirements detailed in ED-220 have the potential to become items on a long checklist that partners must acknowledge having completed. There is recent evidence that to reduce criticisms of regulators, auditors have increased their use of technology-enabled and other standardized audit processes, forms, and checklists—despite recognizing that doing so may negatively impact critical thinking and professional skepticism (Boland, Daugherty, and Dickins 2019; Westermann, Cohen, and Trompeter 2019). Although the documentation guidance provided in paragraphs A102–A104 is appropriate and appears to consider the balance between evidencing compliance and creating unintended consequences that may adversely impact audit quality, we believe additional prominence is warranted. Specifically, we recommend paragraph 38 be modified to include a statement that explicitly requires partners consider this balance when documenting compliance with the standard.

We support the notion that the engagement partner must have sufficient and appropriate involvement in the audit. In particular, the spirit of the requirements described in ED-220 is consistent with research findings that demonstrate engagement partner leadership and specific leadership-prompts influence other members of the engagement team to act in ways that positively impact audit quality (e.g., Carpenter and Reimers 2013; Gissel and Johnstone 2017; Dennis and Johnstone 2016). However, we are concerned that auditors may see the requirements of ED-220 as separate and apart from other engagement activities when they should be viewed as an integral part of nearly all engagement quality control activities. For example, we suggest clarifying that the requirements detailed in paragraph 12 might be communicated as part of the engagement team's discussion of the susceptibility of the entity to material misstatements of the financial statements required by paragraph 10 of ISA 315: Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and Its Environment.¹ Doing this would not only better demonstrate the integral nature of ED-220′s requirements, it would also reduce the possibility of redundant performance and documentation. There is always a risk that time spent on documenting will reduce time spent on more value-added engagement activities.

Relatedly, ED-220 is designed to operate as part of the broader system of a firm's quality management established in accordance with ED-ISQM 1. We believe this interaction could be more explicitly referenced in the Application and Other Explanatory Material (AOEM) section of ED-220. The items to be communicated in paragraph 12 should also be covered in firm-level training. For example, reprisal (paragraph 12c) could come from any supervisor, including the engagement partner, so engagement team members should have reporting mechanisms beyond that of the engagement partner; and professional skepticism (paragraph 12d) is a concept that must be learned before it can be exercised. We believe this should be acknowledged in ED-220.

Although ED-220 appropriately promotes that quality management is an on-going process, many of its requirements should be addressed prior to, or at the beginning of, an audit engagement (e.g., paragraphs 12 to 15). Several studies find evidence of enhanced audit outcomes when partners consider and emphasize prompts during the planning stage of the audit (e.g., Hoffman and Zimbelman 2009; Lynch, Murthy, and Engle 2009; Trotman, Simnett, and Khalifa 2009; Carpenter and Reimers 2013; Dennis and Johnstone 2018). We therefore recommend emphasizing the importance of relevant requirements during the planning phase of the audit. Minor modifications could achieve this goal. For example, paragraph 12 could be modified to: “In creating the environment described in paragraph 11, during the planning phase of the audit the engagement partner and others to whom supervisory roles are assigned shall take clear, consistent and effective actions that reflect the firm's commitment to quality and establish and communicate the expected behavior of engagement team members, including.” Similarly, paragraph 14 could be: “Prior to commencing the audit, the engagement partner shall have an understanding of the relevant ethical requirements, including those related to independence, that are applicable given the nature and circumstances of the audit engagement.”

Paragraph 37 requires that the engagement partner make a determination at the end of the audit about whether his or her “involvement has been sufficient and appropriate throughout the audit engagement such that the engagement partner has the basis for determining that the significant judgments made and the conclusions reached are appropriate given the nature and circumstances of the engagement.” “Standing back” at the end of the engagement may be too late, particularly if the partner and engagement team are facing time pressures. Research suggests that partners may have difficulty self-identifying weaknesses and potential deficiencies in the audit during the completion stage and that to avoid cognitive dissonance, auditors will report high levels of professional skepticism even when they take actions they previously identified as consistent with low professional skepticism (Adikaram and Higgs 2019). This suggests that when “standing back” engagement partners may unconsciously conclude the audit was conducted with professional skepticism, even if it was not. To mitigate the likelihood of this effect, we recommend “standing back” be required at the end of each phase of the audit (i.e., planning, preliminary fieldwork, final fieldwork, reporting). If this recommendation is adopted, the first sentence of paragraph 37 could be modified to: “At the end of each phase of the audit engagement (e.g., planning, preliminary fieldwork, final fieldwork, reporting), the engagement partner shall determine that he or she has taken overall responsibility for managing and achieving quality on the audit engagement.”

Relatedly, we suggest additional guidance be provided for engagement partners to execute the proposed self-assessment. As currently proposed (paragraphs 37 and A99 to A101), the self-assessment is a largely unstructured task without a clearly defined deliverable and seems to add little incremental value to the independent effort required as part of the engagement quality review required by Proposed ISQM 2. For example, guidance in the AOEM might describe that “standing back” at the end of the planning phase requires engagement partners to reflect whether, given the results of planning, there is reason to believe (1) the auditor should not continue with the audit, (2) should assign additional or different engagement team members (including specialists), or (3) should request additional information from the client. At the end of preliminary fieldwork, “standing back” requires partners to reflect whether (1) the auditor should continue with the audit, (2) additional or different engagement team members should be assigned, (3) materiality should be modified, or (4) the nature, timing, or extent of planned auditing procedures should be modified. Including greater specificity will increase the likelihood that auditors will understand the intent of ED-220 and of “standing back.” It may also heighten the auditor's understanding and exercise of professional skepticism.

Although we generally believe ED-220 appropriately reflects the role of other senior members of the engagement team, we believe paragraph 13 should more directly reference these individuals. We recommend the first sentence of paragraph 13 be modified to: “If the engagement partner assigns procedures, tasks, or actions to other members of the engagement team, such as senior associates or other partners, to assist the engagement partner in complying with the requirements of this ISA, the engagement partner shall continue to take overall responsibility for managing and achieving quality on the audit engagement.”

ED-220 requires the engagement partner to monitor and take responsibility for many aspects of the audit engagement that directly or indirectly impact audit quality. One aspect not explicitly considered is the workload of the engagement team. Unusually high workloads may negatively impact an auditor's exercise of professional skepticism and audit quality (Coppage and Shastri 2014; Persellin, Schmidt, and Wilkins 2014; Brown, Gissel, and Neely 2016; Hurley 2017; Lambert, Jones, Brazel, and Showalter 2017). As most audit engagement teams maintain time summaries, placing the onus on the engagement partner to monitor these throughout the course of the audit would not require much additional effort. Specifically, a bullet point could be added to paragraph A29 to the effect of “Monitoring the workloads of engagement team members to ensure balance among team members, reduce the likelihood of fatigue, and ensure an appropriate level of effort on high risk audit areas.”

We support the material provided in ED-220 on the appropriate exercise of professional skepticism in managing quality at the engagement level. Research provides ample evidence that professional skepticism is a requirement for making appropriate professional judgments and quality decisions in audits (Carpenter and Reimers 2013; Hurtt, Brown-Liburd, Earley, and Krishnamoorthy 2013; Brazel, Jackson, Schaefer, and Stewart 2016; Harding and Trotman 2017; Brazel, Gimbar, Maksymov, and Schaefer 2018; Eutsler, Norris, and Trompeter 2018). We highlight a few expositional issues and offer a few minor suggestions for the Board's consideration.

The second sentence of paragraph 7 is currently “In doing so, the engagement partner and engagement team exercise professional judgment and professional skepticism in meeting the objective and requirements of this ISA.” As professional skepticism is an input to judgment in decision making, we suggest reordering these terms in the sentence. In addition, we recommend specifically identifying ISA 220 to eliminate any possible confusion as to which standard is referenced. If this suggestion is adopted, the second sentence of paragraph 7 would be: “In doing so, the engagement partner and engagement team exercise professional skepticism and professional judgment in meeting the objective and requirements of ISA 220.”

The fifth sentence of paragraph 7 is, “The appropriate exercise of professional skepticism may be demonstrated through the actions and communications of the engagement partner and other members of the engagement team” (emphasis added). We suggest using “should” instead of “may.” We believe the stronger language better places the responsibility of demonstrating professional skepticism on the engagement team.

We recommend the description of possible auditor bias be used consistently throughout ED-220 (e.g., paragraphs 7 and 28). Because the terminology “conscious bias” may be interpreted as auditors intentionally avoid exercising professional skepticism, we suggest omitting the use of both “conscious” and “unconscious,” and simply using the word, “bias.” We also recommend the wording of the last sentence of paragraph 7 replace “deal with” with “mitigate.” If these suggestions are adopted, the revised sentence in paragraph 7 would read: “Such actions and communications may include specific steps to mitigate impediments that may impair the appropriate exercise of professional skepticism such as biases or resource constraints.” The terms, “conscious” and “unconscious” would also be removed from paragraphs A28 and A29.

Academic research has demonstrated the importance and impact of an audit firm's culture on the exercise of professional skepticism (e.g., Gold, Gronewold, and Salterio 2014; Brazel et al. 2016; Brazel, Leiby, and Schaefer 2019). To highlight this connection, we suggest adding language to paragraph 7 that describes that the engagement partner's responsibility is not only to demonstrate the appropriate exercise of professional skepticism, but also to create a culture among all engagement team members that encourages and facilitates the exercise of skepticism.

As paragraph A27 is not an all-encompassing list of the impediments to professional skepticism, we recommend rephrasing “such as” to “including, but not limited to.” In addition, descriptions of the items are inconsistent; not all are explicit about how the exercise of professional skepticism may be undermined. Moreover, we believe bullet point six should explicitly describe that over-reliance on technology-enabled audit processes and tests may negatively impact professional skepticism (Boland et al. 2019). Specifically, bullet point six could be revised to say: “Overreliance on standardized tools and templates and technology-enabled audit processes and tests (collectively, SATs) enhance audit efficiency but may also undermine the exercise of professional skepticism by the engagement team. Client complexity increases the likelihood that SATs may not address all audit risks applicable to a specific audit engagement.”

Paragraph A28 broadly describes four common decision biases. To increase auditors' understanding of these biases, we suggest more familiar examples be included. For example, confirmation bias may result in auditors accepting weak explanations from clients or inappropriately excluding errors or outliers from the results of a sample. Overconfidence bias may result in auditors including too few items to sample—particularly in small populations (e.g., testing monthly reconciliations). Anchoring may result in auditors assuming there is no error in current year account balances when they approximate prior year account balances, but should not (e.g., the loss of a major customer should have resulted in a decrease in revenues and receivables).

In paragraphs A27 and A29, we recommend using the word “address” instead of “deal with;” and in the seventh bullet of paragraph A29, we recommend replacing “on a timely basis” with “timely.”

We support the identification of technological resources that the engagement partner has responsibility for determining if and how to use in connection with the audit engagement (paragraphs A56-A58). As described in our Overall Commentary, we also agree with the Board's concerns about the potential for auditors' over-reliance on technology. This idea is consistent with recently expressed regulatory concerns in the United States (e.g., Harris 2017). However, there is at least an equal likelihood that auditors may under-rely on advanced technologies used in the audit. Audit firms are currently making substantial investments to build advanced cognitive technologies to assist with evidence gathering activities traditionally performed by human specialists (e.g., Alliott Group 2017). Consistent with research in psychology and management science (e.g., Eastwood, Snook, and Luther 2012; Dietvorst, Simmons, and Massey 2015; Yeomans, Shah, Mullainathan, and Kleinberg 2017), emerging research in auditing and accounting finds auditors rely less on their own firm's evidence when it comes from an artificial intelligence system rather than from a human specialist (Commerford, Dennis, Joe, and Wang 2019). We therefore encourage the risk of under reliance to also be considered in ED-220. Specifically, paragraph A56 could be modified to: “Inappropriate use of such technological resources may however increase the risk of overreliance or under reliance on the information produced for decision purposes.”

We also support the Board's explicit focus on evolving audit delivery models as recent research documents several challenges that auditors face when working on global group audits (e.g., Sunderland and Trompeter 2017; Downey and Bedard 2019). However, ED-220 provides little specific guidance for managing these challenges. We encourage guidance be provided about how audit partners might approach managing large distributed audit teams. For example, emerging research finds that enhanced accountability helps auditors overcome challenges within distributed teams (e.g., Downey, Johnstone, and Obermire 2019). Paragraph A23 could be modified to emphasize that partners should consider the extent of geographical distribution within the audit team when designing tailored accountability mechanisms. We also recommend the Board provide guidance on how audit partners might promote shared mindsets among remote engagement team members, particularly those from different cultures. Glover and Prawitt (2013) note that professional skepticism may differ among different cultures; not all auditors will challenge management in the same way or to the same degree. Hurtt et al. (2013) note that auditors from high power distance cultures may not be able to exercise high levels of professional skepticism because they are uncomfortable challenging more senior individuals. ED-220 should acknowledge that partners may encounter difficulties managing the cultural diversity that may accompany geographically disbursed teams and require partners to consider the possible impact of cultural diversity during the planning stage of the audit.

ED-220 recognizes that auditing standards need to be scalable. It is easy to envision the engagement partner being directly responsible for all aspects of quality when all members of the engagement team are employed by a single audit firm, at a single location. When other firms, teams, and locations are involved, the ability of the engagement partner to directly influence the audit environment as required by paragraphs 11 and 12 may be limited. The engagement partner may not have direct communication with lower level engagement team members in other offices or at affiliated firms. For large, multinational audits, where cultures and languages of the audit team members differ, these communications issues may be more extreme. Although ED-220 references to ISA 600: Special Considerations—Audits of Group Financial Statements (Including the Work of Component Auditors) (paragraphs 1 and A1), consideration should be given to expanding guidance in the AOEM (paragraphs A23 to A26) to address the engagement partner's responsibilities in these circumstances.

We support the revised requirements and guidance on direction, supervision, and review provided by ED-220. However, we believe the revised standard could be improved by describing that the nature of supervision and review practices could vary dependent upon audit risk. For example, paragraph A69 could be modified to acknowledge that reviews can be conducted remotely or face-to-face—a possibility acknowledged in paragraph A82. Several studies provide evidence that although electronic review methods may be convenient, face-to-face reviews may be more efficient and effective when the risk of material misstatement is high (Agoglia, Brazel, Hatfield, and Jackson 2010; Payne, Ramsay, and Bamber 2010; Brazel, Agoglia, and Hatfield 2004). As the nature of the engagement may dictate the preferred type of review, both paragraph A69 and A82 should include language to this effect. Specifically, we recommend that paragraph A69 be modified to: “Direction and supervision of the engagement team and the review of the work of the engagement team are firm level responses that are implemented at the engagement level of which the nature, timing, and extent may be further tailored by the engagement partner in managing quality of the audit engagement. Supervision and review may occur remotely or face-to-face. The approach to direction, supervision, and review should consider the nature, circumstances, and risk of material misstatement of the engagement and will generally include a combination of addressing the firm's policies or procedures and engagement-specific responses. The approach will vary from one engagement to the next.” The fifth bullet point in paragraph 82 could be modified to: “The manner in which the engagement partner and manager reviews of work performed are expected to take place. For example, in some circumstances, including when the risk of material misstatement is high, remote reviews may not be effective in providing the necessary direction and may need to be supplemented by in-person interactions.”

We also believe the Board should consider certain other enhancements. Paragraph 27(a) explicitly requires planning be performed “in accordance with the firm's policies or procedures, professional standards, and applicable legal and regulatory requirements.” We suggest paragraph A69 be modified to describe legal or regulatory requirements that may impact audits. For example, audits conducted of governmental entities typically require consideration of specific laws and regulatory requirements. Relatedly, it may be appropriate to revise paragraphs A76 and A81 to incorporate language conforming to paragraph 27(a) describing “the firm's policies or procedures, professional standards, or applicable legal and regulatory requirements.” Paragraph 27(b) requires that the direction, supervision, and review is “responsive to the nature and circumstances of the audit engagement and the resources assigned or made available to the engagement.” This wording may lead to the interpretation that a lack of resources justifies a response that results in insufficient direction, supervision, and/or review. We suggest making the language more consistent with A72 which says, “threats to the achievement of quality related to the resources assigned or made available to the engagement.”

Absent from the requirements of paragraphs 27 to 31 and A68–A80 is any mention of coordination with, when applicable (paragraph 33), the Engagement Quality Reviewer (EQR). Paragraph A91 appropriately notes that “an engagement quality review that is conducted in a timely manner at appropriate stages during the audit engagement may assist the engagement team in promptly resolving matters raised to the engagement quality reviewer's satisfaction on or before the date of the auditor's report.” Dickins, Fay, and Daugherty (2015) summarize findings of the PCAOB related to the conduct of engagement quality reviews citing root causes that include inadequate effort, improper timing, and unqualified reviewers. We suggest ED-220 explicitly recognize the importance of early engagement with EQRs and other assigned partners or specialists when establishing the direction, supervision, and review of the audit engagement. Specifically, paragraph 27(b) could be worded: “Responsive to the nature and circumstances of the audit engagement and the resources assigned or made available to the engagement, including the engagement quality reviewer, specialists, and other experts.” Relatedly, paragraph 28 could be: “On or before the date of the auditor's report, the engagement partner shall, through review of audit documentation and discussion with the engagement team and other relevant parties, including the engagement quality reviewer, specialists, and other experts, determine that sufficient appropriate audit evidence has been obtained to support the conclusions reached and for the auditor's report to be issued.” Paragraph 30 could be worded: “Prior to dating the auditor's report, and in order to determine that the report to be issued will be appropriate in the circumstances, the engagement partner shall review the financial statements and the auditor's report, including, if applicable, the description of the key audit matters and related audit documentation, and, as required by the circumstances, shall consult with the engagement quality reviewer, specialists, and other experts.” Paragraph A76 (third bullet) could be: “Which members of the engagement team, including the engagement quality reviewer, specialists, and other experts, are required to perform reviews.”

Paragraph 29 describes areas required to be reviewed by the engagement partner. Conspicuously absent is any alignment with the determination of materiality in accordance with ISA 320: Materiality in Planning and Performing an Audit. The Board should consider modifying paragraph 29(a) to: “Significant matters considered to be material to the audit engagement,” and modifying footnote 16 to include reference to ISA 320. Relatedly, paragraph A75 (second bullet) and paragraph A78 could incorporate conforming language about materiality. In paragraph 30, the reference to reading the audit report, including “if applicable, the description of key audit matters and related documentation” reads as though there may be circumstances where key audit matters in the auditor's report would not need to be reviewed by the engagement partner. We recommend revising this to, “review the financial statements and auditor's report and, if the auditor's report includes key audit matters, the related audit documentation.” We also recommend changing the phrase in paragraph 30, “in the circumstances,” to “given the circumstances” for clarity.

Paragraph 31 states “The engagement partner shall review, prior to their issuance, any formal written communications to management, those charged with governance, or regulatory authorities.” We recommend replacing “or” with “and” as the engagement partner should review all written communications groups. Similarly, we recommend replacing “or” with “and” in the fifth bullet of A73, so the phrase reads “skills and competencies.”

In light of the growing importance of controls over information technology, we recommend the second bullet of paragraph A79 be modified to: “Information technology experts or other personnel using expertise in a specialized area of accounting or auditing.”

Paragraph 79 includes a bullet point intended to address differences requiring special consideration in group audit situations. Based on our reading, the third sub-bullet point appears to either be redundant with the second or should be re-worded for clarification.