An Updated Analysis of Enforcement Actions against Engagement Quality Reviewers Free

In December 2013, the Public Company Accounting Oversight Board (PCAOB) issued a report entitled Observations Related to the Implementation of the Auditing Standard on Engagement Quality Review (PCAOB 2013), which was based on the PCAOB's 2011 inspections of registered public accounting firms. This was the PCAOB's first comprehensive look at compliance with Auditing Standard No. 7, Engagement Quality Review (AS7, PCAOB 2009), which became effective for audits and interim reviews for fiscal years beginning on or after December 15, 2009. The PCAOB report noted that while the firms' methodologies were consistent with AS7, they did not always lead to an adequate engagement quality review (EQR), and that “audit deficiencies and the related deficiencies in engagement quality reviews continued to be high” (PCAOB 2013, 6).

This paper updates the findings of Messier, Kozloski, and Kochetova-Kozloski (2010) on enforcement actions against engagement quality (EQ) reviewers Messier et al. (2010) found 28 cases from 1993 through 2008 that involved sanctions against an engagement quality (EQ) reviewer. We analyze the SEC's Accounting and Auditing Enforcement Releases (AAERs) and PCAOB's Disciplinary Proceedings (DPs) related to EQ reviewers issued subsequent to their study, covering the time period 2009 through October of 2014. This coincides with the implementation of AS7, and allows us to examine how regulatory enforcement against EQ reviewers has evolved since the new standard was adopted.

Our analysis shows the following results. First, we identified 16 cases since 2009 that involve sanctions against an EQ reviewer. Second, six of the 16 cases involved violations prior to the implementation of AS7, nine cases involved violations that occurred after AS7 took effect in December 2009, and one case involved violations both prior to and after AS7 implementation. Third, only two of the 16 cases involved a Big 4 public accounting firm, while all other cases involved small public accounting firms or sole practitioners. Fourth, seven of the 16 cases (44 percent) involved an inadequate EQR, while more than half of the cases (nine out of 16; 56 percent) involved sanctions due to a failure to perform any EQR. Fifth, all nine of the cases in which no EQR was performed occurred after AS7 went into effect. Finally, our review of these nine post-AS7 cases suggests that many small firms either were unable or unwilling to bring in qualified outside reviewers.

In the following section, we provide background on EQRs, including information on AS7, and a review of prior research. Next, we present the methods used to identify and analyze the relevant cases. This is followed by a discussion of the results and sanctions. We conclude with a discussion of the results, implications for practice, limitations, and final comments.

Engagement quality review for an audit engagement of SEC registrants was first required in 1978 when the American Institute of Certified Public Accountants' (AICPA) Securities and Exchange Commission Practice Section (SECPS) was formed. One of the requirements of membership was that SEC engagements be subjected to an EQR (then commonly referred to as a concurring partner review).¹ In 1999, the SECPS revised its guidance and established specific responsibilities and objectives for an EQR. As oversight responsibilities for public-company audits shifted from the AICPA to the PCAOB, the Sarbanes-Oxley Act (U.S. House of Representatives 2002) mandated that the PCAOB develop an auditing standard to address the EQR. Initially, the PCAOB adopted the SECPS requirements for an EQR. In July 2009, the PCAOB issued AS7 (PCAOB 2009), which outlines objectives of an EQR, qualifications needed for an EQR, specific procedures and documentation required in the EQR process, and steps required before the EQ reviewer can provide concurring approval of issuance.²

Schneider and Messier (2007) provide a review of prior research on EQRs and cite a number of areas for future research. Epps and Messier (2007) compared the EQR audit guidance for six major public accounting firms. They found a moderate level of consistency across firms with some differences in the assignment of an EQ reviewer to audit engagements, the participation of the EQ reviewer in audit planning, the content and extensiveness of practice aids, and the involvement of the EQ reviewer during the course of the audit engagement.

Previous research on PCAOB inspections has shown an inadequate or non-existent EQR to be a common problem, especially among smaller firms (those inspected triennially). A review of publicly disclosed defects from PCAOB inspection reports from 2005 and 2006 found that all five of the single partner firms had defects related to concurring partner reviews (Hermanson and Houston 2008). A similar review of a larger number of smaller firm defects from 2008 through 2012 showed that defects related to concurring partner reviews or EQRs were the second most common category of deficiencies, with 82 percent coming from firms with three or fewer partners (J. Boyle, D. Boyle, Hermanson, and Houston 2013).

The PCAOB has described their philosophy toward enforcement as “supervisory” rather than punitive. As PCAOB Board Member Daniel Goelzer said about the enforcement program in 2005, “As long as we believe that an auditing firm is acting in good faith and is capable of and willing to conduct audits in accordance with the PCAOB's standards, we will generally use our authority to make non-public recommendations, rather than our authority to bring disciplinary action” (Goelzer 2005).

To illustrate Goelzer's point, consider a PCAOB inspection violation. Before a disciplinary proceeding is initiated, the CPA firm is given 12 months to address the violation. If the violation is not addressed during the 12-month period, then the results of the inspection are made public, and disciplinary proceedings may be initiated. Given that CPA firms have a full year to address violations, the vast majority of inspection violations never end up triggering enforcement actions.

PCAOB inspection reports give us useful information on EQRs, but they do not tell us how prevalent the most severe violations are; for this, we need to examine the enforcement actions triggered by inadequate EQRs. Messier et al. (2010) do just this, by providing an analysis of enforcement actions against EQ reviewers. Their research examined all of the enforcement actions against EQ reviewers from 1993–2008, prior to AS7 becoming effective. Their study identified 28 cases and their analysis showed the following: First, eight of the 28 (28.6 percent) cases involved a Big 4/5 public accounting firm. Second, all 28 cases involved sanctions as a result of violation of PCAOB and generally accepted auditing standards (GAAS) and 21 cases (75 percent) involved violations of generally accepted accounting principles (GAAP).³ Third, most of the violations of GAAS involve a lack of due professional care, insufficient competent evidence, financial statements not in conformity with GAAP, issuance of an incorrect audit report, and lack of informative disclosure. Fourth, about half of the cases resulted in the EQ reviewer being denied the privilege of practicing before the SEC or PCAOB for three or more years. Finally, in the 23 cases where the EQ reviewers lacked due professional care, the EQ reviewer (1) demonstrated a lack of professional skepticism in 22 cases, (2) over-relied on management representations in 20 cases, and (3) ignored materiality by either concluding material amounts were immaterial, or failing to consider the qualitative aspects of materiality, in five cases. In many cases, the EQ reviewers were aware of substantive, unresolved issues with the conduct of the audit, and they either did not require sufficient additional audit work or relied too heavily on the engagement partner, audit team, and/or management.

Our research extends the existing research in a couple of key ways. First, all of the prior literature deals almost exclusively with deficiencies or enforcements prior to the implementation of AS7. For example, Boyle et al. (2013) look at publicly disclosed inspection reports from June 2008 to November 2012. They found 107 smaller firms, with a total of 281 deficiencies. We reviewed the inspection reports from those 107 firms, and determined that only 19 of these 107 firms (18 percent) had inspections that pertained to audits subject to AS7; of those 19 firms, only three had deficiencies related to EQRs. In most cases, there was a lag of one to two years between the actual date the inspection was conducted, and when the inspection report containing quality control criticisms was made public, which meant that almost all of the EQR deficiencies examined by Boyle et al. (2013) were actually concurring partner review deficiencies that occurred prior to AS7 being fully implemented. In the case of the prior research on enforcement actions against EQ reviewers, the most recent study by Messier et al. (2010) contained no cases that occurred after the implementation of AS7.

The second way in which we extend the existing research is by identifying in more detail the way audit engagements with inadequate EQRs failed to meet the generally accepted auditing standards (GAAS), and the ways in which EQ reviewers violated standards of due professional care (through either a lack of professional skepticism, or an over-reliance on management representations).

By examining the enforcement actions against EQ reviewers subsequent to those examined by Messier et al. (2010), our research contributes to our understanding of how regulatory enforcement against EQ reviewers has evolved since the implementation of AS7 and the types of actions that lead to EQ reviewer sanctions.

The data for the 16 cases used in this study were obtained from AAERs or DPs. One of the researchers performed keyword searches on the SEC website and identified DPs from the PCAOB's enforcement website. The keywords used were: “concurring partner,” “second partner,” “reviewing partner,” “independent review,” and “engagement quality reviewer.” Table 1 lists the 16 cases identified. In both the case identification procedures as well as the coding procedures (described below), we followed the methods used in Messier et al. (2010).

The researchers each read all 16 cases. For the seven cases that had an engagement quality review performed, we conducted three sets of coding. First, we independently coded these seven cases into two overall categories: (1) sanctions due to a GAAP issue, or (2) sanctions due to a GAAS issue. The GAAP category contains situations where the data indicated that the EQ reviewer was sanctioned because the associated financial statements were not in conformity with GAAP. The GAAS category includes situations where the data indicated that the EQ reviewer violated one or more of the ten GAAS. The researchers agreed with each other on all but two (out of 20) category items, resulting in an inter-rater agreement of 90 percent. The two items involved coding of accounting violations and were easily reconciled by reviewing the related sources.

Second, we broke the seven cases down by company audited, which resulted in ten distinct companies or company groups (see Table 2). Some cases involved multiple companies audited by the same EQ reviewer, which is the reason there are more companies than cases. Within each of these companies, we used the same procedure to code the data into violations of the ten GAAS. In many instances, the data did not distinguish between the four Standards of Reporting, and merely stated that GAAP were violated. We adopted the convention that if the AAER stated that GAAP were not followed, then both Reporting Standards No. 1 and No. 4 were violated. The researchers disagreed with each other on ten (out of 100) category items, resulting in an inter-rater agreement of 90 percent. All differences were reconciled by reviewing the data.

Finally, we coded the cases where a lack of due professional care was the source of the sanctions. We examined those cases for two reasons that were cited as a lack of due professional care: (1) lack of professional skepticism, and (2) overreliance on management's representations.⁴ These reasons were identified in the coding of the cases for GAAS sanctions. The two researchers then re-read each of the cases to code this part of the data. The researchers disagreed with each other on two (out of 30) category items, resulting in an inter-rater agreement of 93 percent. All differences were reconciled by reviewing the data.

The nine cases where sanctions resulted from a failure to perform any engagement quality review were not coded and are discussed below.

Our review of the cases provides the following descriptive statistics. First, of the 16 cases, only two (12.5 percent) involved a Big 4 firm (both Ernst & Young); both cases originated prior to the issuance of AS7. Thus, the vast majority of cases (14 of 16; 87.5 percent) involved EQ reviewers from smaller public accounting firms. Second, six cases (37.5 percent) occurred prior to the implementation of AS7, nine cases (56.2 percent) occurred after AS7 took effect, and one case (AAER 3512) (6.3 percent) involved violations both prior to and after AS7 implementation. Third, all seven of the pre-AS7 cases involved sanctions resulting from an inadequate EQR. In contrast, all nine of the post-AS7 cases involved sanctions resulting from a failure to perform any EQR. Fourth, the average time it took the SEC or PCAOB to issue the first enforcement action from the date of the last financial statement in question was 3.1 years (range of 1.72 years to 5.96 years). Fifth, our review of the cases found that the engagement partner was also charged and/or sanctioned in all 16 cases (100 percent).⁵ Our reading of the cases suggests that this may be a result of almost all of the cases (14 of 16; 87.5 percent) involving one- or two-partner firms. In all cases where both the EQ reviewer and the engagement partner were sanctioned, the sanction against the engagement partner was equal to or greater than the sanction against the EQ reviewer.

Table 2 presents a summary of the violations involving the ten GAAS. These involved the seven enforcement actions cited above where an inadequate EQR was performed. We break these actions into ten distinct firms or firm groups.

There were 16 violations of the General Standards (GS). All ten firm groups (100 percent) included GS No. 3 where the EQ reviewer did not exercise “due professional care” when conducting the EQR. This violation of GAAS is cited in every EQR case (except in the cases where the EQ reviewer did not perform a review). There were six instances (out of ten; 60 percent) where the EQ reviewer and/or engagement team was sanctioned for not possessing adequate technical training and proficiency. Finally, we found no cases where the EQ reviewer (or the firm) was not independent—thus no violations of GS No. 2 were found.

We identified 19 violations of the Standards of Fieldwork (SF). All ten firm groups listed (100 percent) in Table 2 were sanctioned for not gathering sufficient competent evidence (SF No. 3). Seven instances (70 percent) involved situations where the work was not properly planned or where staff were not properly supervised (SF No. 1). There were two instances (20 percent) where SF No. 2 (understanding internal control) was cited as a cause for sanctions.

There were 23 violations of the Standards of Reporting (SR). All ten firm groups listed (100 percent) in Table 2 involved sanctions for violations of SR Nos. 1 and 4 (failure to follow GAAP and thus issuing the wrong audit report). There were two instances (20 percent) where the EQ reviewer was cited for failing to require necessary GAAP disclosures (SR No. 3). There was one situation (10 percent) where the EQ reviewer was cited for not complying with SR No. 2 (consistent application of GAAP).

We coded all seven cases (broken down into ten firm groups) that involved a lack of due professional care (i.e., GS No. 3) looking for the presence of three issues consistent with Messier et al. (2010): a lack of professional skepticism, over-reliance on management's representations, and abuse of materiality. Table 3 summarizes our analysis of due professional care violations. All ten firms (100 percent) involved the EQ reviewer being cited for a lack of professional skepticism and four instances (40 percent) involved an over-reliance on management's representations. We found no cases involving an abuse of materiality.

All nine post-AS7 cases involved audits where no EQR was performed (see Table 4). All of these cases involved smaller public accounting firms, and seven (out of nine; 78 percent) involved a sole practitioner. The issue of smaller public accounting firms conducting adequate EQRs is one the PCAOB focused on when developing AS7. As the board noted when the new standard was announced, “smaller firms may have few partners—and, in the case of sole practitioners, no additional partners—available in-house to perform the EQR” (PCAOB 2009, 5). To remedy this problem, AS7 allows for a qualified EQ reviewer from outside the firm to conduct the review. Our review of these post-AS7 cases suggests that many small firms either were unable or unwilling to bring in qualified outside reviewers. In other cases, an outside reviewer was brought in, but lacked the qualifications to perform an adequate review.

Table 5 shows the distribution of sanctions. Thirteen of the cases (81 percent) resulted in significant sanctions (prohibition of practicing before the SEC for three years or more), while the remaining three cases (19 percent) resulted in less significant sanctions (prohibition of practicing before the SEC for two years or less, or censure). We arbitrarily use three years to define a significant sanction; however, we suspect that any sanction against an EQ reviewer is likely to affect his or her professional reputation.

We identified 16 cases since 2009 that involved some type of sanction against an EQ reviewer. Our results provide a number of insights. First, only two cases involved a Big 4 firm, and both of these cases were prior to AS7. This may suggest that larger firms have adapted to the requirements of AS7 better than smaller firms, and it also may be an indication of better audit quality associated with the larger firms. Second, the vast majority of audit firms sanctioned (14 of 16, or 87.5 percent) were sole practitioners, or two-partner firms. This may suggest that deficient EQRs are more prevalent in smaller public accounting firms that may struggle to find an EQ reviewer with the proper training and experience. Perhaps the PCAOB's registration process should screen out such firms from being registered firms, or perhaps the PCAOB could put a process in place to help smaller firms identify qualified EQ reviewers. Third, cases involving deficient reviews (those involving violations of GAAP and GAAS) occurred almost exclusively prior to AS7 taking effect. This suggests that for firms that do have a qualified EQ reviewer perform the EQR, AS7 has been effective in reducing deficient EQRs. Post AS7, cases overwhelmingly involved engagements where no EQR was performed. Finally, the average time it took the SEC or PCAOB to issue the first enforcement action from the date of the last financial statement in question was 3.1 years. This is a reduction of almost a full year from the average time found in Messier et al. (2010), where it took an average of 3.9 years. It may be that with the implementation of AS7, the process of sanctioning EQ reviewers is becoming more expedited.

AS7 provides audit firms with much clearer guidance on how to conduct an engagement quality review. In addition to providing an objective for an engagement quality review and outlining the necessary qualifications for an EQ reviewer, AS7 details specific procedures and documentation required as part of the engagement quality review process. One thing AS7 cannot do, however, is prevent the nonperformance of the EQR.

The PCAOB's first comprehensive report (PCAOB 2013) on implementation and compliance with AS7 reported that while firms generally had adopted the proper procedures and methodology to meet the requirements of AS7, too often this did not carry over to the execution of the EQRs. With respect to smaller firms (those inspected triennially), the PCAOB found these firms often “failed to perform engagement quality reviews of audits, and/or failed to perform engagement quality reviews of interim reviews” (PCAOB 2013, 5). In addressing the root causes of non-compliance with AS7, the PCAOB highlighted issues of EQ reviewers not devoting sufficient time to their reviews, EQ reviewers not conducting their reviews in a timely fashion, and firms ignoring known concerns about the quality of work of those appointed to perform EQRs.

All the issues noted in the PCAOB's 2013 report were found to be present in our analysis of the cases involving sanctions against an EQ reviewer. An open question is whether compliance with AS7 will improve over time. In its report, the PCAOB noted that the Board's 2012 inspections continue to show a high rate of deficiencies related to engagement quality reviews (PCAOB 2013).

It is important to recognize some of the limitations of this research. First, while the PCAOB's inspection process may be systematic, the SEC's process for investigating a particular problem situation is not. Therefore, our sample of EQR cases may not be representative of the issues that are present in the EQR process. Second, the AAERs and DPs do not always provide a detailed description of the EQ reviewer actions, and the actions reported might be biased by what the SEC or PCAOB viewed as important at the time.

Our review of the enforcement actions since 2009 suggests that AS7 has contributed to the quality of performed EQRs, while not yet ensuring that EQRs are actually conducted. This is particularly true with respect to smaller firms, where the vast majority of enforcement actions relate to the lack of any EQR.

In this paper, we set out to analyze the causes of enforcement actions against EQ reviewers and to gain a better understanding of what led to failures in the EQR process, especially in the period after the implementation of AS7. We believe that our work provides important insights for practitioners, regulators, and researchers interested in EQR and in improving the overall quality of audit engagements.