Surprise! Audits Dig Deeper

January 14, 2014, 12:40 AM ET

Surprise! Audits Dig Deeper

Senior Editor

There are good surprises and bad surprises, but when it comes to an annual audit there’s only one kind.This year, financial executives say their external auditors are requesting far more documents and details than usual on everything from pension assets to management reviews. As companies rush to close their books on 2013, they say these new and unanticipated demands are adding time, cost, and confusion to the audit process.

The more rigorous audits are in reaction to an alert from the government’s accounting watchdog. In October, the Public Company Accounting Oversight Board warned that it had found “high levels of deficiencies” in audits of internal controls. These controls act as a company’s first line of defense against fraud and financial misstatements.

In recent years, the regulator has found nearly 1 in 3 of the audits it inspected had deficiencies in testing of internal controls.

“We were surprised by the report,” said Loretta Cangialosi, Pfizer Inc.’sPFE -0.49% controller, adding that the number of deficiencies seemed high and that the alert came just as companies were planning their year-end audits for 2013 and budgets for 2014. “They’re really focusing on the audits of internal controls,” she said.

The PCAOB’s warning has pushed audit firms to make rapid changes. To test management’s oversight controls, for example, auditors in the past might have checked that managers signed off on a particular transaction.

Now, auditors are asking for more documentation, going line-by-line through budgets, sitting in on meetings to observe internal controls in action, and meeting with company accountants to understand their thinking when they signed a specific document.

The intensity forces companies to produce more minutes from meetings in which executives approved transactions and produce more evidence for valuation assumptions, Ms. Cangialosi said. “The view is, if it’s not documented it didn’t happen,” she added.

Pfizer’s auditor, KPMG LLP, didn’t respond to requests for comment.

The average audit of a public company took almost 17,000 hours of work in 2012, according to the most recent data from Financial Executives International, which conducts an annual survey. The cost was about $4.5 million on average and has been rising between 4% and 5% a year.

Audit firms defend their increased scrutiny and rising fees. Where the PCAOB finds fault, “we’re expected to make changes in our audits to be responsive to that,” said Robert Kueppers, a partner at Deloitte LLP’s Center for Corporate Governance.

What’s more, audits are supposed to retain some aura of mystery to keep a company on its toes, Mr. Kueppers said.

Regulators say the tougher audits will help protect investors and curb fraud. “Audit firms are getting the message,” said James Doty, chairman of the PCAOB.

As business has changed, a signed document from a manager no longer tells the whole story in an audit, he says. It “doesn’t tell you all you need to know about whether a transaction has real financial substance or is merely designed to achieve a tax result, and whether a deal is competitive or with a related party,” Mr. Doty added.

Companies complain, however, that because auditors are making changes in response to PCAOB inspections of past audits, their new requests and procedures can vary.

Companies “have been operating in somewhat of a black hole, with only the ability to react to the changes, as opposed to being able to proactively work with our auditors,” said Robin Washington, chief financial officer at biopharmaceutical company Gilead Sciences Inc.

When companies disagree with their auditors on accounting matters, both groups have a common set of standards to call upon, but when an auditor says it is making a new request because of criticism or deficiencies cited in previous PCAOB inspections, Ms. Washington says, there isn’t “a set of standards that we can all interpret.”

Complicating matters, only audit firms get full copies of the PCAOB’s inspection reports, which are generally published years after an audit has been completed. Even then, the regulator can only make some portions of the reports public, and the findings don’t identify which company audits had problems.

That leaves companies guessing whether, because of their size or industry, they will be put under the microscope. Auditors “are under the gun and afraid to be second-guessed,” said Lynn Atchison, CFO at online vacation-rental company HomeAway Inc. “Any business transactions that involve a lot of judgment get audited over and over again.”