The Public Company Accounting Oversight Board (PCAOB) recently issued a Spotlight on “Auditor Responsibilities for Detecting, Evaluating, and Making Communications About Illegal Acts.” The Spotlight asks auditors to focus on relevant considerations when performing procedures to detect, evaluate, and make communications about illegal acts by a company under audit.

Federal securities laws prescribe the auditor’s responsibilities for considering the possibility of illegal acts by a company and responding when a possible illegal act is detected. Audits are required to include “procedures designed to provide reasonable assurance of detecting illegal acts that would have a direct and material effect on the determination of financial statement amounts.

Detection

Federal securities laws prescribe the auditor’s responsibilities for considering the possibility of illegal acts by a company and responding when a possible illegal act is detected. Audits are required to include “procedures designed to provide reasonable assurance of detecting illegal acts that would have a direct and material effect on the determination of financial statement amounts.

Based on observations from PCAOB oversight activities, to obtain this understanding, auditors often make inquiries of management, the audit committee, internal or external legal counsel, internal audit, and various others within and outside the company.

The PCAOB also recommends that auditors read SEC or other regulatory filings, press releases, and other reports or filings (including prior enforcement actions by the government or regulator, if any), conduct online research, and read news articles and alerts, industry publications, or analyst and similar reports.

The auditor is also required to inquire of management and the audit committee whether they have received, or are aware of, tips or complaints regarding the company’s financial reporting (including those received through the audit committee’s internal whistleblower program, if such program exists) and, if so, management’s and the audit committee’s responses to such tips and complaints.

Evaluation

Once the auditor becomes aware of a possible illegal act (for example, through audit procedures or publicly available information) under PCAOB standards, the auditor is required to obtain an understanding of the nature of the act and the circumstances in which it occurred, and to evaluate the effect on the financial statements.

In performing these steps, the auditor is required to make inquiries of management at a level above that of the individuals involved, if possible.

The PCAOB stresses in its alert that the auditor is required to evaluate any violations of laws and regulations (irrespective of whether such violations have a direct or indirect effect on the financial statements) that have or may have occurred that have come to the auditor’s attention. This statutory requirement applies regardless of the nature of the law or regulation at issue and irrespective of whether the violation is perceived to be material.

To gain insight into any possible violations, the PCAOB recommends consulting management and senior firm personnel, discussing the matter with the audit committee and legal counsel, obtaining audit inquiry letters from legal counsel, reviewing government reports, reviewing relevant regulatory correspondence, and considering using the work of specialists.

Obviously, any illegal acts involving senior management may call into question other information provided by the company during the course of the audit.

Comms about illegal acts

Under existing requirements, the auditor is required to communicate information about possible or actual illegal acts to management, the audit committee, and, in some cases, the board of directors.

In a long but informative sentence, the PCAOB says (with link added by author): ” Under Section 10A, the auditor is required to communicate directly to the board of directors, as soon as practicable, if the auditor concludes the illegal act has a material effect on the financial statements; senior management has not taken, and the board of directors has not caused senior management to take, timely and appropriate remedial actions with respect to the illegal act; and the failure to take remedial action is reasonably expected to warrant departure from a standard report of the auditor, when made, or warrant resignation from the audit engagement.”