In recent years I have presented an update on the activities of the PCAOB at the annual

meeting of the Association of Audit Committee Members. From that experience —

particularly this past year — I can tell you that audit committees are not happy with PCAOB
rulemaking. Much of it feels to them kind of like we all feel when taking off our shoes for the
TSA: because of one misguided and inept soul (pun intended), everyone pays a price. To add
insult to injury, we have absolutely no idea whether our collective acts of compliance do
anything to make us safer.

The most recent source of audit committee resentment of the PCAOB is the overhaul and
expansion of the standard auditor’s report — most especially the requirement that the
auditors communicate information about “critical audit matters,” or CAMs.

Two exposure drafts plus an extended period of deliberations by the SEC generated lots of
comments, clearly divided along battle lines of the Accounting Establishment versus investor
interests. The former argued that CAM disclosures will rapidly devolve to boilerplate.
Nowithstanding, they would not materially add to the information already available to
investors. CAM disclosures, the Accounting Establishment argued, might even diminish audit
quality because auditors would respond by limiting communications with a client’s audit
committee in reaction to a perception of a new source of liability exposure. Finally, and as an
aside and for reasons that totally escape me, it argues that management should be the sole
source of information in SEC filings.

Investors on the other side of the argument say that CAM disclosures would in fact provide
useful information. They base their comments in part on similar rules already in effect in
Europe (more on that later) and numerous interesting audit reports that have been produced
as a result. Moreover, some commenters believe that better information from auditors about
CAMs could have more clearly signaled the deteriorations in bank balance sheets that
precipitated the 2008 Financial Crisis. As to consideration of the effect on audit quality, even
if CAM disclosures devolved to boilerplate, disclosure per se could positively affect how CAMs
will actually be audited.
I won’t bore you with the official definition of a CAM. For the purpose of this post, we need
only agree that they are basically about the parts of the audit that keeps the auditor awake at
night. As an example of what is not a CAM, the Parmalat financial fraud is instructive. One
aspect of that fraud was falsifying cash balances. Although the auditor may have missed
something they should have caught, auditing cash would not have risen to the level of a CAM.

The Boilerplate Question

In October 2017, I wrote a post celebrating the long-awaited SEC approval of the PCAOB’s
required CAM communications. But, I didn’t at that time adequately consider the possibility
that the disclosures would devolve into boilerplate; hence, the motivation for this post.

For each CAM communicated in the auditor’s report, the auditor will be required to identify
the CAM, describe the principal considerations that led the auditor to determine that the
matter is a CAM, describe how the CAM was addressed in the audit, and refer to the relevant
financial statement accounts and disclosures to which it relates. Unfortunately, I now think
that this is a recipe for boilerplate — because the required communications don’t go far
enough.

During the PCAOB’s deliberations, some investors suggested further enhancements to the
auditor’s report such as including an assessment of the significant accounting judgments and
management estimates and requiring auditors to describe specific insights and findings
related to each CAM. These are similar to the requirements that are already in place in
Europe, and the fact that the PCAOB acceded to the Accounting Establishment on this point
essentially dooms their efforts.
To see why, we need not look beyond the PCAOB’s 2016 re-proposal, which, unlike the final
release, provides a couple of illustrative examples of CAM communications. In the final rule
making release, the Board reasoned that examples would be inconsistent with the principles-
based nature of the rules, which should lead to communications tailored to each engagement.
Nonetheless, the PCAOB failed to hold the high ground. I would expect that auditors will
carefully study these examples and squeeze every ounce of boilerplate that they can from
them.
Which should not be too difficult to do. Each illustration is cleanly divided into three parts
that map directly onto the letter of the rules: (1) Identifying the CAM; (2) Setting forth the
principle considerations in determining the CAM; and (3) Describing how the CAM was
addressed in the audit.