Post-Enron, talks doing the rounds was that the asset put to use the most in the offices of Enron's auditor, Andersen, was the paper-shredder. Shredding audit evidence is considered a no-no in a profession that thrives on maintenance of detailed documentation to lend credence to their comments on the financial statements of the auditee.
The Sarbanes Oxley Act (SOX) attempted to kill two birds with one stone by imposing internal control review requirements on auditees and registration and quality control reviews on auditors.
The Public Company Accounting Oversight Board (PCAOB) was given the task. The PCAOB prepares a report on each inspection it conducts, and a portion of each report is made publicly available when issued. Many reports contain non-public content, which may include, among other things, discussion of potential defects in a firm's system of quality control.
Any such quality control criticisms remain non-public if the firm addresses them to the Board's satisfaction within 12 months after the report date. If a firm fails to satisfactorily address any of the quality control criticisms within 12 months, the portion of the report discussing the particular criticism(s) is made publicly available. PCAOB has made available glimpses of inspection reports on four Indian accounting firms — three foreign audit firms that audited Indian entities listed abroad and an Indian audit firm that certified US GAAP financial statements.
Inspections of Indian firms
The Central Bureau of Investigation (CBI) has enough material on the erstwhile auditor of the erstwhile Satyam. An inspection by the PCAOB of the audit firm does not reveal much about the nitty-gritty of what actually occurred at Satyam as the comments on quality control are non-public.
The auditor and the PCAOB have differed over the number of partners and staff that the audit firm had — a point that can be dismissed as insignificant, but which can raise a few eyebrows as to why there should be a difference of opinion on an elementary statistic.
An inspection at another multinational accounting firm resulted in quality control comments on the failure to project misstatement results of a sample that the firm chose for revenue recognition, and the failure to perform sufficient procedures related to the existence of accounts receivable.
The remarks on the inspection of the Indian audit firm were more acerbic — the inappropriate determination to act as the firm's principal auditor relating to US-GAAP financial statements and the issuance of an opinion on internal control over financial reporting (ICFR) without having performed any procedures related to it. In reply, the audit firm has detailed that the Indian GAAP financial statements were audited by an audit firm appointed by the C&AG and that the ICFR was prepared by a SOX consulting firm.
Being a separate piece of legislation, SOX would continue even in an era when the United States permits International Financial Reporting Standards (IFRS) for non-US filers. That Lehman Brothers occurred years after SOX was introduced proved that intentional improper financial reporting could circumvent strong internal controls.
Role for ICAI
The Institute of Chartered Accountants of India (ICAI) has a Peer Review Mechanism in place in which major audit firms are reviewed for quality control and documentation procedures.
A PCAOB inspection may not take into account the realities of the Indian marketplace such as multiple audits and duplicating work. With both United States and India going in for diluted versions of IFRS, the PCAOB should think of outsourcing inspections to the ICAI for entities listed in the US.
They could lay down additional quality and internal control guidelines and step in only if there are major transgressions.
(The author is a Bangalore-based chartered accountant.)