Read the Magnum Hunter Resources Case (MHRC) provided with the exhibit, as well as the readings then answer the question on the case.

accounting case study and need an explanation and answer to help me learn. Read the Magnum Hunter Resources Case (MHRC) provided with the exhibit, as well as the readings then answer the question on the case. PCAOB AS 2201: An Audit of ICFR that is Integrated with an Audit of Financial Statements Prepare written responses to each of the questions in the case Requirements: AUDITING:AJOURNALOFPRACTICE&THEORYAmericanAccountingAssociationVol.39,No.4DOI:10.2308/AJPT-18-088November2020pp.57–85AuditPartners’JudgmentsandChallengesintheAuditsofInternalControloverFinancialReportingJeffreyR.CohenBostonCollegeJenniferR.JoeUniversityofDelawareJayC.ThibodeauBentleyUniversityGregoryM.TrompeterUniversityofCentralFloridaSUMMARY:Internalcontroloverfinancialreporting(ICFR)auditshavebeenthesubjectofintensiveexaminationbythePublicCompanyAccountingOversightBoard(PCAOB)andresearchersbuttheprocessthroughwhichauditorsmakeICFRjudgmentsislargelya‘‘blackbox.’’TounderstandICFRjudgments,weconductedsemi-structuredinterviewswith20auditpartners.CommonthemesinourinterviewssuggestthatthesubjectivityinherentintheICFRevaluationtaskcontributestoresistanceagainstICFRauditfindingsandcougnterargumentsfrommanagement.Moreover,auditorsperceivethattheirjudgmentsarebeingsecond-guessedbyPCAOBinspectors.Auditorsbelievethatmanagershavedifficultyacceptingthatmaterialweaknessescanexistwithoutadetectederror,thatmanagement’sreflexivereactionistodeny/avoidamaterialweaknessfinding,andmanagersroutinelyclaimthatmanagementreviewcontrols(MRCs)wouldhavecaughtthedetectedcontroldeficiency.Auditorscopewithmanagement’sdefensesbyconsultingwiththeirnationalofficeandleveragingsupportfromstrongauditcommittees.DataAvailability:Requestsforthedatashouldbeaccompaniedbyadescriptionofintendeduses.Keywords:internalcontrols;managementdefensiveness;auditpartnerjudgment;managementreviewcontrols;compensatingcontrols;PCAOBoversight.I.INTRODUCTIONSection404(b)oftheSarbanes-OxleyActof2002(hereafterSOX)requiresanexternalauditortoconductanannualauditofinternalcontroloverfinancialreporting(ICFR)forallpubliccompanieswhosepublicfloatexceeds$75million(U.S.HouseofRepresentatives2002;2010).AlthoughtheprofessionhasworkedtodevelopandrefineICFRaudits,regulatorsworldwidehaveexpressedconcernsoverauditqualityaroundICFR(e.g.,FRC2011;PCAOB2011,2012a,2017;WeacknowledgeresearchsupportfromtheCenterforAuditQuality(CAQ).WethankmembersoftheResearchAdvisoryBoardattheCAQfortheirassistanceindevelopingandrefiningthecasematerialsusedinthisstudy.Additionally,wewouldliketothanktheparticipantswhotookpartinthestudy.WeespeciallywanttothankoureditorDanaR.Hermansonforprovidingsuchtimelyandinsightfulguidance.WealsowanttoacknowledgeKimWestermann,LoriHolder-Webb,SteveSalterio,KellyMcKenna,theNyenrodeBusinessUniversityandNorthCarolinaStateUniversityresearchworkshopparticipantsandparticipantsatthe2017MidyearAuditconferenceforcommentsonearlierdrafts.TheviewsexpressedinthisarticleanditscontentarethoseoftheauthorsaloneandnotthoseoftheCAQ.Pleasenotethatthispaperwasthe2019–2020recipientoftheGlenMcLaughlinPrizeforResearchinAccountingEthicsfromtheSteedSchoolofAccounting(TheUniversityofOklahoma).JeffreyR.Cohen,BostonCollege,CarrollSchoolofManagement,DepartmentofAccounting,Boston,MA,USA;JenniferR.Joe,UniversityofDelaware,LernerBusiness&Economics,DepartmentofAccountingandManagementInformationSystems,Newark,DE,USA;JayC.Thibodeau,BentleyUniversity,DepartmentofAccounting,Waltham,MA,USA;GregoryM.Trompeter,CollegeofBusiness,KennethG.DixonSchoolofAccounting,UniversityofCentralFlorida,Orlando,FL,USA.Editor’snote:AcceptedbyDanaR.Hermanson,undertheSeniorEditorshipofChristopherP.Agoglia.Submitted:July2018Accepted:May2020PublishedOnline:August202057Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 CPAB2012).Forexample,intheU.S.,thePCAOB’sconcernsaresosignificantthatin2013theOfficeoftheChiefAuditorissuedPCAOBStaffPracticeAlertNo.11(hereafterPCAOBStaffAlert)tospecificallyaddress‘‘practiceissuesobservedbythePCAOBstaff...relatingtoauditsofinternalcontroloverfinancialreporting’’(PCAOB2013a,1).ThePCAOBStaffAlertcautionsauditorsabout‘‘significantauditingpracticeissues’’and‘‘significantauditingdeficiencies[that]havebeenfrequentlycitedinPCAOBinspectionreports’’(PCAOB2013a,1).Importantly,problemswithICFRauditsremainaprimaryconcernforthePCAOB,asitwaslistedasoneofthe‘‘threekeyareaswiththemostfrequentauditdeficiencies’’inastaffbriefon2016audits(PCAOB2017,1)andremainedanareaofcommonauditdeficienciesobservedin2018audits(PCAOB2019a).TheSEChasalsoindicatedthatmonitoringICFRisanongoingpriorityfortheOfficeoftheChiefAccountant(Croteau2013,2014;Bricker2017).TheSECChiefAccountantrecentlyreiteratedthat,‘‘adequateinternalcontrolsarethefirstlineofdefenseindetectingandpreventingmaterialerrorsorfraudinfinancialreporting...wheninternalcontroldeficienciesareleftunaddressed,financialreportingqualitycansuffer’’(SEC2019a).AsKral(2017)attests,‘‘SECenforcershavebeeninvestigatingandprosecutingabroaderrangeofICFRviolationsthaneverbefore,thusraisingthestakesforcertifyingofficersandothersinvolvedinthefinancialreportingprocess.’’Further,ananalysisofaccounting-relatedfederalclass-actionlawsuitsfiledin2014foundthatissuesaroundICFRwerethemostfrequentlymentionedproblem,occurringin31ofthe53legalcasesidentified(LaCroix2015).WhiletherehasbeenasubstantialamountofresearchrelatedtoSection404(b)ofSOX,muchofthisworkhasfocusedonhowtheauditofICFRhasaffectedquantitativemeasuresofauditquality(suchasdiscretionaryaccruals)ormarketreactionstoICFRopinionsthatreportmaterialweaknesses(Knechel,Krishnan,Pevzner,Shefchik,andVelury2013).Therehasbeen,however,limitedresearchonthedifficultjudgmentsandchallengesauditorsencounteronactualICFRengagements(Earley,Hoffman,andJoe[2008];Gramling,O’Donnell,andVandervelde[2013];alsoseeGramling,Maletta,Schneider,andChurch[2004]andAsare,Fitzgerald,Graham,Joe,Negangard,andWolfe[2013]forreviews).Specifically,althoughtheICFRaudit,anditssubsequentimpactonreporting,havebecomeincreasinglyimportantforregulators(SEC2007;PCAOB2013a,2019a,2019b),theliteraturetodate(primarilyarchivalandexperimental)hasnotexaminedthedifficultaspectsof,andchallengesassociatedwith,theICFRevaluation.Toaddressthisgapintheliterature,weexplorethe‘‘blackbox’’ofasignificantjudgmentmadewithinanICFRaudit,theevaluationofanobservedinternalcontroldeficiency.Weconductaninterview-basedfieldstudytobetterunderstandthechallenges,complexities,andpressuresauditorsencounterinmakingtheICFRevaluationandthenatureofauditorinteractionswithclientmanagement-relatedICFRfindings(includingmanagement’sreactionsanddefensesandauditors’strategiestoaddressthosereactions).AnadvantageoftheinterviewapproachisthatweareabletoexploresomeofthechallengesauditorsencounterinpracticewhenmakingICFRevaluations,butwhichcannotbeobservedthroughtraditionalarchivalandexperimentalresearch.Weconductourstudy,whichincorporatestwocasestoserveasreferencepointsforourdiscussions,usingasemi-structuredinterviewapproach(Cohen,Krishnamoorthy,andWright2002,2010,2017;TrompeterandWright2010;Westermann,Cohen,andTrompeter2019).ThecaseswereintendedtopromptparticipantstothinkaboutthedifficultICFRjudgmentsanddecisionstheyconfrontonauditengagements.Weinterviewed20veryexperiencedauditpartnerstounderstandthefactorsthattheyconsiderimportantwhenevaluatingobservedinternalcontroldeficienciesandthefactorsthatcanpromoteand/orinhibittheeffectiveconductoftheICFRaudit.Participantsreadthecasesinadvanceoftheinterviewsandwereaskedtoevaluatethecasesbyassessingtheseverityoftheinternalcontroldeficienciesdescribedandwhetherthefactsoftheclientsituationrepresentedadeficiency,asignificantdeficiency,oramaterialweakness.Intheinterviews,participantsprovideddetailsofhowtheymadetheirevaluations,includingthesimilaritieswithtypicalissuesencounteredwiththeirownclients,andthefactorsthatinfluencetheirICFRjudgmentsanddecisions.Anadvantageofincorporatingjudgment-basedcasesintheinterviewsisthatitallowedforacommonstartingpointfordiscussionswiththeparticipantsaboutclientandICFRconditions.Weuseaqualitativeresearchapproachbecauseourstudyisaimedatgainingaricher,morecomprehensive,in-depthunderstandingofeachauditor’sjudgmentanddecision-makingprocess(GendronandPower2015)onanICFRauditandhowtherelatedregulationsandstandardsareinterpretedandappliedinpractice.Inparticular,wefocusontheprocessofevaluatingidentifiedcontroldeficiencies.Aqualitativeapproachallowsforconsiderationofabroadersetofvariablesthanisfeasibleinexperimentalorarchivalwork,anditallowsustogainconstructiveinsightsintothethoughtprocessesthatare‘‘insidetheblackbox’’ofimportantjudgmentsthatarecompletedduringtheICFRaudit.ConsistentwithMalschandSalterio(2016),aqualitativeresearchapproachiswell-suitedforresearchthatisaimedatunderstandingjudgmentanddecisionprocessesthatcannotbeobservedfrommerelyreviewing,forexample,firmauditmanualsorotherproprietary‘‘howto’’guidancefromauditfirms.Suchmaterialsdonotprovidethenecessaryinformationabouthowfirmguidanceisactuallyperceivedandthenappliedbyauditprofessionals.Importantly,wefocusourresearchonthejudgmentanddecision-makingprocessesofauditpartnersevaluatingidentifiedinternalcontroldeficiencies,becausepartnersbearultimateresponsibilityfordeterminingwhetheramaterialweaknessexists(andtheensuingadverseICFRreport).58Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 AuditpartnersarealsotaskedwithmanagingtheclientrelationshipandfacescrutinyfromPCAOBinspectors.PartnersareresponsibleforconductinghighqualityauditsthatcomplywithprofessionalstandardsinadditiontoadequatelyaddressingconcernsrelatedtotheICFRauditraisedinthePCAOBStaffAlert(PCAOB2013a,2).ThePCAOBStaffAlertidentifiesspecificareasofconcernabouttheconductoftheICFRauditthatshouldbeofparticularimportancetoengagementpartnersandseniorengagementteammembers(PCAOB2013a,2).Collectively,thealignmentbetweenourparticipantsandresearchgoalsmeritstheuseofaqualitativeresearchapproach.Overall,wefindthatthedecisiontoidentifyadetectedcontrolproblemasacontroldeficiency,asignificantdeficiency,oramaterialweaknessisquitecomplex.Forexample,thedecisioninvolvesawidevarietyofvariablesrangingfromtechnicalitemslikemateriality,scope,aggregation,andextrapolation,tomorequalitativefactorssuchastheclient’stoneatthetop.AnimportantfactorcontributingtothecomplexityoftheICFRjudgmentisthatauditorsmustbalancethedemandsofmaintainingpositiveclientrelationswhileremainingfirmagainstmanagements’resistancetoICFRfindingsandthetendencytodiscounttheauditors’findings.Managersoftenarguethattheirmanagementreviewandothercompensatingcontrolscouldmitigatethecontrolproblemsidentifiedbyauditors.WealsofindthatthePCAOBsignificantlyinfluenceshowparticipantsapproachtheICFRaudittaskandultimatelymaketheirjudgments.Thatis,ourparticipantsreportthatpracticingauditorsarelikelytoconsultwithotherpartnersandtechnicalexpertsonICFRissuesbecausetheyareworriedaboutthenegativepersonalconsequencesthatwouldensueifanengagementtheyledwastoreceiveaPCAOBinspectiondeficiency.Further,participantsindicatedthatauditorstendtodocumentmorethantheybelieveissufficienttosupporttheauditopinionundertheexistingauditstandards.Thisstrategy,whereauditorsprovidewhattheyperceivetobeexcessivedocumentation,appearstobeacommonlyemployedpracticethatisusedtoaccommodatethePCAOB’sprofessionalguidanceandtobolstertheirpositionsintheeventofaPCAOBinspection.Finally,consistentwitharegulatoryfocusonC-suitecontrols,wefindthattheassessmentofthetoneatthetopandauditcommitteeinvolvementareamongthemostimportantevaluationsintheauditors’overallICFRjudgmentprocess.OurresearchextendstheliteraturebyprovidinginformationabouthowICFRjudgmentsaremadeinpractice(i.e.,thekeyfactorsthatinfluencethedecisionprocess)andhowregulatoryguidance‘‘comestolife’’asitisinterpretedandappliedbyauditpractitioners.WealsoprovideacomprehensiveportrayaloftheICFRevaluationprocessthathasthepotentialtoenhanceknowledgeoftheICFRevaluationtask.Ourdescriptionofthedecision-makingprocessaroundICFRhasthepotentialtostimulatefollow-upresearchexaminingtheissuesidentifiedandexploredinthisstudy.Finally,ourresearchhasthepotentialtoinfluencestandardsettersandregulators,becauseweprovideevidencethathowauditorsperceiveregulationcaninfluencetheirICFRjudgments.Interestingly,ourfindingssuggestthatsomeaspectsoftheICFRevaluationtaskhavebeenchanged,notbecauseofamotivationtoenhanceauditquality,butbecauseoftheauditors’perceptionsofregulatorypressures,whichispotentiallyanareaofconcernforclients,regulators,andtheauditprofession.II.EVALUATINGTHESEVERITYOFANINTERNALCONTROLDEFICIENCYInthispaper,weexaminethejudgmentanddecision-makingprocessauditpartnersemploywhenevaluatingidentifiedinternalcontroldeficienciesinanICFRaudit.WerelyonPCAOBAuditingStandardNo.2201(AS2201),AnAuditofInternalControloverFinancialReportingThatIsIntegratedwithanAuditofFinancialStatements(PCAOB2007)andPCAOBStaffAlertNo.11,ConsiderationsforAuditsofInternalControlsoverFinancialReporting(PCAOB2013a)astheauthoritativeframeworktoguidetheprocessusedtoevaluatetheseverityofobservedinternalcontroldeficienciesandthefactorsprescribedforauditors’considerationwhenevaluatingobservedICFRdeficiencies.Dependingontheseverityoftheweakness,anidentifieddeficiencycanbeevaluatedasadeÞciency,asigniÞcantdeÞciency,oramaterialweakness.1Thedifferentiatingfactorsindeterminingasignificantdeficiencyversusamaterialweaknessarethe(1)likelihoodand(2)materialitythatapotential(oractual)misstatementwouldnotbedetectedonatimelybasis(PCAOB2007,A-1-26).ThefollowingarecircumstancesthatthePCAOBidentifiesasstrongindicatorsthatamaterialweaknessexists:(1)restatementofpreviouslyissuedfinancialstatementstoreflectthecorrectionofamisstatement;(2)evidenceofmaterialmisstatements(identifiedbytheauditteam)thatwerenotpreventedordetectedbytheclient’sinternalcontrols;(3)ineffectiveoversightofthefinancialreportingprocessbytheentity’sauditcommittee;and(4)indicationoffraud(eithermaterialorimmaterial)byseniormanagement(PCAOB2007,A1-28).Recently,theSECchargedfourpubliccompaniesfortheirfailuretomaintaineffectiveinternalcontroloverfinancialreporting,stressingthat‘‘companiescannothidebehinddisclosuresasawayto1Aninternalcontroldeficiencyexistswheneitherthedesignoroperationofthecontrolunderconsiderationdoesnotallowtheentity’smanagementoremployeestodetectorpreventmisstatementsinatimelyfashion.Moreseriousinternalcontroldeficienciescanbecategorizedintooneoftwogroups,significantdeficienciesormaterialweaknesses,dependingontheirseverity(PCAOB2007).Thestandarddescribesamaterialweaknessininternalcontrolasadeficiency,orcombinationofdeficiencies,thatresultsinareasonablepossibilitythatamaterialmisstatementwouldnotbepreventedordetectedonatimelybasis.Moreover,asignificantdeficiencyisadeficiencyoracombinationofdeficienciesininternalcontrolthatislessseverethanamaterialweaknessyetimportantenoughtomeritattentionfromthosechargedwithgovernance.AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting59Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 meettheirICFRobligations.Disclosureofmaterialweaknessesisnotenoughwithoutmeaningfulremediation.Wearecommittedtoholdingcorporationsaccountableforfailingtotimelyremediatematerialweaknesses’’(SEC2019a).Thestandardsetters’guidanceonevaluatingtheseverityofinternalcontroldeficienciesislimitedinAS2201.ThePCAOBStaffAlert,however,highlightsanumberofrelevantissuesrelatedtotheICFRevaluation,twoofwhichareparticularlysalientinthepresentcontext:theimportanceofmanagementreviewcontrol(s)(MRCs)andtheroleoftheauditcommittee(PCAOB2013a).ThePCAOBStaffAlert,discussedbelow,highlightsmanyoftheissuescitedinreportsofthePCAOB’sauditinspectionsofthesixlargestfirmsintheperiodsurroundingitsrelease.Forexample,MRC-relateddeficienciesidentifiedinthefirminspectionreportsincludeinsufficienttestingofthedesignandoperatingeffectivenessofMRCsandinadequatetestingtodeterminethattheMRCsoperateatalevelofprecisiontopreventordetectmaterialmisstatements,orserveasappropriatecompensatingcontrols(e.g.,PCAOB2012c,2013b,2014a,2014b,2014c,2015).InthePCAOB’sStaffAlert(PCAOB2013a,34),theroleofMRCsisemphasizedinevaluatingtheseverityofobserveddeficiencies.Specifically,thePCAOBStaffAlertstatesthatin‘‘formingaconclusionaboutwhetheracontroldeficiencyorcombinationofdeficienciesisamaterialweakness,theauditorshouldevaluatetheeffectofcompensatingcontrols,ifany.Thisincludestestingthecompensatingcontrolstodeterminewhethertheyoperateatalevelofprecisionthatwouldpreventordetectamisstatementthatcouldbematerial.Thisincludesevaluatingwhetherthecontroladdressestheriskofmaterialmisstatementtotherelevantassertionintendedtobeaddressedbythedeficientcontrol.’’Inmanysituations,thecompensatingcontrolisaMRC,andasaresultthePCAOB(2013a,19)includesadetaileddiscussionofMRCs,acknowledgingthat,‘‘auditorsoftenselectandtestmanagementreviewcontrolsinauditsofinternalcontrol.Suchmanagementreviewsmightbeperformedtomonitortheresultsofoperations,suchas(1)monthlycomparisonsofactualresultstoforecastedrevenuesorbudgetedexpenses;(2)comparisonsofothermetrics,suchasgrossprofitmarginsandexpensesasapercentageofsales;and(3)quarterlybalancesheetreviews.Thesereviewstypicallyinvolvecomparingrecordedfinancialstatementamountstoexpectedamountsandinvestigatingsignificantdifferencesfromexpectations.’’Importantly,sufficienttestingofMRCsremainsacommonauditdeficiency(PCAOB2017).ThePCAOBStaffAlert(PCAOB2013a,20)thenstatesthat‘‘manymanagementreviewcontrolsareentity-levelcontrols,sotestingthosereviewcontrolscanbeanappropriatepartofatop-downapproach.’’ThePCAOBStaffAlert(PCAOB2013a,20)alsoacknowledges‘‘thatentity-levelcontrolsvaryinnatureandprecisionandthatsomeentity-levelcontrolsmightoperateatalevelofprecisionthatwouldadequatelypreventordetectmisstatementsonatimelybasis.Otherentity-levelcontrols,bythemselves,mightnotoperatewiththenecessarylevelofprecision,butmightbeeffectiveincombinationwithothercontrolsinaddressingtheassessedriskofmaterialmisstatement.’’ThePCAOBactivelymonitorsauditors’evaluationoftheeffectivenessofMRCs,notingintheir2018inspectionoftheauditsofbrokersanddealersthatMRCswerenotsufficientlytestedaspartoftheauditors’testingofcomplianceinternalcontrols(PCAOB2019b).Basedontheabovediscussion,wedeveloptwobroadoverarchingresearchquestions(RQs)aimedatsheddinglightontheICFRevaluationprocessasfollows:RQ1:Whatarethechallenges,complexities,andpressuresauditorsencounterinevaluatingidentifiedcontroldeficiencies?RQ2:Whataretypicalmanagementreactions,defenses,andissuesauditorsfacewhencommunicatingICFRdeficienciestoclients,andhowdoauditorsaddressthesereactions?III.METHODParticipantsParticipantswererecruitedfromsevenlargeinternationalaccountingfirmsaspartofagrantreceivedfromtheCenterforAuditQuality(CAQ).FirmrepresentativeswereaskedtoidentifypartnerswhohadsignificantexperiencewithICFRdecision-makingandnegotiationswithclientsaboutICFRreporting.Tomaintainparticipantanonymity,participants’namesandcontactinformationwereprovidedtoanindependentcoordinatorfromtheCAQwhoestablishedaninterviewscheduleandconferencecalllineforresearchersandparticipants.Theblindconferencecallapproachwasadoptedtomaintainparticipants’anonymityandtoencouragethemtoprovidecandidresponsestoourquestions.Threeofourparticipantshad12–15yearsofauditingexperience,eighthad16–20yearsofauditingexperience,andninehadover20yearsofauditingexperience.Table1providesdescriptiveinformationaboutoursampleparticipantsincludingtheirgender,educationalbackground,andindustryexperience.2EachoftheparticipantshadexperienceauditingICFRforpubliccompaniesandalmostallhadsignificantexperienceevaluatingbothsignificantdeficienciesandmaterialweaknesses.Thus,theyareappropriateparticipantstodiscussandevaluate2ApprovalforthishumansubjectsstudywasgrantedbytheInstitutionalReviewBoard(IRB).60Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 theauditors’judgmentanddecision-makingprocessesfortheICFRaudit.Allinterviewswereconductedaftertheendofthe2014busyseason.Thus,thepartnershadexperiencewithatleastoneauditcyclefollowingtheissuanceofthePCAOBStaffAlertontheauditsofICFR(PCAOB2013a).Inaddition,asdiscussedearlier,theissuesraisedinthePCAOBStaffAlertwerealreadyidentifiedinthe2010to2013firminspectionreports;therefore,auditorshadfamiliaritywiththeICFRauditareasthatwereofconcerntothePCAOB.ProceduresFollowingseveralqualitativestudiesintheauditingandgovernancedomains(e.g.,Beasley,Carcello,Hermanson,andNeal2009;Cohenetal.2002,2010,2017;TrompeterandWright2010;Hermanson,Tompkins,Veliyath,andYe2012;Westermann,Bedard,andEarley2015;Westermannetal.2019),wetakeaninterviewapproachtoaddressourresearchquestions.Weusethepatternedbehaviordescriptiveinterviewapproach(LathamandSue-Chan1999)whereparticipantsareposedquestionsbasedonpastbehaviorsorintendedresponsestosituationsthattheyencounteronthejob.Adoptingthisapproachallowsustogaininsightsintothefactorsthatinfluencepartners’decision-makingonICFRevaluationsandtocaptureTABLE1Participants(n¼20)PanelA:DemographicDatanPercentoftheTotalSampleGenderMale1470%Female630%Total20100%YearsofAuditingExperience12–15years315%16–20years840%Over20years945%Total20100%HighestLevelofEducationUndergraduateDegree1680%GraduateDegree420%Total20100%PrimaryIndustryFinancialServices/Banking630%Commercial,Retail,andConsumerProducts525%Manufacturing420%HealthCare15%Insurance15%Hospitality15%RealEstate15%Mining15%Total20100%PanelB:ICFRExperienceMeanMedianStd.Dev.MinMaxMaterialWeaknessExperience(1¼NoExperienceto7¼ExtensiveExperience)4.85.51.9517SignificantDeficiencyExperience(1¼NoExperienceto7¼ExtensiveExperience)6.06.00.9847AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting61Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 additionalinformationthatcannotbeobtainedintheconfinesofasurveyorexperiment(HirstandKoonce1996;Gendron,Be´dard,andGosselin2004;Beasleyetal.2009).Allinterviewswereconductedbyatleasttwooftheresearchers.Toensureconsistencyacrossinterviews,oneresearcher,whowasveryexperiencedinconductinginterviews,servedastheleadinterviewerforall20interviews.Eachoftheremainingauthorsservedasthesecondaryinterviewerononeormoreoftheinterviews.Tohelptheresearchteamestablishaconsistenttoneandapproachacrossallinterviews,whenauthorswerenotservingasthesecondaryinterviewer,theyweresilentobserversoftheinterviews.Twodoctoralstudentresearchassistants,whowereblindtotheresearchquestions,listenedandtooknotesduringtheinterviewsessions.3Immediatelyfollowingtheinterview,thetworesearchassistantsmetanddevelopedasingleinterviewtranscriptforeachinterview.Twodifferentresearchassistants,whowereblindtothepurposeofthestudyandtheresearchquestions,independentlycodedthetranscriptsaccordingtothemesestablishedbytheresearchers.Eachofthetworesearchassistantswastrainedhowtocodetheresponsesintothemesseparatelybyoneoftworesearchers(i.e.,eachofthetworesearchersonlytrainedoneresearchassistant).FollowingcodingrecommendationsfromMilesandHuberman(1994),theresearchersdevelopedthemesfromthePCAOBStaffAlert(PCAOB2013a),participants’responses,andtheAsareetal.(2013)modelofICFRjudgment.4ThePCAOBStaffAlertindicatedfactorsthatauditorsshouldconsiderintheirICFRjudgment(e.g.,thelevelofprecisionoftheMRC),andAsareetal.(2013)identifiedfactorsinfluentialinauditors’ICFRjudgmentsbasedontheirreviewoftheliterature(e.g.,thepressuretoretainclientsonauditorjudgment).Thefinalcodingstructureincludes17uniquethemesusedbytheresearchassistantstocodetheinterviewresponses(seeTable2).Initialinter-rateragreementonthecodingofinterviewresponseswas94.07percent.Differenceswerethenresolvedbytheindependentcoders,andthedatapresentedisthereconcileddata.Cohen’sKappa,ameasureofinter-rateragreementbeyondthatpredictedbyrandomchance,was0.939(p,0.01).Tosetthecontextforthepatternedbehaviorinterviewsonpartners’judgmentabouttheICFRdeficiencies,wedevelopedtwocaseswiththeassistanceofahigh-level,technicalreview,nationalpartnerofaBigFourfirm.TheexpertdescribedcomplexICFRissuesencounteredonauditsthathadbeenreferredtothenationalofficefortechnicalreviewandtypicalICFRsituationsthatleadtobackandforthexchangesbetweenauditorsandtheirclients.Basedonthesedescriptions,twocasesweredesignedtopromptauditorstodiscusstheissuesandchallengestheyfacewhendeterminingwhethertoclassifyacontroldeficiencyasasignificantdeficiencyoramaterialweakness(seeAppendixAforkeycasefacts).Weincorporatedtwocontroldeficienciesinthefactpatternofeachcasetostimulatediscussionsabouthowauditorsaggregatedetectedcontroldeficienciesintoanappropriateclassificationlevel(i.e.,deficiency,significantdeficiency,ormaterialweakness)whendeterminingtheICFRopinion.ThesolepurposeofthecaseswastostimulatediscussionswiththeparticipantsabouttherealworldissuestheyencounteronICFRaudits.Accordingly,wewerenotinterestedin‘‘solutions’’orinterpretationsofthecases.Thefirstcaseinvolvedalargefinancialservicescompanywithmultipleofficestoencouragediscussionofissuesthatarisewithmorecomplexclients.TheauditfoundsomeomissionsinapplyinganewSECruleregulatinglost-holderaccounts(dormantandunclaimedaccountsinthefinancialsystem).Thisdeficiencyresultedinfinancialstatementexposurefromfinesandpenaltiesthatexceededthetolerablemisstatement,butwerelessthantheoverallmateriality.Managementarguedthattheinternalauditdepartmentwouldhavelikelydetectedthisweakness,andconsequently,anappropriateremedytoensurecompliancebythelocalofficeswouldhavebeenimplemented.Thecontroldeficiencyinvolvedmisclassifiedassetsinthefinancialstatements,whichaffectedearnings,forthelocalofficesconcerned.Managementindicatedthatthesedeficienciesshouldnotbeclassifiedasmaterialweaknesses,becausetheMRC,whichdependsonsystem-generateddata,wouldhavedetectedanyerrorsthatapproachedmateriality.Thesecondcaseinvolvedapubliclytradedcommercialrealestatefirm.TwocontroldeficienciesweredetectedduringtheICFRaudit.First,ananalystappliedtheincorrectinterestratewhendeterminingthefairvalueofthecommercialbuildingsfortwocities,whichresultedinanoverstatementofthefairvalueofassetsinthefinancialstatements.Theerrorapproached,butdidnotexceedoverallmateriality.Second,therewasacomputationalerrorinthevaluationmodelusedtodeterminethefairvalueofinvestmentsecuritiesthatledtoanoverstatementofunauditedpre-taxincomeandtotalassets.Theclientarguedthatthetwoerrorsshouldnotbeclassifiedasmaterialweaknesses(eitherindividuallyorwhenaggregated)because,hadanyerrorapproachedmateriality,aMRCwouldhavedetectedit.3Doctoralstudentsservedastranscribersbecausetheparticipatingaccountingfirmsdidnotpermitdigitalrecordingoftheinterviews.Thedoctoralstudentsweregivenonlygeneralinformationabouttheproject,specifically,thatitwasdesignedtounderstandhowauditorsmakejudgmentsaboutinternalcontroldeficienciesonICFRaudits.4Twoco-authorsindependentlyreadandinitiallycodedthematerialsintosummarycategories(thatwerebaseduponPCAOB[2013a],participants’responses,andAsareetal.[2013]).Theco-authorsthenmettorefinethefinallistofthemes,whichwereusedbytheresearchassistantstocodethetranscripts.ThefinallistofthemesispresentedinTable2.62Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 TABLE2InterviewThemesaPanelA:ThemesRelatedtoRQ1—Challenges,Complexities,andPressuresAuditorsEncounterinEvaluatingIdentifiedControlDeficienciesThemeNumberofParticipantsWhoMentiontheThemeNumberofTimesThemeWasDiscussedSourceMateriality—Auditors’considerationofmateriality.1978AScopingDecisionsRegardingtheNature/ExtentofAdditionalTesting—Considerationandexpansionofnatureand/orextentoftestingrequiredtobecompletedinlightofdeficienciesidentified.1538AUExtrapolation—Movingfromthespecificfactsofthedetectedcontroldeficiencytotheclientlevelcontrolissues.Includescontainmentofdetectedcontroldeficiencies.1729AAggregation—Evaluationoftheimpactoftwoormoredetectedcontroldeficiencies.2045PIdentifyingtheSourceofControlDeficiencies—Whatistheultimatesourceofanidentifieddeficiency?Doestheproblemoriginatewiththeinternalcontrolprocess,design,oreffectiveness?1146A/AUCompensatingControls—Evaluationoftheeffectivenessofanyidentifiedmitigatingand/orcompensatingcontrols.1848PPCAOBOversight—AuditorreactiontoPCAOBoversightandperceptionsofbeingsecondguessedwhenexercisingprofessionaljudgementanditspotentialimpactontheaudit.Includestheperceivedimportanceand/ortheeffectofauditdocumentation.20128AU/AAuditQuality—Theimportanceofauditqualityanditsimpactonstepstakenbytheauditorduringtheevaluationofdeficiencies.1763AUPanelB:ThemesRelatedtoRQ2—TypicalManagementReactions,Defenses,andIssuesAuditorsFaceWhenCommunicatingICFRDeficienciestoClientsandHowAuditorsAddressSuchReactionsThemeNumberofParticipantsWhoMentiontheThemeNumberofTimesThemeWasDiscussedSourceDifficultConversationsonToneattheTop—Managementintegrityandtoneatthetop,includingentity-levelcontrolsandtheoverallcompetencyoftheaccountingdepartment.2098AManagement’sUnwillingnesstoAcceptICFRFindings—Management’sresistancetotheinternalcontrolclassificationofsignificantdeficienciesormaterialweaknesses.2075ATheIsolated/One-TimeIncidentDefense—Givenmanagement’sclaimofanisolatedincident,howauditors‘‘putafencearound’’orisolatethepotentialmagnitudeofanidentifieddeficiency.1536AUManagementDefense—AMaterialErrorWouldHaveBeenCaught—Difficultyingettingtheclienttoacceptamaterialweakness,especiallywhennomaterialerrorsweredetected.2034AManagementDefense—MRCsareEffectiveCompensatingControls—LevelofprecisionoftheMRC,includingevaluatingtheoperatingeffectivenessoftheMRC(e.g.,consistencyofperformance,relevancetoassertionbeingtested,andcompetenceofcontroloperator).20138P(continuedonnextpage)AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting63Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 Participantsreadthecasespriortotheone-hourinterview.TenquestionswereincludedtoprepareparticipantsforadiscussionofICFRissues,butourinterviewsdidnotnecessarilyfollowtheorder,oraddressall,ofthequestions(seeAppendixB).Theorderofthediscussionsreferencingthecaseswascounter-balancedinordertoensurethattheICFRissuesidentifiedbythenationalauditpartnerexpertandincorporatedinthetwocaseswerecoveredacrossourinterviews.Importantly,thecaseswereonlyusedasastartingpointineachoftheinterviewsandweregeneralenoughtostimulatediscussionsoftypicalclientscenarios.Thefollow-upquestionsfromtheresearcherswerefocusedontheparticipants’clientsratherthanthecasespecifics.Further,asevidentintheparticipants’responses,theyusedthecaseasabasetoexplainsituationsthattheyencounteredinpractice.Forexample,participants’commentsincluded:‘‘Myfavoritethingwasthat[yourcasessaid]eacherrorrepresentsaone-timeincident.Clientslovetosaythat’’(Participant4).Thecases‘‘arehittingitrightonthehead.‘One-timeincident,isolated,internalauditwouldhavecaught,’areallpartofatriedandtruelistofclientresponses’’(Participant7).Consistentwithasemistructuredinterviewapproach(Cohenetal.2002,2010,2017;Beasleyetal.2009;TrompeterandWright2010;Westermannetal.2019),whilethequestionsintheresearchinstrumentservedasaguidefortheinterviews,researchersposedfollow-upquestionsbasedontheparticipants’responses.Accordingly,theinterviewswereveryflexibletoallowspaceforrespondentstoelaborateonthemesraised,andsometopicswerenotnecessarilyaddressedinallinterviews.IV.RESULTSWeorganizetheparticipants’responsesrelatedtotheoverarchingRQofthechallengesauditorsencounterinclassifyingdetectedICFRproblems,intotwobroadcategories(seeTable3forasummaryofkeyfindingsandrelatedopportunitiesforfutureresearch).Thefirst,addressedbyRQ1,addressesthechallenges,complexities,andpressuresassociatedwithidentifyingandaddressingpotentialsignificantdeficienciesandmaterialweaknesses.Thesecond,addressedbyRQ2,considersthenatureofthemanagement-auditorinteractionintheICFRdecision-makingprocess.RQ1:Whatarethechallenges,complexities,andpressuresauditorsencounterinevaluatingidentifiedcontroldeficiencies?Togaininsightintothefactorsauditorsconsiderwhendeterminingwhetheracontroldeficiencyreachesthelevelofasignificantdeficiencyormaterialweakness,weaskedparticipantstodiscussthefactorsthatinfluencedtheirdecision-makingwhenclassifyinganidentifiedcontroldeficiency.Wefoundthatfactorsrelatedtomateriality,extrapolation,expansionoftheextentoftesting,aggregationofdeficiencies,thesourceofthedeficiency,compensatingcontrols,PCAOBoversight,andviewsaboutauditqualityaffectedauditors’decisionprocesses.TABLE2(continued)ThemeNumberofParticipantsWhoMentiontheThemeNumberofTimesThemeWasDiscussedSourceManagementDefense—InternalAuditServesasanEffectiveMitigatingControl—Roleoftheinternalauditfunctionintheclientorganization,includingthestrengthandqualityoftheunit.2074AManagementViewsMaterialWeaknessasaStigmatobeAvoided—Discussionordialogueisoftenneededtopersuadetheclienttoacceptthematerialweaknessorsignificantdeficiency.2076AAdditionalResources—AnEffectiveAuditCommittee—Auditcommitteestrength,quality,andsupportforauditors.20116A/AUAdditionalResources—IncreasedInternalConsultations—Roleoftheauditfirm’snationalofficeandconsultationswithfirmexpertsinresolvingdifficultinternalcontrolevaluations.1530AaThethemesweredevelopedbasedonparticipants’responses,thePCAOBStaffAlert(PCAOB2013a)andtheAsareetal.(2013)modelofICFRjudgment.NumberofParticipantsWhoMentiontheTheme¼thenumberofparticipants(outof20)thatmentionedthevariableintheirinterview;NumberofTimesThemeWasDiscussed¼thenumberoftimesthevariableismentionedacrossall20oftheinterviews;andSource¼howthethemewasdeveloped(i.e.,A¼Asareetal.(2013);P¼PCAOB(2013a);AU¼authorsbasedonparticipantresponses).64Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 MaterialityAS2201requiresauditorstoconsiderboththelikelihoodandthemagnitudeofthepotentialmisstatementthatcouldhaveoccurred.Inasynthesisoftheliterature,Asareetal.(2013,141)observethatlittleisknownaboutauditors’materialityjudgmentsintheICFRcontext.OurparticipantswerequitedirectinacknowledgingthattheICFRtaskwasachallengingoneandthattherewerecomplexitiesinassessingthemagnitudeofthepotentialmisstatement.Itishard;youhavetojudgethemagnitude.Ifyoucanboxitinandsaythewholeamount...islessthanmateriality,thentheydonothavea[material]weakness.[However,]inyourcasethepotentialmisstatementcouldbematerial,sothisisthedefinitionofamaterialweakness.(Participant13;CommentsonCase2)IntheirconclusionsoninspectionsofICFRaudits,thePCAOB(2012b)inspectorsexpressedconcernthatauditorsmightplacetoomuchemphasisonthemagnitudefactor(relativetothelikelihoodfactor)whenconcludingabouttheseverityofadetectedcontrolproblemassociatedwithidentifiederrorsinthefinancialstatements.WhendescribingtheICFRevaluationprocess,participantstypicallybeganbydiscussingmateriality.Notably,someauditorsindicatedtheywereunabletoderiveanappropriateclassificationassessmentforthecasefactsthattheyhadreceivedbecausethecasedidnotincludecompletematerialitydatathatwouldnormallybeavailableonanaudit.RelatedtothePCAOB’sobservation,wenotedthatmaterialityTABLE3KeyTakeawaysPanelA:RQ1:WhatAretheChallenges,Complexities,andPressuresAuditorsEncounterinMakingtheICFREvaluation?KeyTakeawayFutureResearchOpportunitiesNatureofICFRMaterialityisperhapsthecrucialconsideration—magnitudeofpotentialexposureandlikelihoodofthepossiblemisstatementaredrivingfactors.Onceaproblemisdiscovered,understandingtheunderlyingcontrolissueisessentialtoallsubsequent,relateddecisions–rootcauseanalysis(RCA)hasbecomecentraltotheauditpartner’sdecision-makingprocess.RCAiscrucialforconsideringissuesinvolving:*Extrapolationfromoneincidenttotheclienttakenasawhole.*Aggregationacrossmultiple(perhapsseeminglyunrelated)errors.RCAisakeyconsiderationwhendeterminingwhetherexpansionofscopeisnecessary(andtheextenttowhichitshouldbeexpanded).Doestheimportanceofmaterialityvarybasedontheriskoftheclient?Howcantheauditorbettermakethecaseforthelikelihoodofamaterialmisstatementintheabsenceofanactualmisstatement?HowroutinizedhasRCAbecome?HowdofirmsdevelopdefensiblepositionswhenundertakingaRCA?Intermsofauditors’RCAaimedatfindingwhytheclient’scontroldeficiencyoccurred:*Aretheidentifiedrootcausesofcontroldeficienciesgenerallyrelatedtoalackoftheclient’spersonnelmotivation(e.g.,toowntheresponsibilityforcontrols)orcapacityfactors(e.g.,didn’thavetheresourcestoperformthenecessarycontrolrelatedfunctions)?*Whatevidencedoauditorsrelyontosupporttheiridentifiedrootcausesoftheclient’scontroldeficiencies?*Dotheauditorsfollowuponandmonitorclient-designedremediationstrategiesinsubsequentyearstoensureappropriateremediationeffortswereeffective?InternalauditÞrmfactorsTherecanbeextensiveconsultationwiththeirfirm’snationalofficeaspartnersseekadviceorvalidationoftheirprofessionaljudgments.Moreextensiveconsultationwithinthefirmcanleadtoauditsthataremorehomogeneous.Inattemptingtoachieveconsistencyintheauditapproach,firmsmayjeopardizeprofessionaljudgmentinthenameofconsensusandstandardization.Whatarethefactorsthatinfluencetheextentofnationalconsultation?Willmoreconsultationincrease,decrease,orhavenoeffectonauditquality?Willgreaterconsensusduetoconsultationincrease,decrease,orhavenoeffectonauditquality?Willincreasedconsultationenhanceorimpairtheabilityofauditorsinthefieldtomakekeyjudgments?(continuedonnextpage)AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting65Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 TABLE3(continued)KeyTakeawayFutureResearchOpportunitiesEffectofPCAOBpressuresParticipantsareconstantlyawareofthenegativeconsequencesassociatedwithnegativefindingsresultingfromaPCAOBinspectionoftheirengagements(e.g.,diminishedcompensation,assignmenttolowerprofileclients,reducedopportunitiesforadvancement).Transparencyanddocumentation,asopposedtoenhancingquality,havebecomemoreessentialbecauseofthePCAOBinspectionprocess.Firmsmodifyauditproceduresbasedonprioryears’inspectionfindings—includinginspectionfindingsofotherfirms.Inessence,theinspectionfindingsareawaythatthePCAOBsignalsitsbeliefsaboutauditquality,andthefirmsrespondtodemonstratethatthey‘‘gotthemessage.’’Clientsarenotalwayssympathetic,andtheymayresistadditionalfeestocompensatetheauditorfortheadditionaleffortthatisrequiredtodemonstrate,tothePCAOB,thefirm’semphasisonheightenedauditquality.Thereisabelief,bysome,thatthePCAOBisdrivingupcostsunnecessarily(i.e.,theincreaseinauditqualitymaynotbecommensuratewiththeincreaseinauditeffortandauditcosts/fees).Initialinspectionsmayhaveledtoamuchgreaterincreaseinauditqualitythanthemorerecentinspections(i.e.,theremaybediminishingreturnstoPCAOBinspections).OneeffectofthePCAOBmaybetocreatethe‘‘plainvanilla’’audit,whichdoesnotallowforthenuancedjudgementnecessaryforaspecificauditengagement.WilluseofexplicitnegativeconsequencesduetoanadversePCAOBinspectionnegativelyaffecttherecruitmentandretentionofauditprofessionals?Withrespecttoauditquality,willitbemoreeffectivetorelyonpunishmentforfailingorrewardsforpassingaPCAOBinspection?TowhatextentdoestherequirementformoreexplicitICFRauditdocumentationincrease,decrease,orhavenoeffectonauditquality?WillchangesinICFRauditapproachesinareasthatthePCAOBemphasizesincrease,decrease,orhavenoeffectonauditquality?Areauditorexpertiseandcredibilityharmedifauditfirmsover-relyontheargumentthat‘‘thePCAOBrequiresthis’’?PanelB:RQ2:WhatareTypicalManagementReactions,Defenses,andIssuesAuditorsFaceWhenCommunicatingICFRDeficienciestoClients,andHowDoAuditorsCope?KeyTakeawayFutureResearchOpportunitiesToneatthetopToneatthetopcanbeverydifficulttoassess/communicatebecauseitis,inherently,verysubjective.Onekeyindicatorofaweaktoneatthetopisaclientmanagementteamthatviewstheaccountingfunctionaslittlemorethanacosttobecontrolled(i.e.,itisnotanincomeproducingdepartment).Thetoneatthetopisreflectedintheclient’scommitmenttoproperlyallocatingresourcestotheaccountingandcontrolsystem.HastheimportanceauditorsplaceonevaluatingtoneatthetopbeenaffectedbyPCAOBinspections?Hasthemethod(s)bywhichauditorsevaluatetoneatthetopchangedinreactiontoPCAOBinspections?Cancasestudies(basedonfieldwork)bedevelopedtohighlightstrongversusweaktoneatthetop,andcanthosestudiesbeusedtostudy/examinetheeffectoftoneatthetoponcontrols’effectiveness?MRCsOftenmanagementarguesthatMRCsoperateascompensatingcontrolsforobserveddeficiencies.Atypicalsituationinvolvestheargumentthat‘‘ifitwouldhaveresultedinamaterialerror,wewouldhavecaughtit.’’Thisleadstoanemphasisontheevaluationofmitigatingcontrols(e.g.,MRCs)asacorepartofauditors’evaluationoftheclient’sICFR.Theauditormustdetermine:What(ifanything)wouldhavecaughtit?Howpreciseisthatcontrol?Internalauditisoftentoutedasacontrol—whichcouldcompromiseitsmonitoringfunction.HowoftenareMRCsactuallyeffectivecompensatingcontrols?DothestrengthandexpertiseofmanagementaffectthedegreetowhichMRCsareusedandcitedasadefensetoreportingamaterialweakness?Dothestrengthandexpertiseofinternalauditaffectthedegreetowhichinternalauditisusedandcitedasadefensetoreportingamaterialweakness?(continuedonnextpage)66Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 considerationswereattheforefrontofauditors’judgmentsaboutwhethertoassignanevaluationofasignificantdeficiencyversusamaterialweakness.Oneparticipantnoted:Ihadthatoneasasignificantdeficiency,becausethetotalpotentialfinancialstatementexposureislessthanmateriality,butexceededtolerablemisstatement.Ifthetotalamountwasgreater,itwouldhavebeenamaterialweakness.(Participant4;CommentsonCase1)Incontrast,andseeminglymoreinlinewiththePCAOB’sperspectiveonanappropriateICFRevaluation,someparticipantsfocusedonthespecificcasefactsandcircumstancestodiscusshowthemagnitudeofpotentialmisstatement(s),ratherthanthemeremagnitudeoftheactualdetectedmisstatementrelatedtoacontroldeficiency,wouldinfluencetheirjudgment.Forexample,oneparticipantnotedthat,whiletheuncoverederrormightbesmall,thekeyjudgmentistodeterminepotentialexposureinassessingtheseverityoftheerrorandultimatelycategorizingthedeficiencyaseitherasignificantdeficiencyormaterialweakness.Relatedtomateriality,astheerrorissubtle(lessthan5percentpretaxincome),thetotalerroritselfwouldnotnecessarilybematerial,butthepotentialerrorismaterial,sowehadthatasamaterialweakness.(Participant4;CommentsonCase2)Thus,auditorsoftenfacethechallengeofevaluatingthepotentialeffectofacontroldeficiencyratherthantheactualeffect.Specifically,whenjudgingtheseverityofadeficiency,theauditormustconsiderthepotentialmagnitude—ratherthantheactualmagnitude—ofanyresultingmisstatement.Stateddifferently,atoneextreme,ifadeficiencyresultedinamaterialerrorinthefinancialstatements,thentheevaluationoftheseverityoftheerrorisrelativelysimple.However,attheotherextreme,whenthedeficiencyledtoasmallerror—orevennoerror—inthefinancialstatements,itbecomesmuchmorechallengingtojudgethepotentiallikelihoodandmagnitudeofanerrorthatmayresultfromthedeficiency.MakingDecisionsRegardingtheNatureand/orExtentofTestingBasedontheDiscoveryofDeficienciesIngrapplingwiththeirevaluationofthepotentialformaterialerrorsrelatedtodetectedcontroldeficiencies,auditorsreportedthattheyconsidertheneedtoexpandtheextentoftheirtesting.Thecasefactsthatservedasareferencepointforourinterviewsfeaturedaclientwith‘‘Seventy-threesubsidiaryofficesandaffiliatedcompaniesoperatinginmorethan20differentstates.’’Thelocations‘‘wererequiredtoadoptcommonfinancialaccountingandinternalcontrols,aswellascommonoperationsandprocedures,whichareestablishedatthenationalheadquarters.’’Whendecidingaboutthemagnitudeofthecontroldeficienciesdetectedintheinitialsample,auditorsreconsideredwhethertheyhadsampledasufficientproportionoftheclient’soperations.Iftheexposureexceedstolerablemisstatementbutdoesnotexceedmateriality,itisajudgmentonhowmuchfurtherI’dgobasedontheexposureleft.Whenwelookatlocations,weusuallypickthemostmateriallocationstoexamine;thesmallerlocationsareusuallyleftoffthattestinglist,dependingonifthesamplewasselectedjudgmentally.Havewecapturedthebiggest24offices[inoursample],dotheymakeup70%ofthetransactions?DotheotherlocationsTABLE3(continued)KeyTakeawayFutureResearchOpportunitiesReachingagreementwithmanagementClientmanagementhasareputationtoupholdanddoesnotwantICFRproblemstotarnishthatreputationinfrontoftheauditcommitteeand/ortheboard.ReachingagreementabouttheclassificationofICFRdeficienciesisgenerallydifficultwhentheauditoridentifiessignificantICFRproblems,butdoesnotfindarelated/correspondingadjustmentinthefinancialstatements.Howdoesthestrengthoftheauditcommitteeaffecttheextenttowhichmaterialweaknessesareidentifiedwithoutacorrespondingerrorinthefinancialstatements?Ifthereisasubsequentrestatementinthefinancialstatements,isthereacorrespondingrestatementintheICFRauditopinion?ClientrelationshipTheauditormustconducttheauditwiththeknowledgethattheclientrelationshipisimportantandthatmaintainingthatrelationshipiscentraltoasuccessfulICFRengagement.ThebalancingactofachievingagreementonthecorrectICFRoutcomeandmaintaininghealthyclientrelationscanbefacilitatedbystrongauditcommittees.HowdoestheICFRopinionaffectclientretention?WhatisthemoderatinginfluenceoftheauditcommitteeonclientretentioninlightofanadverseICFR?AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting67Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 haveamuchlowerlevelthatwouldfactorintomydecisionmakingtoseehowmuchfurtherI’dgo?(Participant10;CommentsonCase1)Someauditorsindicatedthatwhenassessingthemagnitudeoftheproblemtheywouldconsiderexpandingthenatureand/orextentoftheauditprocedurestoalloftheoffices/subsidiariesoftheengagement.Thereisprobablyanewprocessputinplace,basedonlocaloffices.Wewouldlookatacoupleofprocessesandcontrolstoverifydecisionsatlocaloffices...All73subsidiariesshouldbeexamined,astheylikelyrolluptoasignificantamountbetweenlevelone,twoandthreeassets,andthatiswherethefixwouldoccur.Thedecision/actiontakenatthebeginningoftheprocessisfundamental,asitleadsfirmsdownthewrongpath.(Participant3;CommentsonCase1)ExtrapolatingFindingstoFullSetofFinancialsWhendeterminingwhetheranydetectedcontroldeficienciesrisetothelevelofamaterialweaknessversusasignificantdeficiency,auditorsdescribedhowtheyextrapolatefromthespecificdeficiencytothecontrolconditionsattheclientasawhole.Theauditors’considerationsrequireanunderstandingofthenatureandcauseofthedeficiencyitself,assessingthefrequencyandpervasivenessofthecontrol,andconsideringthedeficiencyinthecontextoftheauditors’understandingoftheclient’soverallbusinessstructure.Forclientswithsubsidiariesandsegments,auditors’considerationsincludedhowcentralizedversusdecentralizedtheclient’soperationswereandhowcommonandconsistenttheclient’sinternalcontrolswereacrosstheindividuallocationstohelpthemdeterminethemagnitudeofthepotentialmisstatement.Itdepends,lookingatthelocations,3outof24,thatisonlyabouta10percenterrorrate,sowhenyoulookatitandextrapolateittotheremainingpopulation,I’dneedtogetanunderstandingoftheremainingexposure.(Participant10;CommentsonCase1)Thisonehasthepotentialtorise[toamaterialweakness].Extrapolate...ifyouhadallthesesubsidiariesandtheyallhaddifferentstructures,thenyouwouldjusttryandnarrowthoseentitiesthathavethecontroldeficienciessoyoucansqueezedownthepossiblemisstatements.Ifitwereacommoncontrolsituationthatcutsacrosseverythingthenyouwouldhavesomethingthatyoucouldextrapolateoffof.(Participant20;CommentsonCase2)Insummary,itischallengingtoextrapolatefromadeficiencyandprojectitspotentialeffecttothefinancialstatementsasawhole.Specifically,thenatureofthecontrol(e.g.,somecontrolsareperformedoneverytransactiondailyorevenlessfrequently;somecontrolsaretobeappliedacrosstheorganization,whileothersmaybelimitedtoaspecificunitorregion)andthenatureofthepattern(s)inthedeficiencyaffecttheabilitytoextrapolate.Forexample,itmayberelativelysimplytoprojectanerrorwhenpatternssuggestthatthedeficiencyislimitedtoAugusttransactionsthatoriginatedintheSt.Louisoffice.Itmaybemuchmorecomplicatedtoextrapolateandprojectwhenthereisnoapparentpatterninthedeficiencies,forexample,acrosslocationsandthroughouttime.AggregatingMultipleDeficienciesAS2201guidanceasksauditorstoconsiderwhether,ornot,thecombinationoftwoormoreidentifieddeficienciescouldgiverisetoamaterialweakness.Auditorsreportedthatdeterminingwhetherornottheaggregationofdetectedcontroldeficienciesisappropriateundertheparticularcircumstancesrequiresassessingtheconnectionsinthedeficienciesandevaluatingwhethertherearelinksintheunderlyingcontroldeficiencies.I’dgravitatetowardamaterialweakness,becausetheoverridingcontrolproblemunderbothofthese[controldeficiencies]isthatthebranchesaren’tcomplyingwiththestandardsthatareprovided.Thecorporatepoliciesarebeingcommunicatedbyheadquarters(thedecentralizedentity),but...thebranchesaren’tcomplyingwithcorporateguidance/policies.(Participant10;CommentsonCase1)Let’ssaytherearethreedifferentthingsthatpoppedupinisolationthattiebackintothislocalofficeinformationsystemandtheupdatingofthatsystem,andthatthatiscausingallthreeindividualitemsthatoccur.Wewouldargueit’snotthethreeindividualitemscausingtheissues;it’sreallytheupdatingofthelocalsystem.Then,whenweconsiderallthingsthatcouldgowrongifthesystemisnotuptodate...couldbethreeitemsaggregated,or100...ifnotkeptuptodateoraccurate.(Participant15;CommentsonCase1)Tosummarize,auditorssometimesexperiencedifficultyinassessingwhethertwoseeminglyuniquecontroldeficienciesmightbeinterrelatedsuchthatmisstatementsnotdetectedbyeachindividualcontrolmightoccursimultaneously,andwhen68Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 aggregated,mightleadtoamaterialmisstatement.Forexample,inCase1(asreferredtointhequotesabove)participantsnotedthedifficultyindeterminingwhetherthetwoerrorswereindependentoriftherewasacommonrootcause—i.e.,lackofcompliancewithnationalofficedirectivesbysomegeographicunits—thatwouldnecessitateaggregationoftheerrors.Makingjudgmentsaboutinterrelateddeficienciesandthelikelihoodthemisstatementswouldoccurinsimilartimeframescanbecomplexandhighlysubjective.IdentifyingtheSourceofControlDeficienciesTheconsiderationssurroundingtheaggregationofoneormorecontroldeficienciesdescribedbytheparticipantssuggestthatauditorsarefocusedondeterminingwhetheranissue(ormultipleissues)couldbelinkedbacktoacommonunderlyingfactor(s).Indeed,inalmostalloftheinterviewsconducted,therewassomediscussionoftheimportanceofidentifyingthesourceofthecontroldeficiencyintheICFRaudit.5OurdiscussionsalsorevealedthatauditorsstrugglewiththisaspectoftheICFRtask.Theauditors’ownacknowledgmentofdifficultiesinidentifyingthesourceofcontroldeficienciesisconsistentwithobservationsinPCAOBinspectionreportsidentifyingshortcomingsandtheneedforauditorstoimprovetheireffortsinidentifyingthe‘‘rootcause’’ofICFRauditdeficiencies.EvidenceofthestrongemphasiscomingfromthePCAOBstaffisthatthesummaryofobservationsfrom2010ICFRauditinspectionsdiscussestheimportanceofidentifyingthe‘‘rootcause’’ofdeficiencies15timesinthe22-pagereport(PCAOB2012b).Auditorsappeartohaveinternalizedthiscritiqueandappliedittoinformtheirevaluationoftheclient’sICFRbecausetheirdescriptionsoftendiscussedchallengesinidentifyingthesource(rootcause)ofthedetecteddeficiencies.Itisoftenalsodifficulttogettothesourceofthecontrolproblem.Whatdidn’twork?Wasthecontrolmissing?Wasthereacontrolthatwasnotdesignedwell?Wasthereacontrolthatwasnotoperatingwell?Why?...Imakemyteamandtheclientgobackwardforthesourceoftheerror,togothrougharootcauseanalysisindependently.(Participant2;CommentsonCase1)Whatwastherootcauseofthespreadsheeterror[inthecase]?Wasitaninputerrororwastheformulanotupdatedcorrectlyintheworksheet?Iwouldhavetounderstandmoreabouttheerror.Thisisanexampleofthe‘‘workingbackwards’’rootcauseanalysis.(Participant2;CommentsonCase2)AssessingCompensatingControlsAfterevaluatingthesourceoftheidentifiedcontroldeficiencies,auditorsnextgrapplewithdeterminingwhetherthecompensatingcontrolsidentifiedbytheclienthavethepotentialtomitigatethelikelihoodofamaterialerror.Aswediscussindetaillateron,auditorsfaceconsiderableresistancefromclientswhentheyquestiontheeffectivenessofthecontrolsthatclientsregardtobeservingamitigatingfunction.Consistentwithregulatoryguidance,auditors’evaluationsofthecompensatingcontrolshoneinonassessingthelevelofprecisionatwhichthecompensatingcontrolisoperatingtodeterminewhetheritwassufficienttopreventordetectamaterialmisstatement(PCAOB2007,68;SEC2007,footnote49).Someparticipantsnotedthatclientstendtoidentifycompensatingcontrolsthatlackprecision—oftenbudget-to-actualanalyses—whichauditorsdeemtobeinsufficienttomitigatetheriskofmaterialmisstatement.AuditorsarethenfacedwiththechallengeofconvincingmanagementthattheirMRCisnotpreciseenoughtodetectamisstatementthatwasnotpreventedbythecontrol.ThatisadifficultargumenttomakewhentheauditordoesnothavedatatoprovethatamisstatementwouldnotbedetectedbytheMRC.Itissimilartoa‘‘hesaid,shesaid’’kindofargument.Participantsalsoindicatedthattheywouldgatheradditionalevidencetoconfirmwhetherornotthecompensatingcontrolwasdesignedandoperatingproperlytoenabletheauditortoclassifywhatwouldhaveotherwisebeenconsideredamaterialweaknessintothelesssevereclassificationlevelofasignificantdeficiency.Thekeyistoreallyfocusonourunderstandingoftheprecisionofthatmitigatingcontrol,tosupportthebeliefthatitispreciseenoughtocaptureitems,differences,orerrorsthatmaybemorematerial.So,wewouldexpandourtestingofthatcontroltolookforspecificinstancesofwhattypesoferrorsitdidcapture,andreallytriedtocapture.Welooktoseeiftherewasenoughdatathatwouldpointtotheexamplesofthecontroloperatingtogiveusalotofconfidenceofwhatlevelofprecisionitoperatesin.(Participant11)Inlookingforamitigatingcontrol,wewouldevaluateinternalaudit’splan.Wastheinternalauditplanlookingatthesethings?And,didtheinternalauditornotfindthembecauseinternalaudithadnotgottenthereyet?Isitintheirplan?Wasitsomethingtheycheckfor?(Participant3;CommentsonCase1)5Thisincludesresponsesmadeduringparticipants’commentsontheaggregationofcontroldeficiencies.AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting69Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 AnticipatingandAdjustingtoPCAOBOversightItisnotsurprisingthat,giventhenatureofregulatoryoversight(Johnson,Keune,andWinchel2019),theauditors’observationsabouttheICFRprocessinevitablyledtocommentsonthechallengesandpressurestheyexperienceduetoheightenedawarenessthattheirjudgmentsaresubjecttoPCAOBscrutiny.PCAOBscrutiny(‘‘second-guessing’’)isespeciallysensitiveintheICFRsettingbecausethehighlysubjectivenatureofthetaskmakesitpossiblethatagivensetofclientconditionscanbesusceptibletoalternativeinterpretationsbydifferentprofessionals.Overall,thefindingspresentedinthissection,andinthefollowingsection(i.e.,ConsideringAuditQuality)confirmthefindingsreportedbyJohnsonetal.(2019).All20oftheparticipantsindicatedthatconcernsaboutbeingsecond-guessedbyPCAOBinspectorsinfluencedtheirICFRjudgments(seeTable2).Theparticipants’responsessuggestthatthereisa‘‘cultureoffear’’surroundingPCAOBinspectionsthatinfluenceshowtheICFRauditisconductedandwhatisdocumentedintheworkpapers.AsParticipant4observed:‘‘WeareauditingtonothaveacommentinalotofwaystothePCAOB.’’ParticipantswereunambiguousinacknowledgingthatduringtheconductoftheICFRaudit,theyarealwayscognizantoftheconsequencesofanegativePCAOBinspectionfinding.Further,someparticipantsarguedthatthisspecterofanegativePCAOBinspectionfindingleadsteamstooptforthemoreconservativeclassificationlevelwhentheclassificationisnotclearcut.It[i.e.,theimpactofaPCAOBinspection]dependsonthefirm’sapproachtowardstheramificationsofanegativePCAOBinspection.Ifapartnerhassufferedthose[negative]consequences,theytendtoberiskaverseandmorewillingtointerpretthingsinastricterwaythantheyotherwisewould.Itdoesnotmeanthatitisright.Itisjustaperspective.Themessageisgettingthrough—thataccommodatingforclientrelationshipsisnotgoingtobeawinningdecision—wemustevaluate[ICFR]todayonthegreatestlevelofseveritythatcouldoccur.(Participant3)InsomewaysitappearsthatthecultureoffearsurroundingPCAOBinspectionsisdrivenbothbytheinspectionsprocessandhowtheauditfirmchoosestoreacttoinspectionfindingsbecauseauditfirmsoftenhavetiedauditpartnercompensationtoPCAOBinspectionresults.Atthefirms,becauseofthecloutthatthePCAOBhas,theyareverysensitivetocomments,andifyoureceiveacommentatafirm,ifyou’reapartnerordirectoritdirectlyinfluencesyourcompensation.Endofstory!(Participant20)Thisparticipantnotesthattheanxietyabouttheinspectionprocessisnotrestrictedtothepartnershiporleadershiplevel.Rather,partners’concernsaretransmittedandinfluencethelowerlevelstaffatauditfirms.It[theinspectionprocess]impactseverybody,everythingtheyaskarounddocumentationreliesongranularity...Therealizationstartedtocreepacrosspartnersandmanagers.There’snowayapartnerormanagercouldexecuteonthatwithoutpushingitdown...theburdenbecamesoheavytheyhadtopushitdowntothestaffpeoplesotheycoulddoit.Thenthestaffbecameawareofthat...thestaffpeoplearenotimmunetotheattitudesofthepartnerandmanager,andthepressurethattheyfeelatthemanagerandpartnerleveldoesseepdowntothestafflevelanditimpactshowpeoplegoaboutthings.(Participant20)AcommontopicthatalsoarosefromdiscussionsofPCAOBinspectionswasthattheinspectionprocesspromptsmoredetaileddocumentationonICFRaudits.Onanoverallbasis,allparticipantsdiscussedPCAOBoversight,andthetopicwasmentioned128times(morethansixtimesperinterviewonaverage)overthecourseofourinterviews.Wehaveallbecomemuchmorecognizantof[audit]documentationbecauseofthePCAOB.OurfirmhasissuedPracticeGuidancebecauseofPCAOBissues.(Participant2)Someparticipantsnotedthatchangesinthedocumentationapproachimplementedbytheirfirmsweredonetomakeiteasierforreviewersandinspectorstounderstandtheauditworkpapers.Indeed,itappearsthatauditfirmshaveworkedtomakeasmootherpathforinspectorsinordertolimitnegativePCAOBinspectionoutcomesbymorestandardizationoftheauditprocess.[Wechangedtowards]makingthingsmoretransparenttosomeonenotinvolvedintheengagement.Standardizedacrossthefirm—formstofilloutthroughtheprocessthroughfirm-provideddocuments.Filloutauditorjudgmentformsandlinkrisks—[because]linkagenotclearandevidenttosomeonewhoisnotfamiliarwiththeaudit/engagement,hinderstheabilitytofollowaroadmap.(Participant4)Manyparticipantsperceivedthesechangesinauditapproachanddocumentationtobemoreburdensomeadjustmentstotheirworkthatdidnotenhanceauditquality.70Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 IthinkthefirstcoupleofinspectionperiodswiththePCAOBdidenhancetheoverallauditquality.[But]inthelastcoupleofexaminationsI’vebeenthrough,it’sbeenastretchtofindsomethingintheauditprocessthat[providesalotofaddedvalue].Attheendoftheday,theriskreductionisnothappening.We’resimplyaddingmoredocumentationtothefile,andmorecosts.Icouldnotcarelessaboutthecost,ifit’sabetterproduct,butnowI’mdoingbusyworkandIhavetosubjecttheclienttoadditionalproceduressimplybecauseIhavearegulatorybodysayingifyoudon’t,I’mgoingtocreateapublicreportofyou.(Participant6)ConsideringAuditQualityInterestingly,whileauditorsacknowledgedthattheinspectionshadledtosomeimprovementsinauditquality,theirdiscussionsrevealedsomefrustrationoverwhattheyperceivedtobeanintrusionintoauditors’exerciseofprofessionaljudgment.Eventhepartnersweinterviewed,whogenerallyhadapositiveoutlookaboutthePCAOB,complainedthatmorerecentgainsfromtheinspectionprocesshavebecome,intheiropinion,moremarginal.Theauditors’perceptionswerethatthingsarenowatthepointwheretheyarerealizingverylittlebenefitintermsofauditqualityimprovementsasaresultoftheinspectionprocess.Thefollowingcommentfromaparticipant,whoreportedservingasanengagementqualitycontrolleaderattheirfirm,capturedparticipants’generalsentimentsabouttheimpactofcurrentregulatoryinspectionsonauditquality.Nowwe’regoingfromsevenfeettosevenfeetoneinch,sevenfeettwoinches,andnowthethingswearegettingchallengedonareonlythingswewouldappreciate.Wewouldarguethereare51angelsasopposedto52angelsdancingontheheadofthepin.I’dsaythereisgreatrigor,buttherigoristosomedegreeabitoverboardsometimes.(Participant20)Inparticular,auditorswereconcernedthatthePCAOBinspectionsprocess,ratherthantheBoard’sstandardsettingprocess,wasestablishing(new)requirementsforauditquality.OnepartnersuggestedthatthePCAOBistheproverbialelephantintheroomthatauditorsmustbecognizantofatalltimes,asitrepresentsacombinationoftherelevantstandardsettingbodyandtheprofession’sregulator.WhenI...callmyEQR[EngagementQualityReviewprofessional]wearealwaysreferencing:‘‘IfthePCAOBwastolookatthis,whatwouldtheirquestionsorconcernsbe?’’InrecentPCAOBexaminations,Ibelievethatwehavebeenaskedquestions,oraskedtodocertainthings,beyondtheauditguidanceandrequirementsthatareoutthere.ItisalmostasifthePCAOB[theinspectionsteams]hasbeenmakingsomeauditstandardsinsteadofreviewingtheauditstandards.Becausetheir[inspection]reportsdonothaveagradationoflanguage,itisanauditfailure—thatistheblackandwhitelanguagethatshowsupinthereport.Thegeneralpublicdoesnothavetheabilitytodetermineifitisasignificantmatterornot.(Participant6)AuditorsbelievedthatonengagementssubjecttoPCAOBinspections,thePCAOBinspectorsoftenfocusedtheirreviewonareasthatwereunderthePCAOB’sinspectionspotlightratherthandirectingtheirattentiontoclient-specificareasofconcern.ThePCAOBtriestoinstilltheirwillofwhatclientsneed[todo]throughus.Wespendalotoftimewalkingthroughtheresultsofourinspections[withthePCAOBinspectors],notclientbyclient,but‘‘thesearethethemesthatcomeoutofthemostrecentinspections,sothat’swhatwe’llbeinspectingintheupcomingaudit.’’(Participant15)AuditorsalsoreportthattheystruggletomanagewhattheyperceivetobetheindirectbutintrusiveeffectsthatthePCAOBinspectionprocesspotentiallyhasontheauditor-clientfeerelationship,testingscope,andjudgment.Participantsindicatedthatastheinspections’focuschangesandauditorsseektorespondtoareasthathavehighinspectionrisk,auditorscouldendupchangingtheirtestingapproachand/orassessments,whichcouldimpactauditfeesandclientresources.NotethatthefindingsinthisstudyrevealthatourparticipantsperceivethattheirclientsarenotsensitivetotheirpositionandtendtoberesistanttoincreasedfeesandotherauditchangesthatarisefromincreasedauditorefforttoaddressareasofconcerntothePCAOB.Sometimesthey[clients]getfrustrated.We’rereallytransparentwithourclientsandauditcommitteesaboutwhatthePCAOBisfinding,andhowit’schangingourmethodology.Inalotofways,weareincreasingourfeesbecauseitistakingmoretimeforustodoallthedocumentationthePCAOBisrequiring.Clientshaveheardalotaboutit,andthey’reprobablygettingtiredofit.Everyyearweneedtodoabunchofadditionalwork.Wetakemoreoftheclient’stime,moresupport,morecorroboration.Wesendclientsfeedbackformsatend[oftheengagement].They[clients]don’tunderstandwhysomuchadditionalworkandwhythenecessityofdocumentation.Youkeepsayingit’sPCAOB,PCAOB,PCAOB.Notawholelotwecandootherthanremindingthemwe’rearegulatedindustry.(Participant4)AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting71Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 PCAOBinspectioncausesgreaterexpectationsofdefiningtheimportanceofcontrols,andthisshouldcauseamoreobjectiveevaluationofwhattheissueis.Whenopinionschange,itwouldcausequestionstoarisewhytheopinionchangedcurrentlywhenthecompanyhasbeenauditedforseveralyears.Thiscanbeasourceofcontentionwithclients.Wethenexplainthatwereservetherighttodothesamethingandre-evaluate.(Participant3)Thecommentsaboveexpressbothauditorfrustration,andtheirsensethatclientsarealsofrustrated,whichauditorsbelieveplacestheminthedifficultpositionoftryingtoplacateboththeirclientsandthePCAOBinspectors.Moreover,theauditorsthemselvescomplainedthatchangesimplementedintheirauditapproachtopassPCAOBinspectionsarenotcosteffective.Forexample,someauditorscomplainedthatthePCAOBmightbeunnecessarilydrivingupauditcosts.I’vebeeninbusinessfor20years,largelyinvolvedinrealestateandfinancialinstitutions.Forthepast15–18years(asCPAs)we’vealwaysusedappraisals[thatclients]obtainedfromthirdparties.We’velookedatthem(appraisals)forgeneralizedreasonableness—meaningiftheappraiserslookatcommercialpropertywewanttobesuretheydon’tconsiderresidentialpropertyintheirwriteup.ThePCAOBis[now]sayingweshouldnot,andcannot,relyonthoseappraisals.Weactuallyneedtoreorderanappraisalonthatpropertyinordertoreachaconclusiononthatpropertyforthatopinion.(Participant6)However,weneedtoemphasizethattheseauditorobservationsabouttheirclients’attitudesandresistancetoincreasedfeescouldbemerelyamirroringoftheauditors’ownattitudesandnotnecessarilywhetherornottheirclientsactuallyholdtheseviewsinpractice.RQ2:Whataretypicalmanagementreactions,defenses,andissuesauditorsfacewhencommunicatingICFRdeficienciestoclients,andhowdoauditorsaddressthesereactions?Aftermanagingthecomplexitiesassociatedwithevaluatingdetectedcontroldeficiencies,thenextmajorchallengeauditpartnersencounteriscommunicatingtheirconclusionstotheclientandpersuadingtheclienttoaccepttheauditor’sevaluationoftheirICFR,particularlywhenmaterialweaknessesandsignificantdeficienciesaredetected.Auditorsreportedthattheirclients’managementoftenpushbackonICFRissues,arguingthatthedetecteddeficiencieswere‘‘isolatedoccurrences,’’thattherewerecompensatingcontrolstoaddresstheconcern(butauditorstypicallydeemedsuchcontrolstobeinadequate),andseveralotherdefensesthatwouldhavepreventedthematerialweaknessclassification.Thesedenialsfrommanagementandtacticstoavoidamaterialmisstatementevaluationrequirethatauditorsenlistassistancefromtheauditfirm’sin-housetechnicalsupportandtheclient’sauditcommittee.DifficultConversationsonToneattheTopForauditors,thetoneatthetopisanecessarystartingpointintheirevaluationoftheclient’sICFR.Oneparticipantobservedthat:‘‘anappropriatetoneatthetopismoreliketable-space,youneedtobethereasastartingpoint’’(Participant19).However,becausethetoneatthetopdirectlyinvolvesmanagement,auditorsreportthatitisdifficulttohavetheseconversations.Anotherfactorthatcontributestoproblemsindiscussionsbetweenmanagementandauditorsistheinherentsubjectivityandsensitivityofthenatureoftheauditor’sassessments.Asoneparticipantnoted,‘‘It’sliketheSupremeCourtquoteonpornography:It’shardtoarticulateit,butyoudefinitelyknowitwhenyouseeit’’(Participant8).Sincetheassessmentoftoneatthetopisoftensosubjective,manyauditorsrefertotheassessmentassomethingofa‘‘gut’’feelwhenmakingthedetermination.Theconversationwithmanagementoveritstoneatthetopcanbeawkwardand,thus,sensitivityisrequired.Itisnoteasyasanauditor,butsometimesyouhavetorollupyoursleevesandhavetheharddiscussion.Ifyou(i.e.,theauditfirm)weremoreaccommodatingthanyoushouldhavebeeninthepast,itmakestheconversationmoredifficult.(Participant3)Auditorsjudgeclientmanagements’negativereactiontotheauditors’ICFRfindingsasanimportantindicatorofaweaktoneatthetop,particularlywhenmanagementdoesnotevenbelievetheissueisworthdiscussing.Everyengagementteaminvestigates,tosomedegree,toneatthetop.Ifyouhaveinstanceswheresomeone(management)dismissessomethingoutofhand,yougettoapointwhereyouquestionthings.Iftherearetoneatthetopissues,youtakethemprettyseriously;peoplereacttothatquickly.(Participant20)Auditorsbelievethatanotherindicatorofaweaktoneatthetopiswhenthemanagementteamvaluestheaccountingfunctionsolelyintermsofitscostandability(orinability)tocontributetoprofitgeneration.Auditorsbelievethatthesetypesofmanagerstendtoviewtheaccountingfunctionandinternalcontrolsassomethingthattheyhavetodo—anecessityofrunningabusiness—ratherthanrecognizingthesefunctionsaseffectiveinvestmentsintheirbusinessandeffectiveriskmonitoringor72Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 riskmitigationtools.Consistentwithpartners’observationsofsomemanagersplacinginadequatevalueonICFR,theSECDivisionofEnforcementrecentlyannouncedthataspartoftheirICFRinitiativetheyhadfiledactionsagainstcompaniesforfailuretomaintainadequateICFRsforsevenormoreconsecutiveannualreportingperiods(SEC2019b).Participantsnotedthatwhenmanagementdoesnotvalueinternalcontrols,itoftenresultsintheircompanieshavinglessqualifiedpersonnelandunderstaffingofkeyinternalcontrolfunctions.Insomecases,yeah,ourclientsarefocusedonthebottomline.Therearecertainboards,CFOs,CEOsthatdon’tseeaccountingasvalueadded.Theyseeitasanoverheadcost.Theydon’twanttoinvestinit.Whentheylookatinvestments,theydon’tputtheirdollarsthere.Theyputtheirdollarstoareasthatexpandoperations,boostrevenueandcostreduction.Accounting,marketing,HRiswhatgetshitfirstwhencostsarecut.Noteverybodydoesthat,buttherearealotofcompaniesouttherewiththatmindset.(Participant4)Theparticipantsalsonotedthatthesenarrowviewsaboutthevalueoftheinternalcontrolsometimesextendedtomanagers’lackofappreciationoftheroleandvalueoftheinternalauditdepartment.Wehavecertainlycomeacrossthebudget/‘‘notincomeproducing’’[attitudethat]extendstotheinternalauditdepartment.Thecompanyhasaweakinternalauditorinternalcontroldepartment,andlowerlevelindividualsnotasexperiencedastheyshouldbe.Managementdoesnotwanttopaythesalaryfora[professionalatthe]managerlevelthatcanchallengepeopleandreallyunderstandthecontrolenvironment,ortheyjustwantbodiesininternalaudit.(Participant5)Interestingly,someoftheseviewsthattheinternalcontrolrepresentsmoreofacostthanabenefittotheorganizationwerenotrestrictedtomanagementonly.Auditorsreportedthattheyalsoencounterauditcommitteesthatarenotfullyappreciativeoftheimportanceofstrongcontrols.Thislackofappreciationcanextendtothepointofboardmembersundervaluingthestronginternalcontrolsthatareinplaceandexploringthefeasibilityofdowngradingtheexistinginternalcontrols.Participantscommentedthat,inaddressingsuchinstances,itoftenrequiresaneducationprocesstogettheirclients’auditcommitteesandboardstounderstandwhyastronginvestmentinaccountingandcontrolresourcestranslatestorealbenefitstoshareholders.Somecompanieshaveveryrobustaccountingfunctions,rightsegregationofduties.Thentheauditcommitteesays,‘‘Yougotan‘A’team,butdoweneeditallorisitjustincreasedcostsandcanwegowitha‘B’team?Canitbedonetosavecosts?’’Somecompaniesacceptit,[but]someviewthatthis[accounting]isacostthatmustbeincurredtoaccesscapital.(Participant4)Management’sUnwillingnesstoAcceptICFRFindingsAsdiscussedabove,auditorsusuallylinkeddiscussionsoftoneatthetoptotheconversationstheyhavewithmanagementaboutthecontrolproblemstheydetect.Whiletherewasgeneralagreementthatthediscussionwasnottoodifficultifitcenteredaroundthediscoveryofanissueclassifiedasacontroldeficiency,therewasgeneralconsensusthattheconversationbecamemoredifficultiftheauditorassessedthecontrolproblemtobeasignificantdeficiency,andevenmorecontentiouswhenamaterialweaknesswasassessed.Auditorsindicatethattheyareawarethatmanagementmighttrulybelievethattheexplanationtheyofferisvalid.Otherauditorsbelievethatclientsare‘‘unabletolistentoorheartherelevantfactsif[they]gotothemandsay,‘Hey,you’vegotamaterialweakness’’’(Participant6).Topersuademanagement,someauditorsreportthattheymakepresentationstomanagementthatincorporateflowchartstoexplainhowthekeyconcernisthepotentialforerror,notnecessarilyafounderror.Inthesecircumstances,theclienthastobewalkedthroughtheauditor’sunderstandingthatifthepotentialerrorisgreaterthanwhattheauditordeemstobematerial(materialenoughtorecordanauditadjustment),thentheerrormeetsthethresholdforbeingamaterialweakness.Participantsindicatedthataspartners,theymustmanageadelicatebalanceofbeingobjectiveandfirm,whileatthesametimedemonstratinganunderstandingandappreciationfortheclient’sperspective.Asonerespondentindicated:Itisadifficultconversationtohave,butitdoeshappen.Ihavebeeninvolvedinthree[materialweaknessclassifications].Wegothroughthatprocess,andmanagementdoesnotbelievethattheissueneedstobeaddressed.Forexample,[theybelieve]theauditorislookingatsomethingthewrongway;thentheauditorcansaytheopportunityexistsforthisnottoberight.Theauditprocessisaconfirmationprocess,validatingcontrols.It’snotaneasydecisionwhereyouhavetolookatitfrom50,000feet;[you]mustlookatthebigpicture,theforest,notthetrees.You[theauditor]getafeelingforwhattheenvironmentislikebasedontheissuesandothercontrols.It’snotayes/noonthedesignandeffectiveness[evaluation].Thismakes[ICFR]differentfromsubstantiveprocedures.(Participant3)AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting73Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 TheIsolated/One-TimeIncidentDefenseAcommonstrategythatclientsemploytodenytheexistenceofamaterialweaknessistoclaimthatthecontrolissuedetectedbytheauditorwasanisolatedevent,aone-timeitem,orduetoanindividualwhoisnewonthejob(andislearningwhileonthejob).Myfavoritethingwasthat[themanagementinyourcasessaid]eacherrorrepresentsaone-timeincident.Clientslovetosaythat,‘‘it’sanisolatedincident’’and‘‘it’sthespecificfactsandcircumstances,’’butthereisnosuchthing.(Participant4,CommentsonCase1and2)Youdon’tgetafreepassforonthejobtraining,sotheyshouldhavecertainshadowingoron-the-jobtraining,ineffectacontrolproceduretogetpeopleuptospeed...Idon’tthinkyougetafreepassbecauseofthat.Formeit’smoreyoumaychoosetodosomeadditionaltestingofthatperson’sworkproducttobesurethatwastheonlyproductoritemtainted.It’stoughtoidentifyanisolatederrorwithoutdoingmoretesting.(Participant19)Aclients’tendencytoseektocontainthedetectedcontrolproblemtoaspecificcircumstance,whichwouldnotrequirefurtheraction,isanalogoustopriorfindingsonauditsamplingdocumentingthatauditorsoftendecideagainstprojectingdetectedsampleerrorstothepopulation(e.g.,BurgstahlerandJiambalvo1986;Dusenbury,Reimers,andWheeler1994;Hermanson1997;Wheeler,Dusenbury,andReimers1997;ElderandAllen1998).Forexample,auditorstendtoprojecttothepopulationlessthan50percentofthetime(Hermanson1997),focusoninformationthatcontainserrorstosubpopulations,andweighthecontainmentinformationmorethanerrorfrequency(Dusenburyetal.1994).BurgstahlerandJiambalvo(1986)andHermanson(1997)notethatchoosingtoisolateerrorscanberiskybecauseisolatederrorsmightberepresentativeofotheruniqueerrorsinthepopulation.ConsistentwithHermanson’s(1997)observationthatauditorswithhighertask-relatedexpertiseweremorelikelytoappropriatelyprojecterrorstothepopulation,auditpartnersinterviewedforthisstudyreportedthattheyscrutinizeandrefutemanagement’sattempttocontaintheissuetoanisolatedincident.Auditors’responsestotheisolatedeventresponsearetypicallyfirsttoexplaintotheclient‘‘thestandardsdon’tallowustosaythereisaone-timething;wecan’tsayitwasanisolatedissue’’(Participant5).Theparticipantsreportedthattheyhavetocommunicatetomanagementthattheycannotacceptthe‘‘isolatedevent’’explanation.Auditorshavetoeducateclientsthataccordingtostandardsacontrolshouldworkwithneworseasonedindividualsandtodiscusswhethertheissueisinfactonlyaone-timeevent.Second,theseconversationstypicallyrequireauditorstoexpandtheirtestingtopersuadetheclienttoaccepttheauditor’sclassification.Severalauditorsalsoobservedthatwhenevermanagementputsforththeone-timeorisolatedincidentexcuse,theyseeitasaredflag,whichcanmaketheauditorsmoreskeptical.Otherauditorsreportthattheisolatedincidentexcuseleadstodiminishedmanagementcredibilityandmoreaudittestingbecause‘‘if[yousee]oneantintheroomthereareprobablymorethatyoudon’tsee’’(Participant13).ManagementDefense—AMaterialErrorWouldHaveBeenCaughtAnothercommonresponsemanagersemploytotrytorefuteamaterialweaknessfindingisthetwo-prongedargumentthat(1)iftheerrorassociatedwiththecontroldeficiencywasmaterialitwouldhavebeendetectedand(2)sincethedetectedmisstatementwasnotmaterialthenthereisnomaterialweakness.Seventy-fivepercentofmanagementstartinapositionthatsomethingintheirsystemwouldcatchit,oritwouldbecaughtifmaterial.Only25percentofthecompaniesrecognize‘‘you’reright,wedidnotcatchit.’’(Participant3)Managementthinkstheywouldcatchanythingmaterial;thisiswherethediscussionusuallytakesplace...Itisdefinitelymorechallengingwhenthereisnoerror.Makingsureeveryoneisonthesamepagewheneverytransactionthatissubjectedtothecontroloperatedeffectively,iftheanswerisright[i.e.,therearenomaterialproblemswiththefinancialstatements]itdoesn’tmeanthatthecontrolworks.Thisisahardconceptforpeopletowraptheirheadaround.Itisdifficulttotryandmaketheargumentthattheprocessworked,butthecontroldidnot.(Participant5)TheabovecommenthighlightsourobservationthatgettingmanagementtoacceptnegativejudgmentsmadebyauditorsismostdifficultwhentheICFRauditidentifiessignificantinternalcontroldeficiencies,buttherewerenorequiredauditadjustmentstothefinancialstatementsthatwereassociatedwiththecontroldeficiencies.Consistentwiththeauditors’concerns,theformerSECDeputyChiefAccountantobservedthatitwas‘‘surprisinglyraretoseemanagementidentifyamaterialweaknessintheabsenceofamaterialmisstatement’’andreportedthattheOfficeoftheChiefAccountant,theDivisionofEnforcement,andthePCAOBwereworkingtogethertoaddresstheissue(Croteau2013).Auditorsreportthatpartofthedifficultyingettingmanagerstoappreciatetheexistenceofamaterialweaknessintheabsenceofamaterialerroristhattheauditorisarguing,inessence,thattheclientwas‘‘lucky’’thatitsfinancialstatementswerefairlypresentedeventhoughthe74Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 internalcontrolswerenotadequate.Notsurprisingly,insuchsituations,managementoftenarguesthattheinternalcontrolsmustbefinebecausetherewerenoerrorsfoundinthefinancialstatements.Thisisillustratedbythefollowing:Whenyougetinto‘‘Whatcouldhappen?’’[asaresultoftheinternalcontroldeficiency],that’swheretherelationshipsanddiscussionsgetmoredifficult.(Participant3)Therearemanyclientsthatrolltheireyesandthinkwe’rebeingself-servingandkindofridiculous.Iftherewasnoerror[inthefinancialstatements],therecouldstillbeahole.Ifitisabighole,butnomisstatement,yeah,theymayhavegottenlucky.(Participant4)Management’sdifficultyinacceptingthepotentialformaterialmisstatementwithouttheexistenceofanactualmisstatementcanbeunderstoodthroughthecognitiveconceptoftheoutcomeeffect(Fischhoff1975;BrownandSolomon1987;BaronandHershey1988;Lipe1993;PeecherandPiercey2008).Iftheauditordiscoveredafinancialstatementerrorduringtheaudit,itismucheasiertoclaimtheexistenceofacontroldeficiency—orelse,howdidtheerroroccur?Thus,theoutcome(i.e.,adiscoverederror)makestheweaknessappearobvioustomanagement.However,intheabsenceofsuchanoutcome,itisdifficultformanagementtoacknowledge(oratleasteasierformanagementtoargueagainsttheexistenceof)acontroldeficiency.Thedifficultyoftheseconversationssuggeststhatclientsdonothaveaclearandcompleteunderstandingoftheconceptofanauditofinternalcontrolthatisintegratedwithanauditoffinancialstatements(asoutlinedinAS2201).Inmanyways,theburdenofproofofconcludingthatamaterialweaknessexists,whenthereisnocorrespondingfinancialstatementerror,ultimatelydependsontheabilityoftheauditortoclearlydemonstratethatamaterialerrorcouldoccur,giventhenatureofanobservedinternalcontroldeficiency.Successfullynavigatingthissituation(i.e.,persuadingmanagementtorecognizeandacknowledgeacontrolproblemintheabsenceofafinancialstatementerror)ispotentiallymademoredifficultbytheoutcomeeffect(Fischhoff1975)thatleadstoacognitivebiasagainstrecognizingand/oracknowledgingthatamaterialweaknessactuallyexistswhennocorrespondingfinancialstatementerrorhasbeendetected.ManagementDefense—MRCsareEffectiveCompensatingControlsAuditorsofteninteractwithmanagerswhotendtohave‘‘aknee-jerkreaction’’arguingagainsttheauditor’sconclusionthatthereisacontrolproblembymovingtoadiscussionofmitigatingcontrolsforthedeficiencyidentifiedbytheauditor.Specifically,onecommonthemethatemergedisthatmanagementfrequentlycontendsthatMRCsoperateascompensatingcontrolsformanyobserveddeficiencies,andthatthosecontrolswillpreventmaterialmisstatementsfromoccurring.That’sexactlyright,eveninthegeneralITcontrolissues,managementwillsay,‘‘Wedothisdetailedfinancialstatementreview,andwewouldhavecaughtit.’’(Participant9)Thus,animportantpartoftheICFRauditisevaluatingthevalidityofmanagement’sclaimsthaterrorswillbecaughtbyhigher-levelentity-levelcontrols(ELCs).Accordingly,theevaluationofmitigatingcontrols,suchasMRCs,isacorepartoftheauditor’sevaluationoftheclient’sICFR.Thetwocasesusedtofacilitatediscussionswiththeparticipantsfeaturedmanagementwhoclaimedthattheentity-levelMRCswouldhavedetectedtheerrorsidentifiedbytheauditors.Manyoftheparticipantschosetoresponddirectlytosuchmanagementclaims.Forbothcases,themanagementclaims:‘‘Wewouldhavecaughtit.’’Whatweneedtounderstandiswhatwouldhavecaughtit,andwhy[theirmitigatingcontrols]didn’t.Theauditorhastosay,‘‘Youhavethisprocess.Whydidn’titcatchit?’’Ifwedidn’ttestit,weneedtotestittoputsomecredibilitytothatstatement.(Participant8)TheELCidentifiedinthecase—thedetailedreviewasmitigatingcontrol—isanannualcontrol.Thisistheonlymanagementreviewcontrol,anditisatahighlevel,so[itis]notagoodcontroltomitigatedowntoasignificantdeficiency.[Typically],whatIfindisthatELCsandmanagementcontrolsusuallydonotoperatewellenoughtoidentifymaterial[misstatements]foracompanythatisasdecentralizedasthisone.(Participant2;CommentsonCase2)ManagementDefense—InternalAuditServesasanEffectiveMitigatingControlRelatedtotheELCresponsetheytypicallyencounter,auditpartnersalsoindicatedthatclientsoftenarguethattheinternalauditfunction(IA)couldbereliedupontocatchcontrolproblems.Indeed,oneparticipantindicatedthatthediscussioncasesforthisstudy‘‘arehittingitrightonthehead.‘One-timeincident,isolated,internalauditwouldhavecaught,’areallpartofatriedandtruelistofclientresponses’’(Participant7).However,respondentsquestionedtheideathattheclient’sIAcouldserveAuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting75Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 asacomponentoftheMRCs.Manyoftheparticipantsemphasizedthattheclient’sIAcannotserveasaneffectivereviewcontroliftheyareactiveparticipantsintheperformanceofthecontrolfunction.Intheexample(i.e.,thestudy’scase)itishardtoarguethatthereisacompensatingcontrolbecausethereisnothingelseapartfromIAlookingatthatcontrol,andreally,IAshouldn’tbepartofyourcontrolstructure.IAshouldlookatmakingsurethecontrolsexist,theyshouldbevalidatingthecontrols.[Doingmore]wouldbasicallycompromisetheirindependence,andthentheyarenotindependent.(Participant20;CommentsonCase1)OtherssharedthisobservationthatIAcannotservethefunctionsbothofmonitorandcontrolagent,whichisevidentfromthefollowingcomment.Theothersideis,onceyoustartdownthepathsayingIAwillcatchthings,thenIAswitchesfromamonitoringtoacontrol[function],soitchangestheIA’scharacter.WhenIAbecomesthecontrol,youenduphavingtoconsidertheeffectivenessofthemonitoringfunction.They[IA]loseobjectivityrelativetothecontroltheyareperforming.(Participant3;CommentsonCase1)Overall,management’sautomaticreactiontopotentialinternalcontrolweaknessesisoftentoarguethatMRCswouldhavecaughtanymaterialerrors.Theproblemisthatmanagementbelievesthattheycansimultaneouslyperformandreviewthecontrolactivity.Itappearsthatmanagementdoesnotappreciatethattheserolesareincompatible.Thisissueisfurtherexacerbatedbymanagement’srelianceonIAtoperformthetwoincompatiblerolesofanagentinthecontrolprocedureaswellasareviewerofthecontrolprocedure.Thus,auditorsreportthattheymustbevigilantandremainskepticalwhenmanagementofferssuchexcuses.AlthoughmanagementislikelytoraisethedefenseofaMRCorIAasacompensatingcontrolforanobserveddeficiency,auditorsarecognizantthatthesemanagementdefensesandexplanationsarequiteoftenmerelyattemptstoavoidthestigmaassociatedwithamaterialweaknessfinding.ManagementViewsMaterialWeaknessasaStigmatobeAvoidedAuditorsbelievethatanotherfactorthatcontributestoacombativematerialweaknessconversationwithclientsisthatsomemanagerstreatICFRexceptionsasapersonalissue.Intheauditor’sjudgment,managersperceivethattheyarebeingaccusedofnegligence,incompetence,orareinsomewayatfaultforthecontrolproblemidentifiedbytheauditor.ClientmanagementhasareputationtoupholdanddoesnotwanttobedenigratedinfrontoftheauditcommitteeandtheBoard.Thus,impressionmanagement,onthepartofclientpersonnel,isonefactorthatcanexplainthedisagreement.Somecompanies’management,controllerorCFO,Idon’tknowiftheyarecompensatedorevaluatedonhavingnosignificantdeficienciesormaterialweaknesses,butinsomeclientsituations,Igetthesensetheytakeitverypersonally,andtheythinkitreflectsbadlyonthemtohaveanythingbroughttotheauditcommittee.Insomecases,theywillfighttoothandnailnottobringsomethingtotheauditcommittee.(Participant5)AdditionalResourcestoAddressClientDefenseStrategies—AnEffectiveAuditCommitteeOurobservationsaboverevealthathowauditorsmanagetheirdiscussionswiththeclientcanbecrucialtothesuccessfulcompletionoftheICFRengagement.Whileeachpartnerbelievesthatcomingtotherightconclusionand,ultimately,thecorrectICFRopinion,isparamount,theclientrelationshipisalsoimportant,andmaintainingtherelationshipiscentraltoasuccessfulICFRengagement.Iftheassessmentissubjective,itmakesthejudgmentharderandmoreimportantforauditorstodotheirjobs.And[that]increasesthedifficultytomeettheexpectationsofregulatorsandstandardsetters.Weshouldnotbeadvocatesfortheclient,[but]weneedtobeopenmindedatthesametime.Thebalancebetweentryingtokeepyourclientsatisfiedandtryingtomeetyourprofessionalresponsibilityisimportant.Itisanart,notascience.(Participant4)However,achievingthisbalancingactoftendemandsthatauditorsconsiderthemultiplepartieswithintheclientorganization,asdemonstratedbythefollowingparticipantcomment.Theauditoristryingtobalancerelationships,sotheauditordoesnotwanttothrowtheclientunderthebusandruntotheauditcommittee.Youworkwithmanagement[i.e.,theclient]toreachaconclusionaboutthematter,andthenyousharewiththeauditcommitteewhenappropriate.(Participant3)Withsomeclients,auditorsencounterauditcommitteescommittedtofulfillingtheirfiduciaryresponsibilitytoensurehighqualityfinancialreporting.Theseauditcommitteesshowstrongsupportfortheauditorsinthefaceofmanagementopposition.Insuchcircumstances,auditorscanleveragethepoweroftheauditcommitteetoshapetheappropriatemanagementresponse.76Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 Theimportanceofhavingbothauditcommitteememberswhohavefinancialreportingexpertiseandanauditcommitteethatsupportstheauditorisillustratedbythefollowing.Wetookit[adisputeoveramaterialweakness]alltheway.Itwasbetweenmeandtheclient[management];wetookittotheauditcommittee.TheauditcommitteehappenedtohaveachairthatwasaCPA.[Thefinancials]requiredarestatement,[and]theclient[management]saidwedonotneedtoprovidenoticeofmaterialweaknessuntiltheendofyear,althoughtheissuecameuponaSeptemberquarterlyinterimfiling.Wesaidthat,inconjunctionwiththerestatement,managementneedstoidentifythatthereisamaterialweaknessinthecontrols.Andtheywerehardpressedtoagreetothat,sowegoinfrontoftheauditcommittee.Theauditcommitteechairwenttobatandsaid[tomanagement]‘‘Ifyoudon’t[issueamaterialweakness]Iexpectyourresignationonmydeskshortly,’’andIappreciatedthat.(Participant6)Overall,thesubjectivityintheevaluationofinternalcontrolscreatesanaturalsourceoftensionanddisagreementwithmanagement.However,asoundgovernanceculture,asevidencedbyastrongauditcommittee,hasthepotentialtohelptheauditofICFRrunmoresmoothlyandbemoreeffective.Inaddition,tobetrulyskillfulattheICFRaudittask,auditorshavetobecomfortablewithahighlevelofambiguity.Priorresearchinotherauditsettings,however,hasdocumentedthatauditorsseektoavoidambiguity(e.g.,Bamber,Snowball,andTubbs1989;NelsonandKinney1997;LuippoldandKida2012;Joe,Vandervelde,andWu2017).AdditionalResourcestoAddressClientDefenseStrategies—IncreasedInternalConsultationsAnotherprominentfactorthatreceivedsignificantattentionfromparticipantsistheextenttowhichengagementpartnersconsultwiththeirfirm’snationalofficetoseekadviceorvalidationoftheirprofessionaljudgments.Itappearsthatonestrategyauditorsemploytocopewithclientpushbackandregulatorypressureistogarnersupportwithinthefirmtostrengthentheirposition.Asonepartnernoted,regardingtheirrelationshipwiththenationaloffice:Asanengagementpartner,wecannotputourselvesinan‘‘usvs.them’’[withthenationaloffice].Thatalreadyexistsbetweenusandtheclient.Wecannot‘‘gotobat’’fortheclient,asthatputsusinabadplace.Consultationisneverabadthing.Either,wefindoutthatwewererightandvalidatethedecision,or[theconsultation]bringsupnewideastoshowwewerewrongandhowtoimprove.(Participant3)The‘‘routinization’’ofseekingnationalofficereassurancecouldleadtoalossinindividualprofessionaljudgmentexpertise,aspartnersmightover-consult(frequentuseofthenationalofficeasaknee-jerkresponse)andusethenationalofficeasa‘‘crutch’’tosubstitutefortheirownprofessionaljudgments.Onepartner’scommentsonwhyhe/shewould‘‘gotonational’’directlydescribesthisissue.[For]meas[theone]signingtheopinionline,Idon’twanttobeinthatpoolbymyself.Iwantthenationalofficeinvolvedthatseesthreetimesasmanycompaniesasme.ThisgivesmeadditionalsupportforwhenIhavethosediscussionswithmyclients.Helpsmethinkthroughtheconclusionsandbeabletoarticulatethemcarefully.So,Igotoournationalandregionalofficesfrequently.(Participant4)Further,toachieveincreasedconsistencythroughoutthefirm,auditfirmsworkhardtopromoteasuniformanapproachaspossible.Infact,basedonourobservations,themoreprevalenttheperceptionofaneedtoconsultandobtainreassurancefromthenationaloffice,themorelikelyitisthattheauditcanbecomehomogeneous.Considerthefollowing:OurfirmhasspecializedICFRexpertsthatreviewalladvancedfilersaswegothroughourinitialstagesofdocumenting.AnICFRexpertreviewswiththeexistingengagementteamandexaminesdocuments,anddocumentationofwalkthroughs,andselectingkeycontrols.Ateachmilestone,he’llcomeinandseewhatwehavedocumentedtoensurewemeetstandards.(Participant4)Similarly,anotherpartnerpointsoutthatthereisastronginfrastructuretosupportandencourageinternalconsultationsasaplacetoturntoforadvice.[Thereare]twolayerswecanbounceconclusionsoff:otherpartnersoraresearchcenter.[We]haveanICFRsteeringcommittee,haveresourcemembers,allassignedtoICFRauditing.Isitonthatcommittee,soIamsomeonethathelps[other]peopleworkthroughproblemslikethis.Intermsoffirmmethodologyandpolicy,whereit’saclosecallformaterialweakness,wearerequiredtoconsultwithourregionaltechnicalpartnerandthenationalgroup.(Participant5)Theneedforbalancingjudgmentattheengagementteamlevelandtryingtoachieveconsistencyacrosstheauditpracticeoftheentirefirmisechoedinthefollowingcomment:AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting77Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 Ithinktheengagementteamgoesalongwiththeinitialassessment...goestotheconclusion...butifit’sontheborderlinebetweensignificantdeficiencyormaterialweakness,they’llbringitup.They’llhaveapositiononit,andwe’lldiscussit.It’sajointdecision.Youdon’thavesomeonesittingupthere...it’sjustadialogue.Theonlythinganationalofficeperspectivebringsisconsistencyacrossthefirm.(Participant20)Collectively,theevidencesuggeststhatfirmsaretryingtoachieveconsistencyasmuchaspossibleintheirauditapproach,buttheyruntheriskthatthelossofindividualprofessionaljudgmentcanbeatradeoffinthepursuitofconsensusandstandardizationacrossthefirm.V.CONCLUSIONTheICFRaudithasbeenthesubjectofintensiveexaminationbyregulatorsandresearchersinrecentyears.Regulatorsofauditedfinancialstatements(i.e.,theSECandthePCAOB)haverecentlyissuedseveralwrittenandoralcommunicationsexpressingconcernaboutpubliccompanies’ICFRandtheICFRaudits(Panucci2016;Quaadman2015).Forexample,inanaddresstoauditcommittees,theChiefAccountantoftheSECemphasizedinternalcontrolasa‘‘keyissue’’thatrequiresattentionfromauditcommitteesinordertoachievemorereliablereportingtoinvestors(Schnurr2015).SeveraladditionalSECstaffspeeches(e.g.,Croteau2014)havealsoquestionedwhethercompaniesareproperlyidentifying,evaluating,anddisclosingmaterialweaknessestoinvestors.ThePCAOBhasalsoissuedinspectionreportsandstaffpracticealerts(e.g.,PCAOB2013a)aimedatimprovingtheauditsofICFR.TheSEChasevenacknowledgedthatthefocusonICFRisacoordinatedeffortwiththePCAOB,signalingtheimportanceoftheICFRevaluationtostakeholders.Motivatedbyregulators’concernsovertheauditsofICFRandICFRevaluationsbypreparers,weconductedaninterview-basedexaminationofthechallengesandissuesauditorsfaceduringtheICFRaudit.Ourparticipantswere20highlyexperiencedpartnersfromsevenofthelargestauditingfirms.Usingcases,developedwiththeaidofatechnicalreviewseniornationalpartnerexpert,toserveasareferencepointforadiscussionofcommonissuesandtypicalchallengesencounteredintheICFRaudit,weconductedsemi-structuredinterviewswithauditpartners.OuranalysisoftheissuesdiscussedduringtheinterviewsrevealsthattheregulatoryoversightoftheICFRaudithashadadeepandprofoundimpactonboththewayICFRauditsareconductedandauditorincentivesaroundtheICFRtask.ThisisnotsurprisingbecausethepassageofSOXledtotwonewsimultaneousrequirements:theICFRauditsforpubliclyheldcompaniesandtheimpositionofanexternalregulatortogovernhowauditsareconducted.Partners’responsesprovideimportantinsightsabouttheprocessbywhichauditorsactuallymakeICFRjudgmentsanddecisions,whichhasbeenarelativelyunexploredarea.Wefindthattheevaluationofwhetheranobservedinternalcontroldeficiencywouldrisetothelevelofsignificantdeficiencyormaterialweaknessisacomplexdecisionrequiringtheconsiderationofanumberofvariables.AcommonstartingpointfortheICFRevaluationprocessisafocusonthematerialityofadetectedorpotentialmisstatement.Thatapproachisconsistentwiththeprofessionalstandardsthatrequireauditorstodeterminethemagnitudeofthemisstatementthatcouldpotentiallyoccurbecauseoftheidentifiedcontroldeficiency(PCAOB2007).However,thepartnersnotedthatinordertoreachaconclusion,theyhadtoconsidervariablessuchastheextentofadditionalworktobecompleted,extrapolation,andaggregation.OurinterviewssuggestthatthePCAOB’snotionofRCAwhendiscussingICFRauditdeficiencieshasbecomesuccessfullyingrainedinauditors’thinkingwhenevaluatingtheirclients’ICFRdeficiencies(PCAOB2017).Auditors’approachfocusedonidentifyingthesourceoftheclient’sdeficiency,includingdeterminingwhetherornottherewasasinglecauseformultipleerrors,andwhethertherewasactuallygreaterexposurethantheamountassociatedwiththesourceofthespecificuncoverederror.Moreover,wefoundthatthediscussionofmaterialityandtheanalysisofthesourceofthedeficiencyareoftenlinkedtoevaluationsoftheclient’sMRCs.AuditorsreportedthatmanagementgenerallyperceivesthattheirMRCsserveasacompensatingcontrolforanyobserveddeficiencyandthattheMRCswouldcatchthe(detected)errorbeforeitresultsinamaterialmisstatement.Asaresult,theevaluationofMRCsisakeycomponentofanauditor’sevaluationoftheclient’sICFR.ThesubjectivityintheevaluationofMRCsandICFRdeficienciesingeneralcontributedtoauditorsfeelingvulnerabletosecond-guessingandcriticismsfromPCAOBinspectors.Notsurprisingly,giventhechangefromself-regulationtoPCAOBoversight,auditorsexpressedconcernthattheinspectionsprocesshadthepotentialtodetractfromsubstantiveauditqualitybecauseafocuson‘‘passing’’aPCAOBinspectiontendedtogoverntheirauditapproach.Oneofthemoreprominentfindingsinourinterviewswasthesignificantamountofeffortdedicatedtogettingclientmanagementtoaccepttheauditor’sevaluation/classificationofidentifiedICFRproblems.Participantsindicatedthatitisoftenchallengingtogettheclient’smanagementteamonboardwithclassificationsofsignificantdeficienciesormaterialweaknesses,asmanagersfrequentlybelievethatanyobservedinternalcontroldeficiencyismerelyanisolatedincident.ManagersalsohaddifficultyacceptingthatthepotentialforamaterialmisstatementwasthekeyfactorinevaluatingICFRdeficiencies.Auditorsreportedthattheirclientstendedtoassumethatunlessamaterialerrorwasdetected,therewasnoreasontoraisetheseveritylevelofthecontroldeficiency.Inordertocopewithpressuresfromclientmanagement,auditorsreliedon78Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 eitherastrongauditcommitteeorinternalconsultationswithexpertsintheirauditfirmtopushbackagainstmanagementresistance.Figure1presentsanadditionalsummaryofourresultsbasedonthecommonthemesthatemergedfromboththeevaluationofICFRdeficienciesandhowthisrelatestocommunicatingandresolvingICFRdeficiencieswithmanagement.Forexample,oneimportanttheme,RCA,involvesanevaluationprocessthatcouldextrapolatefromasingleincidenttotheoverallclientlevel.ThechallengeincommunicatingandresolvingICFRdeficienciesinRCAisgettingmanagementtounderstandapotentialmisstatementneedstoberecognized.Asengagementpartnersincreasinglyturntotheirfirm’snationalofficetogetadviceorvalidationoftheirmostdifficultprofessionaljudgmentsaroundICFR,auditfirmsachievemoreconsistencyacrosstheirauditpractice,andtheyperceivethistobeaneffectiveresponsetohelpmitigatesecond-guessingbythePCAOB.Importantly,wefindthatsomeauditfirmshaveplacedmonetarypenaltiesonpartnersforauditdeficiencies,whichappearstoweighonthemindsofthepartners.However,adownsideofthisapproachisthatitcouldleadtoacheck-the-boxmentalitythatcouldbedetrimentaltoanauditor’sprofessionaljudgment.Animportantresearchquestiontoconsiderinthefutureistoevaluatetowhatextent,ifatall,auditfirmsareconverginginthetypesofdocumentationprovided.Next,futureresearchcanexaminetowhatextent,ifany,firmsareadoptingahomogeneous,plainvanillaICFRauditprocessacrossdifferentindustries.Finally,futureresearchcanexamineifaPCAOB-drivenICFRauditprocessimprovesordoesnotimproveauditquality(alsoseeavarietyofspecificresearchquestionsinTable3).Withrespecttoourstudy’simplicationsforregulatorsandstandardsetters,wefindthatthereisagreatdealofambiguityinwhatconstitutesadeficiency,asignificantdeficiency,andamaterialweakness,andwhatdistinguisheseachofthesethreecategoriesfromeachother.ThisambiguityappearstocontributetoourobservationthatthereissignificantdisagreementbetweenauditorsandclientmanagersontheclassificationofICFRdeficiencies.ItcouldbebeneficialforusersiftheSECweretoprovidemoreexplicitguidancetopreparerswithrespecttowhatconstitutes,forexample,amaterialweakness,andhowthatdiffersfromadeficiencyorasignificantdeficiency.ThiswouldallowformoreconsistencyandcomparabilityacrossFIGURE1SummaryofFindingsAuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting79Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 companies,ratherthanrelyingonauditorstoholdsteadfastagainstclientpressurestominimizetheclassificationofdetectedICFRdeficiencies.ThePCAOBanditsinspectionteamsmightalsofinditbeneficialtofurtherconsiderhowauditorsinterpretstandardsandinspectionreports,andhowtheseinterpretationsaffecttheconductoftheauditengagement.Forexample,onecanassumethatunnecessarydocumentationisnotagoalofPCAOBinspectors;therefore,PCAOBinspectorscouldconsiderprovidingadditionalguidanceregardingmoreappropriatelevelsofauditdocumentationwhentheydetectexcessiveandunnecessarydocumentationthatdoesnotcontributetoimprovedauditquality(oranimprovedabilitytoassessauditquality).Asinallstudies,therearelimitationsthatrepresentopportunitiesforfutureresearch.First,weemployedaqualitativeapproachtothemostconsequentialprofessionaljudgmentintheICFRaudit,assessingtheseverityofanobservedinternalcontroldeficiency.Althoughthatdidleadtoaprobeofatleastpartofthe‘‘blackbox,’’wedidnotcontrolforcertainvariablesortheoreticallyexaminecausallinksbetweenvariousfactorsandthefinalICFRassessmentdecision.Thisleadstotheimportantresearchquestionofhowcertainvariables,suchascomplexityoftheissue,theindustryexpertiseoftheauditors,andotherfactors,willinfluencetheeffectiveness,aswellas,theefficiencyoftheICFRdecisionprocess.Relatedly,thecasesusedasareferencepointforourinterviewsdiscussedcontrolproblemsinthefinancialservicesandrealestateindustrysector,butseveralofourparticipantswerenotfinancialservicesorrealestateindustryexperts.Whileourcasesweresimple,andlikelydidnotrequireindustryexpertise,weacknowledgeapotentiallimitationthathavingfinancialservicesorrealestateindustryexpertsasparticipantsmightyielddifferentresponses.Futureresearchcouldexplorethisconcern.Inaddition,wedidnothaveaccesstotheactualPCAOBinspectionreportsortheauditworkpapersrelatedtoourparticipants.Thus,wecannotdirectlylinkthereportstotheactualworkthatisdoneandmakeanyinferencesonthedirectorindirectlinktomeasurabledimensionsofauditquality.Afuturestudycouldusearchivaldatatomakethelinkbetweenfactorssuchasauditfees,clientimportance,andindustryeffectsontheICFRauditprocess.Despitetheselimitations,ourresearchprovidestheinitialevidenceonthe‘‘blackbox’’oftheICFRprocess,andwearehopefulthatthiscouldspurfutureresearchinthearea.Forexample,futurequalitativeresearchintheareacanturntoinstitutionaltheorywhichexamineshowsocialnormsorruleswithinanorganization,oranentireprofession,becomeentrenchedandemergeasauthoritativeguidanceforbehaviorwithinanorganization(Scott1995).Theever-increasingroleofregulationinaccountingandauditinghasledtoincreasedapplicationofelementsofinstitutionaltheoryinanumberofrelatedareassuchascorporategovernance(Beasleyetal.2009;Cohenetal.2010;Westermannetal.2019)andpublicaccountingfirms’expansionintoconsulting(MalschandGendron2013).Inessence,institutionaltheoryarguesthatauditfirmsachievelegitimacybyusingasetofacceptedpracticesandadheringtotheexpectationsoftheoversightbody(i.e.,thePCAOB)evenifthosepracticesarenotaperfectfitforthefirm.Quiteinterestingly,consistentwithelementsofinstitutionaltheory,ourfindingssuggestthatauditorsaredoingatleastsomeadditionalworkbecauseofperceivedpressuresfromtheregulators,andnotbecausetheworkimprovesauditquality,whichispotentiallyaconcerntotheauditingprofession.Moreover,ourresultsrevealthatengagementpartnersincreasinglyturntotheirfirm’snationalofficetogetadviceorvalidationoftheirmostdifficultprofessionaljudgmentsaroundICFR.Thisisdonetohelpauditfirmsachieveasmuchconsistencyaspossibleacrosstheirauditpracticeandtohelpmitigatesecond-guessingbythePCAOB,whichisentirelyconsistentwithaninstitutionaltheoryperspective.Increasingly,auditorsperceivethattheworkconductedfortheICFRauditisdonemerelytoforestallanegativereactionfromaPCAOBinspection,ratherthantoenhancequality.Thishasledtoexcessivedocumentationandconformitythatisdonetoreducesecond-guessingbyregulators,whichisalsoconsistentwithWestermannetal.(2019).Importantly,wefindthatsomeauditfirmshaveplacedmonetarypenaltiesonpartnersforauditdeficiencies,andthisappearstoweighonthemindsofthepartners.Thispotentiallycouldleadtoamind-numbing,check-the-boxmentalitythatcouldbedetrimentaltoanauditor’sprofessionaljudgment.Futureresearchmightconsiderwhetherwearealsoseeingevidenceofinstitutionaltheoryinthatfirmsareconverginginthetypesofdocumentationprovidedandadoptingahomogeneous,plainvanillaICFRauditprocessthatisdrivenbyfear,asopposedtoadesiretobetterservethepublicinterest.REFERENCESAsare,S.,B.Fitzgerald,L.Graham,J.Joe,E.Negangard,andC.Wolfe.2013.Auditors’internalcontroloverfinancialreportingdecisions:Analysis,synthesisandresearchdirections.Auditing:AJournalofPractice&Theory32(Supplement):131–166.https://doi.org/10.2308/ajpt-50345Bamber,E.M.,D.Snowball,andR.M.Tubbs.1989.Auditstructureanditsrelationtoroleconflictandrole.TheAccountingReview64(2):285–299.Baron,J.,andJ.Hershey.1988.Outcomebiasindecisionevaluation.JournalofPersonalityandSocialPsychology54(4):569–579.https://doi.org/10.1037/0022-3514.54.4.56980Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 Beasley,M.,J.Carcello,D.Hermanson,andT.Neal.2009.Theauditcommitteeoversightprocess.ContemporaryAccountingResearch26(1):65–122.https://doi.org/10.1506/car.26.1.3Bricker,W.2017.Statementinconnectionwiththe2017AICPAconferenceoncurrentSECandPCAOBdevelopments.Availableat:https://www.sec.gov/news/speech/bricker-2017-12-04Brown,C.,andI.Solomon.1987.Effectsofoutcomeinformationonevaluationsofmanagerialdecisions.TheAccountingReview62(3):564–577.Burgstahler,D.,andJ.Jiambalvo.1986.Errorprojectionanduncertaintyintheevaluationofaggregateerror.Auditing:AJournalofPractice&Theory19(1):257–264.CanadianPublicAccountabilityBoard(CPAB).2012.Reportonthe2012inspectionsofthequalityofauditsconductedbypublicaccountingÞrms.Availableat:http://www.cpab-ccrc.ca/Documents/Topics/Public%20Reports/CPAB_Public_Report_2012_Eng.pdf(lastaccessedOctober28,2019).Cohen,J.,G.Krishnamoorthy,andA.Wright.2002.Corporategovernanceandtheauditprocess.ContemporaryAccountingResearch19(4):573–594.https://doi.org/10.1506/983M-EPXG-4Y0R-J9YKCohen,J.,G.Krishnamoorthy,andA.Wright.2010.Corporategovernanceinthepost-Sarbanes-Oxleyera:Auditors’experiences.ContemporaryAccountingResearch27(3):751–786.https://doi.org/10.1111/j.1911-3846.2010.01026.xCohen,J.,G.Krishnamoorthy,andA.Wright.2017.Enterpriseriskmanagementandthefinancialreportingprocess:Theexperiencesofauditcommitteemembers,CFOs,andexternalauditors.ContemporaryAccountingResearch34(2):1178–1209.https://doi.org/10.1111/1911-3846.12294Croteau,B.T.2013.AuditPolicyandCurrentAuditingandInternalControlMatters.RemarksBeforethe2013AICPANationalConferenceonCurrentSECandPCAOBDevelopments,Washington,DC,December9.Availableat:https://www.sec.gov/news/speech/2013-spch120913btcCroteau,B.T.2014.AuditPolicyandCurrentAuditing,Independence,andInternalControlMatters.RemarksBeforethe2014AICPANationalConferenceonCurrentSECandPCAOBDevelopments,Washington,DC,December8.Availableathttps://www.sec.gov/news/speech/2014-spch120814btcDusenbury,R.,J.Reimers,andS.Wheeler.1994.Theeffectofcontainmentinformationanderrorfrequencyonprojectionofsampleerrorstoauditpopulations.TheAccountingReview69(1):257–264.Earley,C.,V.Hoffman,andJ.Joe.2008.Reducingmanagement’sinfluenceonauditors’judgments:AnexperimentalinvestigationofSOX404assessments.TheAccountingReview83(6):1461–1485.https://doi.org/10.2308/accr.2008.83.6.1461Elder,R.J.,andR.D.Allen.1998.Anempiricalinvestigationoftheauditor’sdecisiontoprojecterrors.Auditing:AJournalofPractice&Theory17(2):71–87.FinancialReportingCouncil(FRC).2011.Auditinspectionunitannualreport2010/11.Availableat:https://www.frc.org.uk/getattachment/adf01122-7b6b-4db3-92e3-4be586c7e2af/AIU-Annual-Report-2010-111.pdfFischhoff,B.1975.Hindsightdoesnotequalforesight.Theeffectofoutcomeknowledgeonjudgmentunderuncertainty.JournalofExperimentalPsychology.HumanPerceptionandPerformance1(3):288–299.https://doi.org/10.1037/0096-1523.1.3.288Gendron,Y.,andM.Power.2015.Researchforumonqualitativeresearchinauditing.Auditing:AJournalofPractice&Theory34(2):1–2.https://doi.org/10.2308/ajpt-10458Gendron,Y.,J.Be´dard,andM.Gosselin.2004.Gettinginsidetheblackbox:Afieldstudyofpracticesin‘‘effective’’auditcommittees.Auditing:AJournalofPractice&Theory23(1):153–171.https://doi.org/10.2308/aud.2004.23.1.153Gramling,A.,E.O’Donnell,andS.Vandervelde.2013.Anexperimentalexaminationoffactorsthatinfluenceauditorassessmentsofadeficiencyininternalcontroloverfinancialreporting.AccountingHorizons27(2):249–269.https://doi.org/10.2308/acch-50410Gramling,A.,M.Maletta,A.Schneider,andB.Church.2004.Theroleoftheinternalauditfunctionincorporategovernance:Asynthesisoftheextantinternalauditingliteratureanddirectionsforfutureresearch.JournalofAccountingLiterature23(1):194–244.Hermanson,H.M.1997.Theeffectsofauditstructureandexperienceonauditors’decisionstoisolateerrors.BehavioralResearchinAccounting9(Supplement):76–93.Hermanson,D.,J.Tompkins,R.Veliyath,andZ.Ye.2012.Thecompensationcommitteeprocess.ContemporaryAccountingResearch29(3):666–709.https://doi.org/10.1111/j.1911-3846.2011.01118.xHirst,D.,andL.Koonce.1996.Auditanalyticalprocedures:Afieldinvestigation.ContemporaryAccountingResearch13(2):457–486.https://doi.org/10.1111/j.1911-3846.1996.tb00511.xJoe,J.R.,S.D.Vandervelde,andY.Wu.2017.Useofhighquantificationevidenceinfairvalueaudits:Doauditorsstayintheircomfortzone?TheAccountingReview92(5):89–116.https://doi.org/10.2308/accr-51662Johnson,L.M.,M.B.Keune,andJ.Winchel.2019.U.S.auditors’perceptionsofthePCAOBinspectionprocess:Abehavioralexamination.ContemporaryAccountingResearch36(3):1540–1574.https://doi.org/10.1111/1911-3846.12467Knechel,W.R.,G.Krishnan,M.Pevzner,L.Shefchik,andU.Velury.2013.Auditquality:Insightsfromtheacademicliterature.Auditing:AJournalofPractice&Theory32(Supplement):385–421.https://doi.org/10.2308/ajpt-50350Kral,R.2017.ManagementÕsannualreportonICFR.Availableat:https://www.corporatecomplianceinsights.com/managements-annual-report-on-icfr/AuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting81Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 LaCroix,K.M.2015.PwCreportreviews2014securitiessuitfilingsandsettlements,analyzestrendslikelytodrivefuturesuits.Availableat:https://www.lexisnexis.com/LegalNewsRoom/securities/b/securities/posts/pwc-report-reviews-2014-securities-suit-filings-and-settlements-analyzes-trends-likely-to-drive-future-suitsLatham,G.,andC.Sue-Chan.1999.Ameta-analysisofthesituationalinterview:Anenumerativereviewofreasonsforitsvalidity.CanadianPsychology40(1):56–67.https://doi.org/10.1037/h0086826Lipe,M.1993.Analyzingthevarianceinvestigationdecision:Theeffectsofoutcomes,mentalaccountingandframing.TheAccountingReview68(4):748–764.Luippold,B.L.,andT.E.Kida.2012.Theimpactofinitialinformationambiguityontheaccuracyofanalyticalreviewjudgments.Auditing:AJournalofPractice&Theory31(2):113–129.https://doi.org/10.2308/ajpt-10259Malsch,B.,andY.Gendron.2013.Re-theorizingchange:Institutionalexperimentationandthestrugglefordominationinthefieldofpublicaccounting.JournalofManagementStudies50(5):870–899.https://doi.org/10.1111/joms.12006Malsch,B.,andS.Salterio.2016.Doinggoodfieldresearch:Assessingthequalityofauditfieldresearch.Auditing:AJournalofPractice&Theory35(1):1–22.https://doi.org/10.2308/ajpt-51170Miles,M.,andA.Huberman.1994.QualitativeDataAnalysis:AnExpandedSourcebook.ThousandOaks,CA:SAGEPublications,Inc.Nelson,M.W.,andW.R.Kinney.1997.Theeffectofambiguityonlosscontingencyreportingjudgments.TheAccountingReview72(2):257–274.Panucci,M.2016.Remarksbeforethe2016AICPAconferenceoncurrentSECandPCAOBdevelopments.Availableat:https://www.sec.gov/news/speech/panucci-2016-aicpa.htmlPeecher,M.,andD.Piercey.2008.Judgingauditqualityinlightofadverseoutcomes:Evidenceofoutcomebiasandreverseoutcomebias.ContemporaryAccountingResearch25(1):243–274.https://doi.org/10.1506/car.25.1.10PublicCompanyAccountingOversightBoard(PCAOB).2007.AnAuditOfInternalControlOverFinancialReportingThatIsIntegratedWithAnAuditOfFinancialStatementsAndRelatedIndependenceRuleandConformingAmendments.AuditingStandard(AS)No.2201.Washington,DC:PCAOB.PublicCompanyAccountingOversightBoard(PCAOB).2011.AssessingandRespondingtoRiskintheCurrentEconomicEnvironment.StaffAuditPracticeAlertNo.9.Washington,DC:PCAOB.PublicCompanyAccountingOversightBoard(PCAOB).2012a.MaintainingandApplyingProfessionalSkepticisminAudits.StaffAuditPracticeAlertNo.10.Washington,DC:PCAOB.PublicCompanyAccountingOversightBoard(PCAOB).2012b.Observationsfrom2010InspectionsofDomesticAnnuallyInspectedFirmsRegardingDeÞcienciesinAuditsofInternalControlOverFinancialReporting.ReleaseNo.2012-006.Washington,DC:PCAOB.PublicCompanyAccountingOversightBoard(PCAOB).2012c.Reporton2011InspectionofErnst&YoungLLP.ReleaseNo.104-2012-272.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Reports/Documents/2012_Ernst_Young_LLP.pdfPublicCompanyAccountingOversightBoard(PCAOB).2013a.ConsiderationsforAuditsofInternalControlOverFinancialReporting.StaffAuditPracticeAlertNo.11.Washington,DC:PCAOB.PublicCompanyAccountingOversightBoard(PCAOB).2013b.Reporton2012InspectionofErnst&YoungLLP.ReleaseNo.104-2013-146.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Reports/Documents/2013_Ernst_Young.pdfPublicCompanyAccountingOversightBoard(PCAOB).2014a.IntheMatterofKPMGLLPÕsQualityControlRemediationSubmissions.ReleaseNo.104-2014-166.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Reports/Documents/2012_KPMG.pdfPublicCompanyAccountingOversightBoard(PCAOB).2014b.Reporton2013InspectionofBDOUSA,LLP.ReleaseNo.104-2014-232.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Reports/Documents/2014_BDO_USA_LLP_2013.pdfPublicCompanyAccountingOversightBoard(PCAOB).2014c.Reporton2013InspectionofKPMGLLP.ReleaseNo.104-2014-167.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Reports/Documents/2014_KPMG_LLP.PDFPublicCompanyAccountingOversightBoard(PCAOB).2015.IntheMatterofBDOUSA,LLPÕsQualityControlRemediationSubmissions.ReleaseNo.104-2015-189.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Reports/Documents/2012_BDO_USA_LLP.pdfPublicCompanyAccountingOversightBoard(PCAOB).2017.PCAOBPublishesStaffInspectionBriefPreviewing2016InspectionFindings.Availableat:https://pcaobus.org/News/Releases/Pages/staff-inspection-brief-2016-preview-11-9-17.aspxPublicCompanyAccountingOversightBoard(PCAOB).2019a.Staffpreviewof2018inspectionobservations.Availableat:https://pcaobus.org/Inspections/Documents/Staff-Preview-2018-Inspection-Observations.pdfPublicCompanyAccountingOversightBoard(PCAOB).2019b.AnnualReportontheInterimInspectionProgramRelatedtoAuditsofBrokersandDealers.ReleaseNo.2019-002.Washington,DC:PCAOB.Availableat:https://pcaobus.org/Inspections/Documents/Broker-Dealer-Auditor-Inspection-Annual-Report-2019.pdf#search¼%22management%20review%20controls%22Quaadman,T.2015.Re:PCAOBdraftstrategicplan2018-2022(PCAOBReleaseNo.2018-001,August10,2018).Availableat:https://pcaobus.org/About/Administration/StrategicPlanComments/24_Chamber.pdf82Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 Schnurr,J.2015.RemarksbeforetheUCIauditcommitteesummit.Availableat:https://www.sec.gov/news/speech/schnurr-speech-uci-audit-committee-summit.htmlScott,W.1995.InstitutionsandOrganizations:FoundationsforOrganizationalScience.London,U.K.:SagePublicationSeries.SecuritiesandExchangeCommission(SEC).2007.CommissionGuidanceRegardingManagementÕsReportonInternalControloverFinancialReportingunderSection13(a)or15(d)oftheSecuritiesandExchangeActof1934.ReleaseNos.33-8810,34-55929,FR-77;FileNo.S7-24-06.Washington,DC:SEC.Availableat:https://www.sec.gov/rules/interp/2007/33-8810.pdfSecuritiesandExchangeCommission(SEC).2019a.SECchargesfourpubliccompanieswithlongstandingICFRfailures.Availableat:https://www.sec.gov/news/press-release/2019-6SecuritiesandExchangeCommission(SEC).2019b.SpotlightonFinancialReportingandAuditFraudGroup.Washington,DC:SEC.Availableat:https://www.sec.gov/spotlight/financial-reporting-and-audit-task-force.shtmlTrompeter,G.,andA.Wright.2010.Theworldhaschanged:Haveanalyticalprocedurepractices?ContemporaryAccountingResearch27(2):669–700.https://doi.org/10.1111/j.1911-3846.2010.01021.xU.S.HouseofRepresentatives.2002.TheSarbanes-OxleyActof2002.PublicLawNo.107Ð204.[H.R.3763].Washington,DC:GovernmentPrintingOffice.U.S.HouseofRepresentatives.2010.TheDodd-FrankWallStreetReformandConsumerProtectionAct.PublicLawNo.111-203.[H.R.4173].Washington,DC:GovernmentPrintingOffice.Westermann,K.,J.Bedard,andC.Earley.2015.Learningthe‘‘craft’’ofauditing:Adynamicviewofauditors’on-the-joblearning.ContemporaryAccountingResearch32(3):864–896.https://doi.org/10.1111/1911-3846.12107Westermann,K.,J.Cohen,andG.Trompeter.2019.PCAOBinspections:Publicaccountingfirmson‘‘trial.’’.ContemporaryAccountingResearch36(2):694–731.https://doi.org/10.1111/1911-3846.12454Wheeler,S.,R.Dusenbury,andJ.Reimers.1997.Projectingsamplemisstatementstoauditpopulations:Theoretical,professionalandempiricalconsiderations.DecisionSciences28(2):261–278.https://doi.org/10.1111/j.1540-5915.1997.tb01311.xAPPENDIXAKeyFactsCaseContextsCase1ClientisalargepubliclytradednationalfinancialservicescompanywithsubsidiaryofficesacrosstheU.S.Thecompanyhasadecentralizedaccountingsystembutallsubsidiariesfollowacommonsetoffinancialaccountingandinternalcontrol,andoperationalpolicyandprocedures,whichareestablishedatthenationalheadquarters.Subsidiariessubmitamonthlyreportfornationaloffice.TheSECissuedanewruleforfinancialcompaniesservicingretailcustomerswhichrequiresthemtolocatecustomerswhomightnotbeawarethattheyhaveassetsgreaterthan$25owedtothem.DuringICFRtestingtheauditordiscoversthatasmallpercentageofthelocationsselectedfortestinghadnotimplementedthe‘‘searchandnotification’’changesinoperatingproceduresimposedbynationalheadquarters.Thelackofimplementationwasattributedtoincomplete/ineffectiveupdatingofthelocalofficeinformationsystem.Thefinancialstatementexposure(limitedtofinesandpenalties)fromthisdeficiencyexceedsthetolerablemisstatementbutislessthanmateriality.Althoughtheclientdidnotidentifythiscontroldeficiency,managementbelievesthattheirinternalauditdepartmentwouldhavelikelydetectedthisweaknessduringaroutineauditandthereforepresentsastrongmitigatingentity-levelcontrol.Theauditteamalsofoundthatsomeofthecompany’ssecuritieswereinappropriatelyclassifiedas‘‘availableforsale’’securitiesinsteadofas‘‘tradingsecurities’’intheclient’s4thQuarterfinancialstatementsduetoamisapplicationofthesecuritiesbythesubsidiaryofficestocorporate.Misclassifyingthesesecuritiesresultedintheunrealizedlossbeingreflectedasareductioninothercomprehensiveincome.Ifthesecuritieshadbeenproperlyclassifiedastradingsecuritiestheunrealizedlosswouldhavebeenreflectedintheincomestatement.Managementbelievesthatbecausethereisadetailedmanagementreviewcontroloftheannualfinancialstatementsbeforetheyarefiled,amaterialerrorwouldhavebeenpreventedfromoccurringintheannualfinancialstatements.Thecontrolwasdesignedtooperateatthecorporatelevelandistheonlymanagementreviewcontrolperformed.Case2TheclientisalargeregionalpubliclytradedrealestateinvestmentfirmbasedintheNorthwest.Inadditiontorealestateholdings,thecompanyinvestsinrealestaterelatedsecuritiessuchasMortgageBackedSecurities(MBS)andAuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting83Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 CollateralizedDebtObligations(CDOs).Thecompanyiseligibletoandhasselectedthe‘‘fairvalue’’optionforeachofitsrealestateholdings.DuringtheinterimICFRtesting,theauditteamidentifiedacontroldeficiencyinthevaluationofthecompany’sincomeproducingproperties.Ananalysthadappliedtheincorrectinterestrateinthediscountedcashflowanalysesusedtodeterminefairvalue.Theerrorwasnotdetectedbytheclientandresultedinanoverstatementofthepropertyassetaccountinthe1stQuarterfinancialstatementfiling.Theerrorapproached,butdidnotexceed,materialityforthequarter.Thecontroller’sreviewcontroloverthisprocessisbasedonsystem-generateddataandreportsproducedbytheentity’sinformationsystem.Theauditteamisinthemidstoftheyear-endsubstantivetestingphaseoftheaudit.Whiletestingtheaccuracyofthefairvalueoftheclient’sfinancialinstruments,theteamdetectedacomputationalerrorinthevaluationmodelusedfortheMBSinvestment,whichledtoanoverstatementof‘‘tradingsecurities’’portfolio.Asaresultoftheerror,unauditedpre-taxincomehadbeenoverstatedbyapproximately3.27%(onayear-to-datebasis)andtotalassetswereoverstatedbylessthan1%.Theamountisbelowmateriality.Managementagreedtorecordtheproposedauditadjustmenttocorrecttheerror.Managementbelievesthatthetwoerrorsdescribedaboveareimmaterialandthatanyerrorthatapproachesamateriallevelwouldhavebeendetectedbythecontrollerwhocompletesarobustmanagementreviewcontrol(partofwhichisdescribedabove).Managementalsobelievesthattheirreviewcontroloperatesatapreciseenoughleveltopreventthesetypesofoverstatementstothepropertyandfair-valuesecuritiesaccounts.APPENDIXBPre-InterviewQuestionsWithinCaseContextsCase1(1)Howwouldyouclassifyeachoftheitemsdetectedbyyourteam?(Deficiency;Significantdeficiency;Materialweakness;Noneoftheabove):(a)The‘‘LostHolders’’issue:(i)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheotherpossibilities)?(b)The‘‘misclassification’’issue:(i)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheotherpossibilities)?(2)Ifyouhadaclient,andtheseweretheonlytwodeficiencies(lostholderandclassification),howwouldyouviewthesetwodeficiencies,incombination:(Deficiency;Significantdeficiency;Materialweakness)?(a)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheothertwopossibilities)?(3)Whatopiniondoyoubelieveiswarrantedfor[thisclient’s]ICFRaudit?UnqualifiedDisclaimerofOpinionAdverse(duetodetectedMaterialweakness)(a)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheothertwopossibilities)?(4)Wouldpastexperiencewiththisclientpotentiallyhaveaffectedyourresponsesabove?Ifyes,pleaseexplainhowitwould?(5)Whatevidentialmatterwouldyoutypicallyseektoobtaintosupportyourresponsesinnumber4above?Pleaseelaborateonhowthisevidentialmattermightspecificallyhelpindevelopingyourresponseabove.(6)Iftherewerenomaterialmisstatementsfoundontheauditbutyoustillbelievedthereareweaknessesinthecontrolsfortheaboveprocesses,whatevidencewouldyouneedtoobtaininordertofinalizeyourcontrolopinion?(7)AssumingthatyourauditteamconcludedthatoneofthedetectedICFRdeficienciesnotedaboveshouldbeclassifiedasamaterialweaknessandmanagementdisagreed,howwouldyouexplainyourpositiontomanagementsuchthattheycouldbeinapositiontoagreewithyourconclusion,evenifnomaterialmisstatementinthefinancialstatementswasfound?84Cohen,Joe,Thibodeau,andTrompeterAuditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 (8)Inmakingthedecisionsabove,howmuchdoyourelyoneachofthefollowingandexplainhowyouwouldrelyuponthem:(a)Yourfirm’sauditmethodology(b)Thetechnicalresourcesavailableinyourfirm’sautomateddatabase(c)Othermembersoftheauditteam(d)Qualityreviewpartner(orotherpartners)(e)Technicalexpertsatyourfirm’snationalofficeCase2(1)Howwouldyouclassifyeachoftheitemsdetectedbyyourteam?(Deficiency;Significantdeficiency;Materialweakness;Noneoftheabove):(a)The‘‘valuationofincomeproducingproperties’’issue:(i)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheotherpossibilities)?(b)The‘‘valuationofMBSinvestment’’issue:(i)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheotherpossibilities)?(2)Wouldyouviewthesetwodeficiencies,incombination,tobea:(Deficiency;Significantdeficiency;Materialweakness)?(a)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheothertwopossibilities)?(3)Whatopiniondoyoubelieveiswarrantedfor[thisclient’s]ICFRaudit?UnqualifiedDisclaimerofOpinionAdverse(a)Whatfactorsmostinfluencedyourdecision(i.e.,whatcausedyoutochooseyourpreferredoption(above)insteadofoneoftheothertwopossibilities)?(4)Explainwhetherthesubstantiveerrorinfairvaluemeasurementinfluencedyourassessmentoftheinternalcontrolsoverfinancialreportingat[thisclient].Discussthereasonswhyitdidordidnotinfluenceyourselectionintheappropriateauditopinion.(5)Wouldpastexperiencewiththisclientpotentiallyhaveaffectedyourresponsesabove?Ifyes,pleaseexplainhowitwould?(6)Whatevidentialmatterwouldyoutypicallyseektoobtaintosupportyourresponsestonumber5above?Pleaseelaborateonhowthisevidentialmattermightspecificallyhelpindevelopingyourresponseabove.(7)Iftherewerenomaterialmisstatementsfoundduringtheauditbutyoustillbelievedthereareweaknessesinthecontrolsfortheaboveprocesses,whatevidencewouldyouneedtoobtaininordertofinalizeyourcontrolopinion?(8)AssumingthatyourauditteamconcludedthatoneofthedetectedICFRdeficienciesnotedaboveshouldbeclassifiedasamaterialweaknessandmanagementtotallydisagreed,howwouldyouexplainyourpositiontomanagementsuchthattheycouldbeinapositiontoagreewithyourconclusion,evenifnomaterialmisstatementinthefinancialstatementswasfound?(9)Inmakingthedecisionsabove,howmuchdoyourelyoneachofthefollowingandexplainhowyouwouldrelyuponthem:(a)Yourfirm’sauditmethodology(b)Thetechnicalknowledgeavailableinyourautomatedworkpaperplatform(c)Othermembersoftheauditteam(d)Qualityreviewpartner(orotherpartners)(e)Technicalexpertsatyourfirm’snationalofficeAuditPartnersÕJudgmentsandChallengesintheAuditsofInternalControloverFinancialReporting85Auditing:AJournalofPractice&TheoryVolume39,Number4,2020Downloaded from http://meridian.allenpress.com/ajpt/article-pdf/39/4/57/2659805/i1558-7991-39-4-57.pdf by Case Western Reserve University, John Keyser on 25 January 2021 CLASSIFYING INTERNAL CONTROL DEFICIENCIES: THE CASE OF MAGNUM HUNTER RESOURCES CORPORATION Abstract Magnum Hunter Resources Corporation (MHRC) was an oil and gas company headquartered near Dallas, Texas. Although it never achieved profitability, the company grew rapidly through acquisitions. Unfortunately, a material weakness, the accounting department did not keep pace with the company’s growing size and sophistication, was not disclosed to investors until the company later restated its previously issued financial statements to correct multiple material misstatements. Management identified the internal control deficiencies (ICD) prior to issuing the materially misstated financial statements. The ICDs were not disclosed at that time because management underestimated their severity, classifying them as significant deficiencies, rather than as a material weakness. This paper presents a case study for use in the undergraduate or graduate classroom to discuss the classification and disclosure requirements for internal control deficiencies. After completing this case, students will be able to explain the three levels of ICDs and determine when it is necessary for the auditor to issue an adverse opinion on internal controls. Students will also be able to apply the guidance to properly classify ICDs and explain the importance of ICFR to financial statement users and to management. Key words: Internal Controls over Financial Reporting (ICFR), material weakness, internal control deficiency classification, SEC enforcement action, Audit Standard No. 2201, sanctions 1 THE CASE Introduction Magnum Hunter Resources Corporation (MHRC) was a New York Stock Exchange traded oil and gas company headquartered in Irving, Texas. The company’s primary business was the exploration and production of crude oil, natural gas, and natural gas liquids. Revenues grew from $6.6 million in 2007 to $271 million in 2012, in part due to significant acquisitions. However, the company reported net losses every year, increasing from $5.5 million in 2007 to $137 million in 2012, for a cumulative loss from inception of $275 million.1 MHRC grew significantly in 2010 and 2011, but its accounting department did not. In 2010 and 2011, the company completed multiple business combinations that resulted in increased revenues and total assets. The company did not invest in the size or sophistication of its financial reporting resources commensurate with its growth. MHRC was, however, a growing company with increasingly complex accounting issues. The Critical Accounting Policies section of MHRC’s 2011 10-K listed eight accounting policies including successful efforts accounting, proved reserves, derivative accounting, asset retirement obligations, stock-based compensation, impairment of property and equipment, revenue recognition, and income taxes. The company did not include business combination accounting despite the size of acquisitions completed that year, nor did it include the identification and disclosure of related party transactions, although there were many such transactions. 1 This case is based on the official SEC Enforcement Actions found at https://www.sec.gov/news/pressrelease/2016-48.html, as well as corporate filings by MHRC. 2 From 2009 through 2011, MHRC’s auditor was Hein & Associates LLP (Hein), a regional accounting firm headquartered in Denver, Colorado. Hein expressed unqualified (i.e., “clean”) opinions on the company’s financial statements and its internal control over financial reporting (ICFR) for each of those years. After the audit of the 2011 financial statements, Hein declined to continue as MHRC’s auditor. In July 2012, MHRC announced that it had engaged PricewaterhouseCoopers (PwC) to audit the 2012 financial statements. A few months after hiring PwC as its auditor, MHRC restated its 10-Q for the period ended June 30, 2012. PwC never completed the audit of MHRC’s 2012 financial statements because the company terminated PwC on April 10, 2013. Prior to its termination, PwC communicated that material weaknesses in the company’s ICFR prevented the company from developing reliable financial statements. Management disagreed with PwC’s conclusion and replaced them with another auditor, BDO. They acknowledged that accounting resources were stretched thin, but felt the conditions were justified, arguing that the rapid growth of the company would ultimately enhance shareholder value. The Enforcement Division of the Securities and Exchange Commission (SEC) launched an investigation that culminated in an enforcement action announced on March 10, 2016. The investigation revealed that some of the ICFR deficiencies identified by PwC had previously been identified by MHRC’s Chief Financial Officer (CFO) Ronald Ormand, Chief Accounting Officer (“CAO”) David Krueger, and the Hein audit firm partner, Wayne Gray as early as 2010. However, they had classified these ICFR deficiencies as significant deficiencies, rather than material weaknesses. As a result, the deficiencies were not communicated to investors or other users of MHRC’s financial statements for more than two years, long after the information should have been available for decision-making. 3 Background on ICFR Requirements In 1977, Congress enacted the Foreign Corrupt Practices Act of 1977 (FCPA) to make it illegal for companies to bribe foreign officials (U.S. Senate 1977). Congress knew that it would be difficult to prove allegations under this Act in the absence of an audit trail. Accordingly, the FCPA requires public companies to maintain accounting records that fairly reflect the company’s transactions, including dispositions of assets. It also requires them to develop and implement a system of internal accounting controls to provides reasonable assurance that transactions are properly authorized, assets are safeguarded, and that financial statements are prepared in accordance with generally accepted accounting principles. The FCPA requires companies to establish and maintain internal control, but it does not provide specific guidance for how companies should do so. In 1987, the National Commission on Fraudulent Financial Reporting (the Treadway Commission) recommended that its sponsoring organizations develop guidance on internal control (National Commission on Fraudulent Financial Reporting 1987, p. 48). In 1992, the Committee of Sponsoring Organizations (COSO) published a framework for evaluating the effectiveness of internal control (COSO 1992). The framework was updated in 2013 (COSO 2013). The Treadway Commission also recommended that the SEC establish a rule requiring management of public companies to annually assess the effectiveness of internal control and report their conclusions in annual reports. This recommendation was addressed when Congress passed the Sarbanes Oxley Act of 2002, hereafter “SOX” (U.S. House of Representatives 2002). In addition to the annual assessment of the effectiveness of ICFR, management is also required to evaluate the effectiveness of internal control each quarter. 4 SOX Requirements and SEC Rules SOX includes requirements related to internal controls in two sections. Section 302 requires the Chief Executive Officers (“CEOs”) and CFOs of public companies to certify the financial statements included in annual and quarterly SEC filings (U.S. House of Representatives 2002). Section 404 requires management to assess the effectiveness of ICFR as of the end of each fiscal year (U.S. House of Representatives 2002). Section 404 also requires independent auditors to audit and opine on the effectiveness of ICFR. Sections 302 and 404 do not establish the specific rules to meet these requirements, but instead delegate the rule-making responsibilities to the SEC. Section 302. To fulfill the legal requirements of Section 302, the SEC promulgated rules, including §240.13a-14, that requires CEOs and CFOs to certify that they have evaluated the effectiveness of internal controls every quarter. The required certification is included as an exhibit to every 10-Q and 10-K at the time it is filed. MHRC’s executives signed the certifications each quarter. Exhibit A is the certification signed by MHRC’s CFO Ronald Ormand that accompanied the company’s 2011 10-K filed on February 29, 2012. Ormand certified that he had evaluated the effectiveness of internal control, disclosed any material changes in internal control during the period, and disclosed all significant deficiencies and material weaknesses to the external auditors and the audit committee. Item 307 of SEC Regulation S-K requires companies to disclose the conclusions of the CEO and CFO regarding the effectiveness of the company’s disclosure controls and procedures. Disclosure controls and procedures are all the activities designed by the company to ensure that information required to be disclosed is done so on a timely basis. Exhibit B is Item 9A, Controls and Procedures, from MHRC’s 2011 10-K. In the first paragraph, the company discloses that the 5 company’s CEO and CFO concluded that the company’s disclosure controls and procedures were effective as of December 31, 2011. Section 404. Section 404 of SOX has two parts. Section 404(a) requires management to assess the effectiveness of ICFR as of the end of each fiscal year and report the results of that assessment in the 10-K (U.S. House of Representatives 2002). Item 308 of SEC Regulation S-K contains the rules necessary to meet the requirements of Section 404(a). The SEC also published an interpretative release that provides additional guidance to assist management in their assessment of the effectiveness of ICFR (SEC 2007). In the third section of Exhibit B, management reports that it assessed the effectiveness of ICFR and concluded that ICFR was effective as of December 31, 2011. Section 404(b) requires the company’s external auditor to audit the effectiveness of ICFR and express an opinion (U.S. House of Representatives 2002). To meet the requirements of 404(b), auditors must comply with PCAOB Auditing Standard (AS) No. 5. Exhibit C is the report of Hein. They audited MHRC’s ICFR as of December 31, 2011 and issued an unqualified opinion that the company maintained effective ICFR as of that date. ICFR Deficiencies at MHRC Early in 2011, the Hein engagement partner, Wayne Gray, advised MHRC management that their accounting department was having difficulty getting everything done on a timely basis. The company completed multiple acquisitions in 2010 and revenues had grown by 329% from $6.8 million in 2009 to $29.3 million in 2010. MHRC completed additional acquisitions in 2011 that expanded the company’s geographic footprint and increased revenues by 287%. These acquisitions intensified the strain on the accounting department resources. 6 As the company grew, the supervisory personnel in the accounting department were performing accounting functions and falling behind on their internal control responsibilities. The CAO, David Krueger, did not complete his review of the third quarter 10-Q until several days after it was filed with the SEC. Then they skipped the November monthly close process. The staffing shortage in the accounting department adversely impacted the timing of internal control testing. The company had engaged an unnamed PCAOB-registered accounting firm as a consultant to assist with management’s assessment of ICFR as of December 31, 2011. In his report to management, Joseph Allred, the partner leading this firm’s advisory services for MHRC, advised management that his firm experienced difficulties in testing the company’s internal controls. He also identified three ICFR deficiencies (see Exhibit D). First, general ledger account reconciliations were not prepared, reviewed, or approved on a timely basis. Second, there was no documentation of monthly management reviews. Finally, there were delays in the preparation of financial statements due to “inadequate and inappropriately aligned staffing.” Allred indicated that inadequate staffing represented a “substantial risk.” Allred concluded that none of these deficiencies rose to the level of a material weakness. It is ultimately the responsibility of management to classify deficiencies and draw conclusions regarding the effectiveness of ICFR. As the CFO and CAO, Ormand and Krueger were responsible to classify the ICFR deficiencies. They accepted the consultant Allred’s conclusion that the deficiencies were not material weaknesses and reported that ICFR was effective as of December 31, 2011 (See Exhibit B). 7 2011 Audit of ICFR The Hein audit firm partner, Wayne Gray, was aware of the delays in closing the books and communicated this issue to the company’s audit committee. He attributed the delays to insufficient staffing in the accounting department. He also advised the audit committee that the company had made multiple top-side entries (i.e. entries made directly to the financial statements). Rather than posting the entries in the general ledger and preparing new trial balances and consolidation workpapers, management may have felt it would be more efficient to simply “post” the entries on the financial statements directly. Gray shared his view with the audit committee that ICFR was “not adequate” due to the accounting department staffing issues. He also advised the audit committee that the staffing issue increased the possibility of a material error. However, he agreed with management’s conclusion that the deficiency did not rise to the level of a material weakness. According to the official SEC enforcement action, his conclusion was based on the following facts:  No actual misstatements were identified.  Existing accounting staff was competent, and management was in the process of hiring additional staff.  The accounting department was busy due to multiple acquisitions in 2011. Gray evaluated the deficiencies individually, but not in combination. Ultimately, his firm expressed an unqualified opinion on the effectiveness of MHRC’s ICFR as of December 11, 2011 (see Exhibit C). 2012 10-Q Restatement MHRC initially filed its 10-Q for the period ended June 30, 2012 on August 9, 2012. The Company reported that its disclosure controls and procedures were effective. However, the company restated these financial statements three months later, on November 14, 2012. The 8 restatement resulted from a number of misstatements, including errors in calculation of stock-based compensation, errors in equity transactions, and accounting for debt waiver fees. In connection with the restatement of its 10-Q, management reevaluated the effectiveness of ICFR. They considered that the identified misstatements resulted from the deficiencies previously identified and classified as significant deficiencies. Since the size of the potential misstatement resulting from the deficiencies is at least as large as the identified misstatements, management was forced to conclude that the potential misstatements were material. Further, since material misstatements actually occurred, management was forced to conclude that the likelihood of material misstatements arising from the deficiencies were at least reasonably possible. As a result, they concluded that the ICFR deficiencies were material weaknesses and, as a result, disclosure controls were not effective at June 30, 2012. See management’s description of the material weaknesses in Exhibit E. The company also reported, in the restated 10-Q, their plans to remediate the material weaknesses. One of the principal remediation plans was hiring additional personnel to expand the accounting department. They also implemented checklists to ensure that reviews of reconciliations were performed timely, and that calculation of stock-based compensation expense were complete and accurate. 2012 Audit Difficulties The company replaced Hein with PwC to audit the financial statements as of, and for the year ended December 31, 2012. However, PwC experienced difficulties in the audit as a result of deficiencies in the company’s ICFR. As a result of multiple material weaknesses, PwC believed it was necessary to expand their audit procedures to opine on the financial statements. MHRC 9 disagreed with PwC’s view and dismissed them. In the 8-K announcing the dismissal, the Company disclosed fourteen material weaknesses identified by PwC. The Company disclosed that it had engaged a new audit firm, BDO, to complete the 2012 audit. When the 2012 10-K was finally issued (late) in June 2013, the company reported the existence of 14 material weaknesses. SEC Investigation The SEC’s Division of Enforcement conducts investigations into potential violations of the federal securities laws (SEC 2020). Since the SEC conducts its investigations privately, it is unknown exactly what triggered the investigation of MHRC. However, either the restatement of the June 30, 2012 10-Q or the termination of PwC and disclosure of more than a dozen material weaknesses in April 2012 could have prompted the investigation. Regardless of what initiated the investigation, the SEC commenced an enforcement action and found evidence that MHRC, CFO Ronald Ormand, CAO David Krueger, consultant Joseph Allred, and Hein audit partner Wayne Gray violated the law. The SEC found that MHRC violated a provision of the Securities Exchange Act of 1934 requiring companies to design and implement internal controls over financial reporting and required the company to pay a civil monetary penalty of $250,000 to the United States Treasury. CFO Ronald Ormand and Consultant Joseph Allred were fined $25,000 and $15,000, respectively. CAO David Krueger and Hein audit partner Wayne Gray were barred from SEC accounting practice for one year. Epilogue Several class action lawsuits were filed against the company as a result of its restatement, late filings, and matters identified in the 8-K announcing the termination of PwC as the 10 company’s auditor. All these cases were dismissed, and the dismissals were upheld on appeal. MHRC filed for Chapter 11 Bankruptcy in December 2015 and deregistered in May 2016. All the investors in common stock had their shares cancelled as a result of the Chapter 11 bankruptcy plan of reorganization. Requirements 1. (LO 1) List the three levels of internal control deficiencies, rank them in terms of severity, and explain the criteria for each. 2. (LO 1) Explain how the size and likelihood of misstatement impacts the classification of an internal control deficiency. 3. (LO 1) When evaluating the classification of internal control deficiencies at MHRC, the external auditor concluded that they did not rise to the level of a material weakness, in part, because no actual misstatements were identified. Is it possible to conclude that an internal control deficiency is a material weakness in the absence of an actual misstatement? Why or why not? 4. (LO 2) How does the classification of internal control deficiencies affect: a. Management’s conclusion regarding the effectiveness of ICFR? b. The auditor’s report on ICFR? 5. (LO 3) Apply the applicable auditing standards to the facts provided in the case to classify the following internal control deficiencies. a. The failure to perform general ledger account reconciliations on a timely basis. b. The documentation of management review controls. c. Staffing shortage in the accounting department. 6. (LO 2) In your opinion, why did MHRC’s management and auditors fail to classify the identified internal control deficiencies as material weaknesses? 7. (LO 4) How were MHRC’s investors harmed as a result of: a. The failure of MHRC’s management to properly classify and disclose the internal control deficiencies described in the case? b. The auditors’ report opining that ICFR was effective? 11 REFERENCES Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2013. Internal Control – Integrated Framework. Committee of Sponsoring Organizations of the Treadway Commission (COSO) 1992. Internal Control – Integrated Framework. Collens, T.W. 2018. Remarks before the 2018 AICPA Conference on Current SEC and PCAOB Developments. Washington D.C. Available at: https://www.sec.gov/news/speech/collens-remarks-2018-aicpa-conference. Croteau, B.T. 2014. Remarks before the 2014 AICPA National Conference on Current SEC and PCAOB Developments. Washington D.C. Available at: https://www.sec.gov/news/speech/2014-spch120814btc. Croteau, B.T. 2013. Remarks before the 2013 AICPA National Conference on Current SEC and PCAOB Developments – Audit policy and current auditing and internal control matters. Washington D.C. Available at: https://www.sec.gov/news/speech/2013-spch120913btc. Magnum Hunter Resources Corporation. 2012. Annual Report on 10-K. National Commission on Fraudulent Financial Reporting. 1987. Report of the National Commission on Fraudulent Financial Reporting. Securities and Exchange Commission (SEC) 2020. About the Division of Enforcement. Available at: https://www.sec.gov/enforce/Article/enforce-about.html. Last accessed on November 16, 2020. SEC 2007. Commission guidance regarding management’s report on internal control over financial reporting under section 13(a) or 15(d) of the Securities Exchange Act of 1934. Available at: https://www.sec.gov/rules/interp/2007/33-8810.pdf. Stout, K.M. 2014. Remarks before the 2014 AICPA Conference on Current SEC and PCAOB Developments. Washington D.C. Available at: https://www.sec.gov/news/speech/2014-spch120814kms. U.S. House of Representatives. 2002. The Sarbanes-Oxley Act of 2002. Public Law 107-204 [H.R. 3763]. Washington, D.C.: Government Printing Office. U.S. Senate. 1977. Foreign Corrupt Practices Act of 1977. Public Law 95-213. [S. 305]. Washington D.C.: Government Printing Office. Exhibit A 302 Certification from Magnum Hunter Resources Corporation 2011 10-K Exhibit 31.2 CERTIFICATION I, Ronald D. Ormand, chief financial officer of MAGNUM HUNTER RESOURCES CORPORATION (the "Company"), certify that: 1. I have reviewed this annual report on Form 10-K of the Company; 2. Based on my knowledge, this annual report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report; 3. Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report; 4. The registrant's other certifying officer(s) and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f))for the registrant and have: a) Designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared; b) Designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles; c) Evaluated the effectiveness of the registrant's disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and d) Disclosed in this report any change in the registrant's internal control over financial reporting that occurred during the registrant's most recent fiscal quarter (the registrant's fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant's internal control over financial reporting. 5. The registrant's other certifying officer(s) and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant's auditors and the audit committee of the registrant's board of directors (or persons performing the equivalent functions): a) All significant deficiencies and material weaknesses in the design or operation of internal controls over financial reporting which are reasonably likely to adversely affect the registrant's ability to record , process , summarize and report financial information; and b) Any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant's internal control over financial reporting. Date: February 29, 2012 By: /s/ Ronald D. Ormand Ronald D. Ormand, Chief Financial Officer Exhibit B From Magnum Hunter Resources Corporation 2011 10-K Item 9A. CONTROLS AND PROCEDURES Evaluation of Disclosure Controls and Procedures As of the end of the period covered by this report, an evaluation of the effectiveness of the design and operation of the Company's disclosure controls and procedures (as defined in Rule 13a-15(e) under the Exchange Act) was performed under the supervision and with the participation of the Company's management, including our Chief Executive Officer and Chief Financial Officer. Based on that evaluation, the Company's Chief Executive Officer and Chief Financial Officer concluded that the Company's disclosure controls and procedures were effective as of December 31, 2011 to ensure: that information required to be disclosed in the reports it files and submits under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the SEC's rules and forms; and that information that is required to be disclosed under the Exchange Act is accumulated and communicated to the Company's management, including our Chief Executive Officer and Chief Financial Officer, as appropriate to allow timely decisions regarding required disclosure. Evaluation of Changes in Internal Control over Financial Reporting Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we have determined that, during the fourth quarter of fiscal 2011, there were no changes in our internal controls over financial reporting that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting. Management's Annual Report on Internal Controls Over Financial Reporting Our management is responsible for establishing and maintaining adequate internal control over financial reporting as defined in Rules 13a-15(t) and 15d-15(f) of the Exchange Act. Under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, we assessed the effectiveness of our internal controls over financial reporting as of the end of the period covered by this report based on the framework in "Internal Control-Integrated Framework" issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on that assessment, our Chief Executive Officer and Chief Financial Officer concluded that our internal controls over financial reporting were effective as of December 31, 2011 to provide reasonable assurance regarding the reliability of our financial reporting and the preparation of our financial statements for external purposes in accordance with U.S. generally accepted accounting principles. The Company acquired Williston Hunter Canada, Inc., Williston Hunter, Inc., and Magnum Hunter Production, Inc. during fiscal 2011. As permitted by SEC guidance, management excluded the acquired companies from its assessment of the effectiveness of the Company's internal control over financial reporting as of December 31, 2011. Williston Hunter Canada, Inc., Williston Hunter Inc., and Magnum Hunter Production, Inc. are wholly owned subsidiaries whose total assets and net income represent approximately 34% and 35%, respectively, of the related consolidated financial statement amounts as of and for the year ended December 31, 2011. The effectiveness of the Company's internal controls over financial reporting as of December 31, 2011, has been audited by Hein & Associates, LLP, an independent registered public accounting firm, as stated in their attestation report which is included in Item 8, "Financial Statements and Supplementary Data." Important Considerations The effectiveness of our disclosure controls and procedures and our internal controls over financial reporting is subject to various inherent limitations, including cost limitations, judgments used in decision making, assumptions about the likelihood of future events, the soundness of our systems, the possibility of human error, and the risk of fraud. Moreover, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions and the risk that the degree of compliance with policies or procedures may deteriorate over time. Because of these limitations, there can be no assurance that any system of disclosure controls and procedures or internal controls over financial reporting will be successful in preventing all errors or fraud or in making all material information known in a timely manner to the appropriate levels of management. Exhibit C Report of Independent Auditor, Hein and Associates, from Magnum Hunter Resources Corporation 2011 10-K REPORT OF INDEPENDENT REGISTERED PUBLIC ACCOUNTING FIRM To the Board of Directors and Stockholders Magnum Hunter Resources Corporation We have audited Magnum Hunter Resources Corporation and subsidiaries' (collectively, the "Company") internal control over financial reporting as of December 31, 2011, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. The Company's management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting included in the accompanying Management's Report on Internal Control Over Financial Reporting. Our responsibility is to express an opinion on the Company's internal control over financial reporting based on our audit. We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audit also included performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion. As described in Management's Report on Internal Control Over Financial Reporting, management has excluded Williston Hunter Canada, Inc., Williston Hunter, Inc., and Magnum Hunter Production, Inc. from its assessment of internal control over financial reporting as of December 31, 2011, because they were acquired by the Company in a purchase business combinations during 2011 . We have also excluded Williston Hunter Canada, Inc., Williston Hunter Inc., and Magnum Hunter Production, Inc. from our audit of internal control over financial reporting. Williston Hunter Canada, Inc., Williston Hunter Inc., and Magnum Hunter Production, Inc. are wholly owned subsidiaries whose total assets and net income represent approximately 34% and 35%, respectively, of the related consolidated financial statement amounts as of and for the year ended December 31, 2011. A company's internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company's internal control over financial reporting includes those policies and procedures that (a) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (b) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (c) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company's assets that could have a material effect on the financial statements. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. In our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 2011, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated balance sheets of Magnum Hunter Resources Corporation and subsidiaries as of December 31, 2011 and 20 l 0, and the related consolidated statements of operations, changes in stockholders' equity, and cash flows for each of the three years in the period ended December 31, 2011 and our report dated February 29, 2012 expressed an unqualified opinion thereon. Isl Hein & Associates Dallas, Texas February 29, 2012 Exhibit D Internal Control Deficiencies Identified in 2011 In 2011, MHRC’s consultant identified three internal control deficiencies. General Ledger Account Reconciliations A reconciliation control involves comparing two or more data elements and resolving any differences so that the two are in agreement (COSO 2013, 92). Reconciliation controls provide assurance regarding the accuracy and completeness of transactions. For example, reconciliation of the accounts receivable subsidiary ledger to the general ledger helps to identify transactions that were posted in the subsidiary ledger, but not in the general ledger and vice versa. During 2011, there were multiple general ledger accounts for which reconciliations were not prepared, reviewed, or approved on a timely basis. Management Review Controls Management review controls are used to ensure that other internal control activities are being performed and to serve as an additional control over higher risk transactions. There were several deficiencies related to management review controls at MHRC. First, the management review of the 2011 financial statements was not formally documented. Moreover, the CAO did not sign off on the third quarter 10-Q until five days after it was filed with the SEC. Filing the financial statements with the SEC without the CAO’s review creates the risk that inaccurate, incomplete, or omitted disclosures, if material, could influence investors’ decisions. MHRC recognized stock-based compensation expense of $25.1 million for the year ended December 31, 2011. Stock based compensation represented approximately 19.4% of total revenue. Management estimates stock-based compensation expense using an option-pricing model that is, according to the company’s financial statements, “highly complex and dependent on key estimates by management” (Magnum Hunter 2012, F-17). The person responsible for reviewing the calculation of stock-based compensation expense signed off without actually reviewing the supporting details or the journal entry posted to record the expense in the general ledger. One way that misstatements can occur is through inaccurate, fraudulent, or missing journal entries. Companies often implement management review controls to provide reasonable assurance that only authorized entries are posted in the general ledger and that the entries are posted to the correct accounts for the correct amounts. MHRC did not implement controls over journal entries. Staffing Shortage in Accounting Department MHRC experienced significant growth as a result of both organic growth and acquisitions. As the company invested in new business opportunities, it did not make similar investments in the accounting department. Early in 2011, MHRC’s external auditor advised the audit committee that there was insufficient accounting personnel. Later in 2011, the accounting department fell so far behind that it changed the frequency of the closing process from monthly to quarterly. Even with this change, the company experienced significant delays in the preparation of financial statements and other reports. At times, errors were identified after an accounting period was closed, so the accounting department resorted to “top-side” entries (i.e. adjustments made directly to the financial statements, rather than through journal entries posted in the general ledger). The lack of accounting department resources was not simply an insufficient number of employees. The accounting department lacked personnel with competence and training necessary to account for some of MHRC’s complex transactions such as convertible preferred stock with embedded derivative liabilities. Exhibit E Material Weaknesses from Magnum Hunter Resources Corporation Restated 10-Q Magnum Hunter Resources Corporation Description of Material Weaknesses Restated 10-Q for the interim period ended June 30, 2012 A material weakness is a control deficiency, or a combination of control deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis. In connection with the restatements and audit adjustments identified, management identified the material weaknesses described below. Lack of sufficient, qualified personnel to design and manage an effective control environment. We did not design an effective control environment with the sufficient complement of personnel with the appropriate level of accounting knowledge, experience, and training in US GAAP to assess the completeness and accuracy of the accounting for complex accounting matters, principally related to equity instruments including convertible preferred stock and related arrangements. This material weakness resulted in the restatement of our Series A convertible preferred units of Eureka Hunter, our commodity and preferred stock embedded derivative liabilities and our loss on derivatives and related disclosures for the three and six month periods ended June 30, 2012 discussed above and resulted in audit adjustments to our consolidated financial statements for the three and six month periods ended June 30, 2012. This material weakness also contributed to the material weaknesses described below. Period-end financial reporting process. We did not maintain effective controls over the period-end financial reporting process, including controls with respect to the preparation, review, supervision, and monitoring of accounting operations. Specifically, we did not maintain effective controls to provide reasonable assurance that monthly account reconciliations were reviewed on a timely basis and that monthly and quarterly financial information was prepared and reviewed timely. This material weakness resulted in audit adjustments to our Restated Financial Statements for the three and six month periods ended June 30, 2012. Share-based compensation. We did not design effective controls over share-based compensation expense, which is recorded in our general and administrative expenses. Specifically, we did not design effective controls related to the review of supporting details, including the completeness and accuracy of the vesting schedule and the journal entries for share-based compensation expenses. This control deficiency resulted in a misstatement of our general and administrative expense and share-based compensation related disclosures for the three and six month periods ended June 30, 2012 and resulted in the restatement discussed above. Additionally, the material weaknesses described above could result in misstatements that would result in a material misstatement of the consolidated financial statements in a future annual or interim period that would not be prevented or detected.