SPOTLIGHT Data and Technology Research Project Update, May 2021
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
SPOTLIGHT Data and Technology Research Project Update, May 2021 This Spotlight represents the views of PCAOB staff and not necessarily those of the Board. It is not a rule, policy, or statement of the Board.
Spotlight: Data and Technology Research Project Update, May 2021
CONTENTS
Overview 3
PCAOB Staff Activities and Observations 3
General Observations on Technology-Based Tools and
PCAOB Standards 4
Service Centers 5
Automation 5
Auditor’s Responses to the Risks of Material Misstatement 5
Effect of Technology on Auditing Inventory 7
Use of Technology in the Confirmation Process 8
What’s Next? 9
May 2021 | 2Spotlight: Data and Technology Research Project Update, May 2021
OVERVIEW The information in this Spotlight is not
staff guidance; rather, it highlights timely
Advancements in technology continue to
and relevant observations for auditors
affect the nature, timing, and preparation of
and other key stakeholders.
financial information, including preparers’
controls around financial information, and The nature, timing, and extent of the
the planning and performance of audits. The use of technology-based tools in an
Board’s strategic plan highlights the need to audit is dependent on the particular
anticipate and respond to these advancements facts and circumstances of each
and their corresponding opportunities and engagement and may be governed by
risks. The PCAOB’s Office of the Chief Auditor policies and procedures established by
established a research project on data and the audit firm. Accordingly, the PCAOB
technology to assess whether there is a need staff observations below should not
for guidance, changes to PCAOB standards, or be viewed as an endorsement of or
other regulatory actions. recommendation for the use of any
specific technology-based tool in any
We are issuing this Spotlight to provide
particular audit.
transparency into our research project and
share insights from our research and outreach
activities during 2020. The observations
highlighted in this document build upon Confirmation Process; and AS 2510, Auditing
those previously shared in our May 2020 Inventories – in the context of the evolving use
Spotlight for PCAOB Stakeholders – Data and of technology-based tools.
Technology Research Project Update (“May
As highlighted in our May 2020 Spotlight, we
2020 Spotlight”).
assessed whether there is a need for guidance
on, or changes to, AS 1105, Audit Evidence. This
PCAOB STAFF assessment, in conjunction with our outreach
ACTIVITIES AND and research, suggested that guidance or
changes to the standard may be needed, given
OBSERVATIONS the increasing prevalence of technology-based
tools and the increasing availability and use
Throughout last year, PCAOB staff continued of information from sources external to the
to conduct research and outreach activities as company, both in financial reporting and as
part of assessing whether regulatory action audit evidence. We therefore added a project
is necessary in response to the increasing related to audit evidence to our research
use of technology by auditors and preparers. agenda in September 2020.
Our research focused on furthering our
understanding about how auditors are using As part of our ongoing research activities,
technology-based tools to respond to the we continued to gather information from
identified risks of material misstatement. Our PCAOB oversight activities, review changes
work included analyzing the requirements to audit firms’ policies and methodologies
of certain PCAOB standards – including AS related to the use of technology-based tools,
2301, The Auditor’s Responses to the Risks and consider relevant academic research.
of Material Misstatement; AS 2310 The We continued to engage with preparers and
May 2021 | 3Spotlight: Data and Technology Research Project Update, May 2021
key stakeholders on their experiences with audit quality and determine any implications
data and technology, and we have monitored for our standards.
the activities of other standard setters and
regulators. Our work has also been informed The nature, timing, and extent of the use of
by the PCAOB Data and Technology Task technology-based tools continue to differ
Force (“Task Force”), whose members provide among audit firms. Investment in and use of
valuable perspectives on the use of technology these tools are not, however, limited to only the
by auditors and preparers, as well as the larger audit firms. Some smaller audit firms
application of PCAOB standards in relation to are also making investments by developing
its use. tools internally, partnering with software
companies to design and develop customized
In connection with our 2020 outreach, we tools, or directly purchasing “off-the-shelf” tools.
inquired about the effect of the COVID-19 In addition, the auditor’s use of technology-
crisis on the use of technology by auditors and based tools is influenced by preparers’ use of
preparers. Overall, our observations suggest technology.
that the pandemic has not significantly
altered the nature, timing, and extent of Audit firms continue to make progress in
risk assessment procedures or the auditor’s developing their own technology-based tools
response to risks performed using technology- by designing tools for use in multiple audits
based tools. In some cases, auditors expanded and across multiple industries, as well as tools
the use of technology in areas such as that are tailored for specific circumstances.
facilitating supervision and review. Certain For example, some tools are designed to be
additional observations related to the effect used in the audits of companies in specific
of COVID-19 were highlighted in Spotlight: industries (e.g., healthcare), for a particular
Staff Observations and Reminders during the engagement, or to assist with the auditing
COVID-19 Pandemic. of specific transactions (e.g., analysis of
insurance company premiums and claims).
General Observations on Further, we have observed that some audit
firms are customizing tools for specific
Technology-Based Tools and accounting or finance systems or for auditing
PCAOB Standards certain components of a system (e.g., general
To date, the results of our activities continue to ledger, inventory management, investment
indicate that PCAOB auditing standards do not recordkeeping, or payroll).
preclude audit firms’ use of technology-based
Some audit firms believe that the use of
tools during an audit. We have heard, however,
technology-based tools, in certain instances,
and we continue to acknowledge, that our
provides more persuasive evidence than
current standards do not explicitly encourage
traditional audit techniques. For example, as
the use of such tools, indicate when their use
part of performing audit procedures to test the
may or may not be appropriate, or highlight
occurrence of revenue, some auditors use a
related risks or possible pitfalls associated with
technology-based tool that matches revenue
their use. PCAOB staff will continue to gather
transactions with subsequent cash receipts for
input on advancements in technology and
an entire population in lieu of traditional audit
changes in how auditors use technology. We
techniques (e.g., manual tests of details of a
will consider the effects of those changes on
sample of transactions).
May 2021 | 4Spotlight: Data and Technology Research Project Update, May 2021
Our outreach continues to reinforce our view lease agreements for payment terms, contracts
that even as the use of technology-based for unusual terms and conditions, and notes to
tools becomes increasingly common, PCAOB the financial statements for changes from prior
standards will need to continue to address periods).
traditional audit techniques (e.g., the use of
paper confirmations). This would, among other Auditor’s Responses to the Risks
things, facilitate audits where technology-based of Material Misstatement
tools are not used to perform audit procedures
or the use of such tools faces challenges (e.g., In 2020, we took a deeper dive into how
data extraction or system limitations, legal auditors are using technology-based
restrictions, or data privacy concerns). tools in responding to the risks of material
misstatement under AS 2301. That standard
Service Centers describes two types of audit responses: (i)
overall audit responses (i.e., those that have an
Some audit firms have established shared overall effect on how the audit is conducted
service centers or other specialist groups such as incorporating unpredictability in the
(collectively “centralized resources”) that selection of audit procedures to be performed)
are involved in the use of technology-based and (ii) responses involving the nature, timing,
tools on individual audits. Such centralized and extent of audit procedures that address
resources may, for example, extract, aggregate, risks of material misstatement for each relevant
analyze, format, and disseminate information assertion of each significant account and
to engagement teams in support of their disclosure.
audit procedures. While the approach to
involving centralized resources in the use of Our observations related to the use of
technology-based tools varies among audit technology-based tools in the auditor’s overall
firms (e.g., depending on the type of tools audit responses include the following:
used or availability of data), in most instances
yy Unpredictability. Technology-based
members of the engagement team test the
tools can aid auditors in incorporating
completeness and accuracy of company data
unpredictability in the nature and extent
used in the tools.
of audit procedures (e.g., aiding the auditor
Automation in identifying transactions outside of the
traditional selection criteria). The nature
Some audit firms are using technology-based and volume of information available to
tools (e.g., robotic process automation) to auditors when using technology-based
automate certain aspects of repetitive or less tools, including company data and data
complex audit procedures (e.g., reconciling from third-party sources, may allow auditors
account balances to the general ledger, to increase the level of unpredictability in
vouching sales transactions to subsequent cash their work. For example, tools may give an
receipts, or preparing confirmations to be sent auditor the increased ability to analyze, on a
to third parties). Certain audit firms are also disaggregated basis, complete populations
using optical character recognition software to of transactions in new or unexpected ways,
review certain company documents for specific thus thwarting attempts by management to
terms selected by the auditor (e.g., reviewing anticipate the auditor’s procedures.
May 2021 | 5Spotlight: Data and Technology Research Project Update, May 2021
yy Management Bias. In certain instances, improving the precision of an expectation
technology-based tools can aid auditors developed as part of a substantive
in analyzing data for indicators of analytical procedure or the precision of an
management bias. For example, such tools independent estimate developed to test an
may be used to identify instances in which accounting estimate).
management consistently selects prices
from the upper end of a range when valuing yy Testing Data. Technology-based tools
securities. have enabled some auditors to compare
current period and prior period data to
yy Revisions to Planned Audit Response. identify changes in specific attributes in
Technology-based tools may provide a data population that are not expected
auditors with new information that may to change (e.g., date of birth included in
suggest a need for revisions to their planned pension demographic data). Some auditors
audit response. For example, through the have used this approach to identify changes
use of a tool, an auditor may identify new or in a population compared to prior periods
different risks of material misstatement for a and focus their testing on the items that are
certain population of transactions, which in potentially more affected by the identified
turn may require the auditor to revise their risks of material misstatement in lieu of
planned audit response. traditional audit techniques (e.g., selecting a
random sample).
Our observations related to how technology-
based tools affect the nature, timing, and extent yy Testing Controls. While technology-
of audit procedures performed to address risks based tools, in their current form, are
of material misstatement include the following: not widely used to test all attributes of a
control, tools can provide evidence about
yy Refinement of Selection Criteria within an certain attributes of a control’s design (e.g.,
Audit Procedure. Some technology-based analyzing system configurations, such
tools enable auditors to perform multiple as user access rights, access restrictions,
iterations of a test. For example, in some and segregation of duties), and operating
instances, auditors ran several iterations of effectiveness (e.g., the occurrence of an
an audit procedure within a tool in order to electronic signoff or the completeness
detect items (e.g., specific transactions or and accuracy of a system-generated
journal entries) that may be affected by the report), particularly if a control attribute is
identified risks of material misstatement. automated.
With each iteration, the auditor would
refine the selection criteria based on the yy Substantive Procedures for Significant
information learned from previous tests. Accounts. Some auditors are using
technology-based tools to perform
yy Disaggregation of Data. In some instances, substantive audit procedures to audit
the use of technology-based tools may certain assertions for significant accounts
enable auditors to disaggregate data such as revenue, cash, trade accounts
to a level where the most plausible and receivable, investments, and inventory. For
predictable relationships are more readily example, some auditors are using tools as
identified, which in turn can improve part of testing the occurrence of revenue by
the precision of an audit procedure (e.g., comparing the quantity of items ordered to
May 2021 | 6Spotlight: Data and Technology Research Project Update, May 2021
the quantity of items shipped and invoiced and evaluate – new policies and procedures
for an entire population. and to implement new controls (e.g., new
information system access controls to ensure
yy Accounting Principles and Policies. Some that only appropriate personnel have the
audit firms have developed technology- ability to manipulate electronic data, new
based tools to assist in evaluating whether automated controls to interface the inventory
accounting principles and policies have management system with the general
been consistently applied to the relevant ledger).
populations of transactions (e.g., utilizing
tools to ensure consistent application of yy Design and Frequency of Inventory
revenue recognition across transactions). Counts. Automation and advanced inventory
management systems have resulted in some
yy Evaluating Disclosures. Some audit firms management and internal audit groups
have developed technology-based tools that reassessing the design and frequency of their
assist in evaluating the notes to the financial inventory counts based upon the enhanced
statements to identify incomplete or accuracy of perpetual inventory systems,
inaccurate disclosures (e.g., the use of tools which may affect frequency and timing of the
to compare the company’s disclosures to auditor’s inventory observations.
those in prior periods or to industry peers).
yy Performance and Documentation of
Effect of Technology on Auditing Observations. Some audit firms have
Inventory developed technology-based tools to assist
with performing and documenting inventory
Our outreach has shown that some preparers observations. For example, technology-based
have implemented or plan to implement tools can enable the auditor to make test
advanced inventory management systems to count selections, document the test counts
monitor and facilitate the movement, counting, within the tool, and generate the resulting
and recording of inventory. This increase in audit documentation.
the use of technology in the inventory process
is not limited to preparers, as auditors are yy Remote Observations. We understand that
increasingly using technology-based tools to some companies are using technology-based
assist in auditing inventory and in complying tools, such as location cameras and drones,
with the requirements of AS 2510. While the to conduct inventory counts remotely. Some
standards do not explicitly describe how the auditors are using similar technology-based
auditor may use technology when auditing tools to facilitate the remote performance
inventory, the existing requirements remain of their inventory observation. In particular,
relevant when technology is used. Our we observed these tools being used during
observations related to the effect of technology the COVID-19 pandemic to virtually observe
on auditing inventory include the following: inventory or physical assets. Where the tools
are operated by management, internal audit,
yy New Controls (Including Policies and or a vendor, the auditor performs certain
Procedures). At some companies, the procedures to determine that the tools
increased use of technology in their inventory produce reliable audit evidence. This may
process has required the companies to include assessing vendor qualifications (e.g.,
develop – and the auditor to understand licensing and experience).
May 2021 | 7Spotlight: Data and Technology Research Project Update, May 2021
yy Analytical Procedures. Some auditors are yy Design of the Confirmation Request.
using technology-based tools to perform Our outreach has shown that the use of
analytical procedures in connection with technology generally does not affect the
auditing certain assertions related to design of the auditor’s confirmation request
inventory (e.g., to analyze how inventory (i.e., positive or negative confirmations).
composition has changed over time when Many of the factors that may affect the
testing the valuation of inventory or to reliability of paper confirmations – such
select items for inventory observation when as the form of the confirmation request,
testing for existence based upon certain risk prior experience on the audit or similar
characteristics, such as new or higher value engagements, the nature of the information
inventory). being confirmed, and the intended
respondent – are also relevant to electronic
Use of Technology in the confirmations.
Confirmation Process yy Considerations Related to the Use of
Our outreach has shown that auditors are Confirmations. While we have observed
increasingly using technology-based tools in that in certain instances the use of
the confirmation process. In some instances, electronic confirmations can make it easier
the tools used by auditors have been developed for the recipient to respond efficiently, new
by their firm for their exclusive use. In other considerations have emerged related to
instances, the auditors use tools and services their use (e.g., confirmation email captured
provided by external parties. Our observations by spam filter, respondent deletes or
related to the use of technology by auditors in ignores the notification out of concern it
the performance of confirmation procedures is a phishing scam), which may affect the
include the following: confirmation response rate.
yy The Confirmation Process. Technology is yy Risks Related to the Confirmation Process.
generally used to help the auditor maintain Many of the risks that exist with the use
control over the confirmation process and of paper confirmations (e.g., false mailing
improve process efficiency, by facilitating address for the intended recipient, paper
certain administrative aspects of the response received from someone other than
confirmation process, such as preparing, the intended recipient) also exist with the
distributing, receiving, and tracking use of electronic confirmations, although
confirmations. The use of technology in a slightly different form (e.g., false e-mail
may assist the auditor in communicating address for the intended recipient, response
with management about the status of received from false e-mail account).
outstanding positive confirmation requests, Regardless of the form of the confirmation,
as well as in the identification of accounts auditors perform procedures to assess the
or transactions that may require additional reliability of the response (e.g., telephone
investigation or alternative procedures. call to the purported sender when received
electronically, internet search to verify the
validity of a business or other recipient).
May 2021 | 8Spotlight: Data and Technology Research Project Update, May 2021
WHAT’S NEXT?
We Want to Hear from You
In 2021, PCAOB staff will continue to
conduct research and engage in outreach These observations have been informed by our
activities, including with our Task Force, outreach efforts and input from our Task Force.
focusing on: We acknowledge, however, that others may have
different experiences with, and perspectives on,
yy Updating our understanding of the use of technology-based tools, particularly in
changes in the use of technology light of the challenges of the current COVID-19
in auditing and financial reporting, environment.
including how requirements in PCAOB
standards affect the use of technology We welcome the opportunity to hear from
by auditors; auditors about how they are using technology in
the audit and how the use of the tools is affected
yy Obtaining a more in-depth by the requirements in the PCAOB’s standards.
understanding of how auditors We also welcome hearing from preparers about
are using technology-based tools how technology is used in internal control
in responding to identified risks of over financial reporting and in the preparation
material misstatement, focusing on, of the financial statements, and from other
for example, substantive analytical stakeholders – including audit committee
procedures and audit sampling; members, investors, and academics – about
how technology may be used in auditing and
yy Understanding how auditors are using
financial reporting.
technology-based tools to identify,
assess, and respond to fraud risks If you are interested in sharing your experiences,
(e.g., risk of management override of please contact us at TechnologyOutreach@
controls); and pcaobus.org.
yy Collaborating with other regulators You can learn more about this project on the
and standard setters, as appropriate. PCAOB’s Data and Technology Research
Project page. You can also visit the PCAOB’s
We are also continuing to consider how
Research and Standard-Setting Projects page
PCAOB quality control standards should
to learn about other research and standard-
address the evolving and greater use of
setting projects. We encourage you to also sign
technology by audit firms.
up for project updates.
STAY CONNECTED TO PCAOB
Contact Us Subscribe PCAOB @PCAOB_News
May 2021 | 9You can also read
