Cindy Fornelli: Conducting an audit assessment

Cindy Fornelli is the executive director for the Center for Audit Quality (CAQ), the organization dedicated to enhancing investor confidence and public trust in the global capital markets by fostering high-quality performance on the part of public company auditors. Here she speaks with Matthew Scott about conducting an auditor assessment and other responsibilities of the audit committee.

1 What should audit committees be most focused on right now?

What we’ve seen is an increased focus on the role of the audit committee and how it goes about its primary responsibility of overseeing financial reporting and overseeing the external auditor. 

One big issue is a focus on the independence, objectivity and skepticism of the auditor because we’ve got this system that I call the issuer-pay model, where the company the auditor is auditing is the one paying it. You’ve got this independent audit committee inserted in there to mitigate that potential conflict of interest but if the audit committee is going to do its job right, it’s got to assess how independent, objective and skeptical that auditor is. And, of course, those three attributes are also closely linked to deterring and detecting fraud.

Take skepticism: you have to have that skeptical questioning mind-set when you go in to do the audit. So how does the audit committee foster that and check it is in place? I would also argue that the audit committee itself needs to have a certain level of skepticism as it goes around doing its work – again, being respectful but questioning and probing to really understand transactions or accounting methodology.

That’s an important role the audit committee needs to perform, so that might mean the audit committee has to enhance its training in this area, and maybe also obtain the tools to carry out an assessment of the auditor.

 2 You emphasize having an auditor assessment. What should be involved in that process?

We have collaborated with a number of audit committee organizations to create an auditor assessment tool that is available free of charge on our website. It is a document that audit committees can use because we think an audit committee should do a formal assessment of the auditor every year. Whether you are going to retain an auditor year on year or look for a new auditor each year, you have to have a way to assess it.

During the assessment you should focus on whether the auditor was objective: did it comply with all the independence rules, for example? How does it exercise skepticism? What is the tone at the top? What is the level of education and training of the employees?

Another issue to consider is how the audit committee communicates to investors its oversight of the auditor. Right now, the auditor’s report and the audit committee’s report are pretty bare-bones disclosures. So the PCAOB has a project it is working on – that we are very supportive of – to expand the auditor’s report, and I think  the next step will be looking at how audit committees communicate to investors and the public their assessment and oversight of the auditor. 

Then I think you’ll see the retention of the auditor being considered. Rotation of length of tenure of the audit firm with a company has been a big issue lately – just this past summer we saw the House of Representatives vote on a bill that would stop the PCAOB from instituting mandatory auditor firm rotation. At the CAQ, we are opposed to mandatory rotation because we think it’s costly, disruptive and – from a governance perspective – we think it’s really the audit committee’s responsibility to decide who the auditor should be. As a part of good governance, that’s the audit committee’s role. 

But the audit committee has to have a process in order to understand which is the best auditor for its company at this particular time, so we encourage audit committees to make sure they conduct an annual assessment and then disclose how they go about doing it. Giving audit committees ways to do that is very important: there should be an annual assessment where you can disclose how you have carried out that assessment.

 3 What type of skills do audit committee members need in order to be most effective?

I think it is important to note that the audit committee needs to comprise individuals who have experienced skill sets to effectively oversee the auditor. There is no requirement – other than disclosing whether you have a financial expert on the committee – that members of an audit committee have any specific background or education or designation. But I think it is important that, as audit committee members are appointed, you make sure you have the right mix of experience because, as companies become more global and as our economy becomes more complex, overseeing the financial reporting and the audit process becomes more global and complex, so you have to make sure you have the right skills on the audit committee. 

The skills the committee needs depends on the company, but audit committees of large multinational financial institutions should include some sort of former comptroller or former auditor. Does every person on the audit committee need to have that type of experience? No, but it would be nice to have one or two [with those skills].

Having experience with different types of companies would be good. If you are on the audit committee of a large multinational corporation, understanding other economies would also be good. Understanding evaluations and critical accounting estimates – these are all skill sets audit committee members should have, although a lot of it depends on the company. Committee members don’t need to have been auditors, but they should be comfortable in that space – otherwise how are they going to oversee the audit and financial reports?

All of us who care about corporate governance have a responsibility in defining what the best skill sets for audit committee members are and helping to point out what the leading best practices are so that audit committee members who aren’t as strong or experienced have a place to go to [for help].

 4 Are there any other issues audit committees should be concerned about, such as costs?

Everybody is concerned about the cost of the audit. But companies should start out by saying, Here’s what I need – how much is it going to cost?, rather than, Here’s how much money I have – what can I get for this?.

Audit committees also have to be realistic in determining what it will take to do an audit and the fees for completing that work. Audit fees have been trending down generally over the last eight or nine years; some of which reflects the learning curve after the initial adoption of Sarbanes Oxley in 2002, which introduced a slew of new regulations that created a new way of doing things. Companies should just be prepared to pay whatever the true cost is for the best possible audit. 

 5 What’s at stake if we don’t help audit committees improve their effectiveness?

Fundamentally, the biggest thing at stake is investor confidence. Investors have to have a sense that those charged with looking out for their interests – the board of directors, the audit committee and the independent external auditor – are doing so, and doing so in a robust way. 

Investors need to have confidence in the process so they feel that investing in the US economy is the best place for their money. If investors don’t think a particular company has a strong audit committee and strong board of directors, I think they are going to take their money elsewhere. They will vote with their feet.