Just around the corner, in 2020, non-accelerated public filers will have their external auditors include “Critical Audit Matters” (or CAMs for short) in their audit reports. Here’s a brief overview of what a CAM is and how Executives along with Internal Audit can prepare for this new PCAOB requirement. At the end of this article there are links to PCAOB guidance as well as additional links to articles other firms have written.

Changes to the audit report

The definition of a CAM (per the PCAOB) is “… any matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee and that:(1) Relates to accounts or disclosures that are material to the financial statements; and (2) Involved especially challenging, subjective, or complex auditor judgment.”

At a high level, this could potentially include not only material weaknesses, but also Significant Deficiencies typically not included in public documents. There is also a lot left open to an auditor’s opinion. Which could result in businesses in the same industry having different levels of CAMs depending on not only which audit firm they use, but which Partner is responsible for the audit.

How to get ahead of the game

There are several steps the CFO and the Director/VP of Internal Audit can take to start preparing for this new requirement. First, go straight to your auditors. Ask them for their internal guidance, whitepapers, etc. Also ask them what items in the past could have been included as a CAM. This should open up some dialog and get you pointed in the right direction for avoiding potential CAMs in the future.

Next, Internal Audit and the CFO should identify which business processes could have CAMs be documented due to the complex nature of the process or subjective decisions used in calculations and reporting. Some areas could include taxes, derivatives and goodwill calculations. Management should also consider which areas have the most struggles getting through an audit. It’s not a large stretch of the imagination to see departments with past audit struggles to start showing up in CAMs.

Internal Audit should work with the Internal Control person (or whomever is responsible for updating SOX documentation) to identify any new controls or Non-Key controls which might need to be elevated to Key. An additional option is for Internal Audit to conduct specific audits to target these higher risk areas. Combining your discussion with the auditors with your internal discussions, these audits should give you a good snapshot of potential CAMs.

Another Option

Another option to consider is asking your auditors to complete a “dry run”. Most audit groups are wanting to conduct a “dry run” so your request should be met with open arms. This will give your auditors time to discuss details internally and your company time to address items before they are publicly disclosed.

External Links

For more information, I found these pages helpful. If you have any questions feel free to reach out any time via e-mail thomas@r-vmc.com

PCAOB Implementation of Critical Audit Matters: The Basics

PCAOB Implementation of Critical Audit Matters: A Deeper Dive on the Determination of CAMs

From Deloitte (In conjunction with Harvard Law School): Critical Audit Matters—What to Expect

Journal of Accountancy: What ‘dry runs’ reveal about critical audit matters