Successfully navigating Critical Audit Matters (CAMs) and the complex new standard in Internal Controls over Financial Reporting (ICFR) can be tricky. Here’s what you need to know.
As of the December 15, 2020 fiscal year-end, public companies have been required to implement Critical Audit Matters (CAMs). The Public Company Accounting Oversight Board (PCAOB) — which has overseen the audits of public companies since it was established by the 2002 Sarbanes-Oxley Act — made it mandatory for auditors to communicate CAMs based on its standard, The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion, which replaced parts of AS 3101 (Reports on Audited Financial Statements). The new standard — approved in 2017 by the PCAOB and the Securities and Exchange Commission (SEC) — applied to the audits of large accelerated filers for fiscal years ending on or after June 30, 2019, and took effect on or after the fiscal year ending December 15, 2020 for the audits of all other companies that are subject to the requirements.
With auditors expected to take on a larger role — including increased reporting and disclosure responsibilities — now is a perfect time to revisit the requirements of the new standard and its implications for audit reporting. Below, we’ve outlined key things that auditors need to know to effectively support the implementation of the CAMs requirements.
What Is a Critical Audit Matter (CAM)?
A CAM is defined as any matter arising from the audit of the financial statements that was communicated or required to be communicated to the audit committee and that:
- Relates to accounts or disclosures that are material to the financial statements; and
- Involved especially challenging, subjective, or complex auditor judgment.
The new standard outlines significant revisions to the auditor’s reporting model, including a new requirement for auditors to include CAMs in the auditor’s report. The changes cover the communication of critical audit matters, the disclosure of auditor tenure, and other changes intended to improve the auditor’s report. The PCAOB also states that CAMs “are not a substitute for the auditor’s departure from an unqualified opinion (i.e., a qualified opinion, adverse opinion, or disclaimer of opinion on the financial statements as described in AS 3105).” The remaining portions of the original AS 3101 have been redesignated as AS 3105, Departures from Unqualified Opinions and Other Reporting Circumstances.
What Is the Purpose of the New Standard?
The goal behind these changes is to make the auditor’s report more relevant to investors and other users of financial statements. Since the 1940s, although business operations have become more complex and global and financial reporting frameworks have also evolved toward an increasing use of estimates, including fair value measurements, there have been few concurrent updates to the auditor’s reporting standards until now.
The Board believes that reducing the information asymmetry between investors and auditors should, in turn, reduce the information asymmetry between investors and management.
6 Factors Auditors Should Consider When Determining CAMs
Factors the auditor should consider when determining CAMs are:
- The auditor’s assessment of the risks of material misstatement, including significant risks.
- The degree of auditor judgment related to areas in the financial statements that involved the application of significant judgment or estimation by management, including estimates with significant measurement uncertainty.
- The nature and timing of significant unusual transactions and the extent of audit effort and judgment related to these transactions.
- The degree of auditor subjectivity in applying audit procedures to address the matter or in evaluating the results of those procedures.
- The nature and extent of audit effort required to address the matter, including the extent of specialized skill or knowledge needed or the nature of consultations outside the engagement team regarding the matter.
- The nature of audit evidence obtained regarding the matter.
What Are the Requirements for Communicating CAMs?
The four aspects of the CAM communication requirements can be thought of as the what, why, how, and where of CAMs. Requirements for the communication of CAMs include:
- Identify the critical audit matter.
- Describe the principal considerations that led the auditor to determine that the matter is a critical audit matter.
- Describe how the critical audit matter was addressed in the audit.
- Refer to the relevant financial statement accounts or disclosures that relate to the critical audit matter.
Auditors aren’t required to provide any company information if it is not already shared with the public by the company itself — unless the information is needed to describe the primary considerations that led the auditor to determine it was a CAM or to comment on how the matter was addressed. For more guidance from The PCAOB, refer to their CAMs staff guidance here.
What If There Are No CAMs?
If the auditor determines that there are no CAMs, the auditor must include a statement in the auditor’s report that no CAMs were found. The following language is required for communicating this:
Critical Audit Matters: Critical audit matters are matters arising from the current period audit of the financial statements that were communicated or required to be communicated to the audit committee and that: (1) relate to accounts or disclosures that are material to the financial statements and (2) involved our especially challenging, subjective, or complex judgments. We determined that there are no critical audit matters.
Four Lessons Learned Through CAMs Dry Runs
How has CAMs implementation gone to date? The road to CAMs implementation produced significant wins through public accounting firms like Deloitte developing tools, providing guidance and performing “dry runs” of the CAM requirements within large accelerated filers. These dry runs resulted in the following four valuable lessons:
- CAMs identification and communication allowed auditors to gain helpful experience, thus resulting in a smoother implementation process.
- Significant judgment was required to evaluate the circumstances of each audit, helping auditors better identify what may or may not be a CAM in each case.
- Communicating CAMs in an easy-to-understand and non-technical way to a broad readership can be challenging.
- Reaching a common understanding about applying the standard’s requirements, the implementation process, and the timing required to share draft CAMs with management, audit committees, and legal counsel, was an opportunity to set expectations about CAMs.
Best Practices for a Smoother Implementation of CAMs
In our SEC and PCAOB trends article, Rob Frattasio, a CPA who specializes in Sarbanes-Oxley compliance consulting at Protiviti, recommends that internal auditors should talk to their auditors to identify any items that will lead to CAMs — then, go back to ensure the controls that link to those CAMs are more robust, well documented, and your tests are holding management accountable in that area.
1. Assess CAMs in context of normal audits
When applying the requirement to determine matters that involve “especially challenging, subjective, or complex auditor judgment,” assess this in the context of normal audits, using the standard word “especially” instead of “most.” This more clearly conveys that there might be multiple CAMs and that matters are assessed on a relative basis within the specific audit.
2. Use sound judgement as an auditor
CAMs requirements determination is principles-based and should be applied in the context of the facts and circumstances. Differences in an auditor’s judgment and the nature, timing, and extent of the audit response in each specific circumstance influences the determination of CAMs.
3. Avoid boilerplate audits and CAMs
CAMs will vary from year to year and company to company as environmental factors and circumstances change. Some CAMs might crop up annually and may always require especially challenging, subjective, or complex auditor judgment. However, it should be assumed that they might be unique to that year’s audit only.
4. Clarify relationships between CAMs and a company’s critical accounting estimates
Auditors can identify matters as CAMs if they haven’t been identified as critical accounting estimates. While some critical accounting estimates or components within these estimates might be a focus of a CAM, not all critical accounting estimates necessarily will. SEC interpretation is key.
5. Pay close attention to significant events when identifying CAMs
Major events or changes related to regulatory measures, accounting standards, the economic or business environment, or government policies can have an impact on financial statements. Evaluate these events with care to determine if they are CAMs. The impact on the audit will largely depend on the nature and timing of the event or change and the extent of the audit response needed to address any affected accounts and/or disclosures.
6. Factor material weaknesses or significant deficiencies in ICFRs
According to the PCAOB, “When a control deficiency exists, the auditor needs to consider whether and how the auditor might need to adjust the original audit plan (i.e., audit response).” Any affected account balances and disclosures involved — especially those that are challenging, subjective, or involve complex auditor judgment — could identify one or more CAMs. The deficiency could very well be a consideration that led the auditor to determine it was a CAM.
The Future of CAMs
Of course, there is much more to successfully navigating the complex world of CAMs and there are many more considerations to take in account. What does the future hold for auditors, public companies, and CAMs? Following initial implementation of CAMs, the PCAOB plans to assess stakeholders’ experiences and results to determine whether to take further action. For questions and answers about CAMs, visit the Center for Audit Quality (CAQ). To learn more about SOX trends and to find out more about how your company will be impacted by CAMs in the near future, read our article “What’s on the SOX Radar: SEC and PCAOB.”
