By Marc Feinstein, CPA, Technical Reviewer, PICPA Professional and Technical Standards

Over the past few years there have been several hot spots of noncompliance that have drawn the attention of the AICPA peer review board. When focusing on an area, the board has issued specific guidance through alerts that provides peer reviewers with information needed to address the specific issues that the board has deemed to be areas of frequent noncompliance.

From 2018 to 2021, the board’s focus was on risk assessment documentation, which entailed ensuring auditors sufficiently document risk assessment in accordance with AU-C 315 and AU-C 330. Some common areas of noncompliance identified were as follows:  

• Failure to document an understanding of the client and its internal control.  
• Identification of significant risks.  
• Documenting risk assessment at both the financial statement and assertion level.  
• Assessing control risk below the maximum without testing the operating effectiveness of internal controls.  
• Properly linking the risk assessment to procedures performed.

During this three-year time frame, the board indicated that noncompliance with the risk assessment standards would result in a nonconforming engagement. However, if no other audit documentation issues were identified, then the matter would be limited to a “finding” and a pass report would still be issued. Complicating the matter, though, another standard became effective for some firms prior to the end of the three-year period, drawing significant attention.

In November 2020, the board released a peer review alert with a focus on the implementation of the new revenue recognition standard, Accounting Standards Update No. 2014-09, Revenue from Contracts with Customers (ASC 606). If the standard was not implemented when applicable and there was no evidence of its consideration, the end result was a nonconforming engagement. This, coupled with the noncompliance with risk assessment standards, resulted in quite a few firms receiving nonpass reports.

Fast forward to reviews commencing after Oct. 1, 2021: the limitation of a finding for risk assessment noncompliance was removed, and material noncompliance with the risk assessment standards alone – which was found to be pervasive throughout the practice – would most likely result in a nonpass report. Firms quickly realized that risk assessment was not the only problem facing them: a whole new set of standards was right around the corner. That’s right, Statements on Auditing Standards (SAS) 134-140, which made changes to the auditor’s report, and Statements on Standards for Accounting and Review Services (SSARS) 25, which required an additional statement in the accountant’s report and the requirement to document materiality. (Both of these became effective for periods ending on or after Dec. 15, 2021.)  

In October 2021, the board issued another peer review alert focusing on the new SAS and SSARS standards. Essentially, partial implementation would not result in a nonconforming engagement, but complete failure to implement would be deemed nonconforming.

Firms should be aware of ASC 842, which became effective for private companies as of Jan. 1, 2022, and the upcoming quality management standards that are expected to be effective in 2025. Based on the effective date of ASC 842, clients with a Dec. 31, 2022, year-end would be subject to the standard. Since peer reviews with year-ends beginning in 2023 will include these 2022 engagements, we will start to see findings come in that some firms are not implementing this new standard, which will result in nonconforming engagements.  

Based on the significant changes in standards over the past few years – and those still to come – the peer review community has seen a large increase in nonconformity with professional standards. Firms must find ways to ensure that they are on top of all of these changes. Continuing education update courses are an excellent resource for keeping current. In addition, ensuring that a firm’s quality control materials are up-to-date will assist in addressing all the changes.

If you have any questions, don’t hesitate to contact me at mfeinstein@picpa.org or the PICPA per review technical team at (267) 675-6250.

Sign up for PICPA's weekly professional and technical updates by completing this form.