Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] AUD: Auditor Communications and Corporate Governance: The Auditor's Dialogue with Leadership
Transcript
- Marcus: Welcome to VoraPrep Audio's Office Hours. Today, we're talking about a crucial part of the audit: communication with a company's leadership. This isn't just about professional courtesy. It’s a fundamental part of the job, put in place after spectacular failures like Enron. Ava: Right. The Enron collapse wasn't just about fraud. It was a failure of communication. The people in charge, the board, were kept in the dark. So the rules we're discussing today are a direct result of that. They're designed to make sure that never happens again. Marcus: Exactly. This is about the auditor's role in corporate accountability. And to understand that, we first need to understand the structure they're communicating with: corporate governance. Ava: Let's start there. In simple terms, what is corporate governance? Marcus: Think of it as the company's operating system for accountability. It's the set of rules and processes that directs and controls the company. It makes sure the interests of everyone are balanced. That includes shareholders, management, and customers. For an auditor, strong governance is a great sign. Weak governance is a major red flag. Ava: The source material lays out a "chain of accountability." You have shareholders at the top. Then the Board of Directors they elect. And then management running the day-to-day. In that chain, who, specifically, is the auditor talking to? Marcus: We talk to a very specific group: the audit committee. This is a small subcommittee of the Board of Directors. They are our primary point of contact. They serve as the liaison between the auditor and the rest of the company's leadership. Ava: And for public companies, or 'issuers,' the Sarbanes-Oxley Act—SOX.—put the audit committee front and center. How did SOX change their role? Marcus: It completely transformed it. Before SOX, they might have been a more passive group. After SOX, the audit committee is, for all intents and purposes, the auditor’s client. The auditor reports directly to them, not to the CEO or CFO. Ava: So what does that look like in practice? What are the key SOX mandates for an issuer's audit committee? Let's start with who can be on it. Marcus: The first rule is independence. Every single member of the audit committee must be an independent member of the board. That means they can't be part of the management team. And they can't be taking consulting fees or other payments from the company. Ava: So you can't have the CFO sitting on the audit committee. What about expertise? Do they need to know accounting? Marcus: They do. The committee as a whole needs to be financially literate. And SOX requires at least one member to be a designated "financial expert." This is someone with deep experience, like a former CFO or public accountant. Ava: And this is a big one: who actually hires the auditor? Marcus: The audit committee does. They are directly responsible for the appointment, the compensation, and the oversight of the external auditor. This is a critical shift. It means the auditor is accountable to the oversight body. Not to the management team being audited. Ava: What about other services? Can management hire the audit firm for a big consulting project that might create a conflict of interest? Marcus: No, because the audit committee must pre-approve all services the auditor provides. That includes both audit and any permissible non-audit services. This is a key control. It prevents management from creating situations that could impair the auditor's independence. Ava: And there’s one more mandate, about handling complaints? Marcus: Yes. The committee has to establish procedures for handling complaints about accounting or auditing. This includes a whistleblower mechanism. It creates a direct channel for employees to report concerns to the oversight body. Ava: Okay, so we've established who we're talking to—this independent, expert audit committee. Now, what are we required to tell them? Marcus: Auditing standards, from both the PCAOB and the AICPA, lay out a list of required communications. We can think about them in three phases: at the start of the audit, during the audit, and at the end. Ava: Let's start at the beginning. Before the real work even gets going, what's the first conversation? Marcus: The first conversation is about setting expectations. We have to communicate our responsibilities under Generally Accepted Auditing Standards, or GAAS. We explain that an audit provides reasonable assurance, not absolute assurance. It's like a home inspector telling the buyer, "I'm going to find any major structural problems. But I can't promise to find a loose floorboard in every closet." Ava: So you're defining the limits of the audit. What else do you discuss upfront? Marcus: We also discuss the planned scope and timing. This isn't our detailed audit program, but a high-level overview. We tell them what we plan to cover and when we plan to do it. Most importantly, we discuss significant risks we've already identified. These will be major areas of focus for us. Ava: Okay, so the audit is underway. What kind of issues would trigger a communication to the audit committee mid-audit? Marcus: This is where the most critical conversations happen. The first bucket is what the standards call the "qualitative aspects of accounting practices." Ava: That sounds a bit academic. What does it mean in the real world? Marcus: It means we have to talk to them about management's judgment calls. Are their accounting policies appropriate? Are their estimates, like the allowance for bad debt, reasonable? We might even discuss if management's choices seem consistently aggressive or overly conservative. It’s a discussion about the story behind the numbers. Ava: What if management is just being difficult? Not giving you documents on time, or restricting your access to certain people. Marcus: That's another required communication. We have to report any significant difficulties we encountered during the audit. Unreasonable delays or scope limitations are major red flags that the committee needs to know about. Ava: And what about a direct disagreement? Let's say we believe a revenue number should be lower based on GAAP, and the CFO absolutely refuses to change it. Marcus: Any significant disagreement with management must be communicated to the audit committee. And this is key: it has to be communicated whether it was resolved or not. The fact that a serious debate happened is important information. It's something those in charge of oversight need to know. Ava: Okay, what about mistakes we find? Let's say we find a handful of misstatements that are not material on their own, and management decides not to fix them. Marcus: We have to provide the audit committee with a summary of all uncorrected misstatements, other than those that are clearly trivial. This gives them a clear picture of the small cracks in the financials. The ones management has chosen to live with. Ava: Now, what if we find a material misstatement, and management does agree to correct it. Do we still need to tell the committee about it? It’s fixed, after all. Marcus: Yes, absolutely. This is a point that often gets tested. You must communicate material misstatements that were corrected. The reason is simple. It points to a potential weakness in the company’s own financial reporting process. The committee needs to know this. Without the auditors, a material error would have been in their financials. Ava: That makes sense. So as we're wrapping up the audit, what are the final required communications? Marcus: There are two big ones. First, we must provide a formal written statement confirming our firm’s independence. Second is a heavily tested area. We must communicate any significant deficiencies or material weaknesses in internal control that we identified. Ava: Let’s break those internal control terms down. They sound similar. What makes a problem a "material weakness"? Marcus: A material weakness is the most severe. It's a deficiency, or a combination of them. The key phrase is "reasonable possibility." There's a reasonable possibility that a material misstatement in the financials won't be prevented or caught in time. Think of it like a bank discovering the main vault door simply doesn't lock. The potential for a material loss is clear. Ava: Okay, so how is that different from a "significant deficiency"? Marcus: A significant deficiency is less severe. But it's still important enough to bring to the attention of the audit committee. Let's use our bank analogy again. Maybe the vault door locks. But the procedure for handling the combination is weak. And several unauthorized people know it. It’s a serious issue that needs fixing, even if it’s not as critical as a broken lock. Ava: And for both of those—material weaknesses and significant deficiencies—how must they be communicated? Marcus: They must be communicated in writing, to both management and the audit committee. That written requirement is critical. And the timing depends on whether the company is an issuer or a nonissuer. Ava: Okay, what's the difference in timing? Marcus: For issuers, which are public companies, the communication must happen before the audit report is issued. For nonissuers, it's different. The deadline is no later than 60 days after the audit report release date. Ava: This is a lot of theory. Let's walk through the Zenith Manufacturing example from the lesson to make this tangible. I'm the audit manager. What's the first issue? Marcus: The first issue is a major disagreement. Management is using an aggressive revenue recognition method that you believe is a departure from GAAP. The CFO won't change it, and the misstatement is material. Ava: So what do I do? Marcus: You must communicate this disagreement directly to Zenith's audit committee. You explain the specific accounting policy. You explain why you believe it’s wrong, and what management's position is. And you state that a material misstatement remains uncorrected in the financials. This will obviously have a direct impact on your audit opinion. Ava: Okay, issue number two. My team found a control flaw: mid-level managers are approving large purchase orders without the required VP sign-off. We've concluded it's a significant deficiency. Marcus: For that, you need a formal, written communication. You'll send a letter to both management and the audit committee. The letter should describe the deficiency in the purchase order process. It should explain its potential consequences. And it must include definitions of what a significant deficiency and material weakness are. Ava: And the final issue. I'm reading the board minutes and discover Zenith is about to sell its largest subsidiary. It’s a huge event, but it's nowhere in the draft financial statement footnotes. Marcus: This falls under significant audit findings related to disclosures. You must discuss this with the audit committee immediately. You’d explain that the lack of disclosure about this material event could make the financial statements misleading. It’s a perfect example of questioning management's judgment. Specifically, the qualitative aspect of their financial reporting. Ava: This really clarifies the rules. Where do candidates most often get tripped up on this topic? Marcus: The most common pitfall is confusing the recipient of the communication. You might discuss an adjusting entry with the company's controller every day. But a fundamental disagreement over that entry is different. So is the discovery of a significant deficiency. Those must be formally reported to the audit committee. You can't just keep it at the management level. Ava: And what about distinguishing between a significant deficiency and a material weakness? Marcus: The key distinction is the potential magnitude of the misstatement. Ask yourself: is there a reasonable possibility this control failure could lead to a material misstatement? If the answer is yes, you have a material weakness. If it's serious but maybe not at that level, it’s a significant deficiency. Getting that classification right is crucial. Ava: This is a lot of detail to hold in your head for exam day. Is there a good way to organize these required communications? Marcus: There is. Instead of just memorizing a list, think about the communications in a few key categories. Ava: Okay, what are they? Marcus: First, think about setting the stage. This is where you discuss your responsibilities, the planned scope of the audit, and the company's significant accounting policies. Ava: Got it. The upfront conversation. What's next? Marcus: The next category is "problems and judgments." This includes any difficulties you faced, any disagreements you had with management, and your thoughts on their accounting estimates. It also covers any misstatements you found, whether they were corrected or not. Ava: So, all the tough stuff. What's the last category? Marcus: The final category is about overall conclusions. This is where you provide your written statement on independence. And, critically, where you report any significant deficiencies or material weaknesses in their internal controls. Framing it this way—stage-setting, problems, and conclusions—can make it easier to remember. Ava: That's a helpful way to frame it. So to wrap this all up, what are the core principles to remember? Marcus: First, governance sets the tone. A strong audit committee is the foundation of a good control environment. Second, especially for public companies, the audit committee is your client. You report directly to them. And finally, communication isn't optional. It's mandated, it's specific, and for the most critical issues, it must be in writing. Ava: Perfect. Thanks, Marcus. Marcus: VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. Get started at Vora Prep dot com.