PCAOB risk-based inspection consequences evaluated using new model

LAWRENCE — “If it ain’t broke, don’t fix it” remains a sound piece of advice.

But according to new research, that advice may not have been considered by the Public Company Accounting Oversight Board (PCAOB), a nonprofit corporation created by the Sarbanes–Oxley Act of 2002 to oversee the audits of public companies in order to promote investor protection.

“The PCAOB made an announcement in 2020 that they were changing the way they chose audits for inspection. Historically, it had been highly risk-based. But then they decided to include more random selections,” said Mike Wilkins, the Larry D. Horner and KPMG Professor of Accounting at the University of Kansas.

“We questioned why they were radically changing this thing without really knowing if there are upsides or downsides to doing that,” he said. “Is there evidence to suggest what they were doing before was good or bad?” 

In response, Wilkins has written a new paper titled “Costs and Benefits of a Risk-Based PCAOB Inspection Regime.” It investigates how auditors respond to engagement-level inspection risk. The findings suggest there are more benefits than costs associated with auditors’ responses to a selection approach that is primarily risk-based. The paper appears in Accounting, Organizations and Society.

“The PCAOB is very secretive about how they decide which audits to focus on. But typically engagements are more likely to get chosen if they’re higher risk or if they have more issues that are harder to audit, which often is having to do with things like inventory and intangibles,” said Wilkins, who co-wrote the article with Brant Christensen of Brigham Young University and Nathan Newton of Florida State University.

In order to determine how auditors responded to the risk-based selection method, Wilkins’ team scrutinized more than 20,000 company-year observations from 2010 to 2019. They had previously developed a model that identified the characteristics for why the PCAOB might choose a particular engagement for inspection. They then applied that model to each of the auditors and companies to predict what the inspection risk was for each engagement.

“Then we asked, ‘If certain engagements have high inspection risk within the office, what does it look like? Is there any sort of indication auditors are paying attention to that?” he said.

On the positive side, they revealed that auditors are more likely to issue audit opinions informing investors about material weaknesses in the client’s internal control environment.

“The PCAOB is always saying that there aren’t enough material weaknesses being identified. We find that when inspection risk is relatively high, auditors are more likely to judge controls more conservatively, including a lower likelihood that they will judge existing weaknesses as having been remediated. We also find these high-inspection-risk clients are less likely to have restatements in the future, which is what the PCAOB is aiming to achieve, essentially. So, all of those things are quite positive,” Wilkins said.

What Wilkins found especially interesting was when looking at small audit offices that have fewer degrees of freedom in terms of staffing, when auditors spend more time on high-risk clients there’s actually lower audit quality for the ones with lower inspection risk.

“For those offices particularly, it appears they have to make a tradeoff,” he said.

Up until 2019, only about 20% of the audits that the PCAOB was choosing to inspect were chosen at random. In other words, about 80% were risk-based. In 2021 and 2022, that percentage doubled. Now nearly 40% are selected at random.

Wilkins, who has been at KU since 2017, hopes the PCAOB will take note of how this comprehensive new research regards random selection.

He said, “Our explanation is that when audit firms think that inspection risk on a given client is higher, they spend more time on these audits and, as a result, they have higher audit quality — which is what the PCAOB is supposed to be all about.”