HR 6021 / S 3004 SBACA of 2018: Answers to Hill Staff Questions (PCAOB/Audit-Specific)
I would like to take this opportunity to address questions I have received from Congressional staff with specific working examples from accountants on our Task Force, along with general information regarding the PCAOB and small, non-public, non-custodial broker dealer businesses.
• What are the questions/information asked on the PCAOB audit that are not included in the AICPA Reports?
Although some broker-dealer audits have been conducted under PCAOB standards since 2009, all broker-dealer audits were not required to be conducted under those standards until 2014 and thereafter. When this requirement became universal for all broker-dealer audits, the wording on the auditor’s report was changed to reflect the fact that the audits were conducted under PCAOB standards. However, the content of the audited financial statements and the related reports that the regulators and investing community receive are very similar for audits conducted under AICPA auditing standards and PCAOB auditing standards. It is the process by which these reports are produced that is the differentiator.
There are three primary reasons why the time that auditors of small non-clearing, non-custodial broker- dealers (hereafter referred to as “non-carrying BDs”) has so significantly increased due to the necessity of using PCAOB auditing procedures in lieu of AICPA auditing procedures:
1) The staff of the PCAOB consists almost exclusively of accountants formerly from large accounting firms. They have carried over with them from their prior employers their belief that the audit procedures which they had previously applied to large publicly held firms should be applied to all firms undergoing audits. Therefore, in addition to the audit procedures that auditors of non-carrying BDs have always performed, they must now apply those mandated by the PCAOB, which while largely superfluous to this class of firms significantly increases the amount of time needed to complete the audit in compliance with PCAOB requirements.
2) Non-carrying BDs are, for the most part, “introducing” BDs that contract with a clearing firm to handle the execution and settlement of orders that the introducing firm receives from its clients or trading desk. This means that auditors of these entities have available to them a significant amount of externally prepared documents that may be reasonably used by an auditor to provide ample assurance as to accuracy of the revenues of those BDs. However, because PCAOB staff are wedded to a “test of transactions”, an extremely time-consuming and duplicative test, they must now add a substantial amount of time ($$$) to their audits.
The PCAOB standards require the auditor to select a sample size that can approach 80+% of the account balance and test much more of the details of the commission received, and in some cases, test the internal controls at the clearing broker. These commission payers are large, highly regulated companies, such as Fidelity Investments and American Mutual Funds. Additional procedures with respect to testing the clearing broker, mutual fund sponsor, or insurance company’s detail with respect to the non-carrying BD commission income are procedures that have no bearing on the safety of customer funds because those funds are never held with the non-custodial broker dealer or the accuracy of the commission statements from Fidelity or American Funds. The additional testing is burdensome and costly, without a commensurate benefit to “investors”, of which there typically are none (as defined by the PCAOB).
3) Due to the disasters experienced by large accounting firms in the last two decades, the PCAOB staff has not sought to arrive at an audit test that may more adequately test revenues; they have only increased the amount of transaction testing, further burdening auditors of non-carrying BDs with more unnecessary work. In addition, these catastrophes have also increased the amount of documentation and, therefore, the amount of time that is required to assess risk. This assessment of risk, while appropriate for a public company or a custodial firm, is a misplaced exercise with non-public, small, non-custodial businesses because we do not carry customer funds or securities.
• How do the additional PCAOB questions not enhance consumer protection?
It is important to understand the role of the PCAOB audits. The PCAOB does not provide consumer protection (or customer protection, which is what most people are really referring to when this comes up). The purpose of the PCAOB, as taken directly from their website, is Investor Protection NOT Customer Protection. It is the SEC and FINRA which are responsible for customer protection and the SEC protects customers primarily with the Financial Responsibility Rules, specifically 15c3-1 and 15c3-3.
The term “investor”, as it relates to the PCAOB, refers to individuals who invest in public company stock. An investor in a public company is not the same as a customer of a privately-held, non-custodial broker-dealer, but the two are regularly misstated as being one in the same and in need of PCAOB coverage, which is inaccurate. Most FINRA and SEC actions against broker dealers for fraud are in the areas of their business practices within their financial planning/custodial/stewardship roles. Those practices are monitored by the regulators and are not in the scope of the financial statement audit.
• The PCAOB’s annual report on the Interim program shows an 80%+ deficiency rate – What’s up with that?
The 80% deficiency rates cited by the PCAOB concerns the AUDITORS and AUDITING FIRMS performance in the execution of their duties as PCAOB-registered auditors, and is NOT a deficiency rate on broker-dealers. This is an important distinction.
According to the Fact Sheet: Annual Report on the 2016 Inspections of Broker-Dealer Auditors, dated August 17, 2017, and available on the PCAOB website, portions of 115 audits conducted by 75 firms were inspected. It was noted that deficiencies were observed in 73 of 75 audits. However, when we review the “All Open Cases” link on the Securities Investors Protection Corporation and the Brokercheck link on the FINRA website conducted on May 31, 2018, there were only four open cases where broker-dealers were in liquidation proceedings. One was the Madoff entities, then Westor Capital Group was operating in a net capital deficiency, and two more were insolvent because of fines, assessments, and legal awards that resulted because of improper sales/business practices. Audit deficiencies, therefore, do not appear to either indicate or correlate with firm failures or SIPC claims.
Further, the required monthly and quarterly SEC and FINRA regulatory financial reports set (FOCUS II, Form Custody, Supplemental Statement of Income, Off Balance Sheet report, and more) detects in near real time any deviation from the Customer Protection Rules, including and specifically net capital sufficiency.
FEEDBACK FROM AUDITORS IN OUR WORKING GROUP:
1. Practitioners believe the PCAOB inspectors are inventive in finding deficiencies. In addition, deficiencies of lesser and lesser importance are being identified by PCAOB inspectors. For example:
A) Clearing brokers are audited on their internal controls over the processing and custody of customer funds. The report that is issued and made available to the customers of the clearing broker is called an “SOC” or SSAE 16 report. During the financial statement audit of the non-custodial broker, one of the procedures is for the auditor to read the SOC report of the clearing broker to determine whether the introducing broker is properly relying on the internal controls of the clearing broker. In a recent PCAOB inspection, a deficiency was identified because the inspectors felt that the auditor should have tested the controls of the clearing broker, and that evaluating the information included in the SOC report was insufficient. The manager of this audit expressed to me that this would not have been an issue on an inspection of a publicly traded company; reliance on the audit conducted on the clearing broker’s internal controls and the resultant SOC report would have been reasonable and acceptable for a public company, but somehow was insufficient for a privately held, non-custodial broker dealer.
B) Audit firms are required to undergo a peer review, whereby their work is inspected and evaluated by external expert peer reviewers, in addition to the PCAOB inspection requirement. The audit firm of Bleaker and Bleaker was peer reviewed on one of its broker-dealer audits, Shifting Sands Mutual. There were no deficiencies noted. That same year, the Shifting Sands audit was sent to another audit firm with substantial PCAOB experience to conduct a post issuance inspection (voluntary, as part of the Firm’s monitoring process). The inspecting firm issued a 6-page report on items that the PCAOB could note as deficiencies in a PCAOB inspection. Not one of the potential deficiencies involved security of customer funds or material items related to net capital or the firm’s solvency.
C) In another PCAOB inspection, the inspectors spent several hours claiming that a test of journal entries was deficient because the auditor failed to test a journal entry that was made by the broker-dealer on a Saturday, claiming that it was not within working hours. It was noted that in all the entries tested during the audit, there were no errors, and the financial statement balances affected by all of the journal entries were properly supported by adequate documentation.
D) Small company audits under Generally Accepted Auditing Standards (AICPA standards previously used) emphasized the testing of the balance sheets at the beginning and end of the accounting period. PCAOB standards place a much heavier emphasis on transactional testing of the income statement for the period than GAAS. These are smaller companies that hold no customer assets, which is a very important point, and the auditor can review the entire set of books at a level sufficient to identify potential errors, and conduct tests of the balance sheet, within a reasonable period of time when permitted to under GAAS.
E) An auditor is required to obtain management representations prior to concluding an audit. Those representations are obtained in the form of a letter from management to the auditor. During a recent inspection, an inspector was quick to argue the management representation letter was deficient. Upon hearing the template for the letter came from a respected source, the inspector quickly backed down, with no further discussion. One would wonder whether the inspector actually knew what should be contained in the management representation letter, however was fully prepared to cite a deficiency.
F) A small broker dealer that collected approximately $160,000 in renewal commissions resulting from annuities and mutual fund customers during the year (no new business) was inspected. The inspection team consisted of 6 inspectors from 3 PCAOB offices and was conducted over a period of 2 weeks. This is not atypical and appears more than a bit excessive.
2) The PCAOB should be doing more to help decrease the rate of deficiencies. For example, FINRA audits broker-dealers on a cycle, sweep, branch, and cause basis. In those reports, FINRA notes deficiencies, but also notes recommendations and specific corrective measures for the broker-dealer to consider. The PCAOB does no such thing, this body finds deficiencies, but does not offer specific corrective measures beyond referring the auditor back to the relevant standards, which are often less informative to the practitioner than Generally Accepted Auditing Standards practitioners previously relied on.
3) At the end of the inspection process, an auditor is required to respond to the deficiencies the inspectors have noted. In many, if not all, inspections, no feedback is given to the auditor as to the adequacy of the corrective measures. This seems to be an adversarial, not constructive or collaborative process and is, without question, a contributing factor to the rise in deficiency rates. (Another reason, beside the fact that the standards are inappropriate to the model, why the deficiency rates are not and will not decrease.)
4) Presenters at PCAOB Broker-Dealer Forums continually present examples of newly identified deficiencies that may not have been of concern in previous forums. For example, in a webinar presented in 2017 the PCAOB director indicated that a sole owner broker dealer had, by default, a material weakness in internal control because it was not possible to have a segregation of duties within the broker dealer. Current rules require an identification of a material weakness to be reported to the SEC within a 24 hour period, which means that for no other reason than being a sole proprietor these firms will be reported to the SEC.
*As of June 2018, there are 122 sole owner non-carrying BDs, which means that 122 non-carrying sole proprietor firms will be reported to the SEC within a 24-hour period for nothing more than being a sole-owner business; that is not right, fair, or reasonable. Moreover, this is a prime example of the PCAOB not keeping up to date with SEC Rules. Small non-carrying BDs are no longer required to have internal control.
Moreover, how does a segregation of duties within a one-person broker-dealer as it relates to the owner handling their own funds 1) pose a risk to an investor, or 2) benefit anyone anywhere, including customers or investors? And, perhaps more importantly, why is this bias against small businesses being allowed to proliferate at the PCAOB?
5) The PCAOB selectively screens audits for inspection, so does the audit deficiency rate relate to their ability to screen for and hand pick troublesome audits?
6) The majority of the audit deficiencies cited in the PCAOB annual reports are “foot faults” – technical, but not material items. The PCAOB uses the term audit deficiency when, for instance in their judgment, the auditor failed to obtain sufficient appropriate evidence to support its opinion on the financial statements (didn’t test enough items; they tested 500 and the PCAOB inspector says they should have tested 550), irrespective of fairness. The majority of PCAOB audit deficiencies are immaterial to the ultimate audit opinions being issued; they are “foot faults” that even when rectified would not result in a change to the audit opinion.
There are valid reasons to question PCAOB criticism of an auditor’s evidential basis. One reason is that PCAOB inspections usually occur after fieldwork, so hindsight bias can (and clearly does) surface. Inspectors form retrospective judgments about auditors’ judgments regarding the reasonableness of management’s judgments and a considerable source of “deficiency” outcomes. Still another reason for caution is that, even when working on the same problem at the same time, professionals in accounting and elsewhere regularly reach different conclusions after careful, good faith judgment processes. If we give tax-return case materials to 10 highly experienced tax professionals, we can obtain 10 different conclusions of tax due. Similarly, before we undergo major surgery recommended by a trusted family physician, we still customarily seek another physician’s point of view because we know second opinions have value.
Thank you so much for your time and consideration of this very important matter to small businesses in the brokerage and accounting industries. Please feel free to contact me with any questions or concerns – I’m here.
Paige W. Pierce
Larimer Capital Corporation
Paige Pierce Consulting