PCAOB inspection findings on ITGC and ICFR audits

Ask for a count of IT general control deficiencies found in the current year, grouped by the four ITGC areas (access, program changes, program development and computer operations) and by the applications they affect. PCAOB Staff Audit Practice Alert No. 11 suggests audit committees discuss the level of ICFR auditing deficiencies found in internal and PCAOB inspections. A good response separates deficiencies the firm found itself from those raised by internal audit or prior inspections, and states which ones remain open. Request the deficiency log, the severity assessment for each item, and a list of the IT-dependent controls each deficiency touches. A short count with no link to specific controls or applications is a weak answer.

Ask whether the team tested the report writers, query tools and spreadsheets that produce the data behind financial reports, not only the core ledger. The alert describes firms that found ineffective ITGCs but did not test the systems used to produce spreadsheets, queries or reports, and firms that tested ITGCs without covering the customized queries their controls relied on. A good response names each report writer and key spreadsheet, explains how its ITGCs were tested, and shows how the logic of queries and parameters was checked. Request the population of key reports and the walkthrough documentation that traces each report from source system to output.

Ask what criteria the firm used to decide between rolling forward interim results and retesting near year end. The alert says inquiry alone is unlikely to be enough to roll forward testing when a control is complex, subjective or higher risk, when interim testing found exceptions, when the roll-forward period covers a significant part of the year, or when internal control has changed. A good response walks through each control's risk rating, lists any interim exceptions, and states the length of the roll-forward period. Request the roll-forward memo for the key ITGCs and confirm whether any control changed after interim testing.

Ask how much of the ITGC evidence came from internal audit and what the firm did to assess whether that work was reliable. The alert reports inspection findings where auditors used internal audit testing without a sufficient basis, including in higher-risk areas involving significant judgment. A good response explains the firm's assessment of internal audit's objectivity, competence and quality of documentation, and identifies which areas it retested itself. Request the reliance assessment and a list of internal audit workpapers the firm reviewed, along with any areas where it declined to rely on them.

Ask for the root cause of each significant ITGC finding and the remediation status, in addition to the findings themselves. The alert suggests audit committees discuss the deficiencies, their root causes and how the firm is addressing them. A good response distinguishes causes such as missing change approvals, unreviewed privileged access or gaps in service provider oversight from one-off errors, and ties each cause to a corrective action with an owner and a date. Request the root cause analysis and the remediation plan, and ask how management will test whether the fix works before year end.

Ask whether the firm's most recent PCAOB inspection report included ICFR or ITGC-related findings and how the firm has responded. Inspection reports on individual firms are public, and the alert reported that in 46 of 309 integrated audits covered by a 2010 inspection report (15 percent), the firm had not obtained sufficient evidence to support its ICFR opinion. A good response describes the inspection findings in plain terms, names the quality control changes the firm made, and explains how those changes affect your engagement team and testing approach. Request the relevant inspection report sections and the firm's written response to them.

Ask the auditor to confirm which applications, databases, infrastructure and data extraction tools sit behind each IT-dependent control and whether each has been covered by ITGC testing. The alert describes engagements that planned to test ITGCs for IT-dependent controls whose customized data or queries were not covered by the ITGCs tested. A good response maps each key control to its underlying systems and shows where ITGC coverage stops. Request the scoping matrix and ask management to confirm it matches the systems actually used in the close process.

No, the findings apply to the audits that were inspected, but the expectations they describe apply to any company whose auditor tests ICFR under PCAOB standards. Companies subject to the Section 404(b) auditor attestation are the ones whose auditors must follow AS 2201 and AS 2110. The inspection report cited that 46 of 309 integrated audits (15 percent) covered by a 2010 inspection report lacked sufficient evidence for the ICFR opinion, so the gaps are a pattern auditors now plan around. Whether your filer status requires attestation is a separate question, which you should confirm with your counsel and auditor. The practical effect is that auditors who want to avoid those gaps will ask for more ITGC and report evidence from every company they audit, including those with simpler systems.

Auditors expect evidence that the ITGCs supporting each IT-dependent control work across the period, and that the data and reports feeding those controls are complete and accurate. Inspection findings describe firms that tested ITGCs for applications generating data but did not test the logic of queries or parameters used to extract report data. Expect requests for the following:

• Access and change records for the applications, databases and report writers that produce the data
• Evidence that customized queries, spreadsheets and parameters were covered by testing
• Records of how known ITGC deficiencies were evaluated and addressed
• Documentation of the root cause analysis and remediation plans for past issues

Confirm the exact list with your auditor early, because the scope depends on which reports and systems your controls rely on.

Yes, many companies assemble ITGC evidence with their own staff, provided they understand which systems, reports and queries the auditor will test. Management owns the controls and the evidence, so internal teams can extract logs, change tickets, access reviews and report logic themselves. The work becomes harder when the environment includes customized queries, legacy report writers or several cloud providers, because someone must document how each report is produced and prove the logic is unchanged. External help can prepare systems and evidence packages, but it cannot issue the audit opinion, and it does not replace management's assessment. Ask your auditor which artifacts they will accept before deciding the scope of internal versus external work.

No reliable duration can be given in general, because it depends on the number of in-scope systems, the age of the evidence, the quality of existing documentation and how many reports rely on customized logic. Preparation is usually easier when the company already keeps access reviews, change approvals and report documentation as routine work. Work that starts late in the year, or that requires reconstructing evidence for systems changed mid-period, takes longer. Ask your auditor for their expected evidence list and timing well before fiscal year end, and ask any implementation partner for a written schedule tied to a defined scope before work starts.

Internal audit testing can reduce external work only when the auditor has a sufficient basis to rely on it. Inspection findings cite auditors who used internal audit results without that basis, including in higher-risk areas involving significant judgment. Reliance depends on the internal audit team's competence and objectivity, the quality of its documentation and whether its testing covers the same controls and period. Complex, subjective or higher-risk controls, and controls where interim testing found exceptions, are less likely to support reduced testing. Agree the reliance approach with your auditor in advance so internal audit's workpapers match the level of evidence the auditor needs.

An implementation partner can help plan the scope, configure and harden the systems in your own environment, document controls, and prepare evidence packages for the auditor to examine. DeployOpen works this way for self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, and most engagements are fixed-scope with deliverables agreed in writing. A partner cannot issue an audit report, attestation or opinion, and it cannot certify that controls are effective. Management retains ownership of its controls and its ICFR assessment, and the independent auditor alone issues the opinion. Ask any partner to state in writing which deliverables it produces and which decisions remain with management and the auditor.

Audit committees can ask the auditor for the level of ICFR auditing deficiencies found in internal and PCAOB inspections, their root causes, and how the firm is addressing them. Staff Audit Practice Alert No. 11, published October 24, 2013, suggests this discussion as part of oversight. Useful follow-up questions include which ITGCs the auditor will test for each IT-dependent control, whether the auditor will test report writers and queries, how interim testing will be rolled forward, and whether internal audit work will be relied upon. You can also ask how the auditor's firm has addressed the gaps the alert describes. The answers help the committee judge whether the audit plan will produce sufficient evidence before year end.