What do you know about PCAOB? If you are publicly held, probably a lot. True confession time - I am only recently learning about the important impacts this group has on our profession. The first step is recognizing you have a problem; sometimes you can't even teach an old dog old tricks; insert your favorite aphorism or snide remark here.
(Quick – well maybe not so quick – aside: Every internal auditor has a duty to understand what the regulators are saying. When I worked for Farmers Insurance, we didn't just count on our compliance department to keep track of the changes occurring in the fifty separate Departments of Insurance. We had our own approaches to keep abreast of those regulations we felt would impact our operations and our understanding of the risks the organization might be facing. Don't worry; we counted on the compliance department for a lot. It is a good team and we couldn't beat their expertise, insights, and sources. But we also knew we had a personal responsibility to understand what was going on. End of aside)
Now, many of you probably sniggered when I admitted to my lack of knowledge. But I return to my original question: What do you know about the PCAOB? Let me change that question around a little. How much of your understanding of the PCAOB comes from what others tell you? And then let me reemphasize – how much do you really know?
Do you know how they impact the work you do? Do you know how they impact the work of external auditors? Do you know how your external audit firm is perceived by the PCAOB? Does your board understand how the PCAOB impacts internal audit, external audit, and the board itself? What changes being promulgated by the PCAOB will change the way everyone works? What kind of findings has the PCAOB recently had and how should it impact your work? How is your external auditor reacting to changes with PCAOB? Is PCAOB the final say? And, as I have already alluded to, how much do you know and how much have you just been told?
A one-hour presentation from Jeanette Franzel, Board member of PCAOB, and all these questions come to mind. And what also came to mind was just how little I know.
For me, I'm going to spend the next few weeks digging deep into their web site – standards, pronouncement, findings, censures, decrees, writ come down from on high – all to get a better understanding of how they impact what we do. And, ultimately, to better arm myself when people say "Well, the PCAOB says..." You see, in my experience, the minute someone says they heard that someone told them they have to do something is the minute I want to get to the source.
You want an example? How often have you heard "I do this because the auditors said I have to." Well, the phrase I have heard lately is "We do that because the PCAOB says we have to." And I'm willing to bet it has as much credence as the comment about internal audit.
Part of our job as auditors is to get to those sources. And PCAOB may be one of those examples where we are making the mistake of accepting the synopsis of experts in determining what we should be doing.
The PCAOB has important things to say about the way controls work, the way people evaluate those controls, and, because of that, the way internal audit does part of its job. So it behooves every auditor to dig in and find out what is really going on. It is not that the experts don't know. But it never hurts to become your own expert.