PCAOB cautions firms on use of outside service providers for audit confirmations

The Public Company Accounting Oversight Board issued a Spotlight publication Monday containing some observations and reminders for auditing firms about relying on outside service providers for electronic audit confirmations.

Many firms turn to third-party service providers to send and receive electronic audit confirmations to and from “confirming parties,” including banks, financial institutions, investment and brokerage firms, and law firms. The new publication includes some observations from PCAOB staff about how firms are leaning on such providers and suggests procedures for auditors to follow as they plan and perform audits. In some cases, auditing firms may be relying too heavily on such outside companies.

“We observed diverse practices related to the procedures auditors perform to support such reliance,” said the PCAOB. “In some cases, audit firms were not giving any consideration to support whether, as required by PCAOB standards, the auditor maintains control over the confirmation requests and responses in audits where a service provider is used to send and receive confirmations.”

The publication pointed out that the requirement to maintain control over the confirmation process is important to make sure confirmation responses are reliable.

“Audit firms that use a service provider to send and receive confirmations rely on the service provider’s assistance in maintaining control over the confirmation requests and responses,” said the document. “These service providers use their own processes and controls in communicating the auditor’s confirmation request to, and obtaining responses from, the confirming party. Therefore, it is necessary for auditors to determine that they can rely on the service provider’s processes and controls when establishing direct communication between the auditor and the confirming party.”