backOn August 25, 2023, SEC Chief Accountant Paul Munter issued a statement on the importance of comprehensive risk assessments by auditors and management, expressing concern that “management and auditors appear too narrowly focused on information and risks that directly impact financial reporting, while disregarding broader, entity-level issues that may also impact financial reporting and internal controls.”
In the statement, Munter cautioned auditors to “remain alert to potential changes in issuers’ objectives, strategies, and business risks” and “the possible impact of an issuer’s public statements regarding changes in their strategy, board composition, or other governance matters—and whether such statements contradict management’s assessment of its control environment.” Munter also stated that auditors should consider the “consistency of information” disclosed in issuers’ filings and management’s judgments throughout the financial reporting process as compared with information issuers provide to the auditor during the audit.
Munter also commented on the evaluation of control deficiencies identified outside of an issuer’s financial reporting objective and emphasized that, “management and auditors should consider the root cause of [a] deficiency and whether it impacts the issuer’s [internal control over financial reporting] conclusions” and that even controls not directly related to financial reporting could impact management’s ICFR conclusions “due to their impact on the risk assessment and monitoring components of ICFR.” Munter further stated that auditors should consider the “magnitude of [the] potential misstatement” in assessing the severity of control deficiencies. Finally, Munter also reminded “auditors that they may use an ‘emphasis paragraph’ to highlight any matter relating to the financial statements and disclosures[.]”
Munter’s statement is here.