Analyzing Information in Electronic Form: The SEC's Approval of the PCAOB's Amendments on Technology-Assisted Analysis, August 2024

On August 20, 2024, the Securities and Exchange Commission issued an order approving amendments to the auditing standards of the Public Company Accounting Oversight Board, the PCAOB. The Board had adopted them on June 12, 2024. They change parts of AS 1105, Audit Evidence, and AS 2301, on the auditor's responses to the risks of material misstatement, with conforming changes to AS 2501.

The order says what the amendments are for. They "are intended to more specifically address certain aspects of designing and performing audit procedures that involve analyzing information in electronic form with technology-based tools (i.e., technology-assisted analysis)." They "will be effective for audits of financial statements for fiscal years beginning on or after December 15, 2025."

Parts of the order follow, not the whole.

What the Amendments Change

The amendments, the order says, are "principles-based in how they further specify and clarify certain existing auditor responsibilities," and are "intended to be adaptable to the evolving nature of the use of technology in the audit." Among the changes it lists, they specify that an auditor who uses one procedure for more than one purpose "should achieve each objective of the procedure." And they "Specify auditor responsibilities for evaluating the reliability of external information provided by the company under audit."

Comment Letters

The Commission received six comment letters. Commenters generally supported the effort, the order says, and a number of them identified the requirements in a new paragraph of AS 1105 as "requiring further clarity or modification." In their view, the requirements "could be read as not allowing the auditor to apply a risk-based approach," and as requiring the auditor, "in all circumstances," to test each piece of external information obtained from the company to determine whether it was modified "before it was provided to the auditor," or to test controls over receiving, maintaining and, "if applicable," processing that information.

The Commission wrote that "we believe these concerns may be misplaced, particularly in light of the guidance provided by the Board in the Adopting Release." Its understanding of the amendments, read in the overall context of the PCAOB's standards, "is that they do not preclude a risk-based approach to testing external information." It went on, "Nevertheless, given the concerns raised by commenters, we encourage the PCAOB to provide further implementation guidance on this point."

The Commission also acknowledged commenters' concerns about the need for implementation guidance. It noted that the Board has a "historical practice" of performing a post-implementation review and of issuing appropriate implementation guidance for new standards and rule amendments "when needed," and it encouraged the Board "to do the same with respect to the Amendments."

Source Records and Controls

Commenters also raised concerns about auditors' ability to compare electronic information to source records, since many companies keep no paper originals. The Commission did not agree that this would stand in the way. "Source records are not defined in the PCAOB's auditing standards and may exist in many forms, including in electronic form."

Nor, in its view, would companies have to build new controls just to satisfy their auditors. The PCAOB had stated, the order says, "that the Amendments do not require testing of controls to establish reliability."

Why the Commission Approved Them

In its conclusion, the Commission says the amendments "address challenges with the rapidly evolving use of technology-based analytical tools that may not be sufficiently addressed under current professional audit standards." Addressing them, it says, "will advance the Board's investor protection mandate under SOX," the Sarbanes-Oxley Act of 2002, given three things. The use of such tools "is substantially increasing and is expected to continue to do so." The tools "have the potential to enhance the effectiveness of audit procedures," for example by "increasing the amount of data an auditor is able to analyze or otherwise validate" or by "allowing the auditor to focus their procedures on the transactions with the most risk." And "PCAOB research indicates that some auditors may be reluctant to implement new technologies due to perceived regulatory uncertainty," which the order says the amendments' clarity can address.

A footnote quotes the Board's adopting release, which says that an advisory group of the Board "has also noted" that auditors' use of technology-assisted analysis is an area of concern "due to auditors' potential overreliance on company-produced information," and that addressing it in the standards "could be beneficial."

More data seen is not the same as data that can be relied on.