PCAOB Reaches Rule-Making Milestone Under Erica Williams' Administration

The Public Company Accounting Oversight Board (PCAOB) has seen its first standard-setting project with Erica Williams at the helm through from start to finish, as the regulator last month approved an updated auditing standard on confirmations.

Williams, who took over as PCAOB chair in January 2022, has made it a goal for the board to update existing auditing standards that had not changed since before the PCAOB was established by the Sarbanes-Oxley Act in 2002. Last December, the PCAOB issued a proposal on revising its confirmation standard, AS 2310, The Confirmation Process—the process that involves the auditor verifying information about one or more financial statement assertions with a third party.

The confirmation process touches nearly every audit and provides a critical tool for detecting fraud, Williams said during the board’s meeting on Sept. 28, but the auditing rules on that process had not been substantively updated since the standard was adopted by the PCAOB in 2003. In fact, she said, the confirmation standard had not been substantively updated since it was originally written and put in place by the AICPA in 1991.

“In many ways, revising the confirmation standard is indicative of the broader task ahead of us as we work to modernize our standards to make sure they are effective at protecting investors in today’s world. So, it is fitting that this is the first standard-setting project where this board issued a proposal and followed up with a new standard,” Williams said.

“The standard-setting projects on our agenda address more than half of our standards in one way or another. Most of these standards being considered, like confirmation, are so-called ‘interim standards,’ which the PCAOB first adopted in 2003 based on standards set by the profession on what was intended to be on temporary basis. Yet, they have not been significantly updated in at least 20 years,” she continued. “Our capital markets don’t stand still. They evolve constantly. Practices change. Technology advances relentlessly. And new risks emerge. To keep investors protected, our standards must keep up.”

The new confirmation standard establishes principles-based requirements that apply to all methods of confirmation, including electronic and paper-based communications. In addition, the new standard better integrates with the PCAOB’s risk assessment standards. Among its key provisions, the new standard:

Includes a new requirement regarding confirming cash and cash equivalents held by third parties or otherwise obtaining relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source;
Carries forward the existing requirement regarding confirming accounts receivable, while addressing situations where it is not feasible for the auditor to perform confirmation procedures or otherwise obtain relevant and reliable audit evidence for accounts receivable by directly accessing information maintained by a knowledgeable external source;
States that the use of negative confirmation requests alone does not provide sufficient appropriate audit evidence;
Emphasizes the auditor’s responsibility to maintain control over the confirmation process and provides that the auditor is responsible for selecting the items to be confirmed, sending confirmation requests, and receiving confirmation responses; and
Identifies situations in which alternative procedures should be performed by the auditor.

“Today, business is largely conducted online. We walk around with sophisticated computers in our pockets and the ability to share information anytime, anywhere, with one tap,” Williams said. “It no longer makes sense for auditors to drop a confirmation request in the mail and assume the information in question is accurate if they hear nothing back. That’s why the standard before us focuses on positive confirmation, meaning an auditor must hear back from the third-party about the information they are trying to confirm. And if they are unable to obtain a response, they should perform alternative procedures to obtain relevant and reliable evidence for the information in question.

“It does not make sense that accounts receivable should require confirmation, but cash held by third parties would not—nor does it adequately protect investors. That’s why the standard before us not only carries forward the existing requirement regarding confirming accounts receivable, it also includes a new requirement for confirming cash and cash equivalents held by third parties,” she continued. “In these circumstances, the standard creates a presumption of performing confirmation procedures or otherwise obtaining relevant and reliable audit evidence by directly accessing information maintained by a knowledgeable external source.”

The new standard will apply to all audits conducted under PCAOB standards. Subject to approval by the Securities and Exchange Commission, the new standard will take effect for audits of financial statements for fiscal years ending on or after June 15, 2025.