PCAOB Auditor Communications: Why Audit Committees Must Hear More Than Management Wants to Tell Them
What PCAOB AS 1301 and AS 1305 Teach Us About Independent Oversight, Financial Reporting, Internal Controls, and Management Accountability
John C. Blackshire, Jr. The Accountware Group (TAG) | Corporate Governance, Audit Committee Responsibilities, Financial Accountability, and Internal Controls
One of the most important principles of effective corporate governance is that the independent external auditor must be able to communicate directly with the Audit Committee.
That communication should not be controlled, filtered, or limited by the organization's CEO, CFO, or other members of management.
Why?
Because the Audit Committee is responsible for providing independent oversight of financial reporting and the external audit. Management prepares the financial statements, maintains the internal control framework, and is responsible for providing reliable financial information.
The independent auditor evaluates the financial statements and communicates significant matters identified during the audit.
These are different responsibilities.
The Public Company Accounting Oversight Board (PCAOB) recognizes the importance of this relationship through its auditor communication standards.
Two particularly important standards are:
PCAOB AS 1301 — Communications with Audit Committees
PCAOB AS 1305 — Communications About Control Deficiencies in an Audit of Financial Statements
Together, these standards establish important requirements for communication concerning audit responsibilities, significant risks, accounting judgments, financial reporting problems, and identified internal control deficiencies.
Although PCAOB auditing standards apply to specified PCAOB-regulated audit engagements rather than automatically to public school districts or other governmental organizations, their governance principles offer valuable lessons for any organization entrusted with substantial financial resources.
The fundamental principle is simple: An Audit Committee cannot provide effective oversight if management controls what the Committee is allowed to know.
1. Why Auditor Communications Are a Corporate Governance Issue
An external financial statement audit is not merely an exercise in checking accounting balances.
The audit provides an independent examination of financial information prepared by management.
During an audit, the auditor may identify significant accounting estimates, weaknesses in internal controls, disagreements with management, potential fraud risks, and financial reporting practices that deserve attention.
These matters may be critical to the Board's oversight responsibilities.
Consider a hypothetical organization in which the external auditor identifies significant weaknesses in the year-end financial reporting process.
Management may prefer to characterize the weaknesses as minor administrative problems.
But the Audit Committee needs to understand their nature, severity, and implications.
If the Committee receives information only through management, it may not obtain the auditor's independent assessment.
This creates a governance risk.
PCAOB AS 1301 addresses that risk by requiring specified communications between the auditor and the Audit Committee.
The standard is intended to promote meaningful two-way communication rather than simply the delivery of a report at the conclusion of the audit.
2. PCAOB AS 1301: The Audit Committee Must Be an Active Participant
PCAOB AS 1301 requires the auditor to communicate specified matters to the Audit Committee and obtain information from the Committee relevant to the audit.
Its objectives include establishing an understanding of audit responsibilities, obtaining relevant information, communicating the overall audit strategy and timing, and providing timely observations significant to financial reporting.
This means the Audit Committee should be actively involved in understanding the audit.
It should not simply receive the completed financial statements and an audit opinion.
What should the Audit Committee understand?
The Committee should understand the responsibilities of management and the auditor.
It should know the significant risks identified during audit planning.
It should understand important accounting policies and estimates.
It should receive communications about significant audit findings and difficulties.
It should be informed of significant disagreements between management and the auditor.
The Committee should also understand whether management has corrected identified financial reporting errors.
An effective Audit Committee asks questions throughout the audit rather than waiting until the auditor has completed the engagement.
3. The External Auditor Should Not Report Only Through the CFO
The CFO is an important participant in the external audit process.
The CFO and accounting personnel ordinarily coordinate schedules, provide financial records, explain accounting judgments, and respond to audit requests.
However, the CFO is also a member of the management team responsible for the financial reporting process being audited.
This creates an important distinction.
Management should facilitate the audit, but it should not control the independent auditor's communications with the Audit Committee.
Under AS 1301, the auditor has direct communication responsibilities to the Committee.
These responsibilities are not satisfied merely because management has received the auditor's findings.
A practical example
Suppose the auditor identifies an unsupported accounting estimate that could materially affect the financial statements.
The CFO disagrees with the auditor's conclusion.
The auditor and management eventually resolve the accounting issue.
Does the Audit Committee need to know about the disagreement?
Under AS 1301, disagreements with management that could be significant to the financial statements or auditor's report must be communicated, even if satisfactorily resolved.
That requirement helps prevent significant disputes from disappearing from the governance record simply because management and the auditor eventually reach agreement.
4. Audit Planning: What Should the Committee Know Before the Audit Begins?
An effective audit begins with identifying and assessing risks.
AS 1301 requires the auditor to communicate an overview of the audit strategy and timing and discuss significant risks identified during the risk assessment.
This communication allows the Audit Committee to understand the areas receiving particular attention.
For example, significant risks may involve revenue recognition, management estimates, related-party transactions, fraud, or unusual transactions.
The Committee should also be able to raise concerns based on information it possesses.
Questions an Audit Committee should ask
What are the most significant financial reporting risks this year?
Have there been important changes in the organization's operations?
Are there areas where management's accounting judgments are especially subjective?
Are there risks involving management override?
Have prior-year control deficiencies been corrected?
Does the audit team have the necessary expertise?
These questions help the Committee perform its oversight role.
They do not require the Committee to design or perform audit procedures.
5. Significant Accounting Estimates and Management Judgment
Many financial reporting amounts depend on management estimates.
Examples include:
Allowances for credit losses.
Asset impairments.
Inventory valuations.
Income tax valuation allowances.
Pension obligations.
Contingent liabilities.
Fair value measurements.
Revenue estimates.
Management may have legitimate discretion when selecting assumptions.
However, accounting estimates can also create opportunities for bias.
AS 1301 requires communications concerning significant accounting policies, critical accounting policies and practices, and the auditor's evaluation of the quality of financial reporting.
This includes certain matters involving management bias.
Why this matters
A company may technically comply with an accounting standard while using assumptions that consistently produce overly favorable financial results.
The Audit Committee should understand whether the auditor has identified indications of bias.
It should also understand significant differences between management's estimates and estimates supported by audit evidence.
The Committee's responsibility is not to calculate the estimates itself.
Its responsibility is to challenge management appropriately and understand whether the financial reporting process is reliable.
6. Corrected and Uncorrected Financial Statement Errors
Financial statement audits frequently identify adjustments.
Some errors are corrected by management.
Others remain uncorrected because management and the auditor conclude that they are immaterial.
AS 1301 establishes communication requirements concerning both categories.
The auditor must provide the Audit Committee with the schedule of uncorrected misstatements presented to management.
The auditor must also communicate specified corrected misstatements that might not have been detected without the audit.
The governance concern
Suppose the external auditor repeatedly identifies significant accounting errors that management corrects before the financial statements are issued.
The final financial statements may be fairly presented.
But why did management's financial reporting process fail to identify those errors?
Repeated audit adjustments may indicate weaknesses in the organization's accounting personnel, review procedures, or internal controls.
An Audit Committee should not assume that a clean audit opinion means the financial reporting process is functioning effectively.
A financial statement audit can result in an unmodified opinion even when the auditor has identified important internal control deficiencies.
7. PCAOB AS 1305: Communicating Internal Control Deficiencies
PCAOB AS 1305 addresses communication of control deficiencies identified during a financial statement audit.
The standard applies to audits of financial statements only; integrated audits of financial statements and internal control over financial reporting have related communication requirements under PCAOB AS 2201.
A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of their assigned functions, to prevent or detect misstatements on a timely basis.
Three important classifications
Control deficiency: A deficiency in the design or operation of internal control.
Significant deficiency: A deficiency, or combination of deficiencies, less severe than a material weakness but important enough to merit attention by those responsible for oversight of financial reporting.
Material weakness: A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of financial statements will not be prevented or detected on a timely basis.
These distinctions matter because not every control problem represents a material weakness.
However, a deficiency that does not meet the material weakness threshold may still deserve management and Audit Committee attention.
8. A Clean Audit Opinion Does Not Mean Internal Controls Are Effective
One of the most common misunderstandings in financial reporting is the belief that an unmodified audit opinion proves that management has established effective internal controls.
That conclusion is incorrect.
A financial statement audit and an audit of internal control over financial reporting have different objectives.
An auditor may obtain sufficient appropriate evidence to conclude that the financial statements are fairly presented while also identifying significant deficiencies in the organization's internal controls.
For example, management may lack an effective review of significant accounting estimates.
The external auditor may perform additional substantive procedures and obtain sufficient evidence to support the reported amounts.
The financial statements may therefore receive an unmodified opinion.
However, the underlying management control deficiency may remain.
The Audit Committee must distinguish between the reliability of the final financial statements and the effectiveness of management's processes for preparing those statements.
Both are important governance considerations.
9. What Happens When the Audit Committee Itself Is Ineffective?
This is one of the most consequential aspects of PCAOB auditor communication requirements.
AS 1305 states that ineffective Audit Committee oversight of external financial reporting and
ICFR is an indicator that a material weakness exists.
If the auditor becomes aware that the Audit Committee's oversight is ineffective, the auditor must communicate that conclusion in writing to the Board of Directors.
In an integrated audit, AS 2201 also addresses the auditor's evaluation of Audit Committee oversight.
This establishes an important governance principle.
The Audit Committee is itself part of the organization's control environment.
It is not simply an observer of management's internal controls.
Potential indicators of ineffective oversight
An Audit Committee that does not receive meaningful financial reporting information.
A Committee that fails to address significant auditor communications.
A Committee that does not understand material accounting judgments.
A Committee that permits management to interfere with auditor independence.
A Committee that does not adequately oversee identified financial reporting control weaknesses.
These conditions require evaluation based on the circumstances.
A single missed meeting or disagreement with an auditor does not automatically establish a material weakness.
However, ineffective oversight can have a pervasive effect on the financial reporting control environment.
10. The Audit Committee Should Meet Privately With the External Auditor
Private meetings between the Audit Committee and external auditor are an important governance practice.
They provide an opportunity for candid discussion without management present.
Such discussions can help the Committee understand whether management has cooperated with the audit and whether the auditor has concerns that deserve independent attention.
Questions for a private session
Has management provided unrestricted access to relevant information?
Have there been significant disagreements with management?
Has management pressured the audit team regarding accounting conclusions?
Are there concerns about management integrity?
Are there significant unresolved control deficiencies?
Has management been responsive to prior audit findings?
Is there anything the Committee should know that has not been adequately discussed in regular meetings?
These sessions do not replace the communications specifically required by PCAOB standards.
They strengthen the Committee's ability to receive independent information and exercise professional judgment.
11. Why Audit Documentation and Meeting Minutes Matter
AS 1301 requires the auditor to document required communications, whether made orally or in writing.
The timing of communications is also important.
Required communications generally must occur before issuance of the auditor's report, with additional timing requirements potentially arising from other applicable standards or laws.
From a governance perspective, the Audit Committee should maintain an appropriate record of significant matters discussed and actions taken.
Important documentation
Audit planning presentations.
Significant risk communications.
Financial reporting and accounting judgment discussions.
Schedules of uncorrected misstatements.
Communications concerning corrected misstatements.
Internal control deficiency reports.
Significant disagreements with management.
Audit Committee follow-up requests.
Management corrective action reports.
Documentation demonstrates that the Committee received information and provides a basis for monitoring unresolved matters.
However, meeting minutes should be appropriately prepared and maintained with consideration for confidentiality and applicable legal requirements.
12. Management Must Own the Internal Control Framework
The most important responsibility distinction is that management owns the organization's internal control framework.
The external auditor does not design or operate management's controls.
The Audit Committee does not perform management's accounting responsibilities.
Internal Audit does not replace management's monitoring activities.
Management must establish and maintain effective controls.
This includes controls over financial reporting, accounting estimates, regulatory reporting, reconciliations, journal entries, fraud risks, and management review.
When deficiencies are identified, management should investigate their causes and implement corrective actions.
What should the CFO do?
The CFO should establish procedures for identifying financial reporting risks.
The CFO should ensure that important accounting balances and estimates receive appropriate review.
The CFO should monitor identified control deficiencies.
The CFO should communicate significant matters proactively to the Audit Committee.
A governance structure in which the CFO only answers questions when Board members happen to ask them is insufficient for effective risk oversight.
Management's responsibility is to identify significant risks and bring them to the appropriate governance body—not wait for volunteer or independent Board members to discover them.
13. What Public School Districts Can Learn From PCAOB Auditor Communications
Public school districts are not ordinarily subject to PCAOB auditing standards.
Their financial audits are governed by applicable state laws, governmental auditing standards, and other relevant requirements.
Therefore, AS 1301 and AS 1305 should not be presented as direct legal requirements for Arizona school districts.
Nevertheless, the governance principles are highly relevant.
A public school district may manage hundreds of millions of dollars in annual revenues and expenditures.
Its financial activities can involve complex funding restrictions, grants, construction projects, procurement contracts, payroll, capital assets, and long-term obligations.
The Governing Board and Audit Committee need reliable information to oversee these activities.
Lessons for school districts
Independent auditor access: External auditors should have appropriate direct communication channels with the Governing Board or Audit Committee.
Management accountability: The Superintendent and CFO should maintain the district's internal control framework.
Significant risk reporting: Management should proactively communicate significant financial and control risks.
Control deficiency monitoring: The Board should receive information about significant audit findings and corrective actions.
Financial reporting oversight: Significant annual financial reporting matters should receive appropriate governance attention.
Independent oversight: Management should not determine unilaterally which significant audit concerns are communicated to the governing body.
These are sound governance practices even where the specific PCAOB requirements do not apply.
14. The GAO Green Book Reinforces Management Accountability
The GAO's Standards for Internal Control in the Federal Government, commonly known as the Green Book, provides another useful framework for understanding governance and internal control responsibilities.
The Green Book addresses the five components of internal control:
Control Environment.
Risk Assessment.
Control Activities.
Information and Communication.
Monitoring Activities.
Its principles emphasize management responsibility, oversight, communication, and monitoring.
The Green Book is directly applicable to federal agencies. Its application to a particular state or local government depends on applicable requirements and adopted policies.
Nevertheless, the framework offers important guidance for public-sector governance.
An organization cannot maintain effective internal controls if management fails to communicate significant deficiencies or if the governing body lacks information necessary
for oversight.
The Green Book and PCAOB auditor communication standards approach these responsibilities from different perspectives, but both reinforce the importance of accountability and reliable information.
15. Ten Questions Every Audit Committee Should Ask Its External Auditor
Every Audit Committee should consider asking the external auditor the following questions:
What were the most significant financial reporting risks identified during the audit?
Did management provide all requested information and unrestricted access?
Were there significant disagreements with management?
What important accounting judgments or estimates required substantial auditor attention?
What corrected and uncorrected misstatements were identified?
Were significant deficiencies or material weaknesses identified?
Were any previously reported control deficiencies repeated?
Did the auditor identify evidence of management bias or inappropriate override?
Are there concerns about the effectiveness of the organization's financial reporting governance?
What should the Audit Committee do differently to improve its oversight?
The Committee should request clear answers supported by appropriate evidence.
These questions can help transform the annual audit from a compliance exercise into a meaningful governance process.
16. A Practical Audit Committee Communication Framework
Organizations can strengthen audit communications by establishing a structured annual process.
Stage | Communication and oversight activity |
Auditor appointment | Confirm auditor independence, responsibilities, and engagement terms |
Audit planning | Discuss audit strategy, timing, significant risks, and areas of judgment |
Audit fieldwork | Escalate significant problems, disagreements, and emerging risks |
Financial reporting review | Discuss accounting policies, estimates, misstatements, and disclosures |
Audit completion | Review the draft auditor's report and required communications |
Control deficiency reporting | Evaluate significant deficiencies and material weaknesses |
Remediation | Assign management responsibility and monitor corrective actions |
Follow-up | Confirm whether significant prior findings have been addressed |
This framework can be adapted to public companies, private organizations, and public-sector entities according to their applicable requirements.
The important point is that communication should be continuous and purposeful.
Conclusion: An Audit Committee Cannot Oversee What It Does Not Know
The PCAOB's auditor communication standards recognize a fundamental weakness that can occur in corporate governance.
Management controls much of the information generated by the organization.
The Audit Committee is responsible for providing independent oversight.
The external auditor is expected to provide independent professional judgments concerning the financial statements and specified related matters.
If significant information is withheld, delayed, or filtered, the governance structure becomes less effective.
AS 1301 establishes requirements for meaningful communication between the auditor and Audit Committee.
AS 1305 addresses communication of significant financial reporting control deficiencies identified in a financial statement audit.
Together, they reinforce the importance of transparency, auditor independence, management accountability, and effective oversight.
For public companies, these requirements are part of the applicable PCAOB auditing framework.
For school districts and other public organizations, they offer valuable lessons about the importance of independent communication and the responsibilities of management.
The effectiveness of an Audit Committee should not be measured by how many meetings it holds or how many reports it receives. It should be measured by whether it obtains the information necessary to identify significant risks, challenge management, and ensure that serious financial reporting problems receive appropriate attention.
That is what effective governance requires.
Professional Education: PCAOB AS 1300 — Auditor Communications
Corporate Compliance Seminars (CCS) offers a specialized CPE event addressing PCAOB auditor communication requirements, with particular emphasis on AS 1301 and AS 1305.
The program examines auditor-to-Audit Committee communications, control deficiency reporting, auditor independence, documentation, and practices that support audit quality.
Event details
Course: PCAOB AS 1300: Auditor Communications
CPE credits: 2
Format: Live, Group Internet-Based
Schedule: Tuesdays, 10:00 a.m.–12:00 p.m. Central Time, offered approximately every six weeks
Field of study: Auditing
Program level: Basic
Prerequisites: None
Private training: Available for groups of two or more participants
The course is designed for auditors, CPA firm personnel, and financial reporting professionals who want to strengthen their understanding of PCAOB communication requirements and effective Audit Committee relationships.
The Accountware Group publishes analysis and commentary on corporate governance, financial reporting, internal controls, audit quality, and accountability in public and private organizations.
Comments