At Every Turn: Risk, Risk, Risk 

By Douglas L. Bowles, CPA

It seems that at every turn, there is risk. Inherent risk. Control risk. Detection risk. Fraud risk. Risk management. Business risk. Risk prevention. Risk standards. Risk. Risk. Risk. And yes, there is risk assessment in peer review.

Peer review team captains are required to document in the planning of each review, their inherent and control risk assessment both in relation to a firm's accounting and audit practice and also in relation to its system of quality control.

Here are some thoughts on factors to consider when assessing the risk associated with a peer review:

• What is the "tone at the top"? Does the firm appear to embrace and commit to quality control matters or is its culture indifferent, and therefore most likely confrontational, about quality control and the Peer Review Program?
• Does the firm appear to be homogeneous and unified toward consensus? A dysfunctional management group can easily draw commitment away from professional issues, such as quality control.
• Inquire early as to issues related to licensure, prohibition of services, impairment of practice privileges, etc.
• What is the history of the firm's peer review reports? Consistently high level? Erratic? Consistently problematic?
• Review the nature of any findings in the firm's most recent prior review to see if such matters could likely impact risk today.
• If the firm uses self-developed practice aids and is not of sufficient size to devote appropriate resources to their development and maintenance, what is the impact of this situation on risk? Generally, such an approach to conducting engagements would increase risk.
• Is the current member of management with whom you have been asked to coordinate the review the same person that has been in that role in the past? If not, try to assess if the change in responsibility increases or decreases the risk in the current review.
• Through past familiarity with the firm if you are repeating as team captain, or through inquiry prior to planning the review if this is a first review with the firm, what can you conclude as to the stability and continuity of their A&A personnel?
• Similarly, what can you conclude about the caliber of their A&A personnel?
• What levels of service are provided? This is, of course, a firm characteristic that traditionally gets considerable attention. But let's look at it from a different perspective:
  • Does the firm do a very small number of engagements at one level, particularly if it is audit or review?
  • Within the audit level, does the reviewed firm do a small number of engagements in industries defined by program standards as being high risk? Yellow Book, ERISA, etc.?
  • Does the firm appear to understand what might represent an engagement conducted under attestation standards?
• Does the firm perform only a small number of engagements in a specialized industry, such as contracting, nonprofit organizations, CIRAs, etc.?
• Does the firm's inventory of clients indicate a large number of new engagements during the peer review year? If so, did the growth represent new industries? Could the extent of growth stretch the limits of A&A personnel?
• With respect to personnel issues, has the coming effective date of the 150-hour requirement in Virginia significantly impacted the firm's professional staff?
• How severe is the firm's seasonal workload compression as it relates to A&A work?
• Understand how the firm's listing of clients was developed. If tax partners are named as engagement owners, be sure to understand what their attestation role might be, if any at all. Many client data bases are driven by client "ownership", and for the purpose of using the data base for partner compensation. As such, without this clarity, we could be considering engagements assigned to tax partners as higher risk, when in fact the attestation part of the client relationship is fully under the control of an A&A partner.
• Was the year under review one in which significant new standards became effective?
• What were the general economic conditions of the year under review? A stagnant or declining economy could increase the risk that matters related to, for example, valuation estimates could be under pressure. This type of risk could influence the industries from which engagements are selected.
• What is the caliber of CPE generally utilized by the firm? It is probably a safe generality to say that self-study programs are not as beneficial as seminars and conferences, though definitely more affordable.
• If a firm works in complex and/or high risk industries, peer review risk might increase if, in the judgment of the reviewer, the relevant CPE is inadequate in terms of either hours or of quality.
• During times such as these when firms are trending to a paperless environment, could such a change in technique increase or decrease risk?
• What is the caliber of the firm's authoritative and research literature?
• Is the firm committed to an internal inspection program, even if they opt out of that aspect of monitoring in the year of their peer review?
• If the firm performs internal inspections, consider the results of those conducted since the last peer review. Include in your evaluation not only the nature of the findings, but the communication of the findings to those involved in the A&A function of the firm.
• When was the firm's quality control document last updated? All too often, a firm's document, if one exists, was extracted from and cross-referenced to a library of third-party practice aids. It is highly likely that in not too much time after adopting such a configuration, the interaction of the document with the functional practice aids will change, but the document will not be modified.

I suspect we are all tempted to arrive on site for a review, wanting first and foremost to begin reviewing financial statements and the underlying engagement documentation. Instead, we should be requesting, receiving and reviewing in advance as much information as we can possibly obtain that is relevant to assessing risk.

We should be structuring our peer review engagements just as we would our attestation engagements — risk-focused and well-planned — resulting in an effective review.

Douglas L. Bowles, CPA, works at McPhillips Roberts & Deans PLC.