Inspection reports: interpret selected audit deficiencies
A PCAOB inspection report can identify serious audit deficiencies without providing a statistical estimate of errors across every audit performed by the firm. The research task is to preserve the selection process, the areas inspected and the report’s exact finding category before calculating a ratio or drawing a company-level conclusion.
This guide concerns PCAOB inspections of registered accounting firms’ issuer audits. It uses the official inspection overview as read on October 25, 2026. Broker-dealer inspections have their own program and should not be silently mixed into an issuer-audit denominator. All numerical cases below are fictional, not reported results for a named firm.
Read the selection mechanism first
The PCAOB’s Basics of Inspections, especially “How are audits selected?” and “What does an inspection entail?” explains that selection combines risk-based and random methods, most selections target heightened risk, and reviews cover portions of selected audits. It also explains the limitations on interpreting deficiencies as financial-statement conclusions.
Start the worksheet with the registered legal firm, inspection year, relevant audit periods, public report date, and the report’s categories. Retain the source’s wording for an audit with a specified deficiency. Do not merge every issue appearing in Part I or another section into a newly invented universal error category.
The overview supports a method for reading reports; it does not provide a complete census of findings for any fictional firm in this article. For real research, obtain the specific firm’s report through the official inspection-report directory and read its definitions, tables, explanatory notes and firm response.
Work a selected-audit ratio
Assume Fictional Firm F performed 200 issuer audits in a relevant stated population. Inspectors selected 20 distinct audits and reviewed specified portions. The hypothetical report identifies six distinct selected audits with findings in the particular category being analyzed.
Selected-audit ratio = 6 / 20 = 30%.
| Number | Meaning | Valid use |
|---|---|---|
| 200 | Firm’s stated issuer-audit population | Population context, if period and definition match |
| 20 | Distinct audits selected for review | Denominator for the selected group |
| 6 | Distinct selected audits in the specified finding category | Numerator after deduplication |
| 30% | Six divided by twenty | Description of this selected group |
It is invalid to multiply 30% by 200 and conclude that 60 of all the firm’s audits had the same deficiency. Selection is not a simple representative random sample, and review did not examine every area even within selected audits. The arithmetic 0.30 × 200 = 60 is correct; its interpretation as an established population result is unsupported.
Nor does the six automatically mean six issuers have materially misstated accounts, six audit opinions have been withdrawn, or six frauds occurred. Such conclusions require the report’s exact findings and separate issuer or regulatory evidence. Preserve serious findings without turning them into different facts.
The 200 population also needs verification. If it represents the latest annual practice size while the selected audits relate to an earlier period, even the descriptive sampling fraction 20/200 may mix dates. State the mismatch rather than presenting a precise coverage percentage.
Count audits separately from finding issues
Suppose the six affected audits are numbered A through F. Audit A has two issues in the chosen category; B through F each have one. There are seven issues but only six distinct affected audits.
Using seven as the numerator creates 7/20 = 35%, an issue-per-audit calculation presented as if it were the share of affected audits. The correct affected-audit share remains 6/20 = 30%. Both counts can be useful if labeled, but they are not interchangeable.
Build a row for each audit identifier and a separate issue table linked to it. If the report anonymizes audits, use the stable identifiers it provides rather than guessing issuer names. A revenue issue and an inventory issue within the same audit should not create two companies in a company-count chart.
If the report gives only an aggregate number of issues without enough information to deduplicate audits, the affected-audit numerator is unknown. Do not infer that every issue belongs to a different audit. Report the available count and its unit explicitly.
A zero-finding boundary
In a separate fictional case, two randomly selected audits have no finding in the areas reviewed. The number zero is evidence about the inspected work, not proof that the firm’s full practice is free of deficiencies.
The boundary differs from the main 30% extrapolation: even selection with a random element does not turn a tiny, partially reviewed group into a complete assurance statement. Without a defined population, known design, inclusion probabilities, scope and uncertainty analysis, a population estimate is not established.
Likewise, an audit selected for revenue work cannot be described as having passed an unreviewed tax area. An inspection finding is local to the report’s identified work; absence of a reported finding does not reveal every procedure that was or was not performed.
These limits do not make the report useless. They identify where evidence is strong: a documented deficiency in a specified area is a concrete reason to investigate that area, the firm’s response and any later related disclosures. It is the leap to a universal rate or a different issuer fact that is unsupported.
Compare years without inventing improvement
Suppose a prior fictional report identified four affected audits out of ten selected, or 40%. The current result is six out of twenty, or 30%. The selected ratio falls by ten percentage points while the count of affected audits rises by two.
Both statements are arithmetically true. Neither alone establishes that firm-wide audit quality improved or worsened. The risk profile, selection mix, areas inspected, report categories and audit periods may differ.
Before comparing, prepare a compatibility table. Use the same finding category and counting unit, list changes in scope and selection, and keep publication year separate from inspection year and financial-statement year. If those conditions cannot be aligned, describe the two reports independently rather than ranking them by one percentage.
Do not label a later response or corrective action a correction of the original financial statements unless the actual issuer evidence establishes that. The report, firm response, remediation information and any issuer restatement are separate records with separate dates and meanings.
Execute an evidence ladder
| Level | Public evidence | Permitted conclusion | Additional evidence needed |
|---|---|---|---|
| Selection | Specific report’s scope and overview | Identified audits and areas were selected | Design information for population inference |
| Finding | Exact category and audit identifiers | Reported deficiency in stated work | Other areas or full-practice status |
| Firm response | Dated response and subsequent disclosures | Firm describes its action or disagreement | Evidence of effective implementation |
| Issuer outcome | Issuer filing or relevant order | Only the documented company-level event | Unsupported links to anonymous audits |
Inspectors can review workpapers and interview engagement personnel; ordinary investors usually cannot access those materials. A public researcher cannot reproduce the complete inspection or infer undisclosed client identities from an industry hint.
When a firm response disputes a finding, retain the inspector’s finding and the firm’s response as attributed statements. Do not average them into a numerical half-deficiency or silently delete one side. If a later official correction changes the finding, preserve the earlier version and identify the effective update.
A practical output is a short evidence memo plus a machine-readable table: report identifier, firm ID, audit-period field, inspection year, publication date, selected count, affected-audit count, issue count, category, scope limits, and source location. Missing values remain missing.
Update the memo for revised reports, additional public remediation information, issuer-specific filings, or changes in report taxonomy. The conclusion should distinguish what the regulator documented, what the firm said, and what the public evidence still cannot establish.
Check the denominator for a particular audit area
Suppose twenty audits were selected overall, but the fictional report states revenue work was reviewed in only eight, with three distinct audits having the defined revenue finding. The area-specific selected ratio is 3/8, or 37.5%, if those scope statements are comparable. Dividing by twenty produces 15%, but does not measure the same question.
Neither result is a revenue-deficiency rate for all audits in the firm. The example adds a second denominator control: selection of an engagement and selection of work within that engagement are separate. Record the area-review count where available. If it is not disclosed, do not invent it from the total engagement count.
FAQ
Does a 30% selected ratio mean 30% of all firm audits failed?
No. The ratio describes the stated selected group and category; population inference needs a justified design.
Does a reported deficiency always mean an issuer must restate?
No. Read the exact finding and obtain separate evidence of any issuer-level consequence.