Which of the following are PCAOB attestation general standards?

By Dan Goelzer

The Public Company Accounting Oversight Board recently asked for the public’s views on the application and use of the Board’s interim attestation standards. The standards are currently something of a dead letter, and the role that they were intended to play in advancing the PCAOB’s mission of protecting investors and furthering the public interest in “informative, accurate, and independent audit reports” is not clear. However, the Board’s decision to revisit the attestation standards could be an opportunity to make them relevant. Investor demand for reliable corporate environmental, social, and governance disclosures is increasing rapidly, and many companies are engaging auditors or other experts to provide assurance on their ESG disclosures. A PCAOB attestation standard aimed specifically at U.S. public company ESG disclosures would meet a market need. Moreover, by adopting a standard tailored to the preparation of opinions on greenhouse gas emissions, the PCAOB could play an important role in a key aspect of the SEC’s climate change proposals.

What are the PCAOB’s Attestation Standards?

In the world of accounting, an attestation engagement is one in which a CPA is engaged to issue a report on subject matter, or an assertion about a subject matter, that is the responsibility of another party. The audit of a company’s financial statements is the most common type of attestation. Under the Sarbanes-Oxley Act, for SEC reporting companies, these audits (and audits of their internal control over financial reporting) must be performed under the PCAOB’s auditing standards.

Although a financial statement audit is a type of attestation, the term “attestation” normally refers to an assignment in which an accounting firm is engaged to examine or report on a matter outside of the financial statements. As the PCAOB explains in its request for comment, attest engagements may, for example, relate to such things as a company’s compliance with laws and regulations or to evaluating historical data against pre-determined criteria. The PCAOB’s attestation standards provide a framework for these types of engagements.

The PCAOB’s basic attestation standard is AT 101. Under AT 101, there are three types of attestations, each of which provides a different level of assurance — an examination, which provides reasonable assurance; a review, which provides limited assurance; and an agreed-upon procedures engagement, which does not provide specific assurance, but reports on the performance of specific procedures and any related findings. AT 101 covers such matters as the need for adequate training, proficiency, and subject matter knowledge; the need to maintain independence and exercise due professional care; and the need for proper planning and supervision.

AT 101 is generic or foundational — it does not deal with the procedures appropriate for any particular type of attestation engagement. The Board does, however, also have attestation standards that address specific types of engagements — for example, attestations of financial forecasts and projections (AT 300), reporting on pro forma financial information (AT 400), and compliance attestations (AT 600).

The Board did not write its current attestation standards. In April 2003, the PCAOB adopted, on an interim basis, the attestation standards of the American Institute of Certified Public Accountants. While the PCAOB’s attestation standards have not changed substantially in almost two decades, the AICPA standards they originally mirrored were updated in 2016 as part of the Institute’s clarity project.

As the PCAOB points out in the comment request, its standards are used in certain regulatory compliance attestations, such as investment company custody compliance and compliance with Securities Investor Protection Act insurance fund contribution requirements. Apart from these fairly esoteric regulatory attestations, it appears that the PCAOB’s attestation standards are rarely, if ever, used today. This is likely because the PCAOB’s standards are somewhat out-of-date and because there is no particular incentive to use them. One of the goals of the Board’s interim attestation standards review is to determine whether its standards could be retooled to serve a broader investor protection purpose.

ESG — A Role for the PCAOB’s Attestation Standards

While the PCAOB’s standards are not widely used, attestation is by no means a dormant field. There is a growing demand for third party assurance, including auditor attestation, in connection with voluntary ESG disclosures. A report issued by the Center for Audit Quality illustrates the point. S&P 500 and ESG Reporting analyzed S&P 500 company ESG disclosures in 2021. The CAQ found that 95 percent of S&P 500 companies publicly disclosed detailed ESG information. More than half — 264 companies — obtained some form of third-party assurance over their ESG disclosures. About six percent of the S&P 500 received assurance from an audit firm, while about 47 percent obtained assurance from some other type of service provider. The audit firms primarily referenced the AICPA’s attestation standards as the basis for their work, although some referenced International Standard on Assurance Engagements 3000, promulgated by the International Auditing and Assurance Standards Board. None appear to have used the PCAOB’s attestation standards.

ESG metrics are increasingly important in investor decision-making. However, since most U.S. public company ESG disclosures are voluntary and outside of SEC filings, there are inevitably questions about their reliability. Accordingly, the demand for ESG attestation is likely to grow. A PCAOB attestation standard that specifically addressed U.S. public company voluntary ESG disclosures, such as those made under the disclosure standards of the new International Sustainability Standards Board, could bring increased comparability to ESG assurance and strengthen investor confidence in the credibility of these types of disclosures. It could also make auditor attestations, as opposed to those provided by other types of experts, more attractive.

ESG is a broad topic, and an ESG-focused PCAOB attestation standard would need to be general enough to encompass assurance on many different types of disclosures. There is however one specific ESG disclosure that it would be useful for the PCAOB to focus on in the near-term: greenhouse gas emissions.

Under the SEC’s climate change disclosure proposals, public companies would be required to disclose their Scope 1 and Scope 2 GHG emissions. Larger companies — accelerated filers — would also be required to include in their SEC filings an attestation report from an independent third party on those disclosures. Certain SEC requirements and disclosures would apply to these attestations. Some companies would also have to disclose their Scope 3 emissions. While attestation would not be required as to Scope 3, if a company voluntarily elected to obtain such an attestation, it would have to meet the same requirements, and make the same disclosures, as apply to Scope 1 and 2 attestations. (Scope 1 emissions those are directly from the company’s operations. Scope 2 emissions result from the generation of purchased power. Scope 3 are indirect emissions, e.g., in the company’s supply chain or from customer use of its products.)

The SEC would permit GHG emissions attestation reports to be prepared using any set of standards that are publicly available and that are established by a body that has followed due process procedures — including the PCAOB, AICPA, or IAASB. While this flexibility may be desirable in an evolving area like GHG emissions disclosure, it runs the risk that attestation reports will have varying levels of reliability. It would therefore make sense for the PCAOB to address GHG attestations. The Board could do this either in a GHG-specific attestation standard or in GHG-specific guidance in the context of a general ESG attestation standard. Either way, the SEC might then have an incentive to promote comparability by encouraging or requiring that GHG attestations in SEC filings be based on the PCAOB’s standard.

* * *

The PCAOB’s attestation standards currently play a limited role in fulfilling its mission. At the same time, there is a growing investor demand for third party assurance over U.S. public company voluntary ESG disclosures. Further, if the SEC adopts its climate change proposals, one aspect of ESG assurance — over GHG emissions — will become mandatory. The PCAOB could make an important contribution to investor protection by using its review of the interim attestation standards as a springboard for the development of a general standard on ESG attestation and a standard, or specific guidance, on GHG emissions attestations.

How many PCAOB attestation standards are there?

Who are the 5 members of the PCAOB?

Which PCAOB sets are standard?

What are the four categories of attestation services?