Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​CAMs and the Audit Report: Brace for Impact

Internal audit can help assure a smooth approach for critical audit matters.

Comments Views

​Internal and external audit teams alike have entered a brave new world in the last year or so, as critical audit matters (CAMs) arrived as items to be included in the external auditor’s report. Now comes a crucial question: Will CAMs be an asteroid that slams into the annual audit process — or just a meteor shower that breaks up in the atmosphere?

CAMs are disclosures audit firms make in their audit report, to tell investors what the audit firm deems the most important accounting issues at the company. CAMs involve line items material to the business, and typically their issues will fall into one of two categories. Either the CAM will have weak controls that need attention; or it will be an item that involves subjective, complex judgment no matter how good or bad the controls are.

So far, only large accelerated filers have implemented CAMs, starting with companies whose fiscal years ended on or after June 30, 2019. All other companies will implement CAMs starting at the end of this year.

One school of thought is that despite all the angst that surrounded the development of CAM requirements in the 2010s, the inclusion of CAMs in the audit report won’t do much more than memorialize the same conversations that audit firms and internal audit functions have had for years. But will the process to reach those decisions be substantively different?

“No, not at all,” says Brian Tremblay, until recently the head of internal audit at Acacia Communications in suburban Boston. Critical audit matters, he says, are simply where audit firms devote most of their time and attention during the audit. That won’t change just because those issues are now written into the audit report.

Tremblay’s observation gets at a subtle but important point: what the word “critical” really means here. It does not mean that some accounting process is deeply amiss, like a patient in the critical care unit. It only means that the accounting issue is important, in the way that a solid foundation is critical to a whole house.

Now, can that foundation be a rickety mess that threatens the whole structure? Sure. So conversations ensue about how to repair the foundation as necessary. Conversations with audit firms about significant deficiencies or material weaknesses are no different.

“If we were not discussing those things before, we would have been incompetent in our jobs,” says Jan Babiak, chair of the audit committee at Walgreens Boots Alliance. She has served on boards where CAMs have come into force both in North America and Europe, and says the experience should not catch anyone — audit committee, management, or audit firm — by surprise.

Babiak gave the example of the corporate tax cut enacted by Congress in 2017. Audit committees were discussing the implications of that tax cut with management and auditors before the legislation was even final, let alone enacted. “By the time you get to something being in the opinion, it’s really old news — if you’re competent in what you do.”

OK, so successful implementation of CAMs depends on clear communication with the audit firm about difficult accounting issues. What should that look like for the legions of companies adopting CAMs for the first time this year?

The Contours of CAMs

One critical step will be a well-defined process to handle significant control deficiencies. A significant deficiency is not automatically a CAM unto itself — although it can be, or it can make a CAM much more likely. So resolving significant deficiencies in a consistent, productive way is crucial.

Manu Varghese, chief audit executive of Hira Industries in Dubai and previously controller at a Big Three U.S. automaker as it adopted CAMs, used a materiality threshold to grade the severity of control deficiencies. Anything that would affect the income statement by less than $3 million was minor; any effect from $3 million to $10 million was major. Any deficiency that had an effect of more than $10 million was classified as a significant deficiency, or a CAM, “and then management would have to fix it immediately.”

In Varghese’s case, “immediately” was within six months. The internal audit team created an action plan with management, which was presented to the external auditor and then to the audit committee.

What internal audit teams don’t want are disputes about significant deficiencies unfolding in front of the audit committee. “If that happens, you’re doing it wrong,” Tremblay says.

Then again, that’s always been the case: Internal audit, management, and the external auditor should have a method to resolve tensions about internal control issues before going in front of the audit committee. So to that extent, CAMs won’t cause any Big Bang change in how financial audits get done.

There’s another type of critical audit matter, too. At least some CAMs will exist simply because they are material to the financial statement and involve, as the audit standard says, “especially challenging, subjective, or complex auditor judgment” — even without any significant control deficiency.

That would be something like assessment of goodwill, contingencies for uncertain tax positions, or reserves for warranties. And sure enough, according to preliminary research of the first companies disclosing CAMs, the most common subjects were goodwill impairment, tax contingencies, and revenue recognition. 

Those CAMs are not necessarily bad; they’re simply important to the financial statements, even if management is rock-solid confident in its judgment about them. “There are things that exist in every auditor’s file regardless of the ‘real’ risk,” Tremblay says. “Those things are just there because they’re judgments and estimates, and that’s the lay of the land.”

Varghese puts an even more philosophical spin on such CAMs. “We need to understand the risk and ask, ‘Can we live with it?’” he says. “If it’s wrong, we fix it. But if it’s just complex — I can live with complex.”

Whither the Audit Committee

A fair question to ask at this juncture is exactly what the audit committee’s role should be in CAMs. For example, the U.S. Securities and Exchange Commission (SEC) published a statement in December encouraging audit committees “to engage in a substantive dialogue with the auditor” about CAMs and how the external auditor planned to describe them. That’s fine advice, but really the SEC is just advising audit committees to maintain good diplomatic relations with their auditor.

The Public Company Accounting Oversight Board (PCAOB) spent much of 2019 interviewing audit committee chairs, and it found that most chairs already are satisfied with the relationship they have with their audit firms. It’s not like audit committee chairs are straining to dump their audit firms or encouraging investors to deride the audit report at the annual shareholder meeting.

One could argue that all the SEC and PCAOB attention to audit committees is a charm offensive intended to escort board directors past this truth: The audit firm decides what a CAM is — not management, not the audit committee. To a certain extent, audit committees are bystanders here. Sure, they’re bystanders who can protest loudly if CAMs start complicating the message that the board and management want to convey to investors. They are still relatively powerless to stop an audit firm determined to call an issue a CAM.

So the more internal audit and management can work with the audit firm to ensure a smooth, consensus-driven process to handle CAMs, the better. And let’s remember, ultimately CAMs are there to help the investor understand the risks of the company.

“Sometimes people fall asleep reading [audit reports],” Varghese quips. “The CAMs section will probably help focus the attention of the reader, and that’s great."

Matt Kelly
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author



Matt KellyMatt Kelly<p>​Matt Kelly is editor and CEO of, an independent blog about audit, compliance, and risk management issues, based in Boston. ​</p>


Comment on this article

comments powered by Disqus
  • Galvanize-September-2020-Premium-1
  • FSE-September-2020-Premium-2
  • Auditboard-September-2020-Premium-3