The Auditor Rotation Myth
Why a Persistent “Best Practice” May Be Costing Your Nonprofit More Than It Protects
By Susan Colladay, CPA, Partner, Audit & Assurance
If you ask a handful of nonprofit board members how often they should change audit firms, you will likely hear the same answer: every three to five years. Some boards have a periodic rotation requirement written into their bylaws or audit committee charter. However, most board members do not understand where this rotation idea originally came from, only that it seems like good governance. In today’s business climate, it is worth asking whether auditor rotation is good governance. This article provides an overview of where the rotation myth came from and examines whether firm rotation is a best practice for nonprofit organizations.
Origin of the Rotation Myth
When Congress passed the Sarbanes-Oxley Act (SOX) in 2002, the intention of the law was to respond to a crisis of confidence in public company audits. One of the law’s provisions requires publicly traded companies to rotate the lead and concurring audit partners every five years, which is a requirement that applies to the people on the engagement team. The law does not require a public company to change audit firms.
In fact, Congress was careful not to require audit firm rotation in the law. Before SOX became law, they tasked the Government Accountability Office (GAO) with performing a GAO study of the risk of audit failure immediately following audit firm rotation. In the GAO study, 25 years of public company audits were summarized and the results pointed to the fact that the risk of an audit failing to find a material misstatement increased in the first year after a new auditor is engaged. This is why SOX does not require audit firm rotation.
What SOX Actually Requires
SOX requires public companies to rotate the lead and concurring audit partners every five years. It does not require a company to change audit firms.
What Some Nonprofit Boards Do
Some nonprofit boards impose a 3-year firm rotation policy — shorter than federal law asks of public companies, despite the documented increase in audit-failure risk that comes with a new auditor.
The Nonprofit and Audit Firm Reality
A strict rotation policy includes an assumption that a nonprofit has the capacity to handle a request for proposal (RFP) process and then work to transition to a new audit firm every few years. However, most nonprofit Finance teams are thinly stretched. The administrative burden of an RFP process plus hiring a new auditor means weeks of additional staff time spent above and beyond their normal duties. That is staff time not spent on strategy, budgeting, or donor reporting.
The CPA profession is also thinly stretched. The shortage of CPAs has been well-documented, and firms are being more selective about the new clients they are willing to accept. As a result, nonprofits who send out their RFP regularly may not get as many interested bidders because new clients cost firms extra in the first year. Most firms write off these additional start-up costs under the assumption that there will be a long-term relationship with the new client.
Nonprofit funding uncertainty adds another layer to this reality. Nonprofits that depend on federal dollars are dealing with shifting guidance, changing award terms, and heightened scrutiny of how grants are used. Single audit (Uniform Guidance) compliance requires thorough and detailed familiarity with a nonprofit’s programs. Auditors build that knowledge over more than one audit cycle, and starting from zero every three years means paying for the same learning curve repeatedly.
Auditor Independence Matters
The goal behind auditor rotation addresses a legitimate concern. The board wants an auditor who remains objective and unbiased, but requiring a short tenure is a weak proxy for objectivity. Auditor independence is required for an auditor to be engaged to perform and report on an audit. Auditing standards generally accepted in the United States of America (U.S. GAAS) require auditors to be independent in fact and in appearance. A firm that performs bookkeeping or designs internal controls for a client creates a genuine threat to that independence, no matter how new the relationship is. A firm that only performs the audit and reevaluates its independence each year can serve a nonprofit for decades without compromising its judgment or objectivity.The better question for a board member to ask is not how long the auditor has performed the audit, but whether the firm has the safeguards in place that protect objectivity and independence as required by U.S. GAAS.
Best Practices
Every long-standing policy, including the auditor rotation policy, deserves a fresh look periodically. Here are a few approaches that we have seen other nonprofit organizations employ to address their auditor objectivity concerns.
Instead of following a rigid time requirement, nonprofits should evaluate the auditor against other criteria. Such an evaluation is a better approach in today’s business environment. As an alternative to a standard policy that dictates a nonprofit to “rotate audit firms every three to five years,” the board or the audit committee should review the relationship annually against measures that matter, such as independence, technical expertise, and partner availability for consultation. If the auditor meets all the criteria established by those charged with governance, the case for automatically switching simply because of elapsed time becomes weak. If there is still some hesitation about staying with the same firm, request a rotation in the lead partner role. Many firms are more than happy to accommodate this type of request from a client.
Whether the board remains with its current audit firm and requests a partner rotation or changes firms entirely, a short record of what the board considered should be documented in the meeting minutes to show funders, regulators, and future board members that the choice was deliberate.
Bottom Line
A thoughtful, well-governed auditor evaluation policy that appropriately addresses potential audit risks is much better than a rigid rotation policy that requires significant staff effort every few years and the potential for increased risk of audit failure.
For more information on nonprofit governance, risk, and best practices, please visit https://www.grfcpa.com/specialties/nonprofit-organizations/.
Related Article
What an Auditor Does and Doesn’t Do
New requirements by the American Institute of Certified Public Accountants (AICPA) and a host of related regulatory guidance issued by the Securities and Exchange Commission (SEC), the General Accounting Office (GAO, and the U.S. Department of Labor (DOL) have prompted an increased focus on auditor independence over the last decade. These days, the standards generally restrict the non-attest services like tax or consulting services that auditors may perform and the circumstances under which those services may be allowed. The increased regulations serve to muddy an already often misunderstood set of expectations.
