Spotlighting or downplaying risks? Auditor attitudes towards COVID-19 impacts as reflected in key audit matters

The inclusion of Key Audit Matters (KAMs) in the auditor's report, in accordance with ISA 701, was one of the most significant changes made to the audit reporting model in recent years (Coram and Wang, 2020; Gambetta et al., 2019; IAASB, 2015; Pérez Pérez et al., 2021; Sierra-García et al., 2019). According to the IAASB, “Key Audit Matters are those matters that, in the auditor's professional judgment, were of most significance in the audit of the financial statements”. One of the most interesting consequences of the inclusion of KAMs in the auditor's report is that this item provides a better understanding of the work performed by the auditor, detailing the most significant risks faced by the business, from the auditor's perspective. This innovation has had various consequences, not least its effect on audit quality (although opinions in this respect vary; see Lennox et al., 2023; Rautiainen et al., 2021; Shamsuddin and Mador, 2019; Seebeck and Kaya, 2023; Zeng et al., 2021) and in improving communications between auditors and stakeholders (Barghathi et al., 2021; Gambetta et al., 2023; Köhler et al., 2020; Pérez Pérez et al., 2021).

The emergence of the COVID-19 pandemic in 2020 was a real shock to the business world (Hasan et al., 2024). In response, professional bodies and regulatory institutions issued additional standards and recommendations to underpin the quality of companies' financial audits (Atkins et al., 2020). In this regard, the Big 4 accounting firms (Deloitte, EY, KPMG and PwC) issued statements on the effects of the pandemic on the auditor's work, highlighting technical issues such as the need for adjustments and impairments (inventories, fixed assets depreciation, etc.) and the implications regarding fiscal and legal monitoring (Deloitte, 2020; KPMG, 2020; PwC, 2020). These pronouncements are in line with the new standards issued by the IAASB (ISA 700 and 701) according to which new uncertainties arising from COVID-19 must be incorporated into accounting calculations.

This paper relates the two concepts mentioned above, i.e. the emergence of COVID-19 and the recognition of this circumstance by auditors in the KAMs of the audit report. The relevance of the present study is that the inclusion of COVID-19 in the KAMs benefits stakeholders by enhancing the informative value and transparency of audit reports. Therefore, the call to study how accounting responses are like (Pereira and Cerqueira, 2023) and the involvement of stakeholders during a crisis such as COVID-19 (Hasan et al., 2024; Myeza et al., 2024) is taken up, extending the vision of studying stakeholder theory from external agents to companies (Pies and Valentinov, 2024), being interesting to analyze the role of auditing firms (Kolsi et al., 2022).

In order to find out about the studies carried out on the effect of COVID-19 on the KAMs included by the auditor in the audit report, we have carried out a search in Scopus for articles published up to and including the year 2024. There are only 9 results containing the terms “COVID” and “Key Audit Matters” ^[1] in their title, abstract or keyword. These results examine how COVID-19 affects audit quality (Alharasis et al., 2024; Badawy, 2021; Hategan et al., 2022; Hegazy et al., 2022; Ramen and Saib, 2024), its relationship with the increase in KAMs (Murphy et al., 2023; Rainsbury et al., 2023) and the disclosure of audit procedures (Kend and Nguyen, 2022), and the relationship between KAMs and characteristics such as gender (Moubarak and Elamer, 2024; Murphy et al., 2023), firm size (Hategan et al., 2022; Moubarak and Elamer, 2024); work experience (Moubarak and Elamer, 2024). We can thus observe studies that address how this global crisis situation has affected audit reports in the disclosure of KAMs, our study contributing in this line, extending it by focusing on studying the possible attitudes of audit firms and studying the case of Spain, both aspects not addressed by the reviewed papers.

Therefore, the aim of this paper is to consider how audit firms have identified the effect of COVID-19 on KAM reporting in their audit reports. The study is based on a sample of annual financial statements published by the largest Spanish companies, by market capitalization, included in the IBEX-35 index in 2020. Our survey identified 107 KAMs in these reports, 26 of which referred to COVID-19 (mainly regarding companies operating in financial and consumer sectors). Of the Big 4 accounting firms, Deloitte had the highest percentage of KAMs related to COVID-19 in its audit reports. Going beyond a simple descriptive study, our qualitative analysis examines the attitudes adopted by the audit firms concerned, observing the existence of five types of attitudes regarding whether they emphasized or detracted from the business risk produced by COVID-19 to the different items incorporated in the financial statement: (1) aligned by COVID risk (the company reports a risk caused by COVID and there is a KAM indicating that such risk is linked to COVID), (2) generalist (the company reports a risk caused by COVID and there is a KAM on such risk, but without mentioning COVID), (3) conservative (there is a KAM linking a risk to COVID, but the company does not disclose information that such risk is associated with COVID), (4) aligned no COVID risk (there is a KAM without mentioning COVID, and the company has not reported that such risk is associated with COVID) and (5) potentially omissive (the company discloses a risk associated with COVID, and there is no KAM related to such risk). Our findings provide early evidence on the impact of COVID-19 on KAMs. To our knowledge, this is the first research conducted to determine the behavior of auditors in this respect, and to classify their attitudes accordingly. This study has significant implications for policymakers (for example, in assessing how auditors have communicated COVID-19-related issues), the auditors concerned (to identify the strengths and weaknesses of their approach), academia (research possibilities) and stakeholders (to characterize the value of KAM reporting during the pandemic).

The remainder of this paper is structured as follows. Following this introduction, Section 2 presents the theoretical framework and literature review. Section 3 contains the research methodology, Section 4 explains the results, and finally, the study findings are discussed and the main conclusions are presented.

Previous financial crises have demonstrated the critical role auditors play in risk communication during periods of economic uncertainty. The 2008 global financial crisis revealed significant challenges in auditor risk assessment and reporting practices, with many financial institutions requiring government support shortly after receiving unqualified audit opinions (Sikka, 2009). This crisis raised questions about auditors' expertise and their ability to provide independent and objective assessments of corporate affairs, as markets appeared to have little confidence in clean audit opinions when many financial institutions subsequently failed or required bailouts.

Research examining auditor behavior during the 2008 crisis provides valuable insights into how the profession responds to systemic risks. Studies found that auditors' going-concern reporting accuracy varied during different phases of the crisis, with Type I misclassification (issuing modified going-concern opinions for viable companies) decreasing during the crisis, while Type II misclassification (clean opinions for companies that subsequently failed) remained relatively unchanged (Sanoran, 2018). Importantly, the research showed that auditor accuracy and conservatism returned to pre-crisis levels in the post-crisis period, suggesting temporary rather than permanent changes in auditor behavior. Bank audits during the lead-up to the 2008 crisis demonstrated that auditors could recognize and respond to changing audit risks at the entity level, with audit attention shifting in line with emerging risks during 2006–2007 (Doogar et al., 2015). However, the failure to issue early warnings about increasing client risks likely reflected limitations in existing accounting and auditing standards rather than lack of auditor knowledge or attention.

The crisis also highlighted differences in auditor behavior based on firm size and type. Analysis of going-concern decisions during the global financial crisis revealed that Big 4 firms became more conservative during the crisis, issuing higher levels of going-concern opinions, with this behavior persisting for two years post-crisis before returning to normal levels (Rickling et al., 2020). In contrast, non-Big 4 firms showed no significant differences in behavior across periods.

These historical precedents provide important context for understanding auditor responses to the COVID-19 pandemic and inform our analysis of how audit firms adapted their risk communication strategies through KAMs during this unprecedented global crisis.

This research is framed within the context of attribution theory and auditor professional judgment theories, which together provide a comprehensive framework for understanding how auditors develop different attitudes toward COVID-19 risk reporting in Key Audit Matters.

Attribution theory, proposed to elucidate human behavior, involves the identification of the causes of one's own or others' behavior (Heider, 1958). When observing behavior, individuals attempt to discern whether it is driven by internal or external factors (Judge and Robbins, 2017). Behavior stemming from internal forces is believed to be within the individual's control, while behavior influenced by external forces responds to external circumstances. When applied to auditing, attribution theory explains that auditors' professional judgment and KAM identification processes are influenced by both internal factors (individual abilities, knowledge, experience, professional skepticism) and external factors (work environment, client pressures, firm methodology, regulatory requirements). Andiola et al. (2019) utilizes attribution theory to guide an exploration of how subordinate auditors understand, rationalize, and internalize recollections of their actual experiences (both worst and best) with audit review. During the COVID-19 pandemic, this theoretical framework helps explain variations in how auditors approached risk assessment and disclosure decisions when faced with unprecedented uncertainty.

Professional judgment processes provide the cognitive framework through which auditors translate risk assessments into KAM decisions. According to Gibbins (1984), professional judgment is exercised by people with experience in the area as part of their work activity. Hogarth's theory (Hogarth, 1980) models judgment comprising three elements: the person (auditor), the task environment, and the resulting actions. Within the task environment is the person's schema, created by memory and task characteristics. Judgment follows information processing through acquisition, evaluation, and combination stages. COVID-19 presented auditors with novel risk factors that required adaptation of existing schemas, leading to different approaches to risk evaluation. The auditor makes KAM judgments according to experience, best practices, audit strategy, and entity characteristics (Sierra-García et al., 2019). However, the pandemic's unprecedented nature created cognitive processing variations as auditors had to evaluate risks that were not part of their established professional frameworks.

Together, these theoretical perspectives explain how the interaction between internal attribution factors (auditor experience, professional judgment capabilities) and external attribution factors (client pressures, firm methodology, crisis context) influences auditor decision-making processes during crisis periods. The pandemic provides a unique context for examining how attribution processes operate when auditors face unprecedented judgmental challenges.

There are some previous studies have that analyzed the impact of COVID-19 on auditing. Hay et al. (2021) found that it did not substantially affect audit outcomes in New Zealand and expect this pandemic to be followed by auditing reforms, including changes to non-audit services, inspection report publication and going concern reporting by directors, thus increasing auditors' responsibilities. Potential areas for future reform include auditor's liability, the disclosure of internal controls, fraud-prevention obligations and other aspects of corporate governance. Though the full effects of the pandemic are still unfolding, the results observed to date suggest that the auditors and users of financial reports should ready themselves for regulatory shifts. In this respect, Diab (2021) observed that the COVID-19 pandemic produced major implications for audit and assurance processes, together with new forms of fraud risk, requiring changes to risk assessment procedures, accounting estimates and existing audit plans. All of these developments will affect the handling of future events and the nature of opinions issued by auditors. These authors emphasized that auditors and standard setters need to adapt audit procedures to address the exceptional shifts in the business landscape driven by the COVID-19 crisis. Moreover, their study results underline the need to modify the audit process itself to maintain its applicability during and after the disruption caused by the pandemic. In a similar vein, Khalil (2024) studies the impact of changes in audit processes during the COVID 19 pandemic on auditors' deviant behavior, and his results showed a significant positive association between changes in audit processes and an increased perception of deviant audit behavior. Finally, Deb and Chakraborty (2020) concluded that the COVID-19 pandemic had created significant uncertainty and posed important new challenges for corporate financial reporting and auditing. This uncertainty affects both the application of accounting principles to the preparation of financial statements and their subsequent auditing. Henceforth, auditors are likely to pay special attention to areas such as going concern assessment, inventory valuation, asset impairment, the measurement of assets (property plant and equipment, investments, intangibles), lease accounting, revenue recognition, cash flow and tax obligations.

In addition to the above, a small number of studies have considered the impact of COVID on KAMs. According to Badawy (2021) the inclusion of a KAM paragraph regarding the impact of the COVID-19 pandemic did not have a significant effect on the perceived quality of interim financial reports. The researcher suggested this absence of reaction may be because a generic COVID-19 KAM disclosure does not provide company-specific insights beyond what is already presented in the interim report. Although Alharasis et al. (2024), in their study on Jordanian companies before and after 2020, did find a positive relationship between COVID-19 and audit quality, with increased KAM disclosure, workload and auditor accountability. Also, Murphy et al. (2023) found an increase in KAMs disclosure after COVID-19. Rainsbury et al. (2023) examined how auditors in New Zealand responded to regulatory guidance to communicate COVID-19 impacts on KAMs. Considering a sample of listed companies, these authors recorded an increase in the number and length of KAMs disclosed in 2020 compared to 2019, with 82% of companies addressing the question of COVID-19 impacts. In terms of accounting standards, the following featured strongly in COVID-19 related KAMs: inventories, PPE, impairment, investment property, revenue recognition and leases. Finally, Hategan et al. (2022) investigated how auditors identified and reported on the impacts of COVID-19 in terms of the KAMs included in their reports, together with the factors influencing these disclosures. Their analysis of European listed company reports for 2019–2020 identified a direct positive relationship between the number of KAMs, auditor size, the frequency of COVID-19 events and going-concern uncertainty. These findings enhance our understanding of the auditor's responsibility in the reporting of pandemic impacts, such as the increased investment in digitization and the greater use of teleworking. In addition, the regulators relaxed some reporting timelines during the pandemic.

Previous literature has shown that there are a number of alternatives in audit work, with auditors' attitudes being key in the choice of these alternatives. Bamber et al. (1997) studied auditors' attitudes to evidence, establishing different alternatives on evaluating evidence to confirm or disconfirm the initial hypothesis and on whether or not to support the financial statements. Dowling (2009) found different auditor attitudes to using an audit support system, and how 3 of the Big-4 (for confidentiality reasons he could not say which ones) started the process of developing more restrictive support systems. Xu et al. (2013) raised and studied two possible strategies ^[2] to be considered by audit firms in Australia following the 2008 financial crisis, being to issue modified audit reports (they saw such a strategy increase with audit reports with going-concern opinions) and to increase audit effort (with results showing an increase in fees, but no delays in reporting). And focusing on the disclosure of KAMs. Sierra-García et al. (2019) found differences among the Big-4 as Deloitte, EY and KPMG tend to report less entity-level risk KAMs than PwC, while KPMG report less account-level risk KAMs than PwC. In this line, Francis et al. (2014) explain that the Big 4 accounting firms each have their own approach to implementing generally accepted auditing standards (GAAS) and interpreting generally accepted accounting principles (GAAP), leading to a distinct “audit style” for each firm (Cushing and Loebbecke, 1986). In essence, they apply individualized audit methodologies and testing procedures. Auditors differ not just in their methods, but also in aspects like human capital investments (e.g. recruitment, retraining programmes) (Samagaio and Rodrigues, 2016), salary structures and internal initiatives to ensure standardized auditing across engagements (Francis et al., 2014). Additionally, some audit firms distinguish themselves by cultivating unique organizational cultures, particularly regarding risk orientation. Kend and Nguyen (2022) found that during COVID-19, most smaller audit firms disclosed substantially fewer risk-adjusted audit procedures related to the pandemic than the Big 4 firms.

In view of the theoretical framework adopted and the literature review performed, we pose the following research question:

The analysis performed in this study is based on the reports published by the 35 largest companies, by market capitalization, in the Spanish IBEX-35 index in 2020. One of these companies (Arcelormittal) was excluded from consideration because the requisite information was not available to the National Securities Market Commission (Comisión Nacional del Mercado de Valores, CNMV). Thus, content analyses were carried out on the remaining 34 companies, seeking to identify auditors' attitudes towards COVID-related risks. In taking this sample, the main Spanish companies are being evaluated by market capitalization, which are usually taken as a reference and the sample has a certain homogeneity as they are all headquartered in the same country and have a similar size.

Specifically, two content analyses are carried out for the 2020 financial year: (1) Audit Report of the Consolidated Annual Accounts (information prepared by the auditor); (2) Consolidated Annual Accounts and Consolidated Management Report (information prepared by the company).

The content analysis performed on the information contained in the 34 audit reports focused on the assessments made for each KAM and whether the COVID-19 pandemic was acknowledged. When a reference to the pandemic was made, we distinguished between its inclusion in the title or only within the text. The auditor's name and that of the audit firm were also recorded.

For the content analysis carried out on the information prepared by the company (Consolidated Annual Accounts and Consolidated Management Report), searches were carried out using the following terms: (1) Covid, (2) Coronavirus, (3) SARS, (4) Pandemic, (5) Epidemic, (6) Sanitary, (7) Confinement; (8) Alarm (state of).

Once information related to COVID-19 had been identified in the above terms, an analysis was performed to determine whether this information identified a risk to the company's financial situation and/or a negative impact in this respect. To code this information, a value of 1 was assigned when the company did not make any monetary quantification of the impact caused by COVID-19, and a value of 2 when such a monetary quantification was made. In addition, we distinguished between the two locations in which this information might appear, namely the Annual Accounts or the Management Report.

When carrying out the content analysis of the Management Reports, the Non-Financial Information (NFI) Statement was analyzed even if it was in a separate report (this option is permitted under Law 11/2018 in application of Directive, 2014/95/EU, although the NFI Statement continues to be part of the Management Report). However, the section dedicated to the Corporate Governance Report was excluded because this statement is highly standardized and is not expected to present major informative differences between companies.

Based on the data obtained by the two content analyses (Audit Report and Annual Accounts and/or Management Report), 5 categories are obtained on the relationship between the disclosure or non-disclosure of a COVID risk in a KAM and the information issued by the company, thus defining the attitudes of the auditor when considering the company's disclosure regarding COVID-19-related effects (see Table 1):

1. Aligned by COVID risk: when, in the information prepared by the company, we identify a COVID-19-related risk or negative aspect for the company's equity, and regarding which there exists a KAM in the Audit Report. This attitude is termed “Aligned by COVID risk”, as company and auditor both acknowledge the presence of this risk.

2. Conservative: when a KAM regarding COVID-19 is included in the Audit Report, but the information prepared by the company does not identify any information concerning this KAM that represents a COVID-19-related risk or negative aspect for the company's equity. This attitude is termed “Conservative” as the auditor is being conservative/prudent in flagging the presence of such a risk, but the company does not acknowledge this danger.

3. Generalist: when, the company identifies a COVID-19-related risk or negative aspect for the company's equity, about which there is a KAM in the Audit Report, but this KAM does not explicitly mention COVID-19. This attitude is termed “Generalist” because, although the company reports a risk and suggests that COVID is an associated factor, and the auditor acknowledges the existence of such a risk/adversity, no direct link to COVID-19 is established (in other words, it is generalist in the KAM description).

4. Aligned by No COVID Risk: when a KAM is included in the Audit Report but does not mention COVID-19, and when the information prepared by the company does not identify COVID-19 as a factor related to this KAM. This attitude is termed “Aligned by No COVID Risk” because the company and the auditor agree that this risk is not considered to be linked to COVID-19.

5. Potentially Omissive: when, from the information supplied by the company, we identify a COVID-19-related risk/adversity, while in the Audit Report there is no KAM related to this information. In these cases, we conducted a further examination to assess the risk/adversity indicated by the company, via the following analyses:

   • Analysis of the materiality of the information identified in the Annual Accounts and/or Management Report. Any amount associated with COVID that represents more than 0.5% of total assets/turnover (depending on the type of data, whether assets or liabilities, or income or expenses) or more than 5% of profit or loss for the year (only in the case of data relating to income and expenses) is considered material. These percentages are commonly used in practice as they align with ISA 320.A8 (IAASB, 2008).

   • Of the material cases, the evolution over successive years is studied to determine whether the above materiality persists and whether a KAM in this respect is included in a future Audit Report.

   • Analysis of the audit reports of the annual accounts of the firm's main competitors to detect any KAM on the aspects identified.

When the above three analyses of the risk identified in the information prepared by the company were fulfilled, and the auditor had not included a KAM to this effect, but one was published by competing firms, we term this attitude “Potentially Omissive”, as the auditor might be omitting a risk/adversity that is relevant to the company's asset situation.

Annex 1 shows a clarifying example of each attitude described, except for the “Potentially omissive” attitude, whose two identified cases are explained in the following section due to their relevance.

The 34 audit reports considered were all favorable, in that there were no paragraphs of qualifications to analyze. Three contained paragraphs of added emphasis; two of these cases were related to the COVID-19 pandemic (indicating the note in the annual accounts where the company informed about the impact of COVID-19). Accordingly, our content analysis focused on the KAMs in particular.

In total, the 34 reports analyzed contained 107 KAMs (see Table 2). Three reports contained only one KAM, while seven contained five KAMs. In the most common case (eleven reports) there were three KAMs. These results, which show an average slightly higher than three KAMs per company, are consistent with previous studies (Gambetta et al., 2019; Pérez Pérez et al., 2021), that is, there is no significant increase in the number of KAMs due to the COVID-19 pandemic.

Of the 107 KAMs, 26 mention COVID-19 (2 in the title of the KAM itself and 24 in the explanation of the KAM). These 26 KAMs only concern 14 reports, i.e. in 20 audit reports there is no KAM mentioning COVID-19, although two contain an emphasis paragraph related to COVID-19, as explained above.

As Table 3 shows, the pattern of KAM attention to COVID-related issues differs according to the business sector in question. Using the sector classification indicated on the Madrid Stock Exchange website, we found that the audit reports of the consolidated annual accounts of all six companies in the “Financial Services” sector and those of all three companies in the “Consumer Services” sector had KAMs mentioning COVID-19, while in the other five sectors there was only one company whose audit report included KAMs mentioning COVID-19. Table 3 also shows the distribution of the KAMs in our study that mention COVID. Most of these (18/26) correspond to the audit reports of the companies in the “Financial Services” and “Consumer Services” sectors (11 and 7 KAMs, respectively). By percentages of COVID mentions, by business sector, the most noteworthy finding is that 70% of the KAMs in the “Consumer Services” sector mention COVID. This is followed by 44% of those in the “Financial Services” sector, while in the “Oil and Energy” and “Basic Materials, Industry and Construction” sectors, the respective values are only 4.3% and 7.7%. Overall, 24.3% of the KAMs mention the pandemic.

A further analysis considered the possible association between the KAMs included and the Big 4 firm producing the audit report. As shown in Table 4, all of these firms produce some reports with at least one KAM that mentions COVID-19 and others in which no such mention is made. EY produced the fewest audit reports that included at least one KAM with a mention of COVID-19 (which accounted for only two of the eight reports produced by this firm). By contrast, three of the five reports by DELOITTE included at least one KAM with a mention of COVID-19 (with, in total, six KAMs). With respect to the 26 KAMs that allude to COVID, the distribution according to the audit firm issuing the report is very similar: thus, PwC and KPMG account for seven KAMs each, while Deloitte is again pre-eminent, with 50% of its KAMs mentioning COVID. Finally, the above-mentioned two paragraphs of emphasis referring to COVID, included in audit reports in which there were no KAMs mentioning COVID, were produced by PwC and EY.

The data analyzed for the 34 companies, in their Consolidated Annual Accounts or in their Consolidated Management Report, included 33 information items on risks or adverse situations for company equity in relation to the COVID-19 pandemic. Considering only the information included in the Consolidated Annual Accounts, there were 31 cases, while considering only the Consolidated Management Report, there were 32. Table 5 shows that 30 companies reported this information in both statements, with the remaining four reporting in only one or in neither.

The following results were obtained from company-supplied information and from the KAMs identifying COVID-related risks and/or negative impacts on equity:

1. For 59 of the 107 KAMs in the 34 reports analyzed, the company published COVID-related information that was directly linked to the KAM in question. These 59 cases are distributed among 29 of the 34 reports analyzed, so this circumstance is observed in 85% of the sample. These 59 cases can be divided according to whether or not the KAM mentions COVID:

   • In 23 cases, the KAM mentions COVID, and is therefore considered representative of a COVID Risk Aligned Attitude, as both the company and the audit firm mention COVID-19 as a risk/adversity factor.

   • In the remaining 36 cases, the KAM does not mention COVID, and is considered representative of a Generalist Attitude, because the audit firm, when defining the risks/adversities faced, does not stipulate COVID-19 as a factor, unlike the company itself.

2. For the remaining 48 KAMs, we did not record any COVID-related information provided by the company in relation to the KAM in question. This absence of COVID-related information with respect to a KAM was observed in 26 of the 34 reports analyzed (76% of the sample). Of the 48 cases in which there was a KAM but where we had no information from the company that COVID-19 posed a risk/adversity, two situations can be distinguished:

   • In 45 cases, the KAM does not mention COVID. These cases can be considered to present an Aligned Attitude of No COVID Risk, as neither the company nor the auditor consider COVID to be a relevant factor.

   • In the remaining three cases, there is a KAM that mentions COVID, but the information prepared by the company did not enable us to identify COVID as a risk factor. These cases, therefore, represent a Conservative Attitude, as the auditor highlights a COVID risk that the company does not identify as such.

3. In 33 of the 34 reports analyzed, there is no COVID-related KAM in the audit report but the company discloses COVID-related information that represents a risk or adversity to the equity position. As discussed in the methodology section, a more detailed analysis was performed to assess such risks/adversities, consisting of three steps: (1) determining whether the value is material; (2) whether the risk/adversity continued to exist in the following years; (3) whether there is a related KAM in the audit reports of the annual accounts of the company's main competitors. After considering these three criteria, two cases remained, which we identified as representing a Potentially Omissive attitude, in that the auditor might have omitted a risk/adversity that was relevant to the company's equity situation. These two cases are the following:

   • AENA: The consolidated annual reports of Spanish airport operator AENA S.M.E. S.A. for the years 2020–2022 highlighted substantial exceptional expenditures resulting from the COVID-19 pandemic. Specifically, the reports showed 53 million euros in 2020, 114.7 million euros in 2021, and 61.2 million euros in 2022 of exceptional pandemic-related costs. These amounts represented 2.43%, 4.95%, and 1.46% of the company's total revenue in those years, indicating material impacts. The exceptional expenditures contributed to net losses in 2020 and 2021. Had these pandemic costs not been incurred, AENA would have been profitable in 2021 and achieved 33% better results in 2020. Despite this clear business risk disclosed in the financial statements regarding exceptional pandemic impacts, the external audit firm KPMG did not include any related key audit matters in its independent auditor reports for AENA over 2020–2022. However, the audit reports issued by PwC for main competitor Heathrow Airport Holdings Limited in 2020 and 2021 did contain a key audit matter specifically addressing exceptional COVID-19 costs. The omission of this issue by KPMG is concerning given the financial materiality of these expenses for AENA throughout the pandemic period and their potential to significantly obscure underlying performance trends in the coming years as aviation recovers. The magnitude of these costs and their distortive impacts on the financial statements warrant greater auditor attention.

   • GRIFOLS: The 2020 annual report for Spanish biopharmaceutical firm Grifols S.A. revealed a 205-million-euro write-down of inventory, equaling 3.84% of total revenue, driven by decreased inventory turnover resulting from the COVID-19 pandemic. This substantial adjustment was cited in the financial statements as materially reducing Grifols' reported gross margin for the year. Had the inventory write-down been excluded, Grifols' income would have been 28.91% higher in 2020 based on the figures provided. The company also quantified a total negative EBIT impact from the pandemic of 155 million euros, indicating 21.86% stronger earnings had COVID-19 not occurred. While Grifols' inventory turnover improved in 2021, pandemic-related inventory constraints persisted. The company considered any inventory adjustments in 2021 as immaterial without reporting specific amounts. The external audit firm KPMG did not report any key audit matters related to inventory risks in its independent auditor reports for Grifols over 2020–2022. However, rival firm CLS's auditor EY did include pandemic-driven inventory issues as a key audit matter for 2020 through 2022. Given the clear inventory risks and financial distortions introduced by COVID-19 based on the disclosure, more extensive auditor examination of this area appears necessary for Grifols rather than wholly overlooking the issue.

Table 6 summarizes the examples obtained of each of the different auditor attitudes, according to whether COVID-related risk information was identified in the information prepared by the company and whether a KAM to this effect was produced (and if so, whether COVID is mentioned). Thus, each quadrant of the table indicates the type of attitude involved and the number of cases identified.

Continuing with the combinations of the content analyses, Table 7 shows the breakdown by audit firm of the 109 cases of attitudes identified (the 107 derived from the attitude adopted by the auditor when issuing a KAM plus the two cases in which there is no KAM, which could represent an omissive attitude). The table, therefore, shows the number of attitudes broken down by type according to each firm and the percentage of this value to the total number of attitudes identified in each firm within the total sample. Some common patterns can be observed in these four audit firms: the Aligned attitude predominates (although as we indicate later, it is not always the same type of alignment that is most common), and the Potentially Omissive and Conservative attitudes are the least common (the former only appears in KPMG and in each firm the sum of the two attitudes is less than 10%). The firm that differs the most from the rest is Deloitte; this auditor presents the lowest value for Generalist attitude (three cases, representing 25% of the cases corresponding to this firm, while for the other firms this value is close to or exceeds 30%) and it is the firm where the attitude “Aligned by no Covid risk” is less frequent, i.e. neither the company nor the auditor consider there to be a COVID-associated risk (in the other firms, the value for this attitude ranges between 42% and 44%). In Deloitte, the most common attitude is “Aligned by Covid risk” (applicable to 42% of cases, while for the other firms, this value ranges between 17% and 22%).

Table 8 presents the breakdown by sector of the 109 cases in which attitudes were identified. Once again, the number of cases is accompanied by the percentage that this value represents of the total number of cases identified in the companies analyzed belonging to that sector. As with the behavior broken down by audit firm, the least common attitudes by sector are Potentially Omissive and Conservative (only three sectors have these attitudes, with one case of Potentially Omissive in the “Consumer Services” sector, one case of both attitudes in the “Consumer Goods” sector and two cases of a Conservative attitude in the “Financial Services” sector). However, in contrast to what was observed in our analysis of attitudes according to the audit firm, when analyzing the cases by sector, no single attitude was identified as being the most common, as each of the other three attitudes shows the highest value in one or more of the sectors: thus, the Generalist Attitude is most common in the “Consumer Goods” (36%) and “Technology and Communications” (50%) sectors; that of Aligned by COVID risk in the sectors “Consumer Services” (64%) and “Financial Services” (36%); and that of Aligned by No COVID as a risk factor in the “Basic Materials, Industry and Construction” (54%), “Oil and Energy” (65%) and “Real Estate Services” (67%) sectors.

This study was conducted to examine how auditors identified and reported the impacts of the COVID-19 pandemic as key audit matters (KAMs) in their audit reports of Spanish IBEX-35 listed companies in 2020. To do so, we analyzed the possible attitudes by comparing the COVID-19 risk disclosures made by companies in their annual reports, and the inclusion of related KAMs by auditors, in order to find out whether COVID-19 risk was being highlighted or downplayed through the KAMs disclosed.

This analysis showed that of the 107 KAMs identified, 26 (24.3%) referred to COVID-19, and that most referred to the financial and consumer services sectors. Further qualitative analysis revealed five categories of auditor attitudes regarding COVID-19 risk alignment between KAMs and companies' own reports, ranging from fully aligned to potentially omitting risks. The most common aligned attitudes were those of the auditors being generalists towards risks and liabilities despite company reports of COVID-associated risks (33% of cases) and that of both parties agreeing on the absence of pandemic-related impacts (41% of cases).

The concentration of COVID-19 related KAMs in specific sectors reflects the differential impact of the pandemic across industries and varying stakeholder expectations for transparency. Our findings show that 100% of Financial Services and Consumer Services companies included COVID-19 KAMs, compared to much lower percentages in other sectors.

Financial Services firms faced immediate regulatory scrutiny regarding loan loss provisioning, credit risk assessment, and going concern evaluations during the pandemic. The sector's systemic importance and heavy regulation created external attribution pressures that made COVID-19 risk disclosure unavoidable. Additionally, the sector's expertise in risk management meant auditors had established frameworks for identifying and communicating emerging risks, facilitating more comprehensive COVID-19 KAM reporting.

Consumer Services companies experienced direct operational disruption through lockdowns, travel restrictions, and changing consumer behavior. The visible nature of this impact to stakeholders created external pressures for transparent risk communication. In contrast, sectors like Oil and Energy and Basic Materials faced COVID-19 impacts that were less immediate or visible to stakeholders, reducing external pressures for specific pandemic-related KAM disclosure.

These sectoral patterns align with the prediction that companies in industries with higher public visibility and stakeholder sensitivity will provide more extensive crisis-related disclosures to maintain legitimacy during periods of uncertainty.

Our analysis reveals systematic differences between Big 4 firms in their approach to COVID-19 KAM reporting, with Deloitte showing the most proactive stance (60% of reports included COVID-19 KAMs, representing 50% of total COVID-related KAMs). These differences reflect varying audit methodologies, risk tolerance, and internal guidance regarding emerging risk identification.

Larger audit firms like Deloitte may have had more resources to develop COVID-19 specific audit guidance quickly, enabling more systematic identification of pandemic-related risks. The firm's more conservative approach may also reflect lower tolerance for potential criticism regarding omitted risks, consistent with attribution theory's prediction that external reputation pressures influence professional judgment outcomes.

The variation between Big 4 firms demonstrates that even within similar organizational contexts, internal attribution factors (firm culture, methodology, partner experience) significantly influence professional judgment outcomes. This finding has important implications for audit quality consistency across firms during crisis periods.

The study results provide early evidence on Spanish auditor COVID-19 reporting quality in terms of the use of KAMs. The widespread inclusion of pandemic impacts as a KAM enhances transparency for stakeholders regarding significant business uncertainties and auditor risk assessments. These findings suggest that in this context auditors largely adopted a balanced approach, emphasizing issues that were also identified as material risks by company management.

However, the variability observed in the approaches adopted by the Big 4 audit firms indicates further regulatory guidance may be needed to promote standardized COVID-related KAM disclosures. To our knowledge, this is the first study to categorize auditor attitudes based on risk alignment with company information. The taxonomy we propose facilitates a detailed analysis of pandemic reporting alignment and helps identify potential omissions.

This research makes several important contributions to academic literature on the impact of the COVID-19 pandemic on auditing and financial reporting. Firstly, this is a pioneering investigation of COVID-19 references in key audit matters, in the international sphere. Our exploration of Spanish auditor risk reporting alignment builds on emerging KAM-pandemic research in New Zealand (Rainsbury et al., 2023) and elsewhere in Europe (Hategan et al., 2022). Secondly, our proposed taxonomy of auditor attitudes based on management disclosure alignment addresses calls for a more granular analysis of variability in COVID-related KAM quality. This categorized spectrum enriches the conceptual literature on the assessment of crisis risk reporting, and results obtained by studying the response to a crisis such as the one generated by COVID-19 could be applied to other critical scenarios such as the war in Ukraine or the Middle East.

Our findings also provide interesting parallels and contrasts with auditor behavior during previous crises. Unlike the 2008 financial crisis, where many institutions received clean audit opinions shortly before requiring government support (Sikka, 2009), the COVID-19 pandemic saw more proactive risk communication through KAMs. This suggests an evolution in auditor risk reporting practices, potentially influenced by lessons learned from previous crises and the introduction of enhanced audit reporting standards.

Similar to findings from the 2008 crisis where auditors demonstrated ability to recognize emerging risks but were limited by reporting standards (Doogar et al., 2015), our study shows that auditors possessed sufficient knowledge about COVID-19 impacts but varied in their approach to communicating these risks through KAMs. The introduction of KAMs appears to have provided auditors with a more effective mechanism for communicating emerging risks compared to the limited options available during the 2008 crisis.

Finally, our theoretical framing approach, which considers attribution theory and professional judgment perspectives, strengthens the understanding of how internal and external factors influence auditor decision-making during crisis periods. Moreover, these findings reinforce normative demands for transparent COVID-19 risk communication in order to maintain public trust. When observing the results of this work, evidence supporting attribution theory is obtained, since most of the KAMs that mention COVID-19 risk are concentrated in two high-risk sectors (consumer services and financial services), where external attribution pressures were strongest. Additionally, the cases of conservative strategy occurred in these sectors, where through KAMs, COVID risk has been highlighted beyond what is reported by the company, suggesting that external reputation pressures influenced auditor professional judgment.

The study results provide interesting insights into “audit style” differences between the Big 4 firms concerning the prevalence of certain categories of COVID-19 risk attitude alignment. For example, Deloitte displays a distinct style, with a stronger emphasis on aligned by COVID-19 risk attitudes compared to the other Big 4 players. From this, we conclude that Deloitte took a relatively proactive approach towards signaling emerging pandemic impacts via KAMs when this risk was also reported by their clients. Overall, however, all of the Big 4 firms presented a largely balanced approach, with generalist and no COVID-19 risk alignment attitudes predominant. This middle-of-the-road attitude shows that while audit methodologies may differ, the core judgment processes employed usually led auditors to highlight pandemic impacts only when these were also viewed as material risks by the companies involved.

In essence, the variability detected shows that these multinational organizations have certain slight but meaningful differences in their “audit style” – such as their conservatism or otherwise – when assessing the materiality of emerging risks like COVID-19. Nevertheless, substantially harmonized judgments remain at the core of their KAM decision-making frameworks. This finding aligns with attribution theory's prediction that while external pressures create some convergence in professional judgment outcomes, internal factors (firm methodology, auditor experience) still create meaningful variations.

The results we present have significant implications for auditing policy and practice during crisis events, given the increasingly central role played by KAMs in auditors' communications. Our framework helps assess the level of auditor conservatism versus the potential under-reporting of emerging risks. Standards setters and regulators, too, may consider these findings in their evaluation of audit reporting quality, when examining disclosure alignments. Our taxonomy of auditor attitudes provides an analytical lens for future research into reporting variability. Among the limitations to which this exploratory research is subject is its exclusive focus on Spanish listed firms, together with its reliance on content analysis and not also taking into account user perceptions or market reactions.

Our findings from the COVID-19 pandemic provide important insights into auditor behavior and regulatory frameworks during future global crises. The variability in auditor attitudes observed during COVID-19 suggests several areas where regulatory guidance and audit practice improvements could enhance crisis risk communication consistency and quality.

Based on our taxonomy of auditor attitudes, we propose several specific improvements to auditing standards and regulatory guidance for crisis periods:

First, audit standards should require explicit disclosure of whether KAMs represent new risks arising from crisis events or modifications of pre-existing risks. Our analysis revealed that auditors varied significantly in how they linked COVID-19 to traditional risk areas, leading to “Generalist” attitudes that obscured the pandemic's specific impacts. Clear guidance requiring auditors to distinguish between crisis-specific and ongoing risks would improve transparency.

Second, regulators should establish minimum disclosure thresholds for crisis-related risks based on materiality and industry impact. Our finding that sectors like Financial Services and Consumer Services showed 100% COVID-19 KAM inclusion while others showed minimal coverage suggests that industry-specific guidance could reduce the “Potentially Omissive” attitudes we observed. This approach builds on lessons from the 2008 financial crisis, where post-crisis regulatory reforms emphasized sector-specific risk disclosure requirements (Xu et al., 2013).

Third, audit firms should be required to provide more detailed explanations of their risk assessment methodologies during crisis periods. The significant differences between Big 4 firms in COVID-19 KAM reporting suggest that current professional judgment guidance may be insufficient during unprecedented events. Enhanced methodology disclosure would help stakeholders understand the attribution factors influencing auditor decisions.

The COVID-19 experience demonstrates the need for more dynamic and responsive audit approaches during global crises. Future crises—whether health pandemics, geopolitical conflicts like those in Ukraine or the Middle East, climate disasters, or cyber security threats—will likely present similar challenges of uncertainty and rapid change that test traditional audit frameworks.

Our attribution theory findings suggest that audit firms should develop standardized internal protocols for emerging risk identification that reduce reliance on individual auditor judgment during high-stress periods. The variation we observed between firms indicates that those with more systematic crisis response protocols (like Deloitte's more proactive approach) may provide more consistent risk communication.

Additionally, the temporal evolution we observed—with ELRKAM decreasing and ALRKAM increasing over the study period—suggests that KAM reporting evolves as understanding of crisis impacts matures. This pattern implies that audit standards should explicitly acknowledge the iterative nature of crisis risk assessment and encourage auditors to update their KAM approaches as new information becomes available.

Historical evidence from previous financial crises supports the need for proactive regulatory intervention. Following the 2008 financial crisis, Xu et al. (2013) found that audit firms adopted strategies including issuing modified audit reports and increasing audit effort, but these responses were reactive rather than systematic. The COVID-19 experience suggests that pre-established crisis protocols could improve response speed and consistency.

The 2008 crisis led to significant regulatory changes including enhanced going concern reporting requirements and expanded auditor responsibilities (Hay et al., 2021). Similarly, our findings suggest that the COVID-19 pandemic should prompt regulatory evolution toward more structured crisis risk reporting requirements. However, unlike post-2008 reforms that focused primarily on financial sector issues, COVID-19's broad economic impact suggests the need for comprehensive cross-sector guidance.

Our taxonomy of auditor attitudes provides a framework that could be applied to evaluate auditor responses during future crises. The “Aligned,” “Conservative,” “Generalist,” and “Potentially Omissive” categories represent fundamental approaches to balancing professional judgment with external pressures that are likely to recur across different crisis contexts.

For example, during geopolitical crises like the Ukraine conflict, auditors face similar challenges in assessing supply chain disruptions, sanctions impacts, and going concern considerations. Our framework could help identify whether auditors are providing “Conservative” disclosure of war-related risks or adopting “Generalist” approaches that obscure specific geopolitical impacts.

Climate change presents another application context where our framework could assess whether auditors adequately communicate transition risks, physical risks, and stranded asset concerns, or whether external pressures lead to “Potentially Omissive” attitudes regarding climate-related uncertainties.

The key insight from our COVID-19 analysis is that external attribution pressures (regulatory expectations, client relationships, reputational concerns) significantly influence professional judgment outcomes during crisis periods. Future research and regulatory development should focus on structures that optimize these external pressures to promote transparent risk communication while maintaining auditor independence.

While our qualitative taxonomy provides valuable insights into auditor attitudes during the COVID-19 crisis, the limited sample size (34 companies, 26 COVID-related KAMs) prevents us from conducting statistical significance tests that would strengthen our findings. The descriptive nature of our analysis means that observed patterns, while theoretically grounded, cannot be generalized beyond our sample with statistical confidence.

The concentration of COVID-19 KAMs in specific sectors and audit firms reflects meaningful patterns, but larger samples would be needed to establish statistical significance and control for potential confounding factors such as company size, financial health, or auditor tenure. Future research could employ quantitative approaches with larger datasets to test the relationships we observe qualitatively.

Additionally, our focus on Spanish IBEX-35 companies may limit generalizability to other institutional contexts where audit practices, regulatory requirements, or crisis communication expectations differ.

Future studies could build on these auditor attitude categories to investigate the question of reporting alignment for other events affecting diverse institutional contexts, using mixed methods. In short, the present study highlights the need for clearer guidelines on auditor responsibilities to ensure that significant risk issues are transparently communicated through key audit matters.

The supplementary material for this article can be found online.