Board Proposes Revised Auditing Standard in Internal Control over Financial Reporting

The Public Company Accounting Oversight Board today voted unanimously to propose for public comment a new standard on auditing internal control over financial reporting and other related proposals.  The proposed standard would replace the Board’s existing internal control standard, Auditing Standard No. 2. 

The proposed new standard on internal control is a principles-based standard designed to focus the auditor on the most important matters, increasing the likelihood that material weaknesses will be found before they cause material misstatement of the financial statements. The proposed standard also eliminates audit requirements that are unnecessary to achieve the intended benefits, provides direction on how to scale the audit for a smaller and less complex company, and simplifies and significantly shortens the text of the standard. 

“Today’s proposal is the result of the PCAOB’s experience with the first two years of auditors’ implementation of the internal control provisions of the Sarbanes-Oxley Act,” said PCAOB Chairman Mark Olson. “The Board’s goal has been to apply the feedback we’ve received and our observations of implementation to create an auditing standard that preserves the intended benefits without resulting in unnecessary effort and costs.  We believe the new standard will result in audits that are more efficient, risk-based and scaled to the size and complexity of each company. We look forward to comments on the proposal.”

In addition to the proposed internal control standard, the Board also proposed for public comment a new auditing standard on considering and using the work performed by internal auditors, management and others in an integrated audit of financial statements and internal control, or in an audit of financial statements only. This proposed standard is intended to further clarify how and to what extent an independent auditor may use that work to reduce the work the auditor otherwise would have to perform. In addition, the Board proposed to revise the independence requirement that currently is embedded in the text of AS No. 2, which requires the auditor to seek specific pre-approval by the audit committee of any internal control related service. Finally, the Board also proposed certain changes to its other standards to conform to the changes being brought about by this rulemaking. 

 “A principal focus in developing this proposal was to retain and strengthen the substantial benefits investors have received from improved internal control over financial reporting," said Tom Ray, PCAOB Chief Auditor and Director of Professional Standards. "I believe we have proposed a standard that will achieve that objective while reducing audit effort, especially for smaller companies."

The proposed standard and related documents are available on the Board’s Web site under Rulemaking Docket 21.   

The Board will seek comments on the proposed standard and other proposals for 70 days and will carefully consider all comments received.  Comments will be posted on the Board’s Web site under Rulemaking.  Following the close of the comment period on February 26, 2007, the Board will determine whether to adopt a final standard. Any final standard adopted will be submitted to the Securities and Exchange Commission for approval.

A more detailed discussion of the matters proposed for public comment follows.

At today’s meeting the Board also adopted a rule temporarily adjusting the minimum frequency with which the Board inspects registered public accounting firms that have 100 or fewer issuer audit clients.  Public comment is also being sought on the question of whether to make this temporary adjustment permanent.  Following the close of this comment period on February 16, 2007, the Board will determine whether to make this rule permanent.  Any final rule adopted will be submitted to the Securities and Exchange Commission for approval.  The Board also adopted technical amendments to correct non-substantive points in other Board inspections rules. The adopted rule and related documents are available on the Board’s Web site under Rulemaking Docket 22.

Webcast Archive 
 

Background

In June 2003, the Securities and Exchange Commission ("SEC") implemented Section 404 of the Sarbanes-Oxley Act of 2002 (the "Act") by adopting rules requiring issuers to include in their annual reports an assessment of the company's internal control over financial reporting as well as an auditor's report on that assessment.  Soon after, as required by Sections 404(b) and 103 of the Act, the Board adopted Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements ("AS No. 2"), to apply to the newly required audits. The SEC approved AS No. 2 on June 17, 2004.

Two annual financial reporting cycles have been completed since public company auditors began applying AS No. 2 to audits of the largest public companies.  During this time, the PCAOB has closely monitored implementation of the standard and the progress auditors have made in complying with its requirements.  The PCAOB's monitoring has included gathering information during inspections of registered public accounting firms; participating, along with the SEC, in two roundtable discussions with representatives of issuers, auditors, investor groups, and others; meeting with its Standing Advisory Group; receiving feedback from participants in the Board’s Forums on Auditing on the Small Business Environment; and reviewing academic, government, and other reports and studies.

From all of these sources of information, two basic propositions have emerged.   First, the audit of internal control over financial reporting has produced significant benefits. Issuers and auditors have described a focus on corporate governance that had not existed in the past and improvements in the quality and efficiency of important corporate processes and controls. Corporate board members have noted an improvement in audit committee oversight, while investors have found public company financial reporting to be of higher quality and enhanced transparency.

Second, these benefits have come with significant cost. Over the last two years, the Board has heard a consistent message that compliance with the internal control provisions of the Act has required greater effort and resulted in higher costs than expected. The Board agrees that auditors should perform internal control audits as efficiently as possible for companies that are required by the SEC's rules to obtain an audit report on internal control.  With this in mind, the Board has evaluated every significant aspect of the audit of internal control to determine whether the existing standard encourages auditors to perform procedures that are not necessary in order to achieve the intended benefits.  The proposals result from that evaluation.

Proposed Auditing Standard - An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements.  The proposed standard would supersede AS No. 2 and is designed to focus the auditor on the matters most important to internal control; eliminate unnecessary procedures; simplify and shorten the standard by reducing detail and specificity; and make the audit more scalable for smaller and less complex companies.  Among other things, the proposed standard would:

• Direct the auditor to the most important controls and emphasize the importance of risk assessment;
• Revise the definitions of significant deficiency and material weakness, as well as the "strong indicators" of a material weakness;
• Clarify the role of materiality, including interim materiality, in the audit;
• Remove the requirement to evaluate management's process;
• Permit consideration of knowledge obtained during previous audits;
• Direct the auditor to tailor the audit to reflect the attributes of smaller and less complex companies;
• Refocus the multi-location testing requirements on risk rather than coverage; and
• Recalibrate the walkthrough requirement.

The Board is also seeking comment on certain related proposals that would facilitate the Board’s efforts to make audits of internal control more effective and efficient.  These related proposals are described below.
Proposed Auditing Standard - Considering and Using the Work of Others.  The proposed standard would supersede AU sec. 322 and the direction currently contained in AS No. 2 regarding using the work of others.  Among other things, the proposed standard would:

• Allow the auditor to appropriately use the work of others, and not just internal auditors, for both the internal control audit and the financial statement audit, eliminating a barrier to integration of the two audits;
• Encourage greater use of the work of these others by requiring auditors to evaluate whether and how to use their work to reduce auditor testing;
• Require the auditor to understand the relevant activities of these others and determine how the results of that work may affect the audit;
• Provide a single framework for using the work of others based on the auditor's evaluation of the combined competence and objectivity of others and the subject matter being tested; and
• Eliminate the explicit principal evidence provision previously included in AS No. 2.

Proposed Rule 3525 – Audit Committee Pre-approval of Services Related to Internal Control – The proposed new independence rule would replace direction currently contained in AS No. 2 regarding independence and internal control-related services.  The proposed rule is intended to ensure that audit committees are provided relevant information for them to make an informed decision on how the performance of internal control-related services may affect independence. The new rule would also recognize that audit committees may pre-approve the provision by their independent auditor of internal control-related services on an ad hoc (i.e., specific to each request) basis, or pursuant to committee-approved policies and procedures.

Proposed Amendments to the Board's Interim Standards – The Board is proposing amendments that, among other things, would:

• Simplify the internal control standard by moving certain information currently contained in AS No. 2 to other existing interim standards.  For example, the proposed amendments would move the auditor's responsibilities for management's internal control certifications under Section 302 of the Act into AU sec. 722, Interim Financial Information; and
• Change the existing requirement that "generally, the date of completion of the field work should be used as the date of the independent auditor's report" to "the auditor should date the audit report no earlier than the date on which the auditor has obtained sufficient competent evidence to support the auditor's opinion."