[The following paragraphs of AS 2201, amended to read as follows, will be effective for audits of fiscal years ending on or after December 15, 2017. See PCAOB Release No. 2017-001. The current standard can be found  here.]

Reporting on Internal Control

.85     The auditor's report on the audit of internal control over financial reporting includes the following elements¹⁸ -

Title

.85A     The auditor's report must include the title, "Report of Independent Registered Public Accounting Firm."

Addressee

.85B     The auditor's report must be addressed to the shareholders and the board of directors, or equivalents for companies not organized as corporations. The auditor's report may include additional addressees.

Opinion on the Internal Control over Financial Reporting

.85C     The first section of the auditor's report on the audit of internal control over financial reporting must include the section title "Opinion on Internal Control over Financial Reporting" and the following elements-­

a.   The name of the company whose internal control over financial reporting was audited; and

b.   The auditor's opinion on whether the company maintained, in all material respects, effective internal control over financial reporting as of the specified date, based on the control criteria.

Basis for Opinion

.85D     The second section of the auditor's report on the audit of internal control over financial reporting must include the section title "Basis for Opinion" and the following elements:

a.   A statement that management is responsible for maintaining effective internal control over financial reporting and for assessing the effectiveness of internal control over financial reporting;

b.   An identification of management's report on internal control;

c.   A statement that the auditor's responsibility is to express an opinion on the company's internal control over financial reporting based on his or her audit;

d.   A statement that the auditor is a public accounting firm registered with the Public Company Accounting Oversight Board (United States) ("PCAOB") and is required to be independent with respect to the company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB;

e.   A statement that the audit was conducted in accordance with the standards of the PCAOB;

f.   A statement that the standards of the PCAOB require that the auditor plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects;

g.   A statement that an audit included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal control based on the assessed risk, and performing such other procedures as the auditor considered necessary in the circumstances; and

h.   A statement that the auditor believes the audit provides a reasonable basis for his or her opinion. 

Definition and Limitations of Internal Control Over Financial Reporting

.85E     The third section of the auditor's report on the audit of internal control over financial reporting must include the section title "Definition and Limitations of Internal Control Over Financial Reporting " and the following elements:

a.   A definition of internal control over financial reporting as stated in paragraph .A5;

b.   A paragraph stating that, because of inherent limitations, internal control over financial reporting may not prevent or detect misstatements and that projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Signature, Location, and Date

.85F     The auditor's report must include the following elements:

a.   The signature of the auditor's firm;^18A

b.   The city and state (or city and country, in the case of non-U.S. auditors) from which the auditor's report has been issued; and

c.   The date of the audit report.

¹⁸ See Appendix C, which provides direction on modifications to the auditor's report that are required in certain circumstances.

^18ASee Regulation S-X Rule 2-02(a).

.87     The following example combined report expressing an unqualified opinion on financial statements and an unqualified opinion on internal control over financial reporting illustrates the report elements described in this section.

Report of Independent Registered Public Accounting Firm

To the shareholders and the board of directors of W Company

Opinions on the Financial Statements and Internal Control over Financial Reporting

We have audited the accompanying balance sheets of W Company (the "Company") as of December 31, 20X8 and 20X7, and the related statements of [titles of the financial statements, e.g., income, comprehensive income, stockholders' equity, and cash flows] for each of the years in the three-year period ended December 31, 20X8, and the related notes [and schedules] (collectively referred to as the "financial statements"). We also have audited the Company's internal control over financial reporting as of December 31, 20X8, based on [Identify control criteria, for example, "criteria established in Internal Control - Integrated Framework: (20XX) issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)."].

In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of the Company as of December 31, 20X8 and 20X7, and the results of its operations and its cash flows for each of the years in the three-year period ended December 31, 20X8 in conformity with accounting principles generally accepted in the United States of America. Also in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of December 31, 20X8, based on [Identify control criteria, for example, "criteria established in Internal Control - Integrated Framework: (20XX) issued by COSO."].

Basis for Opinion

The Company's management is responsible for these financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying [title of management's report]. Our responsibility is to express an opinion on the Company's financial statements and an opinion on the Company's internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) ("PCAOB") and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the financial statements included performing procedures to assess the risks of material misstatement of the financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

Definition and Limitations of Internal Control Over Financial Reporting

A company's internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company's internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company's assets that could have a material effect on the financial statements.

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Critical Audit Matters [if applicable]

[Include critical audit matters]

[Signature]

We have served as the Company's auditor since [year].

[City and State or Country]

[Date]

.88     If the auditor chooses to issue a separate report on internal control over financial reporting, he or she should add the following paragraph (immediately following the opinion paragraph) to the auditor's report on the financial statements –

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) ("PCAOB"), the Company's internal control over financial reporting as of December 31, 20X8, based on [ identify control criteria ] and our report dated [ date of report, which should be the same as the date of the report on the financial statements ] expressed [ include nature of opinion ].

The auditor also should add the following paragraph (immediately following the opinion paragraph) to the report on internal control over financial reporting –

We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States) ("PCAOB"), the [ identify financial statements ] of the Company and our report dated [ date of report, which should be the same as the date of the report on the effectiveness of internal control over financial reporting ] expressed [ include nature of opinion ].

.B16     In situations in which the SEC allows management to limit its assessment of internal control over financial reporting by excluding certain entities, the auditor may limit the audit in the same manner. In these situations, the auditor's opinion would not be affected by a scope limitation. However, the auditor should include, either in an additional explanatory paragraph or as part of the Basis for Opinion section in his or her report, a disclosure similar to management's regarding the exclusion of an entity from the scope of both management's assessment and the auditor's audit of internal control over financial reporting. Additionally, the auditor should evaluate the reasonableness of management's conclusion that the situation meets the criteria of the SEC's allowed exclusion and the appropriateness of any required disclosure related to such a limitation. If the auditor believes that management's disclosure about the limitation requires modification, the auditor should follow the same communication responsibilities that are described in paragraphs .29 through .32 of AS 4105, Reviews of Interim Financial Information. If management and the audit committee do not respond appropriately, in addition to fulfilling those responsibilities, the auditor should modify his or her report on the audit of internal control over financial reporting to include an explanatory paragraph describing the reasons why the auditor believes management's disclosure requires modification.

.C4     When disclaiming an opinion because of a scope limitation, the auditor should state that the scope of the audit was not sufficient to warrant the expression of an opinion and, in a separate paragraph or paragraphs, the substantive reasons for the disclaimer. The auditor should not identify the procedures that were performed nor include the statements describing the characteristics of an audit of internal control over financial reporting (paragraph .85D f, g, and h); to do so might overshadow the disclaimer.

[Effective pursuant to SEC Release No. 34-81916, File No. PCAOB-2017-01 (October 23, 2017)]