PCAOB Issues Guidance on Audits of Internal Control

The Public Company Accounting Oversight Board today published additional guidance to auditors on how to implement the PCAOB’s Auditing Standard No. 2, "An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements.”

The guidance consists of a Board Policy Statement Regarding Implementation of Auditing Standard No. 2 and a series of staff questions and answers. The questions and answers provide technical guidance to auditors on how to use the provisions and underlying principles of Auditing Standard No. 2 to conduct effective and cost-efficient audits of public companies’ internal control over financial reporting. The Board’s Policy Statement amplifies some of the themes in the questions and answers and articulates the Board’s policy on how it intends to administer Auditing Standard No. 2 in its oversight of the registered public accounting firms that audit public companies.

The guidance represents the PCAOB’s response to questions and concerns raised at the April 13, 2005, Roundtable on Implementation of Internal Control Reporting Provisions, hosted by the Securities and Exchange Commission and attended by the Board. At the roundtable, the Board heard directly from issuers, auditors, and investors on the front lines of implementing Section 404 of the Sarbanes-Oxley Act of 2002.

While roundtable participants generally supported the objectives of Section 404, many expressed concerns about compliance costs and offered constructive comments about how the implementation process can be improved. At the close of the roundtable, PCAOB Chairman William J. McDonough pledged that the Board would respond to some of the concerns about auditors’ implementation of Auditing Standard No. 2 by issuing additional guidance on the standard on May 16.

“It is clear to us that the internal control assessment and audit process has the potential to significantly improve the quality and reliability of financial reporting,” Mr. McDonough said. “At the same time, it is equally clear to us that the first round of internal control audits cost too much. Through the guidance we issue today, as well as our upcoming inspections, we are committed to seeing that AS No. 2 is implemented in a manner that captures the benefits of the process without unnecessary and unsustainable costs.”

Both the Board Policy Statement and the staff questions and answers focus primarily on the scope of the internal control audit and how much testing of a company’s internal control over financial reporting is required. The PCAOB identified these as the issues that primarily drive cost and therefore needed to be addressed most urgently in order to affect the 2005 audit process.

In particular, the staff questions and answers seek to correct the misimpression that certain provisions of Auditing Standard No. 2 need to be applied in a rigid manner that discourages auditors from exercising the judgment necessary to conduct an internal control audit in a manner that is both effective and cost-efficient. The Policy Statement expresses the Board's view that, to properly plan and perform an effective audit under Auditing Standard No. 2, auditors should –

• integrate their audits of internal control with their audits of the client's financial statements, so that evidence gathered and tests conducted in the context of either audit contribute to completion of both audits;
• exercise judgment to tailor their audit plans to the risks facing individual audit clients, instead of using standardized "checklists" that may not reflect an allocation of audit work weighted toward high-risk areas (and weighted against unnecessary audit focus in low-risk areas);
• use a top-down approach that begins with company-level controls, to identify for further testing only those accounts and processes that are, in fact, relevant to internal control over financial reporting, and use the risk assessment required by the standard to eliminate from further consideration those accounts that have only a remote likelihood of containing a material misstatement;
• take advantage of the significant flexibility that the standard allows to use the work of others; and
• engage in direct and timely communication with audit clients when those clients seek auditors' views on accounting or internal control issues before those clients make their own decisions on such issues, implement internal control processes under consideration, or finalize financial reports.

The Board will continue to consider issues related to the implementation of Auditing Standard No. 2. The agenda of the Board’s next meeting with its Standing Advisory Group, scheduled for June 8 and 9, will focus on implementation.

In addition, the Board continues its efforts to facilitate implementation of Auditing Standard No. 2 by the auditors of the smaller U.S. public companies and foreign companies, that, by SEC rule, need not comply with Section 404 until 2006. Among other things, the Board is participating as an observer on both the SEC’s Advisory Committee on Smaller Public Companies and the Committee of Sponsoring Organizations of the Treadway Commission initiative on Implementing the COSO Control Framework in Smaller Businesses.

Section 404 of the Sarbanes-Oxley Act and the SEC’s related implementing rules require certain companies to include in their annual reports filed with the Commission a report on management’s assessment of the effectiveness of those companies’ internal control over financial reporting. In addition, Section 404 requires these companies’ auditors to attest to and report on the internal control assessments made by management. PCAOB Auditing Standard No. 2, which refers to the auditor’s attestation as an audit of internal control over financial reporting, is the standard auditors must use to satisfy their obligations under Section 404.

The guidance is available under Standards, Staff Questions and Answers at www.pcaobus.org.