AS 6115: Reporting on Whether a Previously Reported Material Weakness Continues to Exist

Amendments to paragraphs .21 and .38 have been adopted by the PCAOB and approved by the U.S. Securities and Exchange Commission. The amendments will be effective for audits of financial statements for fiscal years beginning on or after December 15, 2024. See PCAOB Release No. 2024-004, SEC Release No. 34-100773. View the standard as amended.

Adopting Release: PCAOB Release No. 2005-015

Amendments: Amending releases and related SEC approval orders

Summary Table of Contents

.01 Applicability of Standard
.05 Auditor's Objective in an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist
.07 Conditions for Engagement Performance
.09 Framework and Definitions for Evaluation
.18 Performing an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist
.44 Requirement for Written Representations
.47 Documentation Requirements
.48 Reporting on Whether a Previously Reported Material Weakness Continues To Exist
.65 Effective Date
Appendix A - Illustrative Reports on Whether a Previously Reported Material Weakness Continues to Exist
Appendix B - Background and Basis for Conclusions

Applicability of Standard

.01 This standard establishes requirements and provides direction that apply when an auditor is engaged to report on whether a previously reported material weakness in internal control over financial reporting (hereinafter referred to as a material weakness) continues to exist as of a date specified by management.

Note 1: In this context, previously reported material weakness means a material weakness that was described previously in an auditor's report issued pursuant to AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.

Note 2: The date specified by management as the date that the previously reported material weakness no longer exists must be a date after the date of management's most recent annual assessment.

.02 An auditor may conduct an engagement to report on whether a previously reported material weakness continues to exist if (1) the auditor has audited the company's financial statements and internal control over financial reporting in accordance withAS 2201 as of the date of the company's most recent annual assessment of internal control over financial reporting, or (2) the auditor has been engaged to perform an audit of the financial statements and internal control over financial reporting in accordance with AS 2201 in the current year and has a sufficient basis for performing this engagement. (See paragraph .26 of this standard for additional requirements that apply specifically to a successor auditor's application of this standard.)

Note: References in this standard to the company's most recent annual assessment of internal control over financial reporting apply to the company's most recent assessment of internal control over financial reporting overall, either as of the company's year-end or as of a more recent interim date, as audited by the auditor in accordance withAS 2201.

.03 The auditor may report on more than one previously reported material weakness as part of a single engagement.

.04 The engagement described by this standard is voluntary. The standards of the PCAOB do not require an auditor to undertake an engagement to report on whether a previously reported material weakness continues to exist. The auditor may audit the company's internal control over financial reporting in accordance with AS 2201 without ever performing an engagement in accordance with this standard.

Auditor's Objective in an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist

.05 The auditor's objective in an engagement to report on whether a previously reported material weakness continues to exist is to obtain reasonable assurance about whether the previously reported material weakness exists as of a date specified by management and to express an opinion thereon. The auditor's opinion relates to the existence of a specifically identified material weakness as of a specified date and does not relate to the effectiveness of the company's internal control over financial reporting overall.

.06 To obtain reasonable assurance, the auditor should obtain and evaluate evidence about whether specified controls were designed and operated effectively as of the date specified by management and whether those controls satisfy the company's stated control objective.

Note: Obtaining and evaluating evidence about whether the specified controls are designed effectively without also obtaining evidence about whether those controls operated effectively would not result in the auditor obtaining reasonable assurance for the purpose of expressing an opinion on whether a material weakness continues to exist.

Conditions for Engagement Performance

.07 The auditor may report on whether a previously reported material weakness continues to exist at a company only if all of the following conditions are met:

Management accepts responsibility for the effectiveness of internal control over financial reporting;
Management evaluates the effectiveness of the specific control(s) that it believes addresses the material weakness using the same control criteria that management used for its most recent annual assessment of internal control over financial reporting and management's stated control objective(s);
Management asserts that the specific control(s) identified is effective in achieving the stated control objective;
Management supports its assertion with sufficient evidence, including documentation; and
Management presents a written report that will accompany the auditor's report that contains all the elements described in paragraph .48 of this standard.

.08 If all the conditions in paragraph .07 of this standard are not met, the auditor is not permitted to complete the engagement to report on whether a previously reported material weakness continues to exist.

Framework and Definitions for Evaluation

.09 The terms internal control over financial reporting, deficiency, significant deficiency, and material weakness have the same meanings as the definitions of those terms in Appendix A, Definitions, ofAS 2201.

.10 AS 2201.05 states “[t]he auditor should use the same suitable, recognized control framework to perform his or her audit of internal control over financial reporting as management uses for its annual evaluation of the effectiveness of the company's internal control over financial reporting." For purposes of an engagement to report on whether a previously reported material weakness continues to exist, both management and the auditor must use both (1) the same control criteria used for the company's most recent annual assessment of internal control over financial reporting, and (2) the company's stated control objective(s) to evaluate whether a material weakness continues to exist.

Note: The performance and reporting requirements in AS 2201 and in this standard are based on the Committee of Sponsoring Organizations ("COSO") of the Treadway Commission's publication, Internal Control — Integrated Framework . Known as the COSO report, it provides a suitable and available framework for purposes of management's annual assessment of internal control over financial reporting. More information about the COSO framework is included within the COSO report.

.11 The terms relevant assertion and control objective have the same meaning as the definitions of those terms in Appendix A, Definitions, of AS 2201.

.12 Management establishes control objectives that are tailored to the individual company. The process of tailoring control objectives to the individual company allows the control criteria used for management's annual assessment to be applied to the facts and circumstances in a reasonable and appropriate manner. Although control objectives are used most frequently to evaluate the effectiveness of control activities, the other components of internal control over financial reporting (i.e., control environment, risk assessment, information and communication, and monitoring) also can be expressed in terms of control objectives.

.13 In an audit of internal control over financial reporting, the auditor should test the design effectiveness of controls by determining whether the company's controls, if they are operated as prescribed by persons possessing the necessary authority and competence to perform the control effectively, satisfy the company's control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements in the financial statements. ²

.14 Table 1 includes examples of control objectives and their related assertions:

Table 1
Examples of Control Objectives and Related Assertions
Control Objectives	Assertions
Recorded sales of product X initiated on the company's Web site are real	Existence or occurrence
Product X warranty losses that are probable and can be reasonably estimated are recorded as of the company's quarterly financial statement period-ends	Completeness
Interest rate swaps are recorded at fair value	Valuation or allocation
The company has legal title to recorded product X inventory in the company's Dallas, TX warehouse	Rights and obligations
Pending litigation that is reasonably possible to result in a material loss is disclosed in the quarterly and annual financial statements	Presentation and disclosure

.15 If a material weakness has previously been reported, a necessary control objective (or objectives) has not been achieved.

.16 A stated control objective in the context of an engagement to report on whether a material weakness continues to exist is the specific control objective identified by management that, if achieved, would result in the material weakness no longer existing.

.17 Because the stated control objective, for purposes of this engagement, provides management and the auditor with a specific target against which to evaluate whether the material weakness continues to exist, management and the auditor must be satisfied that, if the stated control objective were achieved, the material weakness would no longer exist.

Note: When a material weakness has a pervasive effect on the company's internal control over financial reporting, identifying the related control objectives that are not being achieved may be difficult because of the large number of control objectives affected. A material weakness related to an ineffective control environment would be an example of this circumstance. If management and the auditor have difficulty identifying all of the stated control objectives affected by a material weakness, the material weakness probably is not suitable for this engagement and should be addressed, instead, through the auditor's annual audit of internal control over financial reporting conducted under AS 2201.

Performing an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist

.18 In an engagement to report on whether a previously reported material weakness continues to exist, the auditor must obtain sufficient appropriate evidence about the design and operating effectiveness of specified controls that provide reasonable assurance that the company's stated control objective is achieved in the context of the control criteria (e.g., COSO).

Note 1: An individual material weakness may be associated with a single stated control objective or with more than one stated control objective, depending on the nature of the material weakness and the manner in which the company tailors its stated control objectives to its business.

Note 2: Depending on the nature of the company's business, its organization, its internal control over financial reporting, and the specific material weakness that is the subject of this engagement, the auditor may determine that he or she is not able to obtain a sufficient basis for reporting on whether a previously reported material weakness continues to exist without performing a complete audit of internal control over financial reporting in accordance with AS 2201.

Applying the Standards of the PCAOB

.19 The auditor must adhere to the standards of the PCAOB in performing an engagement to report on whether a previously reported material weakness continues to exist. Adherence to the standards involves:

Planning the engagement,
Obtaining an understanding of internal control over financial reporting,
Testing and evaluating whether a material weakness continues to exist, including using the work of others, and
Forming an opinion on whether a previously reported material weakness continues to exist.

.20 Even though some requirements of this standard are set forth in a manner that suggests a sequential process, auditing whether a previously reported material weakness continues to exist involves a process of gathering, updating, and analyzing information. Accordingly, the auditor may perform some of the procedures and evaluations described in this section of the standard concurrently.

.21 The engagement to report on whether a previously reported material weakness continues to exist must be performed by a person or persons having adequate technical training and proficiency as an auditor. In all matters related to the assignment, an independence in mental attitude must be maintained. Due professional care must be exercised in the performance of the engagement and the preparation of the report.

.22 This standard establishes the fieldwork and reporting standards applicable to an engagement to report on whether a previously reported material weakness continues to exist.

.23 The concept of materiality, as discussed in AS 2201.20, underlies the application of the general and fieldwork standards in an engagement to report on whether a previously reported material weakness continues to exist. The auditor should assess materiality as of the date that management asserts that the previously reported material weakness no longer exists.

Planning the Engagement

.24 The auditor should properly plan the engagement to report on whether a previously reported material weakness continues to exist and should properly supervise engagement team^2A members. When planning the engagement, the auditor should evaluate how the matters described in AS 2201.09 will affect the auditor’s procedures.

Obtaining an Understanding of Internal Control over Financial Reporting

.25 To perform this engagement, the auditor must have a sufficient knowledge of the company and its internal control over financial reporting. An auditor who has audited the company's internal control over financial reporting in accordance with AS 2201 as of the date of the company's most recent annual assessment of internal control over financial reporting would be expected to have obtained a sufficient knowledge of the company and its internal control over financial reporting to perform this engagement.

Note: The second sentence of the paragraph above contemplates that the auditor's previous engagement under AS 2201 resulted in rendering an opinion. If an auditor previously engaged to perform an audit of internal control over financial reporting in accordance with AS 2201 has not yet rendered an opinion on the effectiveness of the company's internal control over financial reporting as of the company's most recent year-end or more recently, then that auditor should follow the requirements for a successor auditor in paragraphs .26a-b and .27. Additionally, if an auditor has previously performed an audit of internal control over financial reporting at the company and is now a successor auditor (because another auditor has subsequently performed an audit of internal control over financial reporting at the company in intervening years), the auditor should follow the requirements in paragraphs .26 and .27 for a successor auditor.

.26 When a successor auditor ³ performs an engagement to report on whether a previously reported material weakness continues to exist and he or she has not yet completed an audit of internal control over financial reporting at the company, he or she must perform procedures to obtain sufficient knowledge of the company's business and its internal control over financial reporting to achieve the objective of the engagement, as described in paragraph .05 of this standard. A successor auditor who has not yet completed an audit of internal control over financial reporting at the company must perform the following procedures as part of obtaining sufficient knowledge of the company's business and its internal control over financial reporting:

Comply with AS 2201.22-.27 regarding obtaining an understanding of internal control over financial reporting. The extent of understanding of internal control over financial reporting needed to satisfy these requirements in the context of an engagement to report on whether a previously reported material weakness continues to exist depends on the nature of the material weakness on which the auditor is reporting. The more pervasive the effects of the material weakness, the more extensive the understanding of internal control over financial reporting should be under these requirements. For example, if the material weakness affects company-level controls, a more extensive understanding of internal control over financial reporting will be necessary than if the effects of the material weakness are isolated at the transaction level.

Perform the procedures described in AS 2201.34-.38 for those transactions that are directly affected by controls specifically identified by management as addressing the material weakness.

In addition to the communication requirements described in AS 2610, the successor auditor should make specific inquiries of the predecessor auditor. These inquiries should address the basis for the predecessor auditor's determination that a material weakness existed in the company's internal control over financial reporting and the predecessor auditor's awareness of any information bearing on the company's ability to successfully address that material weakness.

.27 A successor auditor may determine that he or she needs to perform procedures in addition to those specified in paragraph .26 of this standard to obtain a sufficient knowledge of the company's business and its internal control over financial reporting. Depending on the nature of the company's business, its organization, its internal control over financial reporting, and the specific material weakness that is the subject of this engagement, a successor auditor may determine that he or she is not able to obtain a sufficient basis for reporting on whether a previously reported material weakness continues to exist without performing a complete audit of internal control over financial reporting in accordance with AS 2201.

Testing and Evaluating Whether a Material Weakness Continues to Exist

.28 The auditor must obtain an understanding of and evaluate management's evidence supporting its assertion that the specified controls related to the material weakness are designed and operated effectively, that these controls achieve the company's stated control objective(s) consistent with the control criteria, and that the identified material weakness no longer exists. If the auditor determines that management has not supported its assertion with sufficient evidence, the auditor cannot complete the engagement to report on whether a previously reported material weakness continues to exist, because one of the conditions for engagement completion described in paragraph .07 of this standard would not be met.

.29 As a part of evaluating management's evidence supporting its assertion, the auditor should determine whether management has selected an appropriate date for its assertion. In making this determination, the auditor should take into consideration the following:

Management's assertion that a previously reported material weakness no longer exists may be made as of any specified date that permits management to obtain sufficient evidence supporting its assertion.
Note: The auditor also should determine whether the specified date of management's assertion permits the auditor to obtain sufficient evidence supporting his or her opinion.
Depending on the nature of the material weakness, the stated control objective, and the specified controls, the specified date of management's assertion may need to be after the completion of one or more period-end financial reporting processes.
Controls that operate daily and on a continuous, or nearly continuous, basis generally permit the auditor to obtain sufficient evidence as to their operating effectiveness as of almost any date management might choose to specify in its report.
Controls that operate over the company's period-end financial reporting process typically can be tested only in connection with a period-end.

.30 The auditor should obtain evidence about the effectiveness of all controls specifically identified in management's assertion. The nature, timing, and extent of the testing that enables the auditor to obtain sufficient evidence supporting his or her opinion on whether a previously reported material weakness continues to exist will depend on both the nature of the controls specifically identified by management as meeting the company's stated control objectives and the date of management's assertion.

.31 All controls that are necessary to achieve the stated control objective(s) should, therefore, be specifically identified and evaluated. The specified controls will necessarily include controls that have been modified or newly implemented and also may include existing controls that previously were deemed effective during management's most recent annual assessment of internal control over financial reporting. As part of testing and evaluating the design effectiveness of the specified controls, the auditor should determine whether the specified controls would meet the stated control objective(s) if they operated as designed. In making this evaluation, the auditor should apply AS 2201.42-.43.

.32 Consistent with the direction in AS 2201.44-.45, the auditor should test the operating effectiveness of a specified control by determining whether the specified control operated as designed and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively. In determining the nature, timing, and extent of tests of controls, the auditor should apply AS 2201.50-.54.

.33 The auditor should perform tests of the specified controls over a period of time that is adequate to determine whether, as of the date specified in management's assertion, the controls necessary for achieving the stated control objective are operating effectively. The timing of the auditor's tests should vary with the risk associated with the control being tested. For example, a transaction-based, daily reconciliation generally would permit the auditor to obtain sufficient evidence as to its operating effectiveness in a shorter period of time than a pervasive, entity-level control, such as any of those described in AS 2201.22-.24. Additionally, the auditor typically will be able to obtain sufficient evidence as to the operating effectiveness of controls over the company's period-end financial reporting process only by testing those controls in connection with a period-end.

.34 The auditor should determine whether, based on the nature of the material weakness, performing substantive procedures to support recorded financial statement amounts or disclosures affected by the specifically identified controls is necessary to obtain sufficient evidence regarding the operating effectiveness of those controls. For example, a material weakness in the company's controls over the calculation of its bad debt reserve ordinarily would require that the auditor also perform substantive procedures to obtain sufficient evidence supporting an opinion about whether the material weakness continues to exist as of a specified date. In this circumstance, in addition to testing the design and operating effectiveness of the controls specifically identified as achieving the company's stated control objective that its bad debt reserve is reasonably estimated and recorded, the auditor ordinarily would need to perform substantive procedures to determine that, as of that same specified date, the company's bad debt reserve was fairly stated in relation to the company's financial statements taken as a whole.

.35 When the specified controls, stated control objectives, and material weakness affect multiple locations or business units of the company, the auditor may apply the relevant concepts in paragraphs B10-B16 of Appendix B, Special Topics, of AS 2201 to determine the locations or business units at which to perform procedures.

Using the Work of Others

.36 The auditor should evaluate whether to use the work performed by others in an engagement to report on whether a previously reported material weakness continues to exist. To determine the extent to which the auditor may use the work of others to alter the nature, timing, or extent of the work the auditor otherwise would have performed, the auditor should apply AS 2201.16-.19.

.37 The auditor's opinion relates to whether a material weakness no longer exists at the company because the stated control objective(s) is met. Therefore, if the auditor has been engaged to report on more than one material weakness or on more than one stated control objective, the auditor must evaluate whether he or she has obtained sufficient evidence that the control objectives related to each of the material weaknesses identified in management's assertion are achieved. The auditor may, however, use the work of others to alter the nature, timing, or extent of the work he or she otherwise would have performed. For these purposes, the work of others includes relevant work performed by internal auditors, company personnel (in addition to internal auditors), and third parties working under the direction of management or the audit committee that provide information about the effectiveness of internal control over financial reporting.

.38 AS 2201.18-.19 should be applied in the context of the engagement to report on whether a previously reported material weakness continues to exist. There may, therefore, be some circumstances in which the scope of the audit procedures to be performed in this engagement will be so limited that using the work of others will not provide any tangible benefit to the company or its auditor. Additionally, the auditor should perform any walkthroughs himself or herself because of the degree of judgment required in performing this work.

.39 The following example illustrates how to apply this section on using the work of others to this engagement.

In this example, the company's previously reported material weakness relates to the company's failure to perform bank reconciliations at its 50 subsidiaries. The specified controls identified by the company are the timely preparation of complete and accurate reconciliations between the company's recorded cash balances and the company's cash balances as reported by its financial institution.

Although certain controls over bank reconciliations are centralized, the performance of the bank reconciliations themselves is not centralized because they occur at each individual operating unit. Further, each operating unit has, on average, three separate cash accounts. The cash accounts affected are not material individually but are material in the aggregate. Most of the controls over the preparation of bank reconciliations involve a low degree of judgment in evaluating their operating effectiveness, can be subjected to objective testing, and have a low potential for management override.

If these conditions describe the specified controls over the preparation of bank reconciliations, the auditor could determine that, based on the nature of the controls as described above, he or she could use the work of others to a moderate extent, provided that the degree of competence and objectivity of the individuals performing the tests is high. The auditor might perform tests of controls that are centralized at the holding company level himself or herself; perform testing at a limited number of locations himself or herself; test the work of others performed at a limited number of other locations; review the results of the work of others at all other locations tested; and determine that, qualitatively and quantitatively, principal evidence had been obtained.

On the other hand, if the company's previously reported material weakness related to the company's failure to perform a reconciliation of its only cash account, few controls and few operations of those controls would underlie management's assertion that the material weakness no longer exists. In this circumstance, it is unlikely that the auditor would be able to use a significant amount of the work of others because of the limited scope of the total amount of work needed to test management's assertion and due to the requirement that the auditor obtain the principal evidence himself or herself.

Engagements Involving Other Accounting Firms

.40 If an engagement to report on whether a previously reported material weakness continues to exist involves another accounting firm, the lead auditor⁴ must not divide responsibility for the engagement with the other accounting firm.

Forming an Opinion on Whether a Previously Reported Material Weakness Continues to Exist

.41 When forming an opinion on whether a previously reported material weakness continues to exist, the auditor should evaluate all evidence obtained from all sources. This process should include an evaluation of the sufficiency of the evidence obtained by management and the results of the auditor's evaluation of the design and operating effectiveness of the specified controls.

.42 Management may conclude that a previously reported material weakness no longer exists because its severity has been sufficiently reduced such that it is no longer a material weakness.

.43 The auditor may issue an opinion on whether a previously reported material weakness continues to exist only when there have been no restrictions on the scope of the auditor's work. Because of the scope of an engagement to report on whether a previously reported material weakness continues to exist, any limitations on the scope of the auditor's work require the auditor either to disclaim an opinion or to withdraw from the engagement. A qualified opinion is not permitted.

Note: As described in paragraph .51 of this standard, the auditor's opinion on whether a previously reported material weakness continues to exist may be expressed as "the material weakness exists" or "the material weakness no longer exists." Therefore, the provisions of this standard do not distinguish between an unqualified opinion and an adverse opinion and, instead, refer simply to "an opinion" or "the auditor's opinion."

Requirement for Written Representations

.44 In an engagement to report on whether a previously reported material weakness continues to exist, the auditor should obtain written representations from management:

Acknowledging management's responsibility for establishing and maintaining effective internal control over financial reporting;
Stating that management has evaluated the effectiveness of the specified controls using the specified control criteria and management's stated control objective(s);
Stating management's assertion that the specified controls are effective in achieving the stated control objective(s) as of a specified date;
Stating management's assertion that the identified material weakness no longer exists as of the same specified date;
Stating that management believes that its assertions are supported by sufficient evidence;

Describing any fraud resulting in a material misstatement to the company's financial statements and any other fraud that does not result in a misstatement in the company's financial statements but involves senior management or management or other employees who have a significant role in the company's internal control over financial reporting and that has occurred or come to management's attention since the date of management's most recent annual assessment of internal control over financial reporting.
Stating whether there were, subsequent to the date being reported on, any changes in internal control over financial reporting or other factors that might significantly affect the stated control objective(s) or indicate that the identified controls were not operating effectively as of, or subsequent to, the date specified in management's assertion.

.45 The written representations should be signed by those members of management with overall responsibility for the company's internal control over financial reporting whom the auditor believes are responsible for and knowledgeable about, directly or through others in the organization, the matters covered by the representations. Such members of management ordinarily include the chief executive officer and chief financial officer or others with equivalent positions in the company.

.46 The failure to obtain written representations from management, including management's refusal to furnish them, constitutes a limitation on the scope of the engagement. As discussed further in paragraph .43 of this standard, if there is a limitation on the scope of an engagement to report on whether a previously reported material weakness continues to exist, the auditor must either disclaim an opinion or withdraw from the engagement. Further, the auditor should evaluate the effects of management's refusal on his or her ability to rely on other representations of management, including, if applicable, representations obtained in an audit of the company's financial statements.

Documentation Requirements

.47 The documentation requirements in AS 1215, Audit Documentation, are modified in the following respect as they apply to this engagement. AS 1215.14 defines the report release date as the date the auditor grants permission to use the auditor's report in connection with the issuance of the company's financial statements. As described in paragraph .29 of this standard, management's assertion that a material weakness no longer exists may be made as of a date other than a period-end financial reporting date. Therefore, the auditor's release of a report on whether a previously reported material weakness continues to exist may not necessarily be associated with the issuance of financial statements of the company. Accordingly, in an engagement to report on whether a previously reported material weakness continues to exist, the report release date for purposes of applying AS 1215 is the date the auditor grants permission to use the auditor's report on whether a previously reported material weakness continues to exist.

Reporting on Whether a Previously Reported Material Weakness Continues to Exist

Management's Report

.48 As a condition for the auditor's performance of this voluntary engagement, management is required to present a written report that will accompany the auditor's report, as described in paragraph .07e of this standard. To satisfy this condition for the auditor's performance of this engagement, management's report should include:

A statement of management's responsibility for establishing and maintaining effective internal control over financial reporting for the company;
A statement identifying the control criteria used by management to conduct the required annual assessment of the effectiveness of the company's internal control over financial reporting;
An identification of the material weakness that was identified as part of management's annual assessment;
Note: This report element should be modified in the case in which management's annual assessment did not identify the material weakness, but, rather, only the auditor's report on management's annual assessment identified the material weakness.
An identification of the control objective(s) addressed by the specified controls and a statement that the specified controls achieve the stated control objective(s) as of a specified date; and
A statement that the identified material weakness no longer exists as of the same specified date because the specified controls address the material weakness.

Auditor's Evaluation of Management's Report

.49 With respect to management's report, the auditor should evaluate the following matters:

Whether management has properly stated its responsibility for establishing and maintaining effective internal control over financial reporting;
Whether the control criteria used by management to conduct the evaluation is suitable;
Whether the material weakness, stated control objectives, and specified controls have been properly described; and
Whether management's assertions, as of the date specified in management's report, are free of material misstatement.

.50 If, based on the results of this evaluation, the auditor determines that management's report does not include the elements described in paragraph .48 of this standard, the conditions for engagement performance have not been met.

Auditor's Report

.51 The auditor's report on whether a previously reported material weakness continues to exist must include the following elements:

A title that includes the word independent;
A statement that the auditor has previously audited and reported on management's annual assessment of internal control over financial reporting as of a specified date based on the control criteria, as well as a statement that the auditor's report identified a material weakness;
Note: This report element should be modified in cases in which a successor auditor's performance of this engagement is occurring before he or she has opined on the effectiveness of internal control over financial reporting overall in accordance with AS 2201. In this circumstance, the auditor's report should refer to the predecessor auditor's report on management's annual assessment and the predecessor auditor's identification of the material weakness.
A description of the material weakness;
An identification of management's assertion that the identified material weakness in internal control over financial reporting no longer exists;
An identification of the management report that includes management's assertion, such as identifying the title of the report (if the report is titled);
A statement that management is responsible for its assertion;
An identification of the specific controls that management asserts address the material weakness;
Note: As discussed further in paragraph .31, all controls that are necessary to achieve the stated control objective should be identified.
An identification of the company's stated control objective that is achieved by these controls;
A statement that the auditor's responsibility is to express an opinion on whether the material weakness continues to exist as of the date of management's assertion based on his or her auditing procedures;
A statement that the engagement was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States);
A statement that the standards of the Public Company Accounting Oversight Board require that the auditor plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company;
A statement that the engagement includes examining evidence supporting management's assertion and performing such other procedures the auditor considered necessary in the circumstances and that the auditor obtained an understanding of internal control over financial reporting as part of his or her previous audit of management's annual assessment of internal control over financial reporting and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the material weakness;
Note: This report element should be modified in cases in which a successor auditor's performance of this engagement is occurring before he or she has opined on the effectiveness of internal control over financial reporting overall in accordance with AS 2201. In this circumstance, the auditor's report should include a statement that the engagement includes obtaining an understanding of internal control over financial reporting, examining evidence supporting management's assertion, and performing such other procedures as the auditor considered necessary in the circumstances.
A statement that the auditor believes the auditing procedures provide a reasonable basis for his or her opinion;
The auditor's opinion on whether the identified material weakness exists (or no longer exists) as of the date of management's assertion;
A paragraph that includes the following statements:
- That the auditor was not engaged to and did not conduct an audit of internal control over financial reporting as of the date of management's assertion, the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting, and that the auditor does not express such an opinion, and
- That the auditor has not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company as of any date after the date of management's annual assessment of the company's internal control over financial reporting, other than the controls specifically identified in the auditor's report, and that the auditor does not express an opinion that any other controls operated effectively after the date of management's annual assessment of the company's internal control over financial reporting.
  Note: This report element statement should be modified in the case in which a successor auditor's performance of this engagement is occurring before he or she has opined on the effectiveness of internal control over financial reporting overall in accordance with AS 2201 to read as follows: That the auditor has not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company other than the controls specifically identified in the auditor's report and that the auditor does not express an opinion that any other controls operated effectively.
A paragraph stating that, because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements and that projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate;
The manual or printed signature of the auditor's firm;
The city and state (or city and country, in the case of non-U.S. auditors) from which the auditor's report has been issued; and
The date of the auditor's report.

.52 Example A-1 in Appendix A is an illustrative auditor's report for an opinion that a material weakness no longer exists, expressed by an auditor who has previously reported on the company's internal control over financial reporting in accordance with AS 2201 as of the company's most recent year-end (herein after referred to as a continuing auditor). Example A-2 in Appendix A is an illustrative auditor's report for an opinion that a material weakness no longer exists expressed by a successor auditor.

.53 As stated in paragraph .03 of this standard, the auditor may report on more than one previously reported material weakness as part of the same engagement. In this circumstance, the auditor should modify the report elements described in paragraph .51 of this standard accordingly.

.54 Report modifications. The auditor should modify the standard report if any of the following conditions exist.

Other material weaknesses that were reported previously by the company as part of the company's annual assessment of internal control are not addressed by the auditor's opinion. (See paragraph .56 of this standard.)
A significant subsequent event has occurred since the date being reported on. (See paragraphs .57 and .58 of this standard.)
Management's report on whether a material weakness continues to exist includes additional information. (See paragraphs .59 and .60 of this standard.)

.55 As described further in paragraph .43 of this standard, the form of the auditor's report resulting from an engagement to report on whether a previously reported material weakness continues to exist may be an opinion on whether a material weakness continues to exist, or it may be in the form of a disclaimer of opinion. A qualified opinion is not permitted. Any limitations on the scope of the auditor's work preclude the expression of an opinion. In addition to these reporting alternatives, an auditor may elect not to report on whether a material weakness continues to exist and, instead, withdraw from the engagement.

.56 Other material weaknesses reported previously by the company as part of the company's annual assessment of internal control are not addressed by the auditor's opinion. In the circumstance in which the company previously has reported more than one material weakness, the auditor may be engaged to report on whether any or all of the material weaknesses continue to exist. If the auditor reports on fewer than all of the previously reported material weaknesses, the auditor should include the following or similar language in the paragraph that states that the auditor was not engaged to perform an audit of internal control over financial reporting. When referring to his or her previously issued report on management's annual assessment, the auditor should either attach that report or include information about where it can be publicly obtained.

Our report on management's annual assessment of XYZ Company's internal control over financial reporting, dated [ date of report ], [attached or identify location of where the report is publicly available] identified additional material weaknesses other than the one identified in this report. We are not reporting on those other material weaknesses and, accordingly, express no opinion regarding whether those material weaknesses continue to exist after [ date of management's annual assessment, e.g., December 31, 200X ]. [ Revise this wording and references or attachments appropriately for use in a successor auditor's report. ]

Example A-3 in Appendix A is an illustrative report issued by a continuing auditor reporting on only one material weakness when additional material weaknesses previously were reported.

.57 Subsequent events. A change in internal control over financial reporting or other factors that might significantly affect the effectiveness of the identified controls or the achievement of the company's stated control objective might occur subsequent to the date of management's assertion but before the date of the auditor's report. Therefore, the auditor should inquire of management whether there was any such change or factors. As described in paragraph .44 of this standard, the auditor should obtain written representations from management regarding such matters. Additionally, to obtain information about whether such a change has occurred that might affect the effectiveness of the identified controls or the achievement of the company's stated control objective and, therefore, the auditor's report, the auditor should inquire about and examine, for this subsequent period, the following:

Internal audit reports (or similar functions, such as loan review in a financial institution) relevant to the stated control objective or identified controls issued during the subsequent period;
Independent auditor reports (if other than the auditor's) of significant deficiencies or material weaknesses relevant to the stated control objective or identified controls;
Regulatory agency reports on the company's internal control over financial reporting relevant to the stated control objective or identified controls; and
Information about the effectiveness of the company's internal control over financial reporting relevant to the stated control objective or identified controls obtained as a result of other engagements.

.58 If the auditor obtains knowledge about subsequent events that he or she believes adversely affect the effectiveness of the identified controls or the achievement of the stated control objective as of the date specified in management's assertion, the auditor should follow the requirements in paragraph .61 regarding special considerations when a material weakness continues to exist. If the auditor is unable to determine the effect of the subsequent event on the effectiveness of the identified controls or the achievement of the stated control objective, the auditor should disclaim an opinion.

.59 Management's report includes additional information. If management's report includes information in addition to the matters described in paragraph .48 of this standard, the auditor should disclaim an opinion on the additional information. For example, the auditor should use the following or similar language as the last paragraph of the report to disclaim an opinion on management's plans to implement new controls:

We do not express an opinion or any other form of assurance on management's statement referring to its plans to implement new controls by the end of the year.

.60 If the auditor believes that management's additional information contains a material misstatement of fact, he or she should discuss the matter with management. If, after discussing the matter with management, the auditor concludes that a material misstatement of fact remains, the auditor should notify management and the audit committee, in writing, of the auditor's views concerning the information.

Note: If management makes the types of disclosures described in paragraph .59 outside its report on whether a previously reported material weakness continues to exist and includes them elsewhere within a document that contains management's and the auditor's reports on whether a previously reported material weakness continues to exist, the auditor would not need to disclaim an opinion, as described in paragraph .59. However, in that situation, the auditor's responsibilities are the same as those described in this paragraph if the auditor believes that the additional information contains a material misstatement of fact.

Special Considerations When a Previously Reported Material Weakness Continues to Exist

.61 If the auditor determines that the previously reported material weakness continues to exist and the auditor reports on the results of the engagement, he or she must express an opinion that the material weakness exists as of the date specified by management.

.62 As described in paragraph .55, the auditor is not required to issue a report as a result of this engagement. If the auditor does not issue a report in this circumstance, he or she must communicate, in writing, his or her conclusion that the material weakness continues to exist to the audit committee. Similarly, if the auditor identifies a material weakness during this engagement that has not been previously communicated to the audit committee in writing, the auditor must communicate that material weakness, in writing, to the audit committee.

.63 Additionally, whenever the auditor concludes that a previously reported material weakness continues to exist, the auditor must consider that conclusion as part of his or her evaluation of management's quarterly disclosures about internal control over financial reporting, as required by paragraphs .07 and .29-.32 of AS 4105, Reviews of Interim Financial Information.

.64 For example, if the auditor were engaged to report on whether two separate material weaknesses continue to exist and concluded that one no longer exists and one continues to exist, the auditor's report could comprise either of the following: (1) a report that contained two opinions, one on the material weakness that the auditor concluded no longer exists and one opinion on the material weakness that the auditor concluded continues to exist, or (2) a report that contained only a single opinion on the material weakness that the auditor concluded no longer exists if the company modifies its assertion to address only the material weakness that the auditor concluded no longer exists. In the second circumstance, the auditor must communicate, in writing, his or her conclusion that a material weakness continues to exist to the audit committee and also should apply paragraph .56 of this standard regarding other material weaknesses reported previously that are not addressed by the auditor's opinion. Additionally, the auditor must consider that conclusion as part of his or her evaluation of management's quarterly disclosures about internal control over financial reporting, as required by AS 4105.07 and AS 4105.29-.32.

Effective Date

.65 This standard is effective February 6, 2006.

Appendix A - Illustrative Reports on Whether a Previously Reported Material Weakness Continues to Exist

Paragraphs .51 through .60 of this standard provide direction on the auditor's report on whether a previously reported material weakness continues to exist. The following examples illustrate the application of those paragraphs.

Summary Table of Contents

Example A-1 - Illustrative Auditor's Report for a Continuing Auditor Expressing an Opinion that a Previously Reported Material Weakness No Longer Exists
Example A-2 - Illustrative Auditor's Report for a Successor Auditor Expressing an Opinion that a Previously Reported Material Weakness No Longer Exists
Example A-3 - Illustrative Auditor's Report for a Continuing Auditor Expressing an Opinion on Only One Previously Reported Material Weakness When Additional Material Weaknesses Previously Were Reported

Example A-1

Illustrative Auditor's Report for a Continuing Auditor Expressing an Opinion that a Previously Reported Material Weakness No Longer Exists

Report of Independent Registered Public Accounting Firm

We have previously audited and reported on management's annual assessment of XYZ Company's internal control over financial reporting as of December 31, 200X based on [ Identify control criteria, for example, "criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." ]. Our report, dated [ date of report ], identified the following material weakness in the Company's internal control over financial reporting:

[ Describe material weakness ]

We have audited management's assertion, included in the accompanying [title of management's report], that the material weakness in internal control over financial reporting identified above no longer exists as of [ date of management's assertion ] because the following control(s) addresses the material weakness:

[ Describe control(s) ]

Management has asserted that the control(s) identified above achieves the following stated control objective, which is consistent with the criteria established in [ identify control criteria used for management's annual assessment of internal control over financial reporting ]: [ state control objective addressed ]. Management also has asserted that it has tested the control(s) identified above and concluded that the control(s) was designed and operated effectively as of [ date of management's assertion ]. XYZ Company's management is responsible for its assertion. Our responsibility is to express an opinion on whether the identified material weakness continues to exist as of [ date of management's assertion ] based on our auditing procedures.

Our engagement was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company. Our engagement included examining evidence supporting management's assertion and performing such other procedures as we considered necessary in the circumstances. We obtained an understanding of the company's internal control over financial reporting as part of our previous audit of management's annual assessment of XYZ Company's internal control over financial reporting as of December 31, 200X and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the material weakness described above. We believe that our auditing procedures provide a reasonable basis for our opinion.

In our opinion, the material weakness described above no longer exists as of [ date of management's assertion ].

Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate.

[ Signature ]
[ City and State or Country ]
[ Date ]

Example A-2

Illustrative Auditor's Report for a Successor Auditor Expressing an Opinion that a Previously Reported Material Weakness No Longer Exists

Report of Independent Registered Public Accounting Firm

We were engaged to report on whether a previously reported material weakness continues to exist at XYZ Company as of [ date of management's assertion ] and to audit management's next annual assessment of XYZ Company's internal control over financial reporting. Another auditor previously audited and reported on management's annual assessment of XYZ Company's internal control over financial reporting as of December 31, 200X based on [ Identify control criteria, for example, "criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." ]. The other auditor's report, dated [ date of report ], identified the following material weakness in the Company's internal control over financial reporting:

[ Describe material weakness ]

[ Describe control(s) ]

In our opinion, the material weakness described above no longer exists as of [ date of management's assertion ].

[ Signature ]
[ City and State or Country ]
[ Date ]

Example A-3

Illustrative Auditor's Report for a Continuing Auditor Expressing an Opinion on Only One Previously Reported Material Weakness When Additional Material Weaknesses Previously Were Reported

Report of Independent Registered Public Accounting Firm

We have previously audited and reported on management's annual assessment of XYZ Company's internal control over financial reporting as of December 31, 200X based on [ Identify control criteria, f or example, "criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO)." ]. Our report, dated [ date of report ], identified the following material weakness in the Company's internal control over financial reporting:

[ Describe material weakness ]

[ Describe control(s) ]

In our opinion, the material weakness described above no longer exists as of [ date of management's assertion ].

We were not engaged to and did not conduct an audit of internal control over financial reporting as of [ date of management's assertion ], the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting. Accordingly, we do not express such an opinion. This means that we have not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company as of any date after December 31, 200X, other than the control(s) specifically identified in this report. Accordingly, we do not express an opinion that any other controls operated effectively after December 31, 200X. Our report on management's annual assessment of XYZ Company's internal control over financial reporting, dated [ date of report ], [attached or identify location of where the report is publicly available ] identified additional material weaknesses other than the one identified in this report. We are not reporting on those other material weaknesses and, accordingly, express no opinion regarding whether those material weaknesses continue to exist after [ date of management's annual assessment, e.g., December 31, 200X ].

[ Signature ]
[ City and State or Country ]
[ Date ]

Footnotes (AS 6115 - Reporting on Whether a Previously Reported Material Weakness Continues to Exist):

^[1] [Footnote deleted.]

² See AS 2201.42

^2A The term “engagement team,” as used in this standard, has the same meaning as defined in Appendix A of AS 2101, Audit Planning.

³ The term successor auditor has the same meaning as the definition of that term in paragraph .02 of AS 2610, Initial Audits—Communications Between Predecessor and Successor Auditors .

⁴ The term “lead auditor,” as used in this standard, has the same meaning as defined in Appendix A of AS 2101. See AS 2101.06A–.06C, which establish requirements regarding serving as the lead auditor. See also AS 1206, Dividing Responsibility for the Audit with Another Accounting Firm.