China’s premier firm for advising on audit standards in SOX. We assist with
AUDITING STANDARD No. 5
AN AUDIT OF INTERNAL CONTROL OVER FINANCIAL REPORTING THAT IS INTEGRATED WITH AN AUDIT OF FINANCIAL STATEMENTS AND RELATED INDEPENDENCE RULE AND CONFORMING AMENDMENTS
PCAOB Release No. 2007-005A June 12, 2007
Summary: After public comment, the Public Company Accounting Oversight Board is adopting Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, as well as an independence rule and conforming amendments to the Board's auditing standards.
1. Introduction
In 2002, Congress passed the Sarbanes-Oxley Act (the "Act"), which, among other things, established new provisions related to internal control over financial reporting. Section 404 of the Act requires company management to assess and report on the effectiveness of the company's internal control. It also requires a company's independent auditor, registered with the Public Company Accounting Oversight Board ("PCAOB" or "Board"), to attest to management's disclosures regarding the effectiveness of its internal control. As directed by Sections 103 and 404 of the Act, the Board established a standard to govern the newly required audit by adopting Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements ("Auditing Standard No. 2").1/ The Securities and Exchange Commission ("Commission" or "SEC") approved Auditing Standard No. 2 on June 17, 2004.2/
Since Auditing Standard No. 2 became effective, the Board has closely monitored the progress registered firms have made in implementing its requirements. The PCAOB's monitoring has included gathering information during inspections of registered public accounting firms; participating, along with the SEC, in two roundtable discussions with representatives of issuers, auditors, investor groups, and others; meeting with its Standing Advisory Group; receiving feedback from participants in the Board's Forums on Auditing in the Small Business Environment; and reviewing academic, government, and other reports and studies.
As a result of this monitoring, two basic propositions emerged.3/ First, the audit of internal control over financial reporting has produced significant benefits, including an enhanced focus on corporate governance and controls and higher quality financial reporting. Second, these benefits have come at a significant cost. Costs have been greater than expected and, at times, the related effort has appeared greater than necessary to conduct an effective audit of internal control over financial reporting.
As part of a four-point plan to improve implementation of the internal control requirements, the Board determined to amend Auditing Standard No. 2.4/ On December 19, 2006, the Board proposed for comment a new standard on auditing internal control, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, that would replace Auditing Standard No. 2. The Board also proposed a related auditing standard, Considering and Using the Work of Others in an Audit, an independence rule relating to the auditor's provision of internal control-related non-audit services, and conforming amendments to its auditing standards.5/
The Board issued these proposals with the primary objectives of focusing auditors on the most important matters in the audit of internal control over financial reporting and eliminating procedures that the Board believes are unnecessary to an effective audit of internal control. The proposals were designed to both increase the likelihood that material weaknesses in companies' internal control will be found before they cause material misstatement of the financial statements and steer the auditor away from procedures that are not necessary to achieve the intended benefits. The Board also sought to make the internal control audit more clearly scalable for smaller and less complex public companies and to make the text of the standard easier to understand. In formulating these proposals, the Board re-evaluated every significant aspect of Auditing Standard No. 2.
The Board received 175 comment letters on its proposals. The Board also discussed the proposals with its Standing Advisory Group on February 22, 2007.6/ A large majority of commenters were generally supportive of the Board's proposals, particularly the top-down, risk-based approach and focus on the most important matters. Based on the comments received, the Board believes that the proposal achieves, in large part, the objectives the Board set out when deciding to amend Auditing Standard No. 2. Many commenters also offered suggestions to improve the final standard, which the Board has carefully analyzed. In considering the comments received and formulating a final standard, the Board closely coordinated its work with the SEC, which proposed guidance for management on evaluating internal control at the same time that the Board issued its proposals.7/ In addition to its role in implementing Section 404(a) of the Act, the SEC must approve new PCAOB auditing standards before they can become effective.8/ On April 4, 2007, the Commission held a public meeting to discuss the Board's proposals and the coordination of those proposals with the Commission's proposed management guidance. At the meeting, the SEC staff provided the Commission its analysis of the public comments on the PCAOB's proposal and the proposed management guidance. The Commission endorsed the recommendations of its staff and directed its staff to focus its remaining work in four areas:
• "Aligning the PCAOB's new auditing standard … with the SEC's proposed new management guidance under Section 404, particularly with regard to prescriptive requirements, definitions, and terms";
• "Scaling the 404 audit to account for the particular facts and circumstances of companies, particularly smaller companies";
• "Encouraging auditors to use professional judgment in the 404 process, particularly in using risk-assessment"; and
• "Following a principles-based approach to determining when and to what extent the auditor can use the work of others."9/
After careful consideration of the comments it received and the input from the SEC, the Board has refined its proposals to provide additional clarity and further help auditors to focus on the most important matters. The Board has decided to adopt the revised standard on auditing internal control as Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements ("Auditing Standard No. 5"), to supersede Auditing Standard No. 2. The Board has also decided to adopt the independence rule and conforming amendments to the auditing standards.
FOR A COMPLETE COPY OF AUDIT STANDARD NO. 5, PLEASE CONTACT Lulu Zhang at Lulu.Zhang@ChinaFIG.com