PCAOB Issues Guidance on Audits of Internal
Washington, DC, May 16, 2005 – The Public Company Accounting Oversight Board today published additional guidance to auditors on how to implement the PCAOB’s Auditing Standard No. 2, "An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements.”
The guidance consists of a Board Policy Statement Regarding Implementation of Auditing Standard No. 2 and a series of staff questions and answers. The questions and answers provide technical guidance to auditors on how to use the provisions and underlying principles of Auditing Standard No. 2 to conduct effective and cost-efficient audits of public companies’ internal control over financial reporting. The Board’s Policy Statement amplifies some of the themes in the questions and answers and articulates the Board’s policy on how it intends to administer Auditing Standard No. 2 in its oversight of the registered public accounting firms that audit public companies.
The guidance represents the PCAOB’s response to questions and concerns raised at the April 13, 2005, Roundtable on Implementation of Internal Control Reporting Provisions, hosted by the Securities and Exchange Commission and attended by the Board. At the roundtable, the Board heard directly from issuers, auditors, and investors on the front lines of implementing Section 404 of the Sarbanes-Oxley Act of 2002.
While roundtable participants generally supported the objectives of Section 404, many expressed concerns about compliance costs and offered constructive comments about how the implementation process can be improved. At the close of the roundtable, PCAOB Chairman William J. McDonough pledged that the Board would respond to some of the concerns about auditors’ implementation of Auditing Standard No. 2 by issuing additional guidance on the standard on May 16.
“It is clear to us that the internal control assessment and audit process has the potential to significantly improve the quality and reliability of financial reporting,” Mr. McDonough said. “At the same time, it is equally clear to us that the first round of internal control audits cost too much. Through the guidance we issue today, as well as our upcoming inspections, we are committed to seeing that AS No. 2 is implemented in a manner that captures the benefits of the process without unnecessary and unsustainable costs.”
Both the Board Policy Statement and the staff questions and answers focus primarily on the scope of the internal control audit and how much testing of a company’s internal control over financial reporting is required. The PCAOB identified these as the issues that primarily drive cost and therefore needed to be addressed most urgently in order to affect the 2005 audit process.
In particular, the staff questions and answers seek to correct the misimpression that certain provisions of Auditing Standard No. 2 need to be applied in a rigid manner that discourages auditors from exercising the judgment necessary to conduct an internal control audit in a manner that is both effective and cost-efficient. The Policy Statement expresses the Board's view that, to properly plan and perform an effective audit under Auditing Standard No. 2, auditors should –
The Board will continue to consider issues related to the implementation of Auditing Standard No. 2. The agenda of the Board’s next meeting with its Standing Advisory Group, scheduled for June 8 and 9, will focus on implementation.
In addition, the Board continues its efforts to facilitate implementation of Auditing Standard No. 2 by the auditors of the smaller U.S. public companies and foreign companies, that, by SEC rule, need not comply with Section 404 until 2006. Among other things, the Board is participating as an observer on both the SEC’s Advisory Committee on Smaller Public Companies and the Committee of Sponsoring Organizations of the Treadway Commission initiative on Implementing the COSO Control Framework in Smaller Businesses.
Section 404 of the Sarbanes-Oxley Act and the SEC’s related implementing rules require certain companies to include in their annual reports filed with the Commission a report on management’s assessment of the effectiveness of those companies’ internal control over financial reporting. In addition, Section 404 requires these companies’ auditors to attest to and report on the internal control assessments made by management. PCAOB Auditing Standard No. 2, which refers to the auditor’s attestation as an audit of internal control over financial reporting, is the standard auditors must use to satisfy their obligations under Section 404.
The guidance is available under Standards, Staff Questions and Answers