Overview of PCAOB Auditing Standard No. 5

1
Overview of PCAOB Auditing Standard No. 5

• An Audit of Internal Control Over Financial
  Reporting that is Integrated with an Audit of
  Financial Statements

2
PCAOBs New Guidance for Audits of Internal
Control

• Issued May 24, 2007 to supersede PCAOB Auditing
  Standard No. 2
• Responds to concerns about perceived
  inefficiencies in initial years of AS2
  implementation, without reducing audit
  effectiveness
• Retains most of the core concepts of AS2
  described in Chapter 10 of Auditing Assurance
  Services An Integrated Approach
• Effective for audits of fiscal years ending on or
  after November 15, 2007

3
Key Changes in AS5

• The new standard
• Emphasizes a top-down risk based approach
• Places greater reliance on entity-level controls
• Focuses on understanding and testing controls
  related to risks for significant accounts and
  disclosures
• Allows for greater ability to rely on work of
  others
• Changes definition of material weakness and
  significant deficiency
• Simplifies the auditors opinion by eliminating
  opinion on managements assessment of internal
  control

4
Top Down Risk Based Approach

• Emphasizes auditor focus on controls related to
  risks that might lead to material misstatements
• Begins at the financial statement level with
  consideration of risks affecting overall
  financial statements
• Leads to identifying and understanding
  entity-level controls management has implemented
  to address overall financial statement risks
• Encourages auditor to consider entity-level
  controls before assessing controls related to
  specific objectives
• Notes that fraud risk is an area of higher
  overall risk requiring auditor to focus on
  antifraud programs and controls
• Recognizes that size and complexity of entity and
  its processes affect the nature of risks and need
  for related controls

5
Entity-Level Controls

• Focus on entity-level controls helps direct
  auditor to controls related to high risk areas
• Entity-level controls often include those related
  to control environment, risk assessment, and
  monitoring components of internal control
• Leads to audit efficiencies by reducing tests at
  transaction, account, or disclosure levels
  because
• Some entity-level controls indirectly affect
  performance of other controls
• Other entity-level controls directly monitor
  operating effectiveness of other controls

6
Significant Accounts and Disclosures

• AS5 requires auditor to identify controls
  relevant to significant accounts and disclosures
• An account or disclosure is significant if there
  is
• a reasonable possibility that the account or
  disclosure could contain a material misstatement
  that, individually or when aggregated with
  others, has a material effect on the financial
  statements.
• Represents a change from AS2, which required the
  auditor to understand controls for each material
  class of transactions within a single process
• Likely will reduce the extent of walkthroughs the
  auditor must perform
• Emphasizes controls where risks of material
  misstatements are highest

7
Using Work of Others

• Allows auditor to use the work of others to
  obtain evidence about operating effectiveness of
  internal controls
• Includes work performed by company personnel or
  others working under the direction of management
  or audit committee
• Tests performed by management to provide Section
  404 assertion
• Requires assessment of
• Competence and Objectivity of individuals
  performing work
• Relative risks associated with controls tested

8
Evaluating Deficiencies

• AS5 revises definitions of material weakness and
  significant deficiency
• Material weakness is
• a deficiency, or combination of deficiencies, in
  internal control over financial reporting, such
  that there is a reasonable possibility that a
  material misstatement of the companys annual or
  interim financial statements will not be
  prevented or detected on a timely basis.
• Significant deficiency is
• a deficiency, or combination of deficiencies, in
  internal control over financial reporting that is
  less severe than a material weakness, yet
  important to merit the attention by those
  responsible for oversight of the companys
  financial reporting.

9
Auditors Opinion

• AS2 required two auditor opinions on
• Whether managements assessment of internal
  controls was fairly stated
• Whether internal controls over financial
  reporting operated effectively
• AS5 eliminates the first opinion
• Auditors opinion must only address whether the
  company maintained, in all material respects,
  effective internal control over financial
  reporting as of the end of the fiscal year
• Change affects auditors report wording in the
  introductory and opinion paragraphs of the
  combined report shown in Figure 3-3