Internal Control Audits: PCAOB Standard 2

1
Internal Control AuditsPCAOB Standard 2

Andrew D. Bailey, Jr. Deputy Chief
Accountant Office of the Chief Accountant
The Securities and Exchange Commission, as a
matter of policy, disclaims responsibility for
any private publication or statement by any of
its employees. The views expressed herein are
those of the author and do not necessarily
reflect the views of the Commission or of the
authors colleagues upon the staff of the
Commission.
2
The US System Before Sarbanes-Oxley

• Oversight and regulation of the accounting
  profession
• Largely self-regulated
• Administered through the AICPA
• Limited oversight of the peer review process
  provided by the Public Oversight Board

3
Self-Regulation Problems

• Peer Review
• Perceived lack of objectivity
• Fairly narrow charge
• PEEC and QCIC
• Operated slowly
• Issues set aside until all litigation over
• Limited public disclosure

4
Self-Regulation Problems

• Auditing Standards Board
• Appearance of lack of independence
• Public Oversight Board
• Lacked authority to make significant changes
• Dependent on profession for funding

5
Key Sarbanes-Oxley Provisions Relating to Auditors

• Key Provisions
• Establishes PCAOB as new regulator
• SEC oversight
• Auditor Independence
• Scope of services
• Preapproval
• Audit partner rotation
• Auditor reports to audit committee
• Internal Control Reporting
• Retention of Audit Records
• Applies only to audits of issuers

6
Public Company Accounting Oversight Board

• Created by Sarbanes-Oxley Act
• Board responsibilities
• Registration
• Auditing, quality control, ethics and
  independence standards and rules
• Inspection of registered public accounting firms
• Investigations and disciplinary proceedings
• Authority to implement further reforms, if
  necessary
• Board is subject to SEC oversight
• Independent funding mechanism

7
Relationship between SEC and PCAOB

• SEC oversees PCAOB
• PCAOB budget must be approved by SEC
• Standards must be approved by SEC
• Disciplinary actions may be appealed to SEC
• Board members appointed by SEC
• PCAOB inspected by SEC

8
Managements Assessment of Internal Control

• Section 404(a)
• Required SEC to implement rules requiring
  management to assess the effectiveness of the
  companys internal controls over financial
  reporting statements
• SEC Rule Required
• A statement of managements responsibility for
  establishing and maintaining an adequate internal
  control structure and procedures for financial
  reporting and
• Managements assessment, as of the end of the
  fiscal year, of the effectiveness of the
  companys internal control structure and
  procedures for financial reporting

9
Managements Assessment of Internal Control

• SEC Rule
• Act does not specify a framework
• SEC rule requires that the framework be a
  suitable, recognized, control framework that is
  established by a body or group that has followed
  due process procedures
• Report must address design of controls and
  operating effectiveness
• Nature of companys testing activities will
  largely depend on
• The companys particular circumstances,
• The type of control involved, and
• The significance of such control to the companys
  financial reporting

10
Managements Assessment of Internal Control

• SEC Rule
• Considerations
• Inquiry alone will not provide adequate basis for
  assessment
• Companies must maintain evidentiary matter,
  including documentation, to support assessment
• Deferred to November 15, 2004 for accelerated
  filers
• But expect companies have started to prepare
  several months ago

11
Management and Auditor Internal Control
Requirements

• Management and Auditor Requirements
• SEC rule on management requirements is not overly
  prescriptive
• Sarbanes-Oxley Act requires that the PCAOB issue
  rule on auditor responsibilities

12
Audit of Internal Control

• Issues raised in comment letters on draft PCAOB
  proposal
• Auditor must opine on managements assessment
• Rule requires auditor to evaluate effectiveness
  of internal controls directly
• Audit or Attestation
• Integrated approach to audit of internal control
  and financial statements
• Attestation would not require reduced level of
  work or cost
• Definition of significant deficiency and material
  weakness

13
Audit of Internal Control

• Issues raised in comment letters on draft PCAOB
  proposal
• Work of Others
• Controls for which auditor is precluded from
  relying on the work of others
• Control environment
• Fraud controls
• The auditor must obtain principal evidence
  supporting their opinions
• Qualitative and quantitative judgment
• Limitations on auditors ability to select an
  audit testing strategy
• Walkthroughs, rotating tests, cumulative audit
  knowledge
• Evaluating effectiveness of audit committee

14
Audit of Internal Control

• My personal view of the final PCOAB rule
• Balanced approach
• Responsive to comments
• Cost effective

15
The Next Wave

• PCAOB oversight of foreign firms
• Documentation
• Second partner review
• Quality control

16

Conclusion

Questions and Answers

?
?
?
?
?
?