In the third of its three-part Webcast series on auditing internal control over financial reporting, the Center for Audit Quality provides some expert insight into how auditors should evaluate control deficiencies and wrap up the audit process.

While that may be old hat for companies that have already experienced a few rounds of reporting and auditing under Auditing Standard No. 5, which governs the audit of internal control over financial reporting, it’s still relatively new stuff for smaller companies that are facing their first-ever ICFR audit.

So far, smaller companies—those with market caps of $75 million or less—have produced management reports on ICFR but have not been subject to the audit. That changes this year as even the smallest public companies become subject to requirements for both the management report and the audit report required under Section 404 of the Sarbanes-Oxley Act.

Panelists for the CAQ Webcast puzzled about what auditors will do if they face a worst-case scenario where companies that have control deficiencies of such magnitude it’s difficult for the auditor to reach any opinion, even an adverse one. Greg Wilson, deputy director of inspections for the Public Company Accounting Oversight Board, said auditors and public companies can certainly expect lots of questions from the Securities and Exchange Commission if they reach such an impasse.

Wilson said small companies generally can expect some challenges around how best to establish and rely on controls when segregation of duties across a small accounting or finance staff is an issue. It will be a challenge not only in accounting, but also in relying on information technology. “In this day and age when we’re relying so heavily on IT-generated data, you have to be very careful about placing an appropriate amount of reliance,” on such data as well as the reports that result, he said.

CAQ’s first two Webcasts focused on the fundamentals of an integrated audit, resources available to help auditors through their first-ever ICFR audit, and performing tests of controls. The CAQ offers a host of resources on its Website for companies and auditors that are still working their way through the ICFR audit for the first time.

Topics