PCAOB Releases Third FAQ On SOX 404 Audits

Yesterday, The Public Company Accounting Oversight Board released the third in a series of staff questions and answers to assist in the implementation of PCAOB Auditing Standard No. 2, regarding audits of public companies' internal control over financial reporting.

The latest group of questions and answers, prepared by the PCAOB’s Office of the Chief Auditor, were intended partially to respond to criticism that the standard is too prescriptive. At a Senate hearing in September, corporate executives like Eli Lilly Chief Accounting Officer Arnie Hanish and HSBC Holdings Group Finance Director Douglas Flint specifically described related "unfortunate consequences, perhaps unintended" of Sarbanes-Oxley. Flint stated that the way SOX being implemented by the accounting profession has become "meticulously prescriptive" and detailed. The danger, noted Flint, was that the SOX 404 process (e.g., documentation) "becomes the objective rather than the means to the end."

Carmichael

"Some auditors and issuers have been interpreting the standard as being more prescriptive and demanding more work than was intended,’’ said PCAOB Chief Auditor Douglas Carmichael in announcing the latest FAQ. “These staff questions and answers should provide these auditors and issuers with a better understanding of the standard so that they can apply their judgment in their circumstances in a reasonable and appropriate manner."

Topics addressed in the most recent staff guidance include:

Audits of multi-national companies that involve the work of more than one auditor;

Audits of federally insured financial institutions;

The timing of auditors' communications to management and audit committees regarding material weaknesses or significant deficiencies in internal control;

Evaluations of deficiencies in information technology general controls; and

The ability of outside auditors to use internal auditors to provide direct assistance in the audit of internal control over financial reporting.

The PCAOB's second FAQ, released in October, addressed a variety of related issues, from the extent and scope of testing required by auditors, to the evaluation of deficiencies. The FAQ also provided a variety of examples to help illustrate certain scenarios.

Downloadable versions of the FAQs, as well as related regulatory contacts and resources, are available from the

box above, right.