The Public Company Accounting Oversight Board plans to unveil a proposal for a dramatic revision of Auditing Standard No. 2 next week, promising to clear up vexing confusion over what opinions auditors are supposed to give and to what extent they should study management’s internal control assessment process.
The PCAOB has scheduled a public meeting on the morning of Dec. 19 to “consider proposing for public comment a new auditing standard to supersede the Board’s existing auditing standard on internal control over financial reporting, and other related proposals,” according to a written statement. The new standard will essentially replace AS2, which auditors have used for three years and companies denounce as far more exacting than necessary.
Olson
Chairman Mark Olson said the Board is concerned that the costs associated with internal control reporting and auditing required under the Sarbanes-Oxley Act “are not adequately aligned with the benefits.” He said the changes the PCAOB will propose are intended to provide a more efficient, risk-based implementation that can be scaled to be appropriate to companies of all sizes.
Specifically, the PCAOB said the new standard will focus on five objectives: directing auditors to focus more on areas of higher risk; eliminating unnecessary procedures; strengthening earlier guidance on efficiency by including the language directly in the standard; providing explicit guidance on how to scale the audit to smaller companies; and simplifying the standard.
One key area of confusion that the PCAOB hopes to fix is the nature and number of opinions the auditors are required to issue. Currently, AS2 requires auditors to issue control-related opinions on two different issues: one focusing on whether management’s assessment of internal control is fairly stated, and a second focusing on the auditor’s own assessment of internal control.
PCAOB Chief Auditor Thomas Ray addressed the confusion in a speech in June at the SEC and Financial Reporting Institute Conference, saying the belief that auditors are supposed to issue an opinion on management’s assessment process is probably responsible for unnecessary audit procedures.
Ray
“AS2 requires the auditor to obtain an understanding of and evaluate management’s assessment process and provides direction as to what the auditor should look for when performing that evaluation,” he said at the time. “The principal objective of the auditor’s evaluation of management’s assessment process is for the auditor to be satisfied that management has an appropriate basis for its conclusion.”
Now, it appears, the PCAOB is preparing to drop the assessment requirement, and perhaps even one of the required opinions. According to the Board’s written statement about its plans for revising AS2, the PCAOB is looking at changes that would “clarify that an internal control audit is limited to an evaluation of whether, in the auditor’s opinion, the company’s internal control is effective, and does not include an opinion on the adequacy of management’s process to reach its conclusion.”
AGENDA
The agenda for the PCAOB’s Dec. 19 meeting follows:
Focus the Internal Control Audit on the Most Important Matters.
The Board intends to consider changes that would focus auditors on matters that present the greatest risk that a company’s internal controls will fail to detect or prevent a material misstatement in its financial statements. In particular, the Board plans to consider changes that would:
More clearly focus auditors on identifying control weaknesses before they result in material misstatements in the financial statements.
Require auditors to use a top-down approach that begins with the financial statements and company-level controls, and to identify for further testing only those controls that are, in fact, important to the effective functioning of a company's internal control over financial reporting.
Emphasize the importance of a company’s control environment, and how it can affect the risk of financial reporting fraud or other material failure.
Emphasize higher risk stages of financial statement preparation, such as the period-end close process.
Eliminate Procedures Unnecessary to Achieve the Intended Benefits.
The Board is evaluating every area of the internal control audit to determine whether the existing standard encourages auditors to perform procedures that are not necessary to achieve the intended benefits of the audit. In particular the Board plans to consider changes that would:
Clarify that an internal control audit is limited to an evaluation of whether, in the auditor’s opinion, the company’s internal control is effective, and does not include an opinion on the adequacy of management’s process to reach its conclusion.
Permit auditors to use experience gained in previous years’ audits to make audits in subsequent years more efficient.
Clarify how auditors should use risk assessment to eliminate from further consideration those accounts that are unlikely to contain a material misstatement.
Require auditors to consider whether and how to use the work of others, instead of doing certain procedures themselves.
Incorporate Guidance on Efficiency
Since Auditing Standard No. 2 was first released, the PCAOB has issued guidance to make internal control audits more efficient. The Board intends to consider whether incorporating that guidance into the standard would help to promote improvements in efficiency.
Provide Explicit and Practical Guidance on Scaling the Audit to Fit the Size and Complexity of the Company
The Board intends to provide direction in the Standard to help the auditor anticipate the various differences in smaller company internal control and to direct the auditor to tailor the audit for smaller companies.
A Simplified Standard
The Board intends to propose a revised auditing standard that is shorter, easier to understand, and more clearly scalable to audits of companies of all sizes and complexity. Among the changes the Board plans to consider are:
Reducing granularity.
Redefining key terms.
Clarifying that the auditor’s evaluation of materiality for purposes of an internal control audit is based on the same long-standing principles applicable to financial statement audits.
Consolidating the Board’s standards on using the work of others in internal control audits and in financial statement audits into one new standard, so as to better facilitate integration of the two audits.
Source
PCAOB Press Release On Proposed Revisions To Auditing Standard (Dec. 5, 2006)
Board spokesman Michael Shokouhi said that phrase “is meant to signal that the Board plans to eliminate the requirement currently contained in paragraph 40 of AS2 that the auditor perform a separate evaluation of management’s process for assessing the effectiveness of the company’s internal control.”
Less clear is whether the Board will drop the requirement for the assessment, or the entire opinion associated with it. “We’re not publicly saying yet whether the auditor will still be required to issue two separate opinions,” Shokouhi said. “Exact details regarding the proposal will be available on the 19th.”
Arguments About Assessments
Anne Sittman, a spokesman for the American Institute of Certified Public Accountants, notes that Sarbanes-Oxley specifically requires auditors to attest to and report on management’s assessment. The Act says the attestation would be done in accordance with standards issued or adopted by the PCAOB.
Sharman
The Institute of Management Accountants contends that eliminating the auditor’s assessment of management’s assessment process and directing auditors to independently assess controls will not reduce the audit work or cost that has led to outcry in the market. The requirement that auditors independently assess controls is what causes excessive testing, says Paul Sharman, president of the IMA.
“What they’re doing with keeping the auditor’s opinion on the internal control system is basically keeping the work and the billable hours,” Sharman says. “This is where they have to do the work to assure the internal control system is effective. It doesn’t begin to address the cost concerns. Auditors will still have to do their own independent testing and evaluation to come to this opinion.”
Richards
The Institute of Internal Auditors also has stumped for eliminating the auditor’s independent assessment. In a comment letter to the Securities and Exchange Commission, IIA President David Richards said the auditor’s independent assessment of internal control “represents a fundamentally unrealistic and unfair expectation on the part of the auditors, which in turn leads to operating inefficiencies and costs.”
Richards said auditors’ role is to give an opinion on management’s statement, not to create statements of their own. “Making statements about operations status, financials, internal controls accomplishments, tone at the top, and strategy is the sole responsibility of management and are duties that solely management has capacity to fulfill,” he wrote.
Tim Leech, chief methodology officer for Paisley Consulting, says the requirement for an independent assessment is what makes auditors worry about liability. An opinion about whether controls are good or bad is too subjective, he says, and drives auditors to gather plenty of evidence to support their positions.
Leech
“I would argue that the amount of testing has to be far greater when I’m going to give my subjective opinion that you have enough controls,” he says. “I’m going to test and I’m going to do a lot more work when I’m going to be held liable when I have to say your contols are effective. I’m going to do a huge amount of work to protect myself from being wrong.”
Leech says auditors need more objective criteria, such as a framework or a grading system of some sort for saying a control is effective or ineffective, if regulators want them to continue to offer independent assessments.
The PCAOB meeting to consider changes to AS2 will be webcast via the Board’s Web site. Copies of the draft revisions will be made available via the Web site in conjunction with the meeting, according to Shokouhi.
No comments yet