The American Institute of CPAs' Auditing Standards Board is poised to issue an exposure draft of five proposed statements and amendments to statements relating to auditors' risk assessment.
If adopted, the changes will result in more in-depth understanding of companies, their internal controls and their risks of material misstatements. They will also strengthen the link between assessed risks and the audit process. Depending on public comments on the exposure drafts, final issuance of new standards -- which could number as many as seven, depending on how the board decides to delineate the statements -- is expected by the end of 2005.
"These exposure drafts propose a change, at a minimum, in how auditors document and approach their audits," said Brian Ballou, an associate professor at Miami [Ohio] University and a member of the AICPA risk assessment task force. "Assertions will be broken into three categories: transactions, accounts, and presentation and disclosure. They will be reorganized that way."
One proposal deals with understanding the client entity and its environment. It will look at all the types of risk assessments that an auditor will look at in an engagement.
The theory and methodology behind the expected proposals are similar to those of SAS 99, which deals with fraud. They require auditors to assess the risk to controls and the risks inherent in the company. Under earlier standards, such an assessment would normally be preceded by evidence of risk.
"This is going to require more thinking, up front, where risk may occur," said Chuck Landes, AICPA director of auditing and attestation. "SAS 99 requires the same kind of brainstorming for fraud ... and the new standards will require brainstorming to look for anyplace that material misstatement could occur, whether it's fraud or error."
The proposed changes were first issued in 2002, after the signing of the Sarbanes-Oxley Act, but before it was determined whether the ASB or the Public Company Accounting Oversight Board would set audit standards. The ASB stopped work on the project pending a decision on jurisdiction. At roughly the same time, the International Auditing and Assurance Standards Board of the International Federation of Accountants continued work on similar risk assessment standards. The two boards are working together to converge U.S. and international standards, so when the ASB continued its work, it chose to adapt its proposal to more closely resemble that of the IAASB.
"Our goal is to have substantially equivalent auditing standards between the IAASB and the ASB," Landes said. He said that the decision to re-expose was because the board felt that most practitioners had lost track of the project and needed another opportunity to review it. The IAASB has already exposed and approved its set of standards. The only significant differences are those in the ASB proposal that relate only to U.S. regulations.
The statements are expected to resolve the fundamental issue of the "rollover" method versus the "iron curtain" method. The rollover method considers the aggregate effect of prior-period and current-period uncorrected misstatements. The iron curtain method only considers the effect of the current period's uncorrected misstatements. The IAASB standard is interpreted to require consideration of misstatements of prior periods; therefore, the ASB standard is likely to require auditors to consider both methods.
Landes characterized the suite of proposed standards as a lot of relatively small, nuanced rules which, considered together, constitute a sweeping reform that will make a real difference in audits of practitioners large and small.
"These standards get back, in a certain way, to the blocking and tackling basics of good auditing," Landes said. "They say you can't use a canned audit program. For every client you have to think where there is risk of material misstatement, control risk, and inherent risk. These are part of the formula that all of us grew up with. Now we have to sit back and say, 'How do I need to design my audit program - the timing, nature and extent of what I do - to be responsive to those risks.'"
The AICPA plans to develop an educational training program to help practitioners understand and use the new standards. The ASB also expects to issue authoritative and non-authoritative guidance to accompany the statements.
The international standards are effective for years beginning after Dec. 15, 2004. Landes expected the ASB standards to be effective a year or more after that.
