Section 404 of the Sarbanes-Oxley Act, which deals with auditing internal controls, has brought widespread agreement with the act's intentions and equally widespread complaints of increased costs and a disturbing lack of specificity on some aspects of the rules.
The requirements of Section 404 hit home about a year ago, when the Public Company Accounting Oversight Board issued Auditing Standard No. 2, "An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements."
AS 2 was a radical departure from the old ways of auditing, and it got off to a bumpy start.
In reaction to a clamouring among auditors, the American Institute of CPAs' Center for Public Company Audit Firms fired off a letter to the PCAOB in early April identifying several areas of the standard that could use some fine-tuning. Representatives from the center then went on to participate in a Securities and Exchange Commission roundtable discussion of weaknesses in the standard.
Within a month of the roundtable, the PCAOB issued new guidance on implementing the standard, most of it helping auditors reduce the cost of audits by allowing them the judgment needed to avoid unnecessary work.
CPCAF director Lillian Ceynowa praised the PCAOB's quick response.
"I think the guidance that the PCAOB came out with is great," she said. "It's specific, and it addresses the questions and concerns that were raised during the first year of application. It would have been great if it had been there last year, but auditors and clients will be able to apply in the upcoming year. I think we're moving closer to getting it right."
The CPCAF replaced the AICPA's SEC Practice Section in 2004, after the PCAOB was formed and audit quality protection was overhauled. The center has over 900 paying members, most of them auditors of public companies.
The CPCAF letter cited six problems with the standard, and the PCAOB reacted to about half.
If there is an overriding directive behind the board's solutions, it is, "Use judgment."
The letter complained that the standard defined significant accounts and processes in a way that resulted in needless testing of areas of insignificant materiality where the risk of fraud and error is low.
The board responded by advising auditors to "exercise judgment to tailor their audit plans to the risks facing individual audit clients, instead of using standardized 'checklists' that may not reflect an allocation of audit work weighted toward high-risk areas."
The letter also suggested that the work of internal auditors could be better leveraged to lessen the efforts of public auditors. AS 2 has a "principal evidence" provision that prevents external auditors from relying too much on the work of other parties. Part of the auditor's function, the standard says, is to determine whether a company's internal audit function is effective.
"There was selectability in the standard, but it wasn't clear to us how much work could be pushed off to others and still satisfy the principle evidence notion," the CPCAF's Ceynowa said. "We were looking for additional clarification, and they addressed it. They were very responsive."
The board reiterated that if the external auditor has sufficient evidence that the internal auditor's work is reliable, internal audit information can be used in the external audit.
"An auditor who applies Auditing Standard No. 2 from the top down and appropriately assesses risk should naturally identify areas where use of the work of others is not only appropriate, but is also the most efficient way to perform the audit," the board's policy statement said. "Redoing work in these areas may unnecessarily increase costs without producing a corresponding increase in audit quality. Spending auditor resources in areas in which the auditor could rely on the work of others also may cause the auditor to focus too much on low-risk controls."
The board also cleared up a misperception that the CPCAF and others had articulated, that public company clients may not provide accounting advice to clients, and that clients must finish all assessments of internal control and financial statements before an auditor can comment on them.
According to the board's new policy statement on Section 404, "Such practices are neither necessary nor advisable."
"When auditors are unwilling, or believe that they are unable, to provide advice on accounting or internal control," the guidance stated, "management may be forced to retain other accounting experts, or to make accounting decisions without the benefit of access to the auditor's technical knowledge."
The policy specified several examples of how auditors can help clients use communication to minimize the cost of doing things right, without crossing the crucial line of auditor independence.
The board did not, however, respond to all of the points in the CPCAF letter. The letter expressed concern that the standard requires too much judgment in distinguishing between a significant deficiency and a material weakness.
The lack of guidance, the letter said, could result in inconsistent application.
The PCAOB offered no solution to the problem and has declined to comment on whether it is still working on it.
The board did not respond to the CPCAF's suggestions that auditors should not need to communicate all detected deficiencies in internal control. Communication of significant deficiencies and material weaknesses, the letter stated, should be sufficient.
The board also remained silent on a complaint that investors are often confused by two opinions that auditors issue: one on the effectiveness of internal controls, and one on management's assessment of the effectiveness of internal controls.
The new PCAOB guidelines also eased the auditor's task by allowing auditors to use prior knowledge or audits of their client to avoid needless investigation of areas that the auditors know are probably not susceptible to problems.
Ceynowa said that she was pleased that the PCAOB responded quickly to so many problems.
"It's been a tough year for firms and companies," Ceynowa said. "It's a big, complex standard. The larger firms that had to implement the standard immediately had to train their staff and implement methodologies that needed to be applied, and I think they did a great job."
