Many accounting firms are doing a good job of following new standards for conducting risk-based audits of internal controls, but others are not applying the standards properly, according to a new
The PCAOB examined portions of approximately 250 audits of internal control over financial reporting by the eight largest domestic registered firms in 2007 and 2008. The report assesses the first year of implementation of the risk-based Auditing Standard No. 5.
The new standard, which was adopted on June 12, 2007, was intended to focus auditors on the most important matters in audit of internal controls, eliminate unnecessary audit procedures, make the audit scalable to size and complexity of the business, and simplify the text of the predecessor standard. AS No. 5 became effective for audits for fiscal years ending on or after Nov. 15, 2007, and replaced the PCAOBs previous ICFR standard, Auditing Standard No. 2.
The PCAOB said its inspectors' observations varied both across and within the firms. In each of the areas that inspectors reviewed, inspectors observed instances of inappropriate application of the standard. In general, the areas where inappropriate application was most frequently observed were risk assessment, the evaluation of entity-level controls, and the nature, timing, and extent of the controls testing.
This report finds that, in the engagements our inspection teams looked at, auditors generally focused on the areas that presented more significant audit risk, said Acting PCAOB Chairman Daniel L. Goelzer in a statement. While we are encouraged by the first-year implementation of AS No. 5, there is still room for improvement, and we will continue to review and assess the effectiveness of firms integrated audit procedures in 2009.
The PCAOB noted that it is not changing or proposing to change any existing standard in the report, nor is the board providing any new interpretation of any existing standards in the document.
