New PCAOB FAQs

By: Cydney Posner

The PCAOB has issued six new FAQs on internal control.  The FAQs address the following points:

• If a different auditor is engaged to audit a subsidiary or division, that auditor may, but is not required to, audit internal control for the subsidiary (unless the subsidiary is itself a public company, in which case the auditor must perform the internal control audit). There are three possible approaches:
  • The other auditor may perform the work. If the principal auditor assumes responsibility for the work of the other auditor, the principal auditor will not refer to the work of the other auditor in his or her report. If the principal auditor decides to divide responsibility with the other auditor, the principal auditor will refer to the other auditor in his or her report. If the principal auditor decides to make reference to the other auditor in his or her report on the audit of internal control, then the other auditor must perform an integrated audit of internal control and the financial statements and separately issue a report.
  • The principal auditor may direct the other auditor to perform specified procedures related to internal control. In this case, the principal auditor must assume responsibility for the specified procedures.
  • The principal auditor may perform procedures at the subsidiary that he or she considers necessary to be able to express an opinion on the internal control on a consolidated basis.
• The auditor's opinion relates to the effectiveness of the company's internal control as of a point in time. Although auditors obtain evidence about internal control over a period of time, the auditor has flexibility in determining the timing of testing. The auditor is required to reach a conclusion regarding the significance of all identified control deficiencies only as of the date of the assessment (i.e., as of year end). Although the auditor might reach a conclusion regarding the significance of a control deficiency as of an earlier date, an earlier conclusion is not required by Auditing Standard No. 2.
• In contrast, the auditor's responsibility to communicate in writing to management and the audit committee all significant deficiencies and material weaknesses identified during the audit encompasses:
  • all significant deficiencies and material weaknesses that exist as of the date of the assessment and
  • any deficiencies that the auditor concludes, as of an earlier date, are significant deficiencies or material weaknesses and that management has not also identified as such and begun corrective action regarding as of the interim date.
• The auditor is required to obtain a representation from management that, among other matters, management has disclosed to the auditor all deficiencies in the design or operation of internal control identified as part of management's assessment, including separately disclosing significant deficiencies or material weaknesses. This representation contemplates that management has disclosed to the auditor all deficiencies in internal control identified as part of management's assessment, regardless of whether the deficiencies have been corrected as of the date of management's assessment.
• Although IT general control deficiencies do not result in financial statement misstatements directly, an associated ineffective application control may lead to misstatements. After an IT general control deficiency has been evaluated in relation to its effect on application controls, it also should be evaluated when aggregated with other control deficiencies. It is also possible that an auditor could determine that a prudent official in the conduct of his own affairs would conclude that the IT general control deficiency, by itself, was a significant deficiency.
• The auditor may use internal auditors to provide direct assistance in the audit of internal control; however, the auditor must perform enough of the testing himself so that his own work provides the principal evidence for the auditor's opinion. Testing performed by internal auditors as direct assistance does not qualify as part of the principal evidence supporting the auditor's opinion. For example, the auditor may not use internal auditors as direct assistance for the walkthroughs that the auditor determines are necessary.

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.