July 12, 2007
Subject: File No. PCAOB-2007-02
July 12, 2007
One of the questions in Release 34-5512 is: "Will AS5 reduce expected audit costs under Section 404, particularly for smaller public companies, to result in cost-effective, integrated audits?"
I believe AS 5 will reduce audit costs somewhat, but not as much as it could or should. Therefore, I do not believe that the integrated audit will be cost-effective, or as cost-effective as it should be.
That outcome will be the result of the elimination of the auditor's opinion on management's assessment and, instead, the retention of the requirement for an auditor's opinion on the effectiveness of internal control.
Section 404 of the Sarbanes-Oxley Act does not call for the latter opinion. It requires quite literally and clearly an opinion of the auditor on management's assessment of internal control.
A legitimate concern of reporting companies has been the imposition of the auditor's expectations regarding the procedures management should use in its evaluation of internal control effectiveness. The root cause of this problem has been the absence of guidance for management. Auditors were appropriately concerned if managements' procedures were less than what auditors were required to do under AS 2. AS 2 thus became de facto guidance for management.
Managements have also reacted with complaints about auditor's evaluation of management's assessment process, as required by AS 2, which often resulted in auditors dictating management's procedures.
Primarily in response to these concerns, the SEC/PCAOB eliminated the auditor's opinion on management's assessment.
This left the only alternative – an opinion on the effectiveness of internal control.
The result, however, is a substantial duplication of effort.
The better course of action, which I strongly recommend, is to retain the requirement for an opinion on management's assessment and delete the opinion on internal control effectiveness.
Appendix 4 of PCAOB Release 2007-005 discusses "Reporting the Results of the Audit." It states: "The Board continues to believe that the overall scope of the audit that was described by Auditing Standard No. 2 and the proposed standard is correct - that is, to attest to and report on management's assessment, as required by Section 404(b) of the Act, the auditor must test controls directly to determine whether they are effective."
This appears to be the only reason given for rejecting the alternative of reporting on management's assessment. But it is a very weak argument. There is nothing to prevent an auditor from testing the effectiveness of controls directly where the auditor is reporting on management's assessment, just as the auditor would perform substantive tests in an audit of the financial statements (which are representations of management). The issue is the amount of testing to be done.
As a general rule, if management is reporting on the effectiveness of internal control and if the auditor is acting as a check on management's assessment, as is the intent of Section 404, it is only necessary that the auditor check management's tests of controls rather than for the auditor to re-test controls. This process entails less work.
An analogy may be found with a quality control procedure used in audits, in which an audit is reviewed by a partner of the audit firm who is not otherwise involved in the audit. In such a review, the reviewing partner evaluates whether the audit meets PCAOB standards. The reviewing partner uses professional judgment in evaluating the audit process and its results. The reviewing partner does not re-do the audit.
Likewise, in testing management's assessment, it should not be necessary for the auditor to re-do the internal control testing. The auditor would preform some tests of controls directly, just as it performs other tests, such as to corroborate management's representations.
Assuming that the Commission's recently released guidance for management works well in practice, there should no longer be a concern about auditors dictating the procedures management should follow. That guidance, together with the substantial improvements incorporated into AS 5, with the exception discussed above, should allow for better coordination between the roles of management and the auditor.
I can appreciate the pressure the Commission and PCAOB are under to get something out for implementation this year. But the proposed changes are large, and to go down the wrong path now would be a mistake.
If the Commission and PCAOB decide not to make the change recommended above at this time, they should reconsider the matter in the future.
I appreciate your consideration of my comments.
Sincerely,
Robert F. Richter, CPA