Center for Audit Quality issues SOX 404 alert

With the effective date of management's implementation of Sarbanes-Oxley Act Section 404(a) for non-accelerated filers (smaller public companies) fast approaching, the AICPA-affiliated Center for Audit Quality has issued an alert to provide information to auditors of those companies on items to consider during the upcoming audit season.

Items to Consider Regarding Management's Report on Internal Control for Audits of Non-Accelerated Filers

Some Center for Audit Quality member firms have raised questions regarding the auditor's role relative to management's report on its assessment of internal control over financial reporting when, under the SEC's transition provisions for non-accelerated filers, an auditor attestation is not required. With the effective date of management's implementation of Sarbanes-Oxley Section 404(a) (Management Assessment of Internal Control Over Financial Reporting) for non-accelerated filers rapidly approaching, the Center is issuing this alert to provide information to auditors of nonaccelerated filers on items to consider during the upcoming audit given that the related auditor attestation on the effectiveness of internal control over financial reporting is not required until the following year. (Note: As of the date of this alert, Chairman Cox of the SEC testified at a hearing before the House Small Business Committee on December 12, 2007 indicating that the Commission will soon approve a further one-year delay of SOX Section 404(b) (external auditor's attestation requirement) for non-accelerated filers. Once the Commission approves of this delay, the auditor's attestation report on the effectiveness of internal control over financial reporting will not be required to be filed until the non-accelerated filer files an annual report for fiscal years ending on or after December 15, 2009.)

Under SEC Release No. 33-8760, Internal Control Over Financial Reporting in Exchange Act Periodic Reports of Non-Accelerated Filers and Newly Public Companies, non-accelerated filers are required to "furnish" the SEC with management's report on internal control over financial reporting when they file an annual report for the first fiscal year ending on or after December 15, 2007. The auditor's attestation report on the effectiveness of internal control over financial reporting is not required to be filed until the non-accelerated filer files an annual report for fiscal years ending on or after December 15, 2008.

This alert includes information for member firms' consideration when performing audits of nonaccelerated filers for the upcoming audit season that:

    1. Illustrate possible additional language to include in the auditor's report on financial statements when the auditor is not required to opine on the effectiveness of internal control over financial reporting; and

    2. Identify items auditors should consider when management furnishes its report on the assessment of internal control over financial reporting and the auditor's attestation report on the effectiveness of internal control over financial reporting is not required.

1. Possible Additional Audit Report Language

We call your attention to the information the former Center for Public Company Audit Firms provided to its members in 2005 in CPCAF Alert #46, Reporting Considerations for Non-Accelerated Filer Audit Reports. We believe that the information in that alert is still relevant to auditors of non-accelerated filers during the initial year of implementation of Section 404. The following information was provided in that alert (adapted from CPCAF Alert #46):

In an audit of a non-accelerated filer that has determined it is not required to obtain, and that did not engage the auditor to perform, an audit of internal control over financial reporting (under Section 404 (b) of the Sarbanes-Oxley Act of 2002 and Item 308(b) of SEC Regulation S-K), firms may wish to consider expanding their audit report to include a statement that the purpose and extent of the auditor's consideration of internal control over financial reporting were to determine that the nature, timing and extent of tests to be performed were appropriate in the circumstances, but were not sufficient to express an opinion on the effectiveness of internal control over financial reporting. Firms are not required to expand their audit report to include this statement. However, the SEC staff has indicated that if a firm chooses to expand its report to clarify this point, the language in Interpretation 18 to SAS No. 58 [CPCAF Alert #12] provides appropriate language to consider in an audit conducted in accordance with PCAOB standards. Accordingly, the scope section of the auditor's report might be modified as follows:

    We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. The Company is not required to have, nor were we engaged to perform, an audit of its internal control over financial reporting. Our audit included consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the Company's internal control over financial reporting. Accordingly, we express no such opinion. An audit also includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements, assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audit provides a reasonable basis for our opinion.

A second alternative would be to use language from AU Section 9550, Other Information in Documents Containing Audited Financial Statements: Auditing Interpretations of Section 550 of the Public Company Accounting Oversight Board's (PCAOB) Interim Professional Auditing Standards. AU Section 9550.10 states, "Although not required, the auditor may consider adding the following paragraph to the standard auditor's report:

    We were not engaged to examine management's assertion about the effectiveness of [name of entity's] internal control over financial reporting as of [date] included in the accompanying [title of management's report] and, accordingly, we do not express an opinion thereon."

2. Other Factors for Auditors to Consider

At the October 2007 PCAOB Forum on Auditing in a Small Business Environment in New York City, there was a discussion regarding the responsibilities of the auditors of non-accelerated filers with respect to internal control over financial reporting when management's assessment report (under Section 404(a)) is required but the auditor's report on internal control (under Section 404(b)) is not yet required. As part of this discussion, the PCAOB staff made the following remarks based on the relevant standards:

PCAOB Staff Remarks:

"To the extent that management's assessment on internal control over financial reporting is included in the [annual report], the auditor should focus on [management's] conclusion of internal control to determine that there are no misrepresented facts. There is no need to re-test [management's] testing. [Auditors should] just focus on [management's] conclusion" and "do not have to worry about the process."

Applicable PCAOB Interim Professional Auditing Standards:

Auditor focus should be on management's conclusion in its report on internal control over financial management's report and decide whether any information obtained during the financial statement audit gives them reason to believe that the conclusion reached by management misrepresents the facts. AU Section 550.04 and AU Section 550.05, Other Information in Documents Containing Audited Financial Statements, of the PCAOB's Interim Professional Auditing Standards states that "[t]he auditor's responsibility with respect to information in a document does not extend beyond the financial information identified in his report, and the auditor has no obligation to perform any procedures to corroborate other information contained in the document. However, he should read the other information and consider whether such information, or the manner of its presentation, is materially inconsistent with information, or the manner of its presentation, appearing in the financial statements… If, while reading the other information…the auditor becomes aware of information that he believes is a material misstatement of fact that is not a material inconsistency…he should discuss the matter with the client."

PCAOB Staff Remarks

"Based solely on the knowledge gathered from the financial statement audit, auditors should consider whether management's assessment is materially inconsistent [in the context of the requirements of AU Section 550]. If management concludes that internal control over financial reporting is effective but the auditor disagrees, then the auditor has the responsibility to first discuss the difference with management and potentially the audit committee." [AU Section 325.01 Communications About Control Deficiencies in an Audit of Financial Statements]

Applicable PCAOB Interim Professional Auditing Standards:

An auditor, in connection with an audit of financial statements, is required to consider internal control as a basis in designing audit procedures. An auditor may become aware of information that causes him or her to believe that management's assertion on the effectiveness of internal control contains a material misstatement of fact. In such cases, the auditor should discuss the information with the client. If after discussions with the client, the auditor concludes that a material misstatement of fact remains, the action he or she takes will depend on his or her judgment in the particular circumstances. He or she should consider steps such as notifying the client in writing of his or her views concerning the information and consulting his or her legal counsel as to further appropriate action in the circumstances. (AU Section 550.06)

PCAOB Staff Remarks:

"Auditors should be aware of their Section 10A responsibilities when [an auditor] determines that management's assessment is materially misstated."

Applicable Law – Securities Exchange Act of 1934:

Lastly, auditors should be aware of their responsibilities to notify the SEC under certain circumstances relative to Section 10A of the Securities Exchange Act of 1934, Audit Requirements, which include investigation of information that indicates illegal acts may have occurred and, upon the satisfaction of certain criteria, reporting illegal acts to management, the Board of Directors, and the SEC. Consultation with legal counsel should be considered. Committee on December 12, 2007 indicating that the Commission will soon approve a further one-year delay of SOX Section 404(b) (external auditor's attestation requirement) for non-accelerated filers. Once the Commission approves of this delay, the auditor's attestation report on the effectiveness of internal control over financial reporting will not be required to be filed until the non-accelerated filer files an annual report for fiscal years ending on or after December 15, 2009.

For more information, visit the Center for Audit Quality

You may like these other stories...

Companies are taking their time transitioning to the 2013 Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control-Integrated Framework, even though the updated guidance is set to take effect...
By Jason BramwellOfficials from the Public Company Accounting Oversight Board (PCAOB) said on August 19 that deficiencies were found in all sixty of the broker-dealer audits conducted by audit firms that the PCAOB inspected...
By Frank Byrt and Anne RosivachThe Public Company Accounting Oversight Board (PCAOB) issued a cautiously optimistic report on US auditors' performance, saying the Board found a reduced rate of "significant audit...

Already a member? log in here.

Upcoming CPE Webinars

Sep 18
In this course, Amber Setter will shine the light on different types of leadership behavior- an integral part of everyone's career.
Sep 24
In this jam-packed presentation Excel expert David Ringstrom, CPA will give you a crash-course in creating spreadsheet-based dashboards. A dashboard condenses large amounts of data into a compact space, yet enables the end user to easily drill down into details when warranted.
Sep 30
This webcast will include discussions of important issues in SSARS No. 19 and the current status of proposed changes by the Accounting and Review Services Committee in these statements.
Oct 23
Amber Setter will show the value of leadership assessments as tools for individual and organizational leadership development initiatives.