Integrated Audits of Public Companies: PCAOB Standards for the CPA Exam
Understand integrated audits under PCAOB AS 2201 for the CPA AUD exam. Covers ICFR assessment, top-down approach, significant accounts, and material weakness evaluation.
What Is an Integrated Audit?
An integrated audit is an audit of both a public company's financial statements and its internal control over financial reporting (ICFR), conducted simultaneously by the same auditor. This requirement was established by the Sarbanes-Oxley Act of 2002 and is governed by PCAOB Auditing Standard No. 2201 (formerly AS 5). The integrated audit concept is a major topic on the CPA AUD exam because it requires candidates to understand how the audit of ICFR interrelates with and influences the financial statement audit.
In an integrated audit, the auditor plans and performs the work to achieve the objectives of both audits simultaneously. Evidence obtained in either audit is relevant to both. For example, a material misstatement identified during the financial statement audit must be considered when evaluating the effectiveness of ICFR, and a material weakness in ICFR has implications for the nature, timing, and extent of financial statement audit procedures.
The Top-Down Approach
Starting at the Entity Level
The auditor uses a top-down approach to identify the controls to test. This approach begins at the financial statement level with the auditor's overall understanding of the risks to ICFR, focuses on entity-level controls, and then works down to significant accounts, relevant assertions, and transaction-level controls. Entity-level controls include controls related to the control environment, management's risk assessment process, centralized processing and controls including shared service environments, controls to monitor results of operations, controls to monitor other controls (including the audit committee and internal audit), the period-end financial reporting process, and policies that address significant business control and risk management practices.
Identifying Significant Accounts and Disclosures
The auditor identifies significant accounts and disclosures based on the risk of material misstatement. Factors considered include size and composition of the account, susceptibility to misstatement due to error or fraud, volume of activity and complexity, accounting and reporting complexities, exposure to losses, the possibility of significant contingent liabilities, and the existence of related-party transactions.
Selecting Controls to Test
For each significant account and relevant assertion, the auditor identifies and tests controls that are important to the auditor's conclusion about whether the company's controls sufficiently address the assessed risk of misstatement. The auditor does not need to test all controls but must test controls that are sufficient to provide a reasonable basis for the opinion on ICFR.
Testing the Operating Effectiveness of Controls
The auditor tests the operating effectiveness of selected controls using the same types of procedures used in a financial statement audit: inquiry, observation, inspection, and reperformance. The auditor must obtain evidence about operating effectiveness over a sufficient period of time, which ordinarily means that interim testing alone is not sufficient. The auditor must test a sufficient number of items to conclude on effectiveness, considering the nature of the control, frequency of operation, importance of the control, and evidence from other tests.
Evaluating Deficiencies
Control Deficiency Classification
The auditor classifies identified control deficiencies as a deficiency, a significant deficiency, or a material weakness. A control deficiency exists when a control does not allow management or employees to prevent or detect misstatements on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit the attention of those responsible for financial reporting oversight. A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.
Indicators of Material Weakness
Strong indicators of a material weakness include identification of fraud by senior management, restatement of previously issued financial statements, identification by the auditor of a material misstatement in circumstances that indicate it would not have been detected by the company's controls, and ineffective oversight of external financial reporting by the audit committee.
Reporting on ICFR
The auditor expresses an opinion on whether the company maintained effective ICFR as of the assessment date. If one or more material weaknesses exist, the auditor must express an adverse opinion on ICFR. The auditor's report on ICFR is typically combined with the report on the financial statements. The auditor must communicate significant deficiencies and material weaknesses in writing to management and the audit committee.
CPA Exam Key Points
- An integrated audit covers both financial statements and ICFR. Evidence from one audit is used in the other.
- The top-down approach starts with entity-level controls and works down to significant accounts and transaction-level controls.
- A single material weakness results in an adverse opinion on ICFR, regardless of how many controls are effective.
- The auditor must communicate all significant deficiencies and material weaknesses in writing to the audit committee.
- Management's assessment of ICFR is separate from the auditor's opinion. The auditor independently evaluates ICFR effectiveness.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.