CPA Exam AUD: PCAOB vs. AICPA Standards Compared

PCAOB vs. AICPA Standards: Key Differences for the CPA Exam

One of the most important distinctions on the AUD exam is between PCAOB and AICPA auditing standards. PCAOB standards apply to audits of public companies (issuers) and SEC-registered broker-dealers, while AICPA standards (clarified Statements on Auditing Standards, or SASs, codified as AU-C sections) apply to audits of nonpublic entities. Understanding the key differences is essential for CPA exam success.

Standard-Setting Authority

The PCAOB (Public Company Accounting Oversight Board) was established by the Sarbanes-Oxley Act of 2002 (SOX) to oversee audits of public companies. The PCAOB sets auditing standards for public company audits, and these standards are designated as "AS" (Auditing Standards). The AICPA's Auditing Standards Board (ASB) sets auditing standards for nonpublic entities. These standards are designated as AU-C sections in the AICPA's codification. While many concepts overlap, there are important differences in requirements and report formatting.

Integrated Audit Requirement

One of the most significant differences is the PCAOB's requirement for an integrated audit of public companies. Under PCAOB AS 2201, the auditor of a public company must perform an integrated audit that includes both the audit of financial statements and the audit of internal control over financial reporting (ICFR). The auditor expresses two opinions: one on the financial statements and one on the effectiveness of ICFR. Under AICPA standards, there is no requirement for a separate opinion on ICFR. The auditor considers internal control as part of the risk assessment process but does not issue an opinion on its effectiveness unless specifically engaged to do so.

Audit Report Differences

The format and content of the auditor's report differ significantly between PCAOB and AICPA standards:

• Title: Both require the title to include the word "independent."
• Opinion placement: Under both PCAOB and AICPA standards, the opinion paragraph appears first in the report.
• Critical Audit Matters (CAMs): PCAOB reports must include CAMs, which are matters arising from the audit that were communicated to the audit committee, relate to material accounts or disclosures, and involved especially challenging, subjective, or complex auditor judgment. There is no equivalent requirement under AICPA standards, although Key Audit Matters (KAMs) may be communicated voluntarily under AU-C Section 701.
• Tenure disclosure: PCAOB reports must disclose the year the auditor began serving consecutively as the company's auditor. There is no such requirement under AICPA standards.
• ICFR opinion: PCAOB reports on public companies include an opinion on ICFR; AICPA reports do not.

Independence Requirements

Independence requirements for public company audits are significantly more restrictive. Under SOX and SEC rules, auditors of public companies are prohibited from providing certain nonattest services, including bookkeeping, financial information systems design and implementation, appraisal or valuation services, actuarial services, internal audit outsourcing, management functions, human resource services, broker-dealer or investment advisor services, and legal and expert services unrelated to the audit. Under AICPA rules for nonpublic entities, many of these services are permitted as long as management responsibilities are not assumed and general nonattest service requirements are met.

Partner Rotation

For public company audits, SOX requires mandatory rotation of the lead audit partner and the concurring review partner every five years, with a five-year cooling-off period. Other audit partners who serve the audit client must rotate every seven years with a two-year cooling-off period. Under AICPA standards for nonpublic entities, there is no mandatory rotation requirement, although the firm should have policies to address the familiarity threat.

Communication Requirements

Both PCAOB and AICPA standards require communication with those charged with governance, but the specifics differ. Under PCAOB AS 1301, the auditor must communicate certain matters to the audit committee, including the auditor's responsibility under PCAOB standards, the planned scope and timing of the audit, significant findings from the audit, and certain independence matters. Under AICPA AU-C 260, the auditor communicates similar matters to those charged with governance, but the specific requirements and terminology differ.

Materiality Considerations

While the concept of materiality is similar under both sets of standards, there are nuances. The PCAOB uses the concept of material weakness, significant deficiency, and control deficiency in the context of the ICFR audit. Under AICPA standards, these terms are used in the context of communicating internal control matters, but since there is no ICFR opinion requirement, the implications differ. A material weakness under PCAOB standards results in an adverse opinion on ICFR; under AICPA standards, it results in a written communication to governance but does not independently affect the opinion on the financial statements.

Fraud Consideration

Both sets of standards require the auditor to consider fraud risk. The requirements are substantially similar, including the brainstorming session, assessment of fraud risk factors, required procedures to address management override, and communication requirements. However, the PCAOB standard (AS 2401) and the AICPA standard (AU-C 240) may differ in specific procedural details.

Exam Tips for PCAOB vs. AICPA Standards

• PCAOB standards apply to issuers (public companies); AICPA standards apply to nonissuers (nonpublic entities).
• Only PCAOB audits require an integrated audit with an opinion on ICFR.
• CAMs are required for PCAOB reports; KAMs are optional under AICPA standards.
• SOX imposes stricter independence rules and mandatory partner rotation for public company audits.
• A material weakness in an integrated audit means an adverse opinion on ICFR.