SOX Compliance and Auditing Internal Controls: PCAOB Standards for the CPA Exam
Master SOX compliance and the integrated audit of internal controls over financial reporting for the CPA AUD exam. Covers PCAOB AS 2201, top-down risk assessment, testing controls, and reporting.
The Sarbanes-Oxley Framework
The Sarbanes-Oxley Act of 2002 (SOX) was enacted in response to major corporate accounting scandals and fundamentally changed the landscape of public company auditing. Section 404 is the most impactful provision for auditors: it requires management of public companies to assess and report on the effectiveness of internal control over financial reporting (ICFR), and the external auditor to audit that assessment. This integrated audit of financial statements and ICFR is governed by PCAOB Auditing Standard No. 2201 (formerly AS 5) and is a critical topic on the CPA AUD exam.
Management's Responsibilities Under SOX 404
Management must maintain an adequate ICFR system, assess its effectiveness as of year-end, provide a written assessment of ICFR effectiveness in the annual report, and identify the framework used for the assessment (typically the COSO Internal Control - Integrated Framework). Management's assessment must identify any material weaknesses that exist as of the assessment date. If a material weakness exists, management cannot conclude that ICFR is effective.
The Auditor's Integrated Audit
Under AS 2201, the auditor performs an integrated audit that encompasses both the audit of the financial statements and the audit of ICFR. The two audits are interrelated: the auditor's understanding of internal controls for the financial statement audit informs the ICFR audit, and ICFR findings affect the nature, timing, and extent of substantive procedures.
Top-Down Risk Assessment
The auditor uses a top-down approach to identify the controls to test. This begins with understanding the overall risks to reliable financial reporting, then focuses on entity-level controls, significant accounts and disclosures, relevant assertions, and the specific controls that address the risks of material misstatement. This approach ensures the auditor focuses on the controls that matter most rather than testing every control.
Entity-Level Controls
Entity-level controls operate at the organizational level and include the control environment (tone at the top, ethical values, management philosophy), the risk assessment process, centralized processing and controls including shared service environments, monitoring activities (including the internal audit function), and the period-end financial reporting process. Some entity-level controls are precise enough to detect or prevent misstatements to specific assertions. Others are indirect and, while important, require the auditor to also test process-level controls.
Testing Controls
The auditor must obtain sufficient evidence about the design and operating effectiveness of selected controls. Evidence about design effectiveness is obtained through inquiry, observation, inspection of documents, and walkthroughs. Evidence about operating effectiveness requires testing that a control operated as designed consistently throughout the period. Testing approaches include:
- Inquiry combined with other procedures (inquiry alone is not sufficient)
- Inspection of documents and reports
- Observation of the control being performed
- Reperformance of the control by the auditor
Extent of Testing
The auditor varies the extent of testing based on the nature and frequency of the control. Controls performed daily require larger sample sizes than monthly controls, which require larger samples than annual controls. For automated controls, testing one instance may be sufficient if the auditor verifies that the IT general controls supporting the automated control operated effectively throughout the period.
Evaluating Deficiencies
A control deficiency exists when the design or operation of a control does not allow management or employees to prevent, or detect and correct, misstatements on a timely basis. Deficiencies are classified as:
Material Weakness
A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented, or detected and corrected, on a timely basis. The presence of a material weakness means ICFR is not effective.
Significant Deficiency
A deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight of the company's financial reporting. Significant deficiencies must be communicated to management and the audit committee but do not prevent the auditor from issuing an unqualified opinion on ICFR.
The Auditor's Report on ICFR
The auditor issues a separate opinion (or a combined report) on the effectiveness of ICFR as of year-end. The possible opinions are:
- Unqualified: ICFR is effective in all material respects.
- Adverse: One or more material weaknesses exist; ICFR is not effective.
- Disclaimer: The auditor is unable to obtain sufficient evidence (scope limitation).
Note that a qualified opinion on ICFR is not permitted under PCAOB standards. If a material weakness exists, the opinion must be adverse. The auditor must communicate all material weaknesses and significant deficiencies to management and the audit committee in writing.
Relationship Between ICFR and Financial Statement Opinions
An adverse opinion on ICFR does not automatically result in a modified opinion on the financial statements. The auditor may still issue an unqualified opinion on the financial statements if substantive procedures provide sufficient evidence that the financial statements are fairly stated despite the control weakness. However, the material weakness must be considered in planning the nature, timing, and extent of substantive tests.
Key Exam Tips
- The integrated audit covers both financial statements and ICFR; the opinions may differ.
- A material weakness requires an adverse ICFR opinion; qualified opinions are not allowed for ICFR.
- The top-down approach starts with entity-level controls and drills down to process-level controls for significant accounts.
- For automated controls, test IT general controls to support reliance on a single-instance test of the automated control.
- Know the distinction between material weakness and significant deficiency: both must be communicated, but only a material weakness affects the ICFR opinion.
Practice What You Learned
Study with 1,200+ flashcards and 140 practice exams across all 4 CPA sections.