|
|
 |
|
Sarbanes Oxley Act -
Auditing Standards |
|
Public
Company Accounting Oversight
Board
Bylaws and Rules – Standards – AS2
Auditing Standard No. 2: An Audit of Internal
Control Over Financial Reporting Performed in
Conjunction With an Audit of Financial
Statements
176. When expressing an adverse opinion on the
effectiveness of internal control over
financial reporting because of a material
weakness, the auditor's report must include:
• The definition of a material weakness, as
provided in paragraph 10.
• A statement that a material weakness has
been identified and included in
management's assessment. (If the material
weakness has not been
included in management's assessment, this
sentence should be modified
to state that the material weakness has been
identified but not included in
management's assessment. In this case, the
auditor also is required to
communicate in writing to the audit committee
that the material weakness
was not disclosed or identified as a material
weakness in management's
report.)
• A description of any material weaknesses
identified in a company's
internal control over financial reporting.
This description should provide
the users of the audit report with specific
information about the nature of
any material weakness, and its actual and
potential effect on the
presentation of the company's financial
statements issued during the
existence of the weakness. This description
also should address
requirements described in paragraph 194.
177. Depending on the circumstances, the
auditor may express both an unqualified
opinion and an other-than-unqualified opinion
within the same report on internal control
over financial reporting. For example, if
management makes an adverse assessment
because a material weakness has been
identified and not corrected ("…internal
control
over financial reporting is not effective…"),
the auditor would express an unqualified
opinion on management's assessment
("…management's assessment that internal
control over financial reporting is not
effective is fairly stated, in all material
respects…").
At the same time, the auditor would express an
adverse opinion about the effectiveness
of internal control over financial reporting
("In our opinion, because of the effect of the
material weakness described…, the company's
internal control over financial reporting
is not effective."). Example A-2 in Appendix A
illustrates the form of the report that is
appropriate in this situation. Example A-6 in
Appendix A illustrates a report that reflects
disagreement between management and the
auditor that a material weakness exists.
178. Scope
Limitations. The auditor can express an
unqualified opinion on
management's assessment of internal control
over financial reporting and an unqualified
opinion on the effectiveness of internal
control over financial reporting only if the
auditor
has been able to apply all the procedures
necessary in the circumstances. If there are
restrictions on the scope of the engagement
imposed by the circumstances, the auditor
should withdraw from the engagement, disclaim
an opinion, or express a qualified
opinion.
The auditor's decision depends on his or her
assessment of the importance of
the omitted procedure(s) to his or her ability
to form an opinion on management's
assessment of internal control over financial
reporting and an opinion on the
effectiveness of the company's internal
control over financial reporting. However,
when
the restrictions are imposed by management,
the auditor should withdraw from the
engagement or disclaim an opinion on
management's assessment of internal control
over financial reporting and the effectiveness
of internal control over financial reporting.
179. For example, management might have
identified a material weakness in its
internal control over financial reporting
prior to the date specified in its report and
implemented controls to correct it. If
management believes that the new controls have
been operating for a sufficient period of time
to determine that they are both effectively
designed and operating, management would be
able to include in its assessment its
conclusion that internal control over
financial reporting is effective as of the
date
specified.
However, if the auditor disagrees with the
sufficiency of the time period, he or
she would be unable to obtain sufficient
evidence that the new controls have been
operating effectively for a sufficient period.
In that case, the auditor should modify the
opinion on the effectiveness of internal
control over financial reporting and the
opinion
on management's assessment of internal control
over financial reporting because of a
scope limitation.
180. When the auditor plans to disclaim an
opinion and the limited procedures
performed by the auditor caused the auditor to
conclude that a material weakness
exists, the auditor's report should include:
• The definition of a material weakness, as
provided in paragraph 10.
• A description of any material weaknesses
identified in the company's
internal control over financial reporting.
This description should provide
the users of the audit report with specific
information about the nature of
any material weakness, and its actual and
potential effect on the
presentation of the company's financial
statements issued during the
existence of the weakness. This description
also should address the
requirements in paragraph 194.
181. Example A-3 in Appendix A illustrates the
form of report when there is a limitation
on the scope of the audit causing the auditor
to issue qualified opinions. Example A-4
illustrates the form of report when
restrictions on the scope of the audit cause
the
auditor to disclaim opinions.
182. Opinions Based, in Part, on the Report of
Another Auditor. When another auditor
has audited the financial statements and
internal control over financial reporting of
one
or more subsidiaries, divisions, branches, or
components of the company, the auditor
should determine whether he or she may serve
as the principal auditor and use the
work and reports of another auditor as a
basis, in part, for his or her opinions. AU
sec.
543, Part of Audit Performed by Other
Independent Auditors, provides direction on
the
auditor's decision of whether to serve as the
principal auditor of the financial statements.
If the auditor decides it is appropriate to
serve as the principal auditor of the
financial
statements, then that auditor also should be
the principal auditor of the company's
internal control over financial reporting.
This relationship results from the requirement
that an audit of the financial statements must
be performed to audit internal control over
financial reporting; only the principal
auditor of the financial statements can be the
principal auditor of internal control over
financial reporting. In this circumstance, the
principal auditor of the financial statements
needs to participate sufficiently in the audit
of internal control over financial reporting
to provide a basis for serving as the
principal
auditor of internal control over financial
reporting.
183. When serving as the principal auditor of
internal control over financial reporting,
the auditor should decide whether to make
reference in the report on internal control
over financial reporting to the audit of
internal control over financial reporting
performed
by the other auditor. In these circumstances,
the auditor's decision is based on factors
similar to those of the independent auditor
who uses the work and reports of other
independent auditors when reporting on a
company's financial statements as described
in AU sec. 543.
184. The decision about whether to make
reference to another auditor in the report on
the audit of internal control over financial
reporting might differ from the corresponding
decision as it relates to the audit of the
financial statements. For example, the audit
report on the financial statements may make
reference to the audit of a significant
equity investment performed by another
independent auditor, but the report on
internal
control over financial reporting might not
make a similar reference because
extend to controls at the equity method
investee.23/
23/ See
Appendix B, paragraph B15, for further
discussion of the evaluation of
the controls over financial reporting for an
equity method investment.
185. When the auditor decides to make
reference to the report of the other auditor
as
a basis, in part, for his or her opinions, the
auditor should refer to the report of the
other
auditor when describing the scope of the audit
and when expressing the opinions.
186. Subsequent Events. Changes in internal
control over financial reporting or other
factors that might significantly affect
internal control over financial reporting
might occur
subsequent to the date as of which internal
control over financial reporting is being
audited but before the date of the auditor's
report. The auditor should inquire of
management whether there were any such changes
or factors. As described in
paragraph 142, the auditor should obtain
written representations from management
relating to such matters. Additionally, to
obtain information about whether changes
have occurred that might affect the
effectiveness of the company's internal
control over
financial reporting and, therefore, the
auditor's report, the auditor should inquire
about
and examine, for this subsequent period, the
following:
• Relevant internal audit reports (or similar
functions, such as loan review in
a financial institution) issued during the
subsequent period;
• Independent auditor reports (if other than
the auditor's) of significant
deficiencies or material weaknesses;
• Regulatory agency reports on the company's
internal control over financial
reporting; and
• Information about the effectiveness of the
company's internal control over
financial reporting obtained through other
engagements.
187. The auditor could inquire about and
examine other documents for the
subsequent period. Paragraphs .01 through .09
of AU sec. 560, Subsequent Events,
provides direction on subsequent events for a
financial statement audit that also may be
helpful to the auditor performing an audit of
internal control over financial reporting.
188. If the auditor obtains knowledge about
subsequent events that materially and
adversely affect the effectiveness of the
company's internal control over financial
reporting as of the date specified in the
assessment, the auditor should issue an
adverse opinion on the effectiveness of
internal control over financial reporting (and
issue an adverse opinion on management's
assessment of internal control over financial
reporting if management's report does not
appropriately assess the affect of the
subsequent event). If the auditor is unable to
determine the effect of the subsequent
event on the effectiveness of the company's
internal control over financial reporting, the
auditor should disclaim opinions. As described
in paragraph 190, the auditor should
disclaim an opinion on management's
disclosures about corrective actions taken by
the
company after the date of management's
assessment, if any.
189. The auditor may obtain knowledge about
subsequent events with respect to
conditions that did not exist at the date
specified in the assessment but arose
subsequent to that date. If a subsequent event
of this type has a material effect on the
company, the auditor should include in his or
her report an explanatory paragraph
describing the event and its effects or
directing the reader's attention to the event
and its
effects as disclosed in management's report.
Management's consideration of such
events to be disclosed in its report should be
limited to a change that has materially
affected, or is reasonably likely to
materially affect, the company's internal
control over
financial reporting.
|
|
| | |
