Upfront: PCAOB Issues Audit Guidance

Auditors have been taken to task for interpreting Sarbanes-Oxley too strictly. Will the new Section 404 guidance make them more flexible?

The case made by executives straining under the weight of Sarbanes-Oxley compliance requirements who spoke at the SEC's Roundtable on Implementation of Internal Control Reporting Provisions in Washington, D.C., in April was compelling enough that the Public Company Accounting Oversight Board (PCAOB) in May issued long-awaited guidance regarding implementation of the Sarbanes-Oxley Act, Section 404, Auditing Standard No. 2 (AS2), "An Audit of Internal Control Over Financial Reporting Performed in Conjunction With an Audit of Financial Statements."

The guidance consists of a board policy statement regarding the implementation of AS2 and a series of staff questions and answers that provide technical guidance to auditors about how to use the provisions and underlying principles of the standard to conduct effective and cost-efficient audits of public companies' internal control over their financial reporting. Both the statement and the staff questions and answers focus on the scope of the internal controls and the audit and on how much testing of the controls is required. These two issues influence the cost of implementing the standard.

According to the policy statement, to properly plan and perform an effective audit, auditors should do the following:

• integrate their audits of internal control with their audits of the client's financial statements so that evidence gathered and tests conducted in the context of either audit contribute to the completion of both audits
• exercise judgment to tailor their audit plans to the risks facing individual audit clients instead of using standardized checklists that may not reflect an allocation of audit work weighted toward high-risk areas (and weighted against unnecessary audit focus in low-risk areas)
• use a top-down approach that begins with company-level controls to identify for further testing only those accounts and processes that are, in fact, relevant to internal control over financial reporting, and use the risk assessment required by the standard to eliminate from further consideration those accounts that have only a remote likelihood of containing a material misstatement
• take advantage of the significant flexibility that the standard allows to use the work of others
• engage in direct and timely communication with audit clients when those clients seek auditors' views on accounting or internal control issues before those clients make their own decisions on such issues, implement internal control processes under consideration or finalize financial reports

The guidance chided auditors for interpreting Sarbanes-Oxley too strictly, causing some public companies to incur unnecessary costs. Regulators now urge accountants to be more flexible in assessing internal controls, abandoning a one-size-fits-all mind-set.

"I strongly agree with the PCAOB and SEC in the criticism and their offered guidance," says Kelly Dreishpoon, manager at Rothstein Kass, Certified Public Accountants in Roseland, N.J. "The criticisms are valid, and the profession needs to transition to a risk-based, judgment approach. However, a lot of the initial approach [to Section 404] was predicated by the first-time-through nature of the implementation. What other guidance was there outside the strict interpretation of what was written?"

Parveen P. Gupta, Frank L. Magee professor of accounting at Lehigh University's College of Business and Economics in Bethlehem, Pa., concurs. "Although the criticism is valid," he says, "the way the accounting standard [AS2] is written, quite frankly, promotes the behavior that the SEC and PCAOB are admonishing."

Auditors might be starting to look a little like scapegoats. "Auditors were naturally very conservative in the first year of Section 404 implementation," says Randy Elder, director of Syracuse University's Joseph I. Lubin School of Accounting in the Martin J. Whitman School of Management. in Syracuse, N.Y. "This is not only due to lack of experience with Section 404, but uncertainties associated with PCAOB Auditing Standard 2 and how it would be interpreted by the PCAOB," he explains. "Auditors also had difficulty integrating the internal control and financial statement audits because many of their clients were not ready until near the reporting deadline. Now that auditors and their clients have experience with Section 404, the internal control and financial statement audits should be more coordinated in subsequent years."

When one of the Big Five firms was crushed by government action, is it any wonder that accounting firms will err on the side of caution in interpreting the PCAOB's standards? asks Daniel P. Tinkelman, accounting professor at Pace University's Lubin School of Business in New York City. "I find the SEC's statement an outrageous attempt to pass the blame for the costs of enforcement of Sarbanes-Oxley onto the accounting profession," he says. "The major problem is that PCAOB statement No. 2 is extremely detailed in what it specifies as requirements, while also being vague in key areas."