| FYI
ICFR -
Objectives—There are two objectives: (1) To obtain reasonable assurance whether material weaknesses exist at the “as of” date in management's assessment of ICFR; and (2) to express an opinion on the effectiveness of ICFR and communicate appropriately with management and those charged with governance. | Underlying Concepts
1. If any (one or more) “material weaknesses” exist, then the entity's internal control cannot be considered effective. The auditor should plan and perform the audit of ICFR to obtain sufficient appropriate evidence to provide reasonable assurance whether material weaknesses exist as of the date specified by management's report.
2. The auditor is not required to search for deficiencies that are less severe than a material weakness (such as significant deficiencies or other lesser matters).
The auditor should use the same suitable and available control criteria to perform the audit of ICFR that management uses for its assessment of the effectiveness of ICFR.
**Management must provide its written assessment about the effectiveness of ICFR in a report that accompanies the auditor's report. (If management refuses to furnish a written assessment, the auditor should withdraw from the audit of ICFR.)** |
| FYI
ICFR -
Risk Assessment, in General—The auditor should use the same risk assessment process to focus attention on the areas of highest risk in the audit of ICFR and the audit of the entity's financial statements.
Materiality— The auditor should use the same materiality for the audit of ICFR and for the audit of the entity's financial statements. | Use a “Top-Down Approach”—
The auditor should (1) begin at the financial statement level; (2) use the auditor's understanding of the overall risks to internal control; (3) focus on “entity-level controls” (e.g., the control environment, the entity's risk assessment process, monitoring controls, etc.); (4) focus on significant classes of transactions, accounts, disclosures, and relevant assertions that have a reasonable possibility of material misstatement to the financial statements; (5) verify the auditor's understanding of the risks in the entity's processes (includes performing walkthroughs); and (6) select controls for testing based on the assessed risk of material misstatement to each relevant assertion. |
| FYI
ICFR -
Testing Controls and Evaluating Identified Deficiencies—The evidence that should be obtained increases with the risk of the control being tested. (The objective is to express an opinion on ICFR overall, not on the effectiveness of individual controls.) | a. Evaluating “Design Effectiveness”—Procedures include a mix of inquiry, observation of the entity's operations, and inspection of relevant documentation. (A walkthrough is usually sufficient to evaluate design effectiveness.)
b. Testing “Operating Effectiveness”—Procedures include a mix of inquiry, observation of the entity's operations, inspection of relevant documentation, recalculation, and reperformance of the control. (Note that these procedures are presented in order of increasing persuasiveness of the resulting evidence.) Inquiry alone is insufficient for evaluating the operating effectiveness of controls. |
| FYI
ICFR -
Communicate Certain Internal Control Matters Identified during the Integrated Audit.
1. Communicating material weaknesses and significant deficiencies— Should be communicated in writing to those charged with governance and management by the report release date. (For governmental entities only, the written communication must occur within 60 days of the report release date.)
2. Communicating other lesser deficiencies—Should be communicated in writing to management within 60 days of the report release date; should also inform those charged with governance of that communication.
3. Communicating an absence of deficiencies— The auditor should not issue any report stating that “no material weaknesses” (or no deficiencies less severe than a material weakness) were identified in an audit of ICFR. | Report Date—The auditor's report on ICFR should not be dated before the auditor has obtained sufficient appropriate audit evidence to support the auditor's opinion, including evidence that the audit documentation has been reviewed; the audit reports on ICFR and on the financial statements should have the same date.
Five Reasons to Depart from the Usual Unmodified Wording in the Auditor's Report on ICFR
1. Adverse opinion issued—When there is at least one material weakness, the report should include the definition of “material weakness” and reference the description in management's report or point out that management's report did not identify the matter; the report also should determine the effect on the audit of the entity's financial statements (state whether the opinion on the financial statements was affected by adding an other-matter paragraph or commenting in the paragraph that identifies the material weakness).
2. Elements of management's report are incomplete or improperly presented—If management does not revise its report, the auditor should add an other-matter paragraph to describe the reasons for the determination that elements of the report are incomplete or improperly presented.
3. Scope limitations—The auditor should either withdraw from the engagement or disclaim an opinion on ICFR (stating the reasons for the disclaimer) and consider the effect on the audit of financial statements.
4. Making reference to a component auditor—The auditor should not make such a reference unless the component auditor has followed appropriate professional standards and has issued a report on a component's ICFR that is not restricted.
5. Management's report includes additional information—The auditor should add an other-matter paragraph to disclaim an opinion on the other information in management's report; if such other information is included in a document containing management's report, the auditor should read the additional information to evaluate whether there are material inconsistencies with management's report. (If there are, the auditor should try to persuade management to make appropriate changes to resolve any inconsistency.) |
| An audit of a nonissuers internal control over financial reporting in an integrated audit will generally require limited scope, extensive scope, or none | The work performed in an audit of on internal control over financial reporting is more extensive in scope than that performed during the control risk assessment in a financial statement audit. It would not necessarily require procedures that duplicate those already applied in assessing control risk during a financial statement audit.
**The existence of one or more material weaknesses in internal control over financial reporting requires the auditor to express an adverse opinion on internal control, not a disclaimer of opinion.** |
| True or False
The discovery of a material weakness related to an audit of internal control over financial reporting under AICPA standards will require a modification of the accountant's report and the issuance of an adverse opinion on internal control. | True |
| True or False
In an integrated audit of a non-governmental entity under AICPA standards, identified material weaknesses and significant deficiencies should be communicated to management and those charged with governance in writing by the report release date. | True
**(For governmental entities only, the written communication must occur within 60 days of the report release date.** |
| True or False
When separate reports are issued on internal control over financial reporting and on the financial statements in an integrated audit under AICPA standards, each of the auditor's reports should include a separate paragraph that references the other related report. | True |
| FYI
ICFR under PCAOB standards
Identifying Significant Accounts and Disclosures and their Relevant Assertions
Relevant assertions—Those financial statement assertions that have a reasonable possibility of containing a material misstatement. | (PCAOB auditing standards specifically refer to the following assertions
(1) existence or occurrence;
(2) completeness;
(3) valuation or allocation;
(4) rights and obligations; and
(5) presentation and disclosure.) |
| FYI
ICFR under PCAOB standards
Communicating Identified Deficiencies | 1. The auditor must communicate (in writing) all material weaknesses identified to management and the audit committee.
2. The auditor must also communicate (in writing) other significant deficiencies identified to the audit committee.
3. The auditor should communicate (in writing) all other identified deficiencies in ICFR to management and inform the audit committee that such a communication has been made.
4. If the auditor concludes that the audit committee's oversight of financial reporting and ICFR is ineffective, he or she must communicate that conclusion in writing to the board of directors. |
| FYI
ICFR under PCAOB standards
Reporting on Internal Control over Financial Reporting
Separate or Combined Reports—
1. The auditor may choose to issue a separate or combined report on the
Combined Report —An unqualified report on the financial statements and on ICFR consists of five paragraphs: (1) introduction; (2) scope; (3) definition; (4) inherent limitations; and (5) opinion.
Separate Reports—The auditor should add an additional paragraph to the audit report on the financial statements that references the report on ICFR; and the auditor should add an additional paragraph to the report on ICFR that references the audit report on the financial statements.
Report Date—If separate reports are issued, they should be dated the same (the date as of which the auditor has obtained sufficient competent evidence). | If One (or More) Material Weakness Exists—The auditor must express an adverse opinion (unless there is a scope limitation).
1. When expressing an adverse opinion—The auditor's report must include the definition of a material weakness and refer to management's assessment of the material weakness. (If not included in management's assessment, the auditor's report should state that fact.)
2. Should determine the effect the adverse opinion on ICFR has on the opinion on the entity's financial statements.
3. If There is a Scope Limitation—The auditor should disclaim an opinion or withdraw from the engagement. |
| FYI
ICFR under PCAOB standards
A complete and accurate list of the walkthrough procedures usually performed in an issuer's integrated audit includes:
Inquiry, Observation, Inspection of relevant documentation, and reperformance of controls | FYI
ICFR under PCAOB standards
A complete and accurate list of the walkthrough procedures usually performed in an issuer's integrated audit includes:
Inquiry, Observation, Inspection of relevant documentation, and reperformance of controls |
| True or False
PCAOB on Reporting Whether Previously Reported Material Weakness Continues to Exist -
An engagement to report on whether a previously reported material weakness continues to exist may result in either an opinion (as to whether the material weakness continues to exist or does not) or a disclaimer of opinion. | True
**In planning the audit of internal control over financial reporting, the auditor should use the same materiality considerations he or she would use in planning the audit of the company's annual financial statements** |
| True or False
PCAOB on Reporting Whether Previously Reported Material Weakness Continues to Exist -
PCAOB standards require a public company to report whether a previously reported material weakness continues to exist. | False, this reporting is Voluntary
**When engaged to report on whether a previously reported material weakness in internal control over financial reporting continues to exist as of a date specified by management. (The date specified by management must be a date after that of management's most recent annual assessment.) PCAOB standards do not require reporting on whether a previously reported material weakness continues to exist, so such an engagement is voluntary.** |
| FYI
PCAOB on Reporting Whether Previously Reported Material Weakness Continues to Exist -
Auditor's Report—In reporting on whether a previously reported material weakness continues to exist, the auditor may express an opinion (as to whether the material weakness continues to exist or does not) or a disclaimer of opinion; | Obtaining an Understanding of Internal Control over Financial Reporting -
1. Must perform a walkthrough for all major classes of transactions that are directly affected by controls specifically identified by management as addressing the material weakness—An auditor who has reported on internal control in accordance with PCAOB auditing standards for the most recent annual assessment is not required to perform a walkthrough for this engagement. |
| A Stated Control Objective, defined | A stated control objective in the context of an engagement to report on whether a material weakness continues to exist is the specific control objective identified by management that, if achieved, would result in the material weakness no longer existing |
