Auditors of

Public Companies

Should report on 

Financial Statements 

and 

Internal control over financial reporting

SOX 404(a)

Requires annual report filed with SEC to include an internal control report

*Mgmt acknowledges responsibility for estabishing and maintaining adequate internal control

*Provides assessment of internal control effectiveness at end of fiscal year

Requires CPA firm to audit internal control and express opinion on effectiveness of internal control 

(required for companies w/capitalization in excess of $75million)

What is

Management's responsibility?

*Accept responsibility for effectiveness

*Evaluate effectiveness using suitable criteria

*Support evaluation with sufficient evidence

*Provide a report on internal control

What must be in

Management's Report on 

Internal Control?

-State that it is management’s responsibility to establish and maintain adequate internal control.

-Identify framework for evaluation

-Include assessment of effectiveness of internal control over financial reporting as of the end of the most recent period, including stmt as to whether it is effective

-Stmt that company's auditors have issued an attestation report on mgmt's assessment

What are the rules for 

Management's Assessment? 

-may be assisted by consultants but not CPA firm that conducts the financial stmt audit

-must understand definition of internal control adopted by the SEC

-must use an accepted control framework such as internal control integrated framework by COSO

-Must understand concepts of control deficiency, significant deficiency and material weakness

What are the 3 types of

deficiency, and do they lead to required modification of management's assessment and auditor's report?

Control Deficiency -not directly considered in definition. Only if material weakness

Significant Deficiency- Less severe than material weakness. No

Material Weakness-Reasonable possibility of a material misstatement. Yes

What is a

control deficiency?

Exists when design or operation of a control doesn't allow mgmt or employees, in the normal course of performing their functions, to prevent or detect misstatements on a timely basis. 

What are the different levels of

control deficiencies?

Less than a significant deficiency

Significant deficiency- less severe than material weakness but important enough to merit attention

Material Weakness- reasonable possibility that a material misstatement will not be prevented or detected

What is the objective of

management's evaluation

of

Internal Control?

To provide a reasonable basis for annual assessment.

What is the process?:

1-evaluate design effectiveness of controls

2-evaluate operating effectiveness of internal control

3-documentation of process

4-reporting

-Plan and perform the audit to obtain reasonable assurance about whether material weaknesses exist to express an opinion on company's internal control over financial reporting

-Evidence gathered as of date specified in management's assessment- normally the last day of the fiscal year. 

What are the Audit Steps in the audit of a Public Company?

1-Plan engagement

2-Use top-down approach to identify controls to test

3-Test and evaluate design effectiveness of internal control

4-Test and evaluate operating effectiveness of internal control

5-Form an opinion on the efffectiveness of internal control