Public Company Accounting Oversight Board; Notice of Filing of Proposed Rule on Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist, 77602-77623 [05-24498]

Download as PDF 77602 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices SECURITIES AND EXCHANGE COMMISSION [Release No. 34–52990; File No. PCAOB– 2005–01] Public Company Accounting Oversight Board; Notice of Filing of Proposed Rule on Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist December 21, 2005. Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the ‘‘Act’’), notice is hereby given that on July 28, 2005, the Public Company Accounting Oversight Board (the ‘‘Board’’ or the ‘‘PCAOB’’) filed with the Securities and Exchange Commission (the ‘‘Commission’’ or ‘‘SEC’’) the proposed rules described in Items I and II below, which items have been prepared by the Board and are presented here in the form submitted by the Board. The Commission is publishing this notice to solicit comments on the proposed rules from interested persons. I. Board’s Statement of the Terms of Substance of the Proposed Rules On July 26, 2005, the Board adopted Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist. The text of the proposed rules is as follows: wwhite on PROD1PC65 with NOTICES2 Auditing Standard No. 4—Reporting on Whether a Previously Reported Material Weakness Continues to Exist Table of Contents—(Paragraph) Applicability of Standard—1–4 Auditor’s Objective in an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist— 5–6 Conditions for Engagement Performance—7– 8 Framework and Definitions for Evaluation— 9–17 Performing an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist—18–43 Applying the Standards of the PCAOB— 19–23 Planning the Engagement—24 Obtaining an Understanding of Internal Control Over Financial Reporting—25– 27 Testing and Evaluating Whether a Material Weakness Continues to Exist—28–35 Using the Work of Others—36–39 Opinions Based, in Part, on the Work of Another Auditor—40 Forming an Opinion on Whether a Previously Reported Material Weakness Continues to Exist—41–43 Requirement for Written Representations— 44–46 Documentation Requirements—47 Reporting on Whether a Previously Reported VerDate Aug<31>2005 20:59 Dec 29, 2005 Jkt 208001 Material Weakness Continues To Exist— 48–64 Management’s Report—48 Auditor’s Evaluation of Management’s Report—49–50 Auditor’s Report—51–60 Report modifications—54–55 Other material weaknesses reported previously by the company as part of the company’s annual assessment of internal control are not addressed by the auditor’s opinion—56 Subsequent events—57–58 Management’s report includes additional information—59–60 Special Considerations When a Previously Reported Material Weakness Continues to Exist—61–64 Effective Date—65 Appendix A—Illustrative Reports on Whether a Previously Reported Material Weakness Continues to Exist Appendix B—Background and Basis for Conclusions Auditing and Related Professional Practice Standards Auditing Standard—Reporting on Whether a Previously Reported Material Weakness Continues to Exist Applicability of Standard 1. This standard establishes requirements and provides direction that apply when an auditor is engaged to report on whether a previously reported material weakness in internal control over financial reporting (hereinafter referred to as a material weakness) continues to exist as of a date specified by management. Note 1: In this context, previously reported material weakness means a material weakness that was described previously in an auditor’s report issued pursuant to Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements. Note 2: The date specified by management as the date that the previously reported material weakness no longer exists must be a date after the date of management’s most recent annual assessment. 2. An auditor may conduct an engagement to report on whether a previously reported material weakness continues to exist if (1) the auditor has audited the company’s financial statements and internal control over financial reporting in accordance with Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements, as of the date of the company’s most recent annual assessment of internal control over financial reporting, or (2) the auditor has been engaged to perform an audit of the financial statements and internal control over financial reporting PO 00000 Frm 00002 Fmt 4701 Sfmt 4703 in accordance with Auditing Standard No. 2 in the current year and has a sufficient basis for performing this engagement. (See paragraph 26 of this standard for additional requirements that apply specifically to a successor auditor’s application of this standard.) Note: References in this standard to the company’s most recent annual assessment of internal control over financial reporting apply to the company’s most recent assessment of internal control over financial reporting overall, either as of the company’s year-end or as of a more recent interim date, as audited by the auditor in accordance with Auditing Standard No. 2. 3. The auditor may report on more than one previously reported material weakness as part of a single engagement. 4. The engagement described by this standard is voluntary. The standards of the PCAOB do not require an auditor to undertake an engagement to report on whether a previously reported material weakness continues to exist. The auditor may audit the company’s internal control over financial reporting in accordance with Auditing Standard No. 2 without ever performing an engagement in accordance with this standard. Auditor’s Objective in an Engagement To Report on Whether a Previously Reported Material Weakness Continues To Exist 5. The auditor’s objective in an engagement to report on whether a previously reported material weakness continues to exist is to obtain reasonable assurance about whether the previously reported material weakness exists as of a date specified by management and to express an opinion thereon. The auditor’s opinion relates to the existence of a specifically identified material weakness as of a specified date and does not relate to the effectiveness of the company’s internal control over financial reporting overall. 6. To obtain reasonable assurance, the auditor should obtain and evaluate evidence about whether specified controls were designed and operated effectively as of the date specified by management and whether those controls satisfy the company’s stated control objective. Note: Obtaining and evaluating evidence about whether the specified controls are designed effectively without also obtaining evidence about whether those controls operated effectively would not result in the auditor obtaining reasonable assurance for the purpose of expressing an opinion on whether a material weakness continues to exist. E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices Conditions for Engagement Performance 7. The auditor may report on whether a previously reported material weakness continues to exist at a company only if all of the following conditions are met: a. Management accepts responsibility for the effectiveness of internal control over financial reporting; b. Management evaluates the effectiveness of the specific control(s) that it believes addresses the material weakness using the same control criteria that management used for its most recent annual assessment of internal control over financial reporting and management’s stated control objective(s); c. Management asserts that the specific control(s) identified is effective in achieving the stated control objective; d. Management supports its assertion with sufficient evidence, including documentation; and e. Management presents a written report that will accompany the auditor’s report that contains all the elements described in paragraph 48 of this standard. 8. If all the conditions in paragraph 7 of this standard are not met, the auditor is not permitted to complete the engagement to report on whether a previously reported material weakness continues to exist. wwhite on PROD1PC65 with NOTICES2 Framework and Definitions for Evaluation 9. The terms internal control over financial reporting, control deficiency, significant deficiency, and material weakness have the same meanings as the definitions of those terms in paragraphs 7 through 10, respectively, of Auditing Standard No. 2. 10. Paragraph 13 of Auditing Standard No. 2 states that management is required to base its annual assessment of the effectiveness of the company’s internal control over financial reporting on a suitable, recognized control framework (also known as control criteria) and describes the characteristics that make a framework suitable for this purpose. For purposes of an engagement to report on whether a previously reported material weakness continues to exist, both management and the auditor must use both (1) the same control criteria used for the company’s most recent annual assessment of internal control over financial reporting, and (2) the company’s stated control objective(s) to evaluate whether a material weakness continues to exist. Note: The performance and reporting requirements in Auditing Standard No. 2 and in this standard are based on the Committee of Sponsoring Organizations (‘‘COSO’’) of the VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 Treadway Commission’s publication, Internal Control—Integrated Framework. Known as the COSO report, it provides a suitable and available framework for purposes of management’s annual assessment of internal control over financial reporting. (More information about the COSO framework is included in paragraphs 14 and 15 of Auditing Standard No. 2, the COSO report, and AU sec. 319, Consideration of Internal Control in a Financial Statement Audit.) 11. A control objective provides a specific target against which to evaluate the effectiveness of controls. A control objective for internal control over financial reporting generally relates to a relevant financial statement assertion and states a criterion for evaluating whether the company’s control procedures in a specific area provide reasonable assurance that a misstatement to or omission in that relevant assertion is prevented or detected by controls on a timely basis.1 12. Management establishes control objectives that are tailored to the individual company. The process of tailoring control objectives to the individual company allows the control criteria used for management’s annual assessment to be applied to the facts and circumstances in a reasonable and appropriate manner. Although control objectives are used most frequently to evaluate the effectiveness of control activities, the other components of internal control over financial reporting (i.e., control environment, risk assessment, information and communication, and monitoring) also can be expressed in terms of control objectives. 13. In an audit of internal control over financial reporting, the auditor is required to identify the company’s control objectives in each area and to identify the controls that satisfy each control objective to evaluate whether the company’s internal control over financial reporting is designed effectively.2 14. Table 1 includes examples of control objectives and their related assertions: TABLE 1.—EXAMPLES OF CONTROL OBJECTIVES AND RELATED ASSERTIONS Control objectives Recorded sales of product X initiated on the company’s Web site are real. Assertions Existence or occurrence. 1 See paragraphs 68 to 70 of Auditing Standard No. 2 for additional information on relevant assertions. 2 See paragraph 88 of Auditing Standard No. 2. PO 00000 Frm 00003 Fmt 4701 Sfmt 4703 77603 TABLE 1.—EXAMPLES OF CONTROL OBJECTIVES AND RELATED ASSERTIONS—Continued Control objectives Product X warranty losses that are probable and can be reasonably estimated are recorded as of the company’s quarterly financial statement period-ends. Interest rate swaps are recorded at fair value. The company has legal title to recorded product X inventory in the company’s Dallas, TX warehouse. Pending litigation that is reasonably possible to result in a material loss is disclosed in the quarterly and annual financial statements. Assertions Completeness. Valuation or allocation. Rights and obligations. Presentation and disclosure. 15. If a material weakness has previously been reported, a necessary control objective (or objectives) has not been achieved. 16. A stated control objective in the context of an engagement to report on whether a material weakness continues to exist is the specific control objective identified by management that, if achieved, would result in the material weakness no longer existing. 17. Because the stated control objective, for purposes of this engagement, provides management and the auditor with a specific target against which to evaluate whether the material weakness continues to exist, management and the auditor must be satisfied that, if the stated control objective were achieved, the material weakness would no longer exist. Note: When a material weakness has a pervasive effect on the company’s internal control over financial reporting, identifying the related control objectives that are not being achieved may be difficult because of the large number of control objectives affected. A material weakness related to an ineffective control environment would be an example of this circumstance. If management and the auditor have difficulty identifying all of the stated control objectives affected by a material weakness, the material weakness probably is not suitable for this engagement and should be addressed, instead, through the auditor’s annual audit of internal control over financial reporting conducted under Auditing Standard No. 2. E:\FR\FM\30DEN2.SGM 30DEN2 77604 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices Performing an Engagement to Report on Whether a Previously Reported Material Weakness Continues to Exist 18. In an engagement to report on whether a previously reported material weakness continues to exist, the auditor must obtain sufficient competent evidence about the design and operating effectiveness of specified controls that provide reasonable assurance that the company’s stated control objective is achieved in the context of the control criteria (e.g., COSO). Note 1: An individual material weakness may be associated with a single stated control objective or with more than one stated control objective, depending on the nature of the material weakness and the manner in which the company tailors its stated control objectives to its business. wwhite on PROD1PC65 with NOTICES2 Note 2: Depending on the nature of the company’s business, its organization, its internal control over financial reporting, and the specific material weakness that is the subject of this engagement, the auditor may determine that he or she is not able to obtain a sufficient basis for reporting on whether a previously reported material weakness continues to exist without performing a complete audit of internal control over financial reporting in accordance with Auditing Standard No. 2. Applying the Standards of the PCAOB 19. The auditor must adhere to the standards of the PCAOB in performing an engagement to report on whether a previously reported material weakness continues to exist. Adherence to the standards involves: a. Planning the engagement, b. Obtaining an understanding of internal control over financial reporting, c. Testing and evaluating whether a material weakness continues to exist, including using the work of others, and d. Forming an opinion on whether a previously reported material weakness continues to exist. 20. Even though some requirements of this standard are set forth in a manner that suggests a sequential process, auditing whether a previously reported material weakness continues to exist involves a process of gathering, updating, and analyzing information. Accordingly, the auditor may perform some of the procedures and evaluations described in this section of the standard concurrently. 21. The engagement to report on whether a previously reported material weakness continues to exist must be performed by a person or persons having adequate technical training and proficiency as an auditor. In all matters related to the assignment, an independence in mental attitude must be maintained. Due professional care VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 must be exercised in the performance of the engagement and the preparation of the report. Paragraphs 30 through 36 of Auditing Standard No. 2 describe the application of these standards in the context of an internal control-related service. 22. This standard establishes the fieldwork and reporting standards applicable to an engagement to report on whether a previously reported material weakness continues to exist. 23. The concept of materiality, as discussed in paragraphs 22 and 23 of Auditing Standard No. 2, underlies the application of the general and fieldwork standards in an engagement to report on whether a previously reported material weakness continues to exist. Therefore, the auditor uses materiality at the financial-statement level, rather than at the individual account-balance level, in evaluating whether a material weakness exists. The auditor should assess materiality as of the date that management asserts that the previously reported material weakness no longer exists. Planning the Engagement 24. The auditor should properly plan the engagement to report on whether a previously reported material weakness continues to exist and should properly supervise any assistants. When planning the engagement, the auditor should evaluate how the matters described in paragraph 39 of Auditing Standard No. 2 will affect the auditor’s procedures. Obtaining an Understanding of Internal Control Over Financial Reporting 25. To perform this engagement, the auditor must have a sufficient knowledge of the company and its internal control over financial reporting. An auditor who has audited the company’s internal control over financial reporting in accordance with Auditing Standard No. 2 as of the date of the company’s most recent annual assessment of internal control over financial reporting would be expected to have obtained a sufficient knowledge of the company and its internal control over financial reporting to perform this engagement. Note: The second sentence of the paragraph above contemplates that the auditor’s previous engagement under Auditing Standard No. 2 resulted in rendering an opinion. If an auditor previously engaged to perform an audit of internal control over financial reporting in accordance with Auditing Standard No. 2 has not yet rendered an opinion on the effectiveness of the company’s internal control over financial reporting as of the company’s most recent year-end or more recently, then that auditor should follow the PO 00000 Frm 00004 Fmt 4701 Sfmt 4703 requirements for a successor auditor in paragraphs 26a–b and 27. Additionally, if an auditor has previously performed an audit of internal control over financial reporting at the company and is now a successor auditor (because another auditor has subsequently performed an audit of internal control over financial reporting at the company in intervening years), the auditor should follow the requirements in paragraphs 26 and 27 for a successor auditor. 26. When a successor auditor 3 performs an engagement to report on whether a previously reported material weakness continues to exist and he or she has not yet completed an audit of internal control over financial reporting at the company, he or she must perform procedures to obtain sufficient knowledge of the company’s business and its internal control over financial reporting to achieve the objective of the engagement, as described in paragraph 5 of this standard. A successor auditor who has not yet completed an audit of internal control over financial reporting at the company must perform the following procedures as part of obtaining sufficient knowledge of the company’s business and its internal control over financial reporting: a. Comply with paragraphs 47 through 51 of Auditing Standard No. 2 regarding obtaining an understanding of internal control over financial reporting. The extent of understanding of internal control over financial reporting needed to satisfy these requirements in the context of an engagement to report on whether a previously reported material weakness continues to exist depends on the nature of the material weakness on which the auditor is reporting. The more pervasive the effects of the material weakness, the more extensive the understanding of internal control over financial reporting should be under these requirements. For example, if the material weakness affects companylevel controls, a more extensive understanding of internal control over financial reporting will be necessary than if the effects of the material weakness are isolated at the transaction level. b. Perform a walkthrough as described in paragraphs 79 through 82 of Auditing Standard No. 2 for all major classes of transactions that are directly affected by controls specifically identified by management as addressing the material weakness. Note: Some controls have only an indirect effect on a major class of transactions, such as certain controls in the control 3 The term successor auditor has the same meaning as the definition of that term in paragraph .02 of AU sec. 315, Communications Between Predecessor and Successor Auditors. E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices environment or risk assessment components of internal control over financial reporting. The auditor need not perform a walkthrough of major classes of transactions that are affected only indirectly by the controls specifically identified by management as addressing the material weakness. wwhite on PROD1PC65 with NOTICES2 c. In addition to the communication requirements described in AU sec. 315, Communications Between Predecessor and Successor Auditors, the successor auditor should make specific inquiries of the predecessor auditor. These inquiries should address the basis for the predecessor auditor’s determination that a material weakness existed in the company’s internal control over financial reporting and the predecessor auditor’s awareness of any information bearing on the company’s ability to successfully address that material weakness. 27. A successor auditor may determine that he or she needs to perform procedures in addition to those specified in paragraph 26 of this standard to obtain a sufficient knowledge of the company’s business and its internal control over financial reporting. Depending on the nature of the company’s business, its organization, its internal control over financial reporting, and the specific material weakness that is the subject of this engagement, a successor auditor may determine that he or she is not able to obtain a sufficient basis for reporting on whether a previously reported material weakness continues to exist without performing a complete audit of internal control over financial reporting in accordance with Auditing Standard No. 2. Testing and Evaluating Whether a Material Weakness Continues to Exist 28. The auditor must obtain an understanding of and evaluate management’s evidence supporting its assertion that the specified controls related to the material weakness are designed and operated effectively, that these controls achieve the company’s stated control objective(s) consistent with the control criteria, and that the identified material weakness no longer exists. If the auditor determines that management has not supported its assertion with sufficient evidence, the auditor cannot complete the engagement to report on whether a previously reported material weakness continues to exist, because one of the conditions for engagement completion described in paragraph 7 of this standard would not be met. Note: Paragraphs 40 through 46 of Auditing Standard No. 2 apply to the auditor’s evaluation of management’s annual VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 assessment of internal control over financial reporting and management’s related documentation. The auditor may apply the relevant concepts described in that section to the evaluation of management’s evidence supporting management’s assertion that a previously reported material weakness no longer exists. 29. As a part of evaluating management’s evidence supporting its assertion, the auditor should determine whether management has selected an appropriate date for its assertion. In making this determination, the auditor should take into consideration the following: a. Management’s assertion that a previously reported material weakness no longer exists may be made as of any specified date that permits management to obtain sufficient evidence supporting its assertion. Note: The auditor also should determine whether the specified date of management’s assertion permits the auditor to obtain sufficient evidence supporting his or her opinion. b. Depending on the nature of the material weakness, the stated control objective, and the specified controls, the specified date of management’s assertion may need to be after the completion of one or more period-end financial reporting processes. c. Controls that operate daily and on a continuous, or nearly continuous, basis generally permit the auditor to obtain sufficient evidence as to their operating effectiveness as of almost any date management might choose to specify in its report. d. Controls that operate over the company’s period-end financial reporting process typically can be tested only in connection with a period-end. 30. The auditor should obtain evidence about the effectiveness of all controls specifically identified in management’s assertion. The nature, timing, and extent of the testing that enables the auditor to obtain sufficient evidence supporting his or her opinion on whether a previously reported material weakness continues to exist will depend on both the nature of the controls specifically identified by management as meeting the company’s stated control objectives and the date of management’s assertion. 31. All controls that are necessary to achieve the stated control objective(s) should, therefore, be specifically identified and evaluated. The specified controls will necessarily include controls that have been modified or newly implemented and also may include existing controls that previously were deemed effective during management’s most recent annual PO 00000 Frm 00005 Fmt 4701 Sfmt 4703 77605 assessment of internal control over financial reporting. As part of testing and evaluating the design effectiveness of the specified controls, the auditor should determine whether the specified controls would meet the stated control objective(s) if they operated as designed. In making this evaluation, the auditor should apply paragraphs 88 through 91 of Auditing Standard No. 2. 32. Consistent with the direction in paragraph 92 of Auditing Standard No. 2, the auditor should evaluate the operating effectiveness of a specified control by determining whether the specified control operated as designed and whether the person performing the control possesses the necessary authority and qualifications to perform the control effectively. In determining the nature, timing, and extent of tests of controls, the auditor should apply paragraphs 93 through 102 and 105 through 107 of Auditing Standard No. 2. 33. The auditor should apply paragraph 98 of Auditing Standard No. 2 regarding an adequate period of time to determine the operating effectiveness of a control in the context of an engagement to report on whether a previously reported material weakness continues to exist. Paragraph 98 of Auditing Standard No. 2 states (in part): The auditor must perform tests of controls over a period of time that is adequate to determine whether, as of the date specified in management’s report, the controls necessary for achieving the objectives of the control criteria are operating effectively. The period of time over which the auditor performs tests of controls varies with the nature of the controls being tested and with the frequency with which specific controls operate and specific policies are applied. For example, a transaction-based daily reconciliation generally would permit the auditor to obtain sufficient evidence as to its operating effectiveness in a shorter period of time than a pervasive, company-level control, such as any of those described in paragraphs 52 and 53 of Auditing Standard No. 2. Additionally, the auditor typically will be able to obtain sufficient evidence as to the operating effectiveness of controls over the company’s period-end financial reporting process only by testing those controls in connection with a periodend. 34. The auditor should determine whether, based on the nature of the material weakness, performing substantive procedures to support recorded financial statement amounts or disclosures affected by the specifically identified controls is necessary to obtain sufficient evidence regarding the operating effectiveness of those controls. For example, a material weakness in the E:\FR\FM\30DEN2.SGM 30DEN2 77606 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices wwhite on PROD1PC65 with NOTICES2 company’s controls over the calculation of its bad debt reserve ordinarily would require that the auditor also perform substantive procedures to obtain sufficient evidence supporting an opinion about whether the material weakness continues to exist as of a specified date. In this circumstance, in addition to testing the design and operating effectiveness of the controls specifically identified as achieving the company’s stated control objective that its bad debt reserve is reasonably estimated and recorded, the auditor ordinarily would need to perform substantive procedures to determine that, as of that same specified date, the company’s bad debt reserve was fairly stated in relation to the company’s financial statements taken as a whole. 35. When the specified controls, stated control objectives, and material weakness affect multiple locations or business units of the company, the auditor may apply the relevant concepts in paragraphs B1 through B13 of Appendix B of Auditing Standard No. 2 to determine the locations or business units at which to perform procedures. Using the Work of Others 36. The auditor should evaluate whether to use the work performed by others in an engagement to report on whether a previously reported material weakness continues to exist. To determine the extent to which the auditor may use the work of others to alter the nature, timing, or extent of the work the auditor otherwise would have performed, the auditor should apply paragraphs 109 through 115 and 117 through 125 of Auditing Standard No. 2. 37. The auditor’s opinion relates to whether a material weakness no longer exists at the company because the stated control objective(s) is met. Therefore, if the auditor has been engaged to report on more than one material weakness or on more than one stated control objective, the auditor must evaluate whether he or she has obtained the principal evidence that the control objectives related to each of the material weaknesses identified in management’s assertion are achieved. The auditor may, however, use the work of others to alter the nature, timing, or extent of the work he or she otherwise would have performed. For these purposes, the work of others includes relevant work performed by internal auditors, company personnel (in addition to internal auditors), and third parties working under the direction of management or the audit committee that provide information about the effectiveness of internal control over financial reporting. VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 38. Paragraph 122 of Auditing Standard No. 2 should be applied in the context of the engagement to report on whether a previously reported material weakness continues to exist. Paragraph 122 states, in part, ‘‘As the significance of the factors listed in paragraph 112 increases, the ability of the auditor to use the work of others decreases at the same time that the necessary level of competence and objectivity of those who perform the work increases.’’ There may, therefore, be some circumstances in which the scope of the audit procedures to be performed in this engagement will be so limited that using the work of others will not provide any tangible benefit to the company or its auditor. Additionally, the auditor should perform any walkthroughs himself or herself because of the degree of judgment required in performing this work. Note: The requirement described in paragraph 26b of this standard for the auditor to perform a walkthrough applies only to an auditor who did not complete an audit of internal control over financial reporting as of the company’s most recent annual assessment. An auditor who has rendered an opinion on the effectiveness of the company’s internal control over financial reporting in accordance with Auditing Standard No. 2 as of the company’s most recent annual assessment is not required to perform a walkthrough as part of this engagement. 39. The following example illustrates how to apply this section on using the work of others to this engagement. In this example, the company’s previously reported material weakness relates to the company’s failure to perform bank reconciliations at its 50 subsidiaries. The specified controls identified by the company are the timely preparation of complete and accurate reconciliations between the company’s recorded cash balances and the company’s cash balances as reported by its financial institution. Although certain controls over bank reconciliations are centralized, the performance of the bank reconciliations themselves is not centralized because they occur at each individual operating unit. Further, each operating unit has, on average, three separate cash accounts. The cash accounts affected are not material individually but are material in the aggregate. Most of the controls over the preparation of bank reconciliations involve a low degree of judgment in evaluating their operating effectiveness, can be subjected to objective testing, and have a low potential for management override. If these conditions describe the specified controls over the preparation of bank reconciliations, the auditor could determine that, based on the nature of the controls as described above, he or she could use the work of others to a moderate extent, provided that the degree of competence and objectivity PO 00000 Frm 00006 Fmt 4701 Sfmt 4703 of the individuals performing the tests is high. The auditor might perform tests of controls that are centralized at the holding company level himself or herself; perform testing at a limited number of locations himself or herself; test the work of others performed at a limited number of other locations; review the results of the work of others at all other locations tested; and determine that, qualitatively and quantitatively, principal evidence had been obtained. On the other hand, if the company’s previously reported material weakness related to the company’s failure to perform a reconciliation of its only cash account, few controls and few operations of those controls would underlie management’s assertion that the material weakness no longer exists. In this circumstance, it is unlikely that the auditor would be able to use a significant amount of the work of others because of the limited scope of the total amount of work needed to test management’s assertion and due to the requirement that the auditor obtain the principal evidence himself or herself. Note: The examples provided in paragraph 126 of Auditing Standard No. 2 illustrate how to apply the requirements in Auditing Standard No. 2 regarding using the work of others in an audit of internal control over financial reporting. Because of the differences between the auditor obtaining the principal evidence supporting an opinion on the effectiveness of internal control over financial reporting overall and supporting an opinion on the much narrower subject of whether a specified material weakness in internal control over financial reporting continues to exist, the examples in Auditing Standard No. 2 may not illustrate the appropriate application of using the work of others in this narrower engagement. For instance, the examples in paragraph 126 of Auditing Standard No. 2 suggest that, for certain controls, the auditor could potentially use the work of others in its entirety. However, in most cases, the auditor could not solely use the work of others for a control specified in management’s assertion regarding a material weakness no longer existing and, at the same time, obtain the principal evidence supporting his or her opinion. As another example, Auditing Standard No. 2 describes an example of appropriately alternating tests of controls. Alternating tests of controls is applicable only in the context of a recurring engagement, which is not the context for the auditor’s reporting on whether a previously reported material weakness continues to exist. Opinions, Based in Part, on the Work of Another Auditor 40. The auditor may apply the relevant concepts in AU sec. 543, Part of Audit Performed by Other Independent Auditors, in an engagement to report on whether a previously reported material weakness continues to exist, with the following exception. If the auditor decides to serve E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices as the principal auditor and to use the work and reports of another auditor as a basis, in part, for his or her opinion, the principal auditor must not divide responsibility for the engagement with the other auditor. Therefore, the principal auditor must not make reference to the other auditor in his or her report. Forming an Opinion on Whether a Previously Reported Material Weakness Continues to Exist wwhite on PROD1PC65 with NOTICES2 41. When forming an opinion on whether a previously reported material weakness continues to exist, the auditor should evaluate all evidence obtained from all sources. This process should include an evaluation of the sufficiency of the evidence obtained by management and the results of the auditor’s evaluation of the design and operating effectiveness of the specified controls. 42. Management may conclude that a previously reported material weakness no longer exists because it has been reduced to a significant deficiency. If management does not plan to correct the significant deficiency within a reasonable period of time, the auditor should evaluate whether the remaining significant deficiency could be indicative of a material weakness in internal control over financial reporting. Under paragraph 140 of Auditing Standard No. 2, a significant deficiency not corrected after some reasonable period of time is a strong indicator of a material weakness. Because the auditor is not required to provide an opinion under this voluntary engagement, the auditor could reasonably decline to provide an opinion under such circumstances. 43. The auditor may issue an opinion on whether a previously reported material weakness continues to exist only when there have been no restrictions on the scope of the auditor’s work. Because of the scope of an engagement to report on whether a previously reported material weakness continues to exist, any limitations on the scope of the auditor’s work require the auditor either to disclaim an opinion or to withdraw from the engagement. A qualified opinion is not permitted. Note: As described in paragraph 51 of this standard, the auditor’s opinion on whether a previously reported material weakness continues to exist may be expressed as ‘‘the material weakness exists’’ or ‘‘the material weakness no longer exists.’’ Therefore, the provisions of this standard do not distinguish between an unqualified opinion and an adverse opinion and, instead, refer simply to ‘‘an opinion’’ or ‘‘the auditor’s opinion.’’ VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 Requirement for Written Representations 44. In an engagement to report on whether a previously reported material weakness continues to exist, the auditor should obtain written representations from management: a. Acknowledging management’s responsibility for establishing and maintaining effective internal control over financial reporting; b. Stating that management has evaluated the effectiveness of the specified controls using the specified control criteria and management’s stated control objective(s); c. Stating management’s assertion that the specified controls are effective in achieving the stated control objective(s) as of a specified date; d. Stating management’s assertion that the identified material weakness no longer exists as of the same specified date; e. Stating that management believes that its assertions are supported by sufficient evidence; f. Describing any material fraud and any other fraud that, although not material, involves senior management or management or other employees who have a significant role in the company’s internal control over financial reporting and that has occurred or come to management’s attention since the date of management’s most recent annual assessment of internal control over financial reporting; and g. Stating whether there were, subsequent to the date being reported on, any changes in internal control over financial reporting or other factors that might significantly affect the stated control objective(s) or indicate that the identified controls were not operating effectively as of, or subsequent to, the date specified in management’s assertion. 45. The written representations should be signed by those members of management with overall responsibility for the company’s internal control over financial reporting whom the auditor believes are responsible for and knowledgeable about, directly or through others in the organization, the matters covered by the representations. Such members of management ordinarily include the chief executive officer and chief financial officer or others with equivalent positions in the company. 46. The failure to obtain written representations from management, including management’s refusal to furnish them, constitutes a limitation on the scope of the engagement. As discussed further in paragraph 43 of this PO 00000 Frm 00007 Fmt 4701 Sfmt 4703 77607 standard, if there is a limitation on the scope of an engagement to report on whether a previously reported material weakness continues to exist, the auditor must either disclaim an opinion or withdraw from the engagement. Further, the auditor should evaluate the effects of management’s refusal on his or her ability to rely on other representations of management, including, if applicable, representations obtained in an audit of the company’s financial statements. Documentation Requirements 47. The documentation requirements in Auditing Standard No. 3, Audit Documentation, are modified in the following respect as they apply to this engagement. Paragraph 14 of Auditing Standard No. 3 defines the report release date as the date the auditor grants permission to use the auditor’s report in connection with the issuance of the company’s financial statements. As described in paragraph 29 of this standard, management’s assertion that a material weakness no longer exists may be made as of a date other than a periodend financial reporting date. Therefore, the auditor’s release of a report on whether a previously reported material weakness continues to exist may not necessarily be associated with the issuance of financial statements of the company. Accordingly, in an engagement to report on whether a previously reported material weakness continues to exist, the report release date for purposes of applying Auditing Standard No. 3 is the date the auditor grants permission to use the auditor’s report on whether a previously reported material weakness continues to exist. Reporting on Whether a Previously Reported Material Weakness Continues To Exist Management’s Report. 48. As a condition for the auditor’s performance of this voluntary engagement, management is required to present a written report that will accompany the auditor’s report, as described in paragraph 7e of this standard. To satisfy this condition for the auditor’s performance of this engagement, management’s report should include: a. A statement of management’s responsibility for establishing and maintaining effective internal control over financial reporting for the company; b. A statement identifying the control criteria used by management to conduct the required annual assessment of the effectiveness of the company’s internal control over financial reporting; E:\FR\FM\30DEN2.SGM 30DEN2 77608 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices c. An identification of the material weakness that was identified as part of management’s annual assessment; Note: This report element should be modified in the case in which management’s annual assessment did not identify the material weakness, but, rather, only the auditor’s report on management’s annual assessment identified the material weakness. d. An identification of the control objective(s) addressed by the specified controls and a statement that the specified controls achieve the stated control objective(s) as of a specified date; and e. A statement that the identified material weakness no longer exists as of the same specified date because the specified controls address the material weakness. Auditor’s Evaluation of Management’s Report 49. With respect to management’s report, the auditor should evaluate the following matters: a. Whether management has properly stated its responsibility for establishing and maintaining effective internal control over financial reporting; b. Whether the control criteria used by management to conduct the evaluation is suitable; c. Whether the material weakness, stated control objectives, and specified controls have been properly described; and d. Whether management’s assertions, as of the date specified in management’s report, are free of material misstatement. 50. If, based on the results of this evaluation, the auditor determines that management’s report does not include the elements described in paragraph 48 of this standard, the conditions for engagement performance have not been met. wwhite on PROD1PC65 with NOTICES2 Auditor’s Report 51. The auditor’s report on whether a previously reported material weakness continues to exist must include the following elements: a. A title that includes the word independent; b. A statement that the auditor has previously audited and reported on management’s annual assessment of internal control over financial reporting as of a specified date based on the control criteria, as well as a statement that the auditor’s report identified a material weakness; Note: This report element should be modified in cases in which a successor auditor’s performance of this engagement is occurring before he or she has opined on the effectiveness of internal control over financial reporting overall in accordance VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 with Auditing Standard No. 2. In this circumstance, the auditor’s report should refer to the predecessor auditor’s report on management’s annual assessment and the predecessor auditor’s identification of the material weakness. c. A description of the material weakness; d. An identification of management’s assertion that the identified material weakness in internal control over financial reporting no longer exists; e. An identification of the management report that includes management’s assertion, such as identifying the title of the report (if the report is titled); f. A statement that management is responsible for its assertion; g. An identification of the specific controls that management asserts address the material weakness; Note: As discussed further in paragraph 31, all controls that are necessary to achieve the stated control objective should be identified. h. An identification of the company’s stated control objective that is achieved by these controls; i. A statement that the auditor’s responsibility is to express an opinion on whether the material weakness continues to exist as of the date of management’s assertion based on his or her auditing procedures; j. A statement that the engagement was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States); k. A statement that the standards of the Public Company Accounting Oversight Board require that the auditor plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company; l. A statement that the engagement includes examining evidence supporting management’s assertion and performing such other procedures the auditor considered necessary in the circumstances and that the auditor obtained an understanding of internal control over financial reporting as part of his or her previous audit of management’s annual assessment of internal control over financial reporting and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the material weakness; Note: This report element should be modified in cases in which a successor auditor’s performance of this engagement is occurring before he or she has opined on the effectiveness of internal control over financial reporting overall in accordance with Auditing Standard No. 2. In this PO 00000 Frm 00008 Fmt 4701 Sfmt 4703 circumstance, the auditor’s report should include a statement that the engagement includes obtaining an understanding of internal control over financial reporting, examining evidence supporting management’s assertion, and performing such other procedures as the auditor considered necessary in the circumstances. m. A statement that the auditor believes the auditing procedures provide a reasonable basis for his or her opinion; n. The auditor’s opinion on whether the identified material weakness exists (or no longer exists) as of the date of management’s assertion; o. A paragraph that includes the following statements: • That the auditor was not engaged to and did not conduct an audit of internal control over financial reporting as of the date of management’s assertion, the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting, and that the auditor does not express such an opinion, and • That the auditor has not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company as of any date after the date of management’s annual assessment of the company’s internal control over financial reporting, other than the controls specifically identified in the auditor’s report, and that the auditor does not express an opinion that any other controls operated effectively after the date of management’s annual assessment of the company’s internal control over financial reporting. Note: This report element statement should be modified in the case in which a successor auditor’s performance of this engagement is occurring before he or she has opined on the effectiveness of internal control over financial reporting overall in accordance with Auditing Standard No. 2 to read as follows: That the auditor has not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company other than the controls specifically identified in the auditor’s report and that the auditor does not express an opinion that any other controls operated effectively. p. A paragraph stating that, because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements and that projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate; E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices q. The manual or printed signature of the auditor’s firm; r. The city and state (or city and country, in the case of non-U.S. auditors) from which the auditor’s report has been issued; and s. The date of the auditor’s report. 52. Example A–1 in Appendix A is an illustrative auditor’s report for an opinion that a material weakness no longer exists, expressed by an auditor who has previously reported on the company’s internal control over financial reporting in accordance with Auditing Standard No. 2 as of the company’s most recent year-end (herein after referred to as a continuing auditor). Example A–2 in Appendix A is an illustrative auditor’s report for an opinion that a material weakness no longer exists expressed by a successor auditor. 53. As stated in paragraph 3 of this standard, the auditor may report on more than one previously reported material weakness as part of the same engagement. In this circumstance, the auditor should modify the report elements described in paragraph 51 of this standard accordingly. 54. Report modifications. The auditor should modify the standard report if any of the following conditions exist. a. Other material weaknesses that were reported previously by the company as part of the company’s annual assessment of internal control are not addressed by the auditor’s opinion. (See paragraph 56 of this standard.) b. A significant subsequent event has occurred since the date being reported on. (See paragraphs 57 and 58 of this standard.) c. Management’s report on whether a material weakness continues to exist includes additional information. (See paragraphs 59 through 60 of this standard.) 55. As described further in paragraph 43 of this standard, the form of the auditor’s report resulting from an engagement to report on whether a previously reported material weakness continues to exist may be an opinion on whether a material weakness continues to exist, or it may be in the form of a disclaimer of opinion. A qualified opinion is not permitted. Any limitations on the scope of the auditor’s work preclude the expression of an opinion. In addition to these reporting alternatives, an auditor may elect not to report on whether a material weakness continues to exist and, instead, withdraw from the engagement. 56. Other material weaknesses reported previously by the company as part of the company’s annual VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 assessment of internal control are not addressed by the auditor’s opinion. In the circumstance in which the company previously has reported more than one material weakness, the auditor may be engaged to report on whether any or all of the material weaknesses continue to exist. If the auditor reports on fewer than all of the previously reported material weaknesses, the auditor should include the following or similar language in the paragraph that states that the auditor was not engaged to perform an audit of internal control over financial reporting. When referring to his or her previously issued report on management’s annual assessment, the auditor should either attach that report or include information about where it can be publicly obtained. Our report on management’s annual assessment of XYZ Company’s internal control over financial reporting, dated [date of report], [attached or identify location of where the report is publicly available] identified additional material weaknesses other than the one identified in this report. We are not reporting on those other material weaknesses and, accordingly, express no opinion regarding whether those material weaknesses continue to exist after [date of management’s annual assessment, e.g., December 31, 200X]. [Revise this wording and references or attachments appropriately for use in a successor auditor’s report.] Example A–3 in Appendix A is an illustrative report issued by a continuing auditor reporting on only one material weakness when additional material weaknesses previously were reported. 57. Subsequent events. A change in internal control over financial reporting or other factors that might significantly affect the effectiveness of the identified controls or the achievement of the company’s stated control objective might occur subsequent to the date of management’s assertion but before the date of the auditor’s report. Therefore, the auditor should inquire of management whether there was any such change or factors. As described in paragraph 44 of this standard, the auditor should obtain written representations from management regarding such matters. Additionally, to obtain information about whether such a change has occurred that might affect the effectiveness of the identified controls or the achievement of the company’s stated control objective and, therefore, the auditor’s report, the auditor should inquire about and examine, for this subsequent period, the following: PO 00000 Frm 00009 Fmt 4701 Sfmt 4703 77609 • Internal audit reports (or similar functions, such as loan review in a financial institution) relevant to the stated control objective or identified controls issued during the subsequent period; • Independent auditor reports (if other than the auditor’s) of significant deficiencies or material weaknesses relevant to the stated control objective or identified controls; • Regulatory agency reports on the company’s internal control over financial reporting relevant to the stated control objective or identified controls; and • Information about the effectiveness of the company’s internal control over financial reporting relevant to the stated control objective or identified controls obtained as a result of other engagements. 58. If the auditor obtains knowledge about subsequent events that he or she believes adversely affect the effectiveness of the identified controls or the achievement of the stated control objective as of the date specified in management’s assertion, the auditor should follow the requirements in paragraph 61 regarding special considerations when a material weakness continues to exist. If the auditor is unable to determine the effect of the subsequent event on the effectiveness of the identified controls or the achievement of the stated control objective, the auditor should disclaim an opinion. 59. Management’s report includes additional information. If management’s report includes information in addition to the matters described in paragraph 48 of this standard, the auditor should disclaim an opinion on the additional information. For example, the auditor should use the following or similar language as the last paragraph of the report to disclaim an opinion on management’s plans to implement new controls: We do not express an opinion or any other form of assurance on management’s statement referring to its plans to implement new controls by the end of the year. 60. If the auditor believes that management’s additional information contains a material misstatement of fact, he or she should discuss the matter with management. If, after discussing the matter with management, the auditor concludes that a material misstatement of fact remains, the auditor should notify management and the audit committee, in writing, of the auditor’s views concerning the information. Note: If management makes the types of disclosures described in paragraph 59 E:\FR\FM\30DEN2.SGM 30DEN2 77610 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices wwhite on PROD1PC65 with NOTICES2 outside its report on whether a previously reported material weakness continues to exist and includes them elsewhere within a document that contains management’s and the auditor’s reports on whether a previously reported material weakness continues to exist, the auditor would not need to disclaim an opinion, as described in paragraph 59. However, in that situation, the auditor’s responsibilities are the same as those described in this paragraph if the auditor believes that the additional information contains a material misstatement of fact. Special Considerations When a Previously Reported Material Weakness Continues to Exist 61. If the auditor determines that the previously reported material weakness continues to exist and the auditor reports on the results of the engagement, he or she must express an opinion that the material weakness exists as of the date specified by management. 62. As described in paragraph 55, the auditor is not required to issue a report as a result of this engagement. If the auditor does not issue a report in this circumstance, he or she must communicate, in writing, his or her conclusion that the material weakness continues to exist to the audit committee. Similarly, if the auditor identifies a material weakness during this engagement that has not been previously communicated to the audit committee in writing, the auditor must communicate that material weakness, in writing, to the audit committee. 63. Additionally, whenever the auditor concludes that a previously reported material weakness continues to exist, the auditor must consider that conclusion as part of his or her evaluation of management’s quarterly disclosures about internal control over financial reporting, as required by paragraphs 202 through 206 of Auditing Standard No. 2. 64. For example, if the auditor were engaged to report on whether two separate material weaknesses continue to exist and concluded that one no longer exists and one continues to exist, the auditor’s report could comprise either of the following: (1) A report that contained two opinions, one on the material weakness that the auditor concluded no longer exists and one opinion on the material weakness that the auditor concluded continues to exist, or (2) a report that contained only a single opinion on the material weakness that the auditor concluded no longer exists if the company modifies its assertion to address only the material weakness that the auditor concluded no longer exists. In the second circumstance, the auditor must communicate, in writing, his or her VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 conclusion that a material weakness continues to exist to the audit committee and also should apply paragraph 56 of this standard regarding other material weaknesses reported previously that are not addressed by the auditor’s opinion. Additionally, the auditor must consider that conclusion as part of his or her evaluation of management’s quarterly disclosures about internal control over financial reporting, as required by paragraphs 202 through 206 of Auditing Standard No. 2. Effective Date 65. This standard is effective [insert date of SEC approval]. Appendix A—Illustrative Reports on Whether a Previously Reported Material Weakness Continues to Exist Paragraphs 51 through 60 of this standard provide direction on the auditor’s report on whether a previously reported material weakness continues to exist. The following examples illustrate the application of those paragraphs. Example A–1—Illustrative Auditor’s Report for a Continuing Auditor Expressing an Opinion that a Previously Reported Material Weakness No Longer Exists Example A–2—Illustrative Auditor’s Report for a Successor Auditor Expressing an Opinion that a Previously Reported Material Weakness No Longer Exists Example A–3—Illustrative Auditor’s Report for a Continuing Auditor Expressing an Opinion on Only One Previously Reported Material Weakness When Additional Material Weaknesses Previously Were Reported Example A–1—Illustrative Auditor’s Report for a Continuing Auditor Expressing an Opinion That a Previously Reported Material Weakness No Longer Exists Report of Independent Registered Public Accounting Firm We have previously audited and reported on management’s annual assessment of XYZ Company’s internal control over financial reporting as of December 31, 200X based on [Identify control criteria, for example, ‘‘criteria established in Internal Control— Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).’’]. Our report, dated [date of report], identified the following material weakness in the Company’s internal control over financial reporting: [Describe material weakness] We have audited management’s assertion, included in the accompanying PO 00000 Frm 00010 Fmt 4701 Sfmt 4703 [title of management’s report], that the material weakness in internal control over financial reporting identified above no longer exists as of [date of management’s assertion] because the following control(s) addresses the material weakness: [Describe control(s)] Management has asserted that the control(s) identified above achieves the following stated control objective, which is consistent with the criteria established in [identify control criteria used for management’s annual assessment of internal control over financial reporting]: [state control objective addressed]. Management also has asserted that it has tested the control(s) identified above and concluded that the control(s) was designed and operated effectively as of [date of management’s assertion]. XYZ Company’s management is responsible for its assertion. Our responsibility is to express an opinion on whether the identified material weakness continues to exist as of [date of management’s assertion] based on our auditing procedures. Our engagement was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company. Our engagement included examining evidence supporting management’s assertion and performing such other procedures as we considered necessary in the circumstances. We obtained an understanding of the company’s internal control over financial reporting as part of our previous audit of management’s annual assessment of XYZ Company’s internal control over financial reporting as of December 31, 200X and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the material weakness described above. We believe that our auditing procedures provide a reasonable basis for our opinion. In our opinion, the material weakness described above no longer exists as of [date of management’s assertion]. We were not engaged to and did not conduct an audit of internal control over financial reporting as of [date of management’s assertion], the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting. Accordingly, we do not express such an opinion. This means that we have not E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company as of any date after December 31, 200X, other than the control(s) specifically identified in this report. Accordingly, we do not express an opinion that any other controls operated effectively after December 31, 200X. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate. [Signature] [City and State or Country] [Date] Example A–2—Illustrative Auditor’s Report for a Successor Auditor Expressing an Opinion That a Previously Reported Material Weakness No Longer Exists Report of Independent Registered Public Accounting Firm We were engaged to report on whether a previously reported material weakness continues to exist at XYZ Company as of [date of management’s assertion] and to audit management’s next annual assessment of XYZ Company’s internal control over financial reporting. Another auditor previously audited and reported on management’s annual assessment of XYZ Company’s internal control over financial reporting as of December 31, 200X based on [Identify control criteria, for example, ‘‘criteria established in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).’’]. The other auditor’s report, dated [date of report], identified the following material weakness in the Company’s internal control over financial reporting: wwhite on PROD1PC65 with NOTICES2 [Describe material weakness] We have audited management’s assertion, included in the accompanying [title of management’s report], that the material weakness in internal control over financial reporting identified above no longer exists as of [date of management’s assertion] because the following control(s) addresses the material weakness: VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 [Describe control(s)] Management has asserted that the control(s) identified above achieves the following stated control objective, which is consistent with the criteria established in [identify control criteria used for management’s annual assessment of internal control over financial reporting]: [state control objective addressed]. Management also has asserted that it has tested the control(s) identified above and concluded that the control(s) was designed and operated effectively as of [date of management’s assertion]. XYZ Company’s management is responsible for its assertion. Our responsibility is to express an opinion on whether the identified material weakness continues to exist as of [date of management’s assertion] based on our auditing procedures. Our engagement was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company. Our engagement included obtaining an understanding of internal control over financial reporting, examining evidence supporting management’s assertion, and performing such other procedures as we considered necessary in the circumstances. We believe that our auditing procedures provide a reasonable basis for our opinion. In our opinion, the material weakness described above no longer exists as of [date of management’s assertion]. We were not engaged to and did not conduct an audit of internal control over financial reporting as of [date of management’s assertion], the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting. Accordingly, we do not express such an opinion. This means that we have not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company other than the control(s) specifically identified in this report. Accordingly, we do not express an opinion that any other controls operated effectively. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that PO 00000 Frm 00011 Fmt 4701 Sfmt 4703 77611 controls may become inadequate because of changes in conditions or that the degree of compliance with the policies or procedures may deteriorate. [Signature] [City and State or Country] [Date] Example A–3—Illustrative Auditor’s Report for a Continuing Auditor Expressing an Opinion on Only One Previously Reported Material Weakness When Additional Material Weaknesses Previously Were Reported Report of Independent Registered Public Accounting Firm We have previously audited and reported on management’s annual assessment of XYZ Company’s internal control over financial reporting as of December 31, 200X based on [Identify control criteria, for example, ‘‘criteria established in Internal Control— Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).’’]. Our report, dated [date of report], identified the following material weakness in the Company’s internal control over financial reporting: [Describe Material Weakness] We have audited management’s assertion, included in the accompanying [title of management’s report], that the material weakness in internal control over financial reporting identified above no longer exists as of [date of management’s assertion] because the following control(s) addresses the material weakness: [Describe Control(s)] Management has asserted that the control(s) identified above achieves the following stated control objective, which is consistent with the criteria established in [identify control criteria used for management’s annual assessment of internal control over financial reporting]: [state control objective addressed]. Management also has asserted that it has tested the control(s) identified above and concluded that the control(s) was designed and operated effectively as of [date of management’s assertion]. XYZ Company’s management is responsible for its assertion. Our responsibility is to express an opinion on whether the identified material weakness continues to exist as of [date of management’s assertion] based on our auditing procedures. Our engagement was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 77612 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices require that we plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company. Our engagement included examining evidence supporting management’s assertion and performing such other procedures as we considered necessary in the circumstances. We obtained an understanding of the company’s internal control over financial reporting as part of our previous audit of management’s annual assessment of XYZ Company’s internal control over financial reporting as of December 31, 200X and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the material weakness described above. We believe that our auditing procedures provide a reasonable basis for our opinion. In our opinion, the material weakness described above no longer exists as of [date of management’s assertion]. We were not engaged to and did not conduct an audit of internal control over financial reporting as of [date of management’s assertion], the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting. Accordingly, we do not express such an opinion. This means that we have not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company as of any date after December 31, 200X, other than the control(s) specifically identified in this report. Accordingly, we do not express an opinion that any other controls operated effectively after December 31, 200X. Our report on management’s annual assessment of XYZ Company’s internal control over financial reporting, dated [date of report], [attached or identify location of where the report is publicly available] identified additional material weaknesses other than the one identified in this report. We are not reporting on those other material weaknesses and, accordingly, express no opinion regarding whether those material weaknesses continue to exist after [date of management’s annual assessment, e.g., December 31, 200X]. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that controls may become inadequate because of changes in conditions or that VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 the degree of compliance with the policies or procedures may deteriorate. [Signature] [City and State or Country] [Date] Appendix B: Background and Basis for Conclusions Table of Contents (Paragraph) Introduction, B1 Background, B2–B6 Voluntary Nature of Engagement, B7–B9 Form of the Auditor’s Opinion, B10–B14 As-of Date of Report, B15–B20 Applicability of the Standard to Material Weaknesses Not Previously Reported, B21–B27 Focus on Control Objectives, B28–B42 Concept of Materiality, B43–B50 Performance of Substantive Procedures, B51– B54 Using the Work of Others, B55–B64 Dividing Responsibility, B65–B68 New Material Weaknesses Identified, B69– B75 Specific Identification of All Previously Reported Material Weaknesses, B76–B79 Other Reporting Matters, B80–B92 Conforming Amendments to AT sec. 101, B93–B95 Introduction B1. This appendix summarizes factors that the Public Company Accounting Oversight Board (the ‘‘Board’’) deemed significant in reaching the conclusions in the standard. This appendix includes reasons for accepting certain views and not accepting others. Background B2. Section 404 of the Sarbanes-Oxley Act of 2002 (the ‘‘Act’’) requires the management of public companies each year to file an assessment of the effectiveness of their companies’ internal control over financial reporting. The company’s independent auditor must attest to, and report on, management’s assessment. Under the Securities and Exchange Commission’s (the ‘‘SEC’’ or ‘‘Commission’’) implementing rules, company management may not conclude that internal control over financial reporting is effective if one or more material weaknesses exists. B3. When a company reports a material weakness, investors may be left uncertain about the reliability of the company’s financial reporting. Both companies and report users have recognized the importance of a mechanism for alerting investors that a previously disclosed material weakness no longer exists.4 The federal securities 4 The Board’s Standing Advisory Group (‘‘SAG’’) discussed possible auditor involvement with the elimination of a material weakness at its November PO 00000 Frm 00012 Fmt 4701 Sfmt 4703 laws provide part of that mechanism. Those laws require the company to disclose to investors any changes in internal control over financial reporting that occurred during the company’s most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, the company’s internal control over financial reporting.5 Therefore, investors will learn of material improvements, such as the remediation of a material weakness, on a timely basis through quarterly disclosures.6 B4. When a company determines that a material weakness has been remediated, it may determine that disclosure is sufficient. Some investors and companies, however, have called for the ability to bolster confidence in management’s assertions about those internal control improvements with the added assurance of the company’s independent auditor.7 B5. The Board reviewed its existing auditing and attestation standards to determine whether adequate standards governing such an engagement already existed. The Board’s interim attestation standards provide requirements for general attest engagements; however, the Board determined that these standards lack sufficient specificity for this purpose.8 The Board, therefore, 18, 2004, public meeting. The webcast of the November 18, 2004 SAG discussion and the related briefing paper on this topic, ‘‘Reporting on the Correction of a Material Weakness,’’ are available on the Board’s Web site at https://www.pcaobus.org. 5 See Item 308(c) of Regulation S–K, 17 CFR 229.308(c). 6 In addition, even if internal control over financial reporting is effective as of the end of a company’s fiscal year, investors also could potentially learn if it deteriorates materially during the year through these quarterly disclosures. 7 The Standing Advisory Group’s November 18, 2004 discussion included this type of encouragement. 8 See AT sec. 101, ‘‘Attest Engagement’’ of the Board’s interim standards. Effective April 16, 2003, the PCAOB adopted, on an initial, transitional basis, five temporary interim standards rules (PCAOB Rules 3200T, 3300T, 3400T, 3500T, and 3600T) that refer to pre-existing professional standards of auditing, attestation, quality control, ethics, and independence (the ‘‘interim standards’’). These rules were approved by the SEC on April 25, 2003. See SEC Release No. 33–8222. On December 17, 2003, the Board approved technical amendments to the interim standards rules indicating that, ‘‘when the Board adopts a new auditing and related professional practice standard that addresses a subject matter that also is addressed in the interim standards, the affected portion of the interim standards will be superseded or effectively amended. Accordingly, the Board approved adding the phrase ‘to the extent not superseded or amended by the Board’ to each of the interim standards rules.’’ Technical Amendments to Interim Standards Rules, PCAOB Release No. 2003– 26 (Dec. 17, 2003); Exchange Act Release No. 49624 (Apr. 28, 2004) (SEC Approval). The interim standards are available on the Board’s Web site at https://www.pcaobus.org. E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices proposed an auditing standard that would be tailored narrowly to an engagement to report on whether a previously reported material weakness continues to exist. B6. The Board received 30 comment letters on its proposal, primarily from auditor and investor groups as well as from two issuers. Those comments led to changes in the standard, intended to make the requirements of the standard clearer and more operational. This appendix summarizes significant views expressed in those comment letters and the Board’s responses. Voluntary Nature of Engagement B7. The proposed standard explicitly stated that the engagement described by this standard is voluntary and that the standards of the PCAOB did not require an auditor to undertake this engagement when a material weakness was previously reported. In addition, the Board stressed the voluntary nature of this engagement at the public meeting proposing this standard. B8. The value and importance of the Board’s standards providing the option of this type of auditor reporting on a material weakness was confirmed unanimously in the comment letters from investors and investor-related parties. Auditors were also supportive of the standard overall and its voluntary nature. Both of the issuers who commented indicated that they would be concerned if issuers become compelled to obtain such opinions. One of these commenters stressed that the disclosure requirements of management, coupled with enhanced criminal penalties, should provide investors with information regarding the continued existence or correction of a material weakness. B9. The Board continues to believe that providing for this type of auditor reporting in its standards will serve the public interest. At the same time, the Board reaffirms that reporting on whether a material weakness continues to exist is a voluntary engagement and is not required by the standards of the PCAOB. wwhite on PROD1PC65 with NOTICES2 Form of the Auditor’s Opinion B10. The proposed standard called for the auditor to express a single opinion directly on the subject matter (i.e., the material weakness itself), rather than on management’s assertion, as follows: In our opinion, XYZ Company has eliminated the material weakness described above as of [date of management’s assertion] because the stated control objective is met as of [date of management’s assertion.] B11. Primarily auditors commented on the form of the opinion in the VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 proposed standard and their comments reflected a wide spectrum of ideas. Some commenters expressed support for the auditor’s report, including the form of the opinion as proposed. Other comments included a suggestion for two opinions, consistent with Auditing Standard No. 2—one on the subject matter (the elimination of the material weakness) and one on management’s assertion. Other commenters suggested that just one opinion was sufficient, though these commenters were split regarding whether the one opinion should be on management’s assertion or on the subject matter. Other commenters suggested that an opinion stating that the material weakness had been eliminated, without the phrase ‘‘because the stated control objective is met’’ would be a better alternative, while others asked the Board to consider an opinion stating that the identified controls were effective because the stated control objective was met, without stating that the material weakness had been eliminated. B12. A number of commenters expressed concern with the phrasing ‘‘the material weakness has been eliminated,’’ including the use of that phrase in the auditor’s opinion and in the title of the proposed standard. These commenters believed that terminology such as ‘‘elimination’’ or ‘‘eliminated’’ might be too definite a term that might mislead report users into believing that there were no remaining deficiencies in the internal control over financial reporting in the area related to the specified material weakness, even though control deficiencies of a lesser severity than a material weakness might persist. B13. After considering these suggestions, the Board decided to retain a single opinion on the subject matter and to revise the opinion wording. The Board continues to believe that a single opinion expressed directly on the subject matter is the simplest and clearest form of communication related to this engagement. Further, the Board believes that an auditor’s opinion directly on the subject matter (i.e., the material weakness itself) will best achieve the overarching objective of this engagement—to clearly communicate as of an interim date auditor assurance about whether a previously reported material weakness continues to exist. B14. The Board agreed with commenters that use of the term ‘‘elimination’’ might increase the risk that a report user would misunderstand the assurance provided by an auditor’s opinion on a previously reported material weakness. As a result, the Board changed the form of the opinion PO 00000 Frm 00013 Fmt 4701 Sfmt 4703 77613 to ‘‘In our opinion, the material weakness described above no longer exists as of [date of management’s assertion]’’ and the title of the standard to ‘‘Reporting on Whether a Previously Reported Material Weakness Continues to Exist.’’ The text of the standard was modified throughout to delete references to ‘‘eliminated’’ or ‘‘elimination’’ and to reflect wording consistent with the revised opinion and title. As-of Date of Report B15. The proposed standard provided for significant flexibility by allowing the engagement to be undertaken at any time during the year, limited only by implications associated with the nature of the material weakness. In other words, the proposed standard did not require the engagement to be performed in conjunction with an audit or review of financial statements. Instead, the proposed standard required the auditor to determine whether management had selected an appropriate date for its assertion and specified several matters for the auditor to consider in making this determination. B16. A number of auditors suggested that the engagement described by the proposed standard should be performed only as of quarterly financial reporting dates instead of as of any date during the year. These commenters believed that such a requirement would allow the auditor to integrate this work with the auditor’s interim review procedures under AU sec. 722, Interim Financial Information, and provide a link between the auditor’s report on the material weakness and management’s quarterly disclosures of material changes in internal control. Commenters noted that many of the material weaknesses that have been disclosed to date are related to the period-end financial reporting process and that the auditor would therefore need to test controls in connection with a period-end to determine whether the material weakness continues to exist. Several commenters linked their suggestion that this engagement be performed only as of a quarterly financial reporting date to the view that the standard’s direction on performing substantive procedures as part of this engagement should be bolstered (see separate discussion on performance of substantive procedures beginning at paragraph B51). One commenter pointed out, however, that if this engagement could be conducted only in connection with a quarterly financial reporting date, special guidance for applying the standard to foreign filers would be necessary because foreign filers are not required to E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 77614 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices report quarterly in the same manner as domestic filers. B17. The Board believes that the flexibility provided in the proposed standard regarding the timing of the engagement is an important and appropriate feature of the standard. Although the Board agrees with commenters’ observations that many of the material weaknesses disclosed during the past year were related to the period-end financial reporting process, the Board determined that the existing provisions of the proposed standard address this circumstance. In determining whether management has selected an appropriate date for its assessment, the standard requires the auditor to consider that controls that operate over the company’s period-end financial reporting process typically can be tested only in connection with a period-end. B18. Moreover, some material weaknesses—such as those that involve transaction-based controls that operate daily—are well suited for a management assertion and an auditor opinion that the material weakness no longer exists as of almost any date. Restricting an auditor’s reporting on whether a material weakness continues to exist to only quarterly financial reporting dates could impose unnecessary delay on a company seeking auditor assurance that this type of material weakness no longer exists. For example, assume that a calendar year-end company had previously disclosed a material weakness that was the type that would lend itself well to reporting that it no longer existed as of any date. Further, management could not yet assert that the material weakness no longer existed as of March 31, but believed that it could make the assertion as of a date in April. If the standard restricted auditor reporting to a quarterly financial reporting date, the auditor would have to wait until June 30 to be able to attest to whether the material weakness continued to exist (and, presumably, would not be able to issue his or her report until July, at the earliest). While management could, in this example, provide timely disclosure to investors that the material weakness no longer existed, the Board concluded that structuring the provisions of the standard to potentially result in this kind of delay in auditor assurance would not serve the public interest. B19. In light of these considerations, the Board decided to retain the provisions of the proposed standard that would permit the auditor to report on whether a previously reported material weakness continues to exist as of any date. VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 B20. At least one auditor asked for clarification about whether a report issued pursuant to Auditing Standard No. 2 that identified a material weakness could be issued at the same time as a report pursuant to this standard indicating that the material weakness no longer exists as of a later date. The degree of flexibility regarding the timing of this engagement would permit the company (depending on the company’s ability to assert that a material weakness no longer exists and the auditor’s ability to timely audit that assertion) to simultaneously distribute its annual reports and the management assertion and auditor report described in this standard. Consistent with this flexible approach, nothing in this standard or Auditing Standard No. 2 would preclude the auditor from issuing a single, combined report on the results of an audit of internal control over financial reporting pursuant to Auditing Standard No. 2 and the results of an engagement performed pursuant to this standard. Applicability of the Standard to Material Weaknesses Not Previously Reported B21. The proposed standard was structured to allow an auditor to report only on a previously reported material weakness. The proposed standard defined a previously reported material weakness as a material weakness that was previously described by an auditor’s report issued pursuant to Auditing Standard No. 2. A material weakness initially identified after the company’s annual assessment date could not, therefore, be the subject of an auditor’s report under the proposed standard. B22. Virtually all of the investors who submitted comment letters suggested that the standard should allow for auditor reporting on material weaknesses identified subsequent to the company’s most recent annual assessment of internal control over financial reporting. Although some of these commenters expressed concern about the level of work that might be required of the auditor to thoroughly understand a material weakness not previously reported upon by an auditor, they did not believe that the standard should prohibit such reporting. One commenter stated that if a successor auditor could gain an understanding of a company’s internal control sufficient to report on a material weakness that was identified and reported on by a predecessor auditor, an auditor should be able to gain the understanding necessary to report on a material PO 00000 Frm 00014 Fmt 4701 Sfmt 4703 weakness identified by management as of an interim date. B23. The majority of the auditors who commented indicated strong opposition to allowing auditors to report in this engagement on material weaknesses not previously reported. These commenters suggested that the initial identification of a material weakness requires a level of understanding of the company’s controls and the specific facts and circumstances surrounding the material weakness that can result only from a complete evaluation of the effectiveness of internal control over financial reporting. Additionally, at least one commenter expressed concern that the identification of a material weakness subsequent to the annual assessment is a strong indicator of a material change within the company’s internal control over financial reporting. This commenter believed that in such a circumstance the auditor would not have sufficient knowledge of the current state of internal control over financial reporting to be able to consider the interaction and potential implications of the change on other controls. This commenter also believed that this situation would prevent the auditor, in most cases, from being able to determine whether the newly identified material weakness no longer exists. B24. The Board decided to retain the approach described by the proposed standard. The Board believes that the issue of a newly identified material weakness being an indicator of a material change within a company’s internal control over financial reporting is a valid concern. Although the change in internal control over financial reporting giving rise to any new material weakness may be confined specifically to the area in which the material weakness originally was identified, the change also could be more far-reaching. In such circumstances, the auditor may not be able to determine the effect of the change without performing a full audit of internal control over financial reporting. B25. The Board also notes that there is an important distinction between material weaknesses previously identified in an auditor’s report issued pursuant to Auditing Standard No. 2 and other newly identified material weaknesses. The primary purpose of the narrow engagement described by this standard is to establish a timely and reasonable mechanism that a company can use to remove any perceived ‘‘stain’’ upon its financial reporting due to an outstanding adverse audit opinion on internal control over financial reporting that identified a material weakness. In the case of a new material weakness that E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices wwhite on PROD1PC65 with NOTICES2 is identified and addressed by management as of an interim date, an adverse auditor opinion previously attesting to the material weakness would not exist and, therefore, the new material weakness would not be the subject of the same type of market focus. B26. There is also a fundamental difference between the auditor reporting on a material weakness not previously reported and a successor auditor reporting on a material weakness that was reported in a predecessor auditor’s opinion on internal control over financial reporting. The fundamental difference is the concept of material change described above. The successor auditor must obtain a sufficient understanding of the company’s internal control over financial reporting to report on the existence of a material weakness that was previously reported. This successor auditor, however, has the benefit of knowing that the material weakness was identified in the context of an audit of the internal control over financial reporting as a whole and that the predecessor auditor should have adequately described the nature of the material weakness (particularly its pervasiveness and the extent of its effect on the company’s financial reporting). In contrast, in situations in which a material change has taken place and a new material weakness has arisen after the previous annual assessment of internal control over financial reporting, neither the predecessor nor the successor auditor has obtained this level of understanding as it relates to the newly identified material weakness. B27. These considerations, taken together, resulted in the Board’s decision to retain the provisions of the proposed standard that limit this engagement only to material weaknesses that have been previously described in an auditor’s report issued pursuant to Auditing Standard No. 2. The Board also made changes to the standard, as suggested by one commenter, to make these provisions clearer. These changes included changing the title of the standard to ‘‘Reporting on Whether a Previously Reported Material Weakness Continues to Exist’’ as well as conforming changes to the text of the standard to refer explicitly to a previously reported material weakness as the subject matter of this engagement. Focus on Control Objectives B28. The proposed standard focused on stated control objectives to determine whether a material weakness continues to exist and posited that if a material weakness has been disclosed previously, a necessary control objective at the company has not been achieved. VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 Because the term ‘‘stated control objective’’ was not precisely defined elsewhere in the Board’s auditing standards, the proposed standard provided a definition as well as examples of stated control objectives. B29. A stated control objective in the context of this engagement is the specific control objective identified by management that, if achieved, would result in the material weakness no longer existing. The stated control objective would provide management and the auditor with a specific target against which to evaluate whether the material weakness continues to exist. For this reason, the proposed standard required that management and the auditor be satisfied that if the stated control objective were achieved the material weakness would no longer exist. B30. Comments on the proposed standard’s focus on control objectives came primarily from auditors. Many auditors, either explicitly or implicitly, supported the focus on control objectives. One auditor suggested that, given the importance of control objectives, the proposed standard should explicitly state that documentation of control objectives is required. B31. Several auditors, however, expressed concerns about the proposed standard’s focus on control objectives. A couple of these commenters suggested that the proposed standard’s emphasis on control objectives might inappropriately establish a framework for evaluating the effectiveness of internal control over financial reporting that differs from, or otherwise adversely affects the proper application of, the Committee of Sponsoring Organizations of the Treadway Commission’s publication Internal Control—Integrated Framework (‘‘COSO’’). B32. Most concerned commenters expressed apprehension that report users might be misled by an auditor’s opinion that a material weakness had been eliminated because the control objectives had been met. They believed that this type of opinion might lead report users to mistakenly believe that if the control objectives were met, there were no remaining deficiencies in the internal control over financial reporting in the area related to the material weakness—when, in fact, a significant deficiency or deficiency could continue to exist. B33. Another commenter noted that the examples in the proposed standard illustrated only control objectives for the control activities component of internal control over financial reporting—not for the other components PO 00000 Frm 00015 Fmt 4701 Sfmt 4703 77615 (control environment, risk assessment, monitoring, information and communication). This commenter suggested that examples of control objectives in the other components would be helpful. Another commenter suggested that, given the importance of the control objective concept, if the Board’s standards were to specifically address the concept, such a definition and discussion should reside in Auditing Standard No. 2. One concerned auditor concluded that, given the importance of control objectives, more guidance was needed, including clarification that if more than one control is necessary to achieve a stated control objective, all such controls must be identified and tested as part of this engagement. B34. In response to comments, the Board decided to retain the definition of, and focus on, control objectives and provide additional guidance. The Board views the auditor’s use of the concept of control objectives as analogous to the use of the concept of relevant assertions. The concept of relevant assertions was already familiar to experienced auditors and was specifically defined for the first time in Auditing Standard No. 2 because of that standard’s focus on testing controls over all relevant assertions related to all significant accounts. Similarly, the concept of control objectives is familiar to most experienced auditors and is already used to describe the auditor’s responsibilities under Auditing Standard No. 2).9 A definition of control objectives (and stated control objectives) is provided in this standard because of the standard’s focus on control objectives as a specific measure for determining whether a material weakness continues to exist. This is consistent with the Board’s objective for its standards to be clear as well as the 9 For example, paragraph 12 of Auditing Standard No. 2 states, ‘‘Therefore, effective internal control over financial reporting often includes a combination of preventive and detective controls to achieve a specific control objective.’’ Paragraph 85 of Auditing Standard No. 2 elaborates on this idea, including the example that, when performing tests of preventive and detective controls, the auditor might conclude that a deficient preventive control could be compensated for by an effective detective control and, therefore, not result in a significant deficiency or material weakness. That paragraph concludes with the statement, ‘‘When determining whether the detective control is effective, the auditor should evaluate whether the detective control is sufficient to achieve the control objective to which the [deficient] preventive control relates.’’ Perhaps most notably, paragraph 88 of Auditing Standard No. 2 requires the auditor to identify the company’s control objectives in each area and identify the controls that satisfy each control objective to evaluate whether the company’s internal control over financial reporting is designed effectively. E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 77616 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices focus on control objectives in the engagement described by this standard. B35. The Board believes that the standard’s focus on control objectives is sound and helpful and is an appropriate complement to the control criteria, such as COSO, for the purposes of this engagement. The process of tailoring control objectives to the individual company allows the control criteria (i.e., the evaluation framework) used for management’s annual assessment to be applied to the facts and circumstances in a reasonable and appropriate manner. Accordingly, the emphasis in this standard on control objectives is consistent with, and supports a correct application of, COSO. B36. The focus on whether the stated control objectives have been met as the target for determining whether a material weakness continues to exist does accommodate the circumstance in which a deficiency or significant deficiency continues to exist in that area of the company’s internal control over financial reporting. Although several commenters linked this result with the focus on control objectives, this potential result would exist in any case within the overall construct of this standard, completely apart from the focus on control objectives. The potential for less severe deficiencies to persist in an area in which a previously reported material weakness no longer exists parallels the reporting results of an engagement performed under Auditing Standard No. 2. According to that standard, only material weaknesses (not less severe weaknesses) are disclosed in an auditor’s report and only the existence of a material weakness and not less severe weaknesses affects the auditor’s opinion on the effectiveness of the company’s internal control over financial reporting. As an illustration, assume that a company that had previously reported a material weakness in internal control over financial reporting elected to wait until the auditor’s next annual report issued pursuant to Auditing Standard No. 2 to obtain auditor assurance related to the existence of the material weakness. If the control weakness that had previously risen to the level of material weakness were reduced to a significant deficiency or deficiency as of the company’s next year-end, the auditor’s next report issued under Auditing Standard No. 2 would present an unqualified opinion indicating that the company’s internal control over financial reporting was effective. The Board concluded that the users of an auditor’s report on whether a previously reported material weakness continues to exist need only receive auditor VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 assurance that the material weakness no longer exists and not more detailed information about whether less severe control deficiencies continue to persist. B37. The Board notes, however, that paragraph 140 of Auditing Standard No. 2 states (in part) that strong indicators of a material weakness include circumstances in which significant deficiencies that have been communicated to management and the audit committee remain uncorrected after some reasonable period of time. If management does not plan to correct the significant deficiency within a reasonable period of time, the auditor should evaluate whether the remaining significant deficiency could be indicative of a material weakness in internal control over financial reporting. An auditor is not required to provide an opinion under this voluntary engagement, and could reasonably decline to provide an opinion under such circumstances. B38. In response to comments that report users will mistakenly believe that an auditor’s report issued pursuant to the standard’s provisions is communicating auditor assurance that no control deficiencies exist in the area related to the former material weakness, the Board decided that the change in the title of the standard and the form of the auditor’s opinion (discussed further in paragraph B14), coupled with this discussion, would sufficiently mitigate any potential for report users to misunderstand the assurance being provided by an engagement conducted under this standard. Removing the concept of control objectives from the standard would not address the potential for misunderstanding because this potential exists independently of the focus on control objectives. B39. With regard to the recommendation that the standard provide additional examples of stated control objectives, including stated control objectives related to components of internal control over financial reporting other than control activities, the Board determined that the provisions of the standard should remain largely at the conceptual level and state that the other components of internal control over financial reporting can be expressed in terms of control objectives. The Board also determined to emphasize, in the note to paragraph 17 of the standard, that when a material weakness has a pervasive effect on the company’s internal control over financial reporting, it may be difficult to identify all of the relevant control objectives and the material weakness probably is not suitable for this type of narrow, interim reporting. PO 00000 Frm 00016 Fmt 4701 Sfmt 4703 B40. For the purposes of this engagement, a stated control objective need not be more precise than to describe an objective that relates to whether there is a more than remote risk that the company’s financial statements are materially misstated in a given area. For instance, paragraph 14 of the standard includes the example control objective, ‘‘The company has legal title to recorded product X inventory in the company’s Dallas, TX warehouse.’’ This example assumes that the product X inventory account related to the company’s Dallas, TX warehouse represents a more than remote risk of material misstatement to the company’s financial statements taken as a whole and has been identified as a separate significant account. This example does not suggest that a company should establish separate control objectives for all of its various types of inventory, by inventory location, regardless of materiality. B41. Although the Board believes that the proposed standard made clear that in performing this engagement, the auditor should identify and test all controls necessary to achieve the stated control objective, based on the importance of this concept and in response to commenters, the Board concluded that an explicit clarification should be added. Not only must newly implemented or modified controls be identified and tested in this engagement, but all controls necessary to achieve the stated control objective must be identified and tested. For example, in a circumstance in which four controls must operate effectively for a given control objective to be achieved, the failure of one of those controls could result in a material weakness. In the context of this engagement, all four controls necessary to achieve the stated control objective would need to be specifically identified and tested. This must be the case because of the inherent limitations in internal control over financial reporting. If three of the four controls were found to be effective as of year-end, they cannot be assumed to be effective as of a later date. To render an opinion as of a current date about whether the material weakness exists, the auditor must have current evidence about whether all controls (in this example, all four controls) necessary to achieve the control objective are designed and operating effectively. B42. Regarding the suggestion to include a requirement that control objectives be documented, the Board notes that neither COSO nor Auditing Standard No. 2 currently contain such a requirement. As with many aspects of E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices wwhite on PROD1PC65 with NOTICES2 assessing the effectiveness of internal control over financial reporting, the better the documentation, the easier and more efficient the evaluation, especially from the auditor’s perspective. In the context of this engagement, by virtue of creating a stated control objective, the company and the auditor would document the stated control objective, even if that documentation appeared only in their respective reports. Therefore, documentation is effectively required for the stated control objectives encompassed by an engagement conducted under this standard. The Board does not believe, however, that establishing a broad requirement for documenting all control objectives related to a company’s internal control over financial reporting is needed at this time or would be appropriately placed within this standard. Concept of Materiality B43. To provide direction on the concept of materiality, the proposed standard largely referred to Auditing Standard No. 2. The proposed standard stated that the concept of materiality, as discussed in paragraphs 22 and 23 of Auditing Standard No. 2, underlies the application of the general and fieldwork standards in an engagement to report on whether a previously reported material weakness continues to exist. Therefore, the auditor uses materiality at the financial-statement level, rather than at the individual account-balance level, in evaluating whether a material weakness exists. B44. Several auditors commented that the proposed standard should provide additional direction on how the auditor considers materiality in performing this engagement. Commenters believed that clarification was necessary regarding the appropriate time context for management’s and the auditor’s materiality judgments. These commenters asked whether materiality should be assessed as of the date management asserts to be the date at which the material weakness no longer exists, or as of the end of the prior year when the material weakness was originally reported. B45. Most commenters on this issue suggested that the date for assessing materiality should be the date management asserts to be the date at which the material weakness no longer exists. Commenters noted, however, that this position would allow a material weakness to no longer exist merely as a result of a business acquisition or disposition, for example, because either of those actions would change materiality as of that point in time (and, in the case of a disposition, send the VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 material weakness along with the disposed business). B46. Several auditors suggested that the auditor’s opinion should explicitly recognize the concept of materiality. Commenters suggested the following as alternatives that would recognize materiality: ‘‘Management’s assertion that XYZ Company has eliminated the material weakness described above as of [date of management’s assertion] is fairly stated, in all material respects* * *’’ and ‘‘XYZ Company has eliminated the material weakness with respect to the Company’s internal control over financial reporting as described above as of [date specified in management’s assertion], in all material respects.’’ These commenters were concerned that the opinion described by the proposed standard misrepresented the precision of the auditor’s assessment and neglected the notion of reasonable assurance. B47. The Board decided that the provisions in the standard regarding materiality should be clarified to specify that materiality should be assessed as of the date management asserts that the material weakness no longer exists. The as-of date of management’s assertion and the auditor’s opinion is fundamental to the auditor’s decisions about whether he or she has obtained sufficient evidence to support an opinion and to the auditor’s evaluation of that evidence to form an opinion on whether the material weakness exists as of that point in time. The Board believes that the logical and internally consistent position regarding the time context for assessing materiality is to assess materiality as of the date that management asserts the material weakness no longer exists. The Board also believes that materiality can be assessed as of a date other than a financial reporting period-end. This is consistent with the Board’s decision, discussed further beginning at paragraph B15, that the standard permit the auditor to report on whether a previously reported material weakness continues to exist as of any date. B48. The Board also believes that auditors should exercise caution in circumstances in which the only aspect of a previously reported material weakness that has changed is materiality (in other words, the size of the financial statement accounts has changed due to an acquisition or other activity rather than any changes in the design or operation of controls). In many such cases, the company will have undergone significant changes, with an associated change in internal control over financial reporting overall. In this circumstance, the auditor would PO 00000 Frm 00017 Fmt 4701 Sfmt 4703 77617 need to perform procedures beyond the scope of work ordinarily contemplated under this standard to have a sufficient basis for his or her new assessment of materiality and an adequate understanding of the company’s internal control over financial reporting overall. The Board believes that, in many cases in which the company has undergone a change of this magnitude, the auditor would need to perform a full audit of internal control over financial reporting in accordance with Auditing Standard No. 2 to have a sufficient basis for assessing materiality, understanding the company’s internal control over financial reporting overall, and rendering an opinion about whether a material weakness continues to exist. Also, as discussed in paragraph B37, a previously reported material weakness may no longer exist because it has been reduced to a significant deficiency. In this circumstance, if management does not plan to correct the significant deficiency within a reasonable period of time, the auditor should evaluate whether the remaining significant deficiency could be indicative of a material weakness. B49. Regarding the form of the auditor’s opinion and concerns that the opinion suggested by the proposed standard implied an inappropriate degree of precision and neglected the concept of reasonable assurance, the Board concluded that the provisions of the proposed standard were sufficiently clear that the auditor’s objective in this engagement was to plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist as of the date specified by management. Furthermore, the auditor’s report described by the proposed standard included disclosure of this objective. The Board does not, therefore, believe that report users would mistakenly believe that the auditor’s opinion, as proposed, would convey absolute assurance. B50. In addition, the Board believes that including another reference to materiality in the auditor’s opinion would not add anything of substance to the auditor’s conclusion and could instead impair its readability. The determination of whether a material weakness exists is inherently linked to materiality. Stating that the material weakness no longer exists in all material respects would be redundant—the equivalent of saying that the financial statements are not materially misstated in all material respects. Accordingly, the Board has not added another reference to materiality in the auditor’s opinion. E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 77618 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices Performance of Substantive Procedures B51. The proposed standard, consistent with its reliance on the existing provisions of Auditing Standard No. 2, focused largely on the tests of controls that the auditor must perform to obtain reasonable assurance that a material weakness no longer exists. The proposed standard additionally recognized that, in some cases, the auditor also would need to perform substantive procedures on account balances to obtain sufficient evidence as to whether a material weakness no longer exists. B52. Several auditors believed that the proposed standard was too mild in its wording that the auditor ‘‘may determine’’ that performing substantive procedures was necessary. Those commenters believed that, to be consistent with the integrated audit concept of Auditing Standard No. 2 and to reflect the fact that identification of many material weaknesses during the past year occurred during the performance of substantive audit procedures, such wording did not adequately convey the importance of performing substantive procedures in an engagement to report on whether a previously reported material weakness continues to exist. Some commenters recommended that the standard set forth a presumptively mandatory requirement for the auditor to perform substantive audit procedures in all cases, while others suggested that strengthening the language or providing additional guidance about when substantive procedures are necessary would be sufficient. B53. The Board continues to believe that in some circumstances, substantive procedures will not be necessary for the auditor to obtain sufficient evidence about whether a material weakness continues to exist. Like many aspects of this standard, the auditor’s judgment in this area will depend on the nature of the material weakness. An auditor can obtain sufficient evidence to support an opinion on whether some material weaknesses continue to exist without the need for substantive procedures. Other material weaknesses necessitate substantive procedures for the auditor to obtain sufficient evidence. Therefore, the Board determined that it would be inappropriate to establish a presumptively mandatory requirement that substantive procedures be performed in all cases. B54. The Board agreed, however, that the proposed standard did not sufficiently stress the potential importance of performing substantive procedures, depending on the nature of VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 the material weakness. Paragraph 34 of the standard has, therefore, been modified in a manner that the Board believes better articulates the potential need to perform substantive procedures. An example also has been added to this paragraph of the standard to illustrate a circumstance in which substantive procedures ordinarily would need to be performed. Using the Work of Others B55. Similar to PCAOB Auditing Standard No. 2, the proposed standard permitted the auditor to use the work of others to alter the nature, timing, and extent of the auditor’s performance of this work. Specifically, the proposed standard applied the framework for using the work of others described in PCAOB Auditing Standard No. 2. That framework requires the auditor to obtain the principal evidence supporting his or her opinion and to evaluate the nature of the controls being tested, together with the competence and objectivity of the persons performing the work. B56. Under both PCAOB Auditing Standard No. 2 and the proposed standard, the framework measures principal evidence in relation to the overall assurance provided by the auditor. In PCAOB Auditing Standard No. 2, the principal evidence supporting the auditor’s opinion should be evaluated in relation to the auditor’s opinion on internal control over financial reporting overall. In contrast, the evaluation of whether the auditor has obtained the principal evidence supporting his or her opinion as to whether a material weakness no longer exists would need to be applied at the control objective level. B57. There were few comments on the provisions for using the work of others in this proposed standard. Most commenters who commented on these provisions expressed confusion about a passage in the example of proposed paragraph 36, which stated that ‘‘the auditor might perform a walkthrough of the reconciliation process himself or herself [emphasis added].’’ Commenters believed that walkthroughs were required in the proposed standard in all cases and that walkthroughs must be conducted by the auditor himself or herself. B58. One auditor suggested clarifying within the proposed standard that the auditor will be able to use the work of others only in limited circumstances. This same commenter also believed that the bank reconciliation example presented in the proposed standard to illustrate how the auditor could use the work of others in this type of engagement was too simplistic and PO 00000 Frm 00018 Fmt 4701 Sfmt 4703 requested additional, more realistic examples. B59. The Board continues to believe that the framework for using the work of others that was established in Auditing Standard No. 2 is appropriate for use in this context and, therefore, the provisions for using the work of others in the standard have been retained as proposed. At the same time, the Board determined that it would be helpful to clarify, through the following discussion, that the evaluation of whether the auditor has obtained the principal evidence supporting his or her opinion on whether a material weakness continues to exist would need to be applied at the control objective level. A complete understanding of this feature of the standard is important because this provision allows for additional flexibility in the auditor’s work. B60. The auditor’s opinion in this engagement is expressed only on whether the material weakness continues to exist—not on whether the individually identified controls are effective. As a result, the evaluation as to whether the auditor has obtained the principal evidence supporting his or her opinion should be made at the control objective level—not at the lower level of the controls individually identified in management’s assertion and the auditor’s report. B61. If, for example, management’s and the auditor’s reports identify three separate previously reported material weaknesses that no longer exist, the auditor would, in effect, be rendering three separate opinions. Those opinions would indicate that each of the three individual material weaknesses continues to exist or no longer exists as of the date of management’s assertion. The standard, therefore, would require the auditor to obtain the principal evidence that the control objectives related to each of the three identified material weaknesses were now achieved. However, the standard would not require that the auditor obtain the principal evidence that each control specifically identified in management’s assertion as achieving the control objectives is effective. B62. Auditing Standard No. 4 follows the same framework for using the work of others as Auditing Standard No. 2. There may, however, be some circumstances in which the scope of the audit procedures to be performed in this engagement will be so limited that using the work of others will not provide any tangible benefit to the company or its auditor. The Board believes that no additional specific restriction on the use of the work of others is appropriate or necessary in the context of this E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices wwhite on PROD1PC65 with NOTICES2 engagement. Such a restriction would diminish the flexibility that the framework otherwise provides and perhaps inhibit the auditor’s exercise of the judgment necessary to implement the framework appropriately. Furthermore, the Board does not believe that auditors need such direction within the standard to make appropriate decisions about using the work of others in this context. B63. Similarly, the Board determined that no further examples of using the work of others were needed. The Board believes that additional examples demonstrating the application of the provisions in the standard for using the work of others to reflect more realistic (i.e., complex, fact-driven) situations is better handled outside of the standard itself and by auditors—in their audit methodology, training courses, and other venues. B64. In response to confusion about the requirement for walkthroughs, the Board clarified the standard by adding a note to paragraph 38 and deleted the reference to a walkthrough from the example on using the work of others. Walkthroughs are required only of a successor auditor when the successor auditor performs this engagement before performing an audit of internal control over financial reporting in accordance with Auditing Standard No. 2. A continuing auditor that has opined already on the company’s internal control over financial reporting in accordance with Auditing Standard No. 2 as of the company’s most recent annual assessment and is engaged to conduct this narrow engagement is not required to perform any walkthroughs as part of this engagement. Dividing Responsibility B65. Due to the narrow scope of an engagement to report on whether a material weakness continues to exist, the provisions of the proposed standard allowed the principal auditor to use the work and reports of another auditor as a basis, in part, for his or her opinion. The proposed standard also prohibited the principal auditor from dividing responsibility for the engagement with another auditor. B66. Very few comments were received on this provision of the proposed standard. One auditor suggested that, although dividing responsibility may not be appropriate in certain circumstances, the standard should not prohibit it. Another auditor expressed confusion about whether the principal auditor could refer to the report of the other auditor but not divide responsibility with the other auditor. VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 B67. The Board continues to believe that, based on the nature of the engagement described by the standard, the principal auditor should be prohibited from dividing responsibility for the engagement with another auditor. The Board’s consideration of the nature of this engagement included recognition of the narrow scope of the work (i.e., whether a previously reported material weakness continues to exist), that the engagement would be voluntary, and that the assignment would be non-recurring (unlike the recurring nature of the audit of the financial statements or the audit of internal control over financial reporting). The Board notes that three appropriate alternatives exist in the circumstance in which another auditor is involved and the company wants to obtain auditor assurance that a previously reported material weakness no longer exists: • The principal auditor could report on whether a previously reported material weakness continues to exist according to this standard by performing all of the testing required for this engagement himself or herself. • The principal auditor could report on whether a previously reported material weakness continues to exist according to this standard by using the work and reports of another auditor as a basis, in part, for his or her opinion, and by taking responsibility for the work performed by the other auditor. In this case, the auditor may not make reference to the other auditor in his or her report on whether a previously reported material weakness continues to exist. • The company could wait until yearend when the principal auditor would report on the effectiveness of internal control over financial reporting overall under the provisions of Auditing Standard No. 2. B68. The Board concluded that the standard was sufficiently clear that the principal auditor could not divide responsibility with another auditor and, therefore, that the auditor also could not refer to the other auditor in his or her report. Accordingly, no change has been made to the standard in this regard. New Material Weaknesses Identified B69. The proposed standard was silent regarding the auditor’s responsibilities if, during the performance of this engagement, he or she became aware of a new material weakness not previously reported on by an auditor. B70. Several commenters requested that the standard address the auditor’s responsibilities for new material PO 00000 Frm 00019 Fmt 4701 Sfmt 4703 77619 weaknesses identified during this engagement and suggested what these responsibilities should be. One investor suggested that the standard should require the auditor to include disclosure of any new material weaknesses of which the auditor was aware in his or her report. This commenter stated that, otherwise, the auditor’s report would become a way of telling investors the good news while concealing the bad news. Another commenter suggested that management should be required to include the new material weakness in management’s assertion that would accompany the auditor’s report and the auditor should then disclaim an opinion on the new material weakness. B71. Both the identification of material weaknesses and the remediation of such weaknesses will be captured by management’s voluntary and required reporting under the SEC’s rules. Accordingly, the provisions of this standard do not facilitate management’s ability to conceal from investors the emergence of a new material weakness at the company. Nevertheless, the Board agreed that when an auditor identifies a new material weakness during the performance of this engagement, the auditor should not simply remain silent. Accordingly, the Board modified the standard to require the auditor to communicate, in writing, to the audit committee any material weaknesses identified during this engagement that the auditor had not previously communicated, in writing, to the audit committee. B72. The existing provisions of Auditing Standard No. 2 contain responsibilities for the auditor if (1) information comes to the auditor’s attention during this engagement that leads him or her to believe, while performing quarterly procedures required by Auditing Standard No. 2, that management’s quarterly disclosures are materially misleading, or (2) the auditor becomes aware of conditions that existed at the date of his or her last report issued under Auditing Standard No. 2. B73. Paragraphs 202–206 of Auditing Standard No. 2 establish certain requirements for the auditor related to management’s quarterly and annual certifications with respect to the company’s internal control over financial reporting. If matters come to the auditor’s attention during this engagement that lead him or her to believe, while fulfilling these quarterly requirements, that modification to the disclosures about changes in internal control over financial reporting is necessary for the certifications to be E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 77620 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices accurate and to comply with the requirements of Section 302 of the Act and the SEC’s rules, these provisions of Auditing Standard No. 2 require the auditor to take action. Such actions escalate from auditor communications with management and then to the audit committee, culminating in the auditor considering his or her additional responsibilities under AU sec. 317, Illegal Acts by Clients, and Section 10A of the Securities Exchange Act of 1934. B74. In addition, a continuing or predecessor auditor would have responsibilities under paragraph 197 of Auditing Standard No. 2 if the existence of a new material weakness came to the auditor’s attention. This paragraph effectively extends the responsibilities in AU sec. 561, Subsequent Discovery of Facts Existing at the Date of the Auditor’s Report, to reports on the effectiveness of internal control over financial reporting issued pursuant to Auditing Standard No. 2. The identification of a new material weakness in the current year would cause the auditor, in fulfilling these responsibilities, to determine whether the facts relating to the material weakness existed at the date of the auditor’s report pursuant to Auditing Standard No. 2 and, if so, (1) whether those facts would have changed the auditor’s report issued under Auditing Standard No. 2 if he or she had been aware of them and (2) whether there are persons currently relying on or likely to rely on the auditor’s report. If the auditor determined that the new material weakness identified in the current year actually existed as of the date of his or her previous report under Auditing Standard No. 2 and that it was not adequately identified and disclosed in that report, the auditor would need to take steps such as recalling and reissuing the previous report to ensure that investors did not continue to rely on the previously issued (erroneous) report. B75. Including newly identified material weaknesses in the auditor’s report could potentially mislead investors into believing that the assurance provided by this type of engagement is broader than it actually is. If report users were provided with disclosure (covered by the auditor’s opinion) of new material weaknesses of which the auditor was aware, report users might incorrectly believe that the auditor’s report captured all new material weaknesses that had arisen at the company. Similarly, a requirement for the auditor to disclose any new material weaknesses could lead report users to conclude, incorrectly, that no such disclosure means that there is VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 current auditor assurance over the whole of internal control over financial reporting at the company. The objective of this engagement is to provide auditor assurance about whether a previously reported material weakness continues to exist—nothing broader. The only way for investors to obtain a more complete report from the auditor would be for the auditor to audit internal control over financial reporting in accordance with Auditing Standard No. 2. Specific Identification of All Previously Reported Material Weaknesses B76. The proposed standard required the auditor to modify his or her report if the auditor provides assurance on less than all of the material weaknesses previously reported. The proposed standard did not, however, require the auditor to specifically identify all of the previously reported material weaknesses not covered. B77. All investors who commented on this issue suggested that all material weaknesses previously reported either should be referred to or specifically included in the auditor’s report. They indicated that failure to identify the additional material weaknesses might lead some users to erroneously conclude that they no longer exist. Auditors, on the other hand, agreed that complete specific identification of the previously reported material weaknesses not covered by the auditor’s opinion should not be included, primarily because they believe that it may increase the risk of confusion about the scope of the engagement and what is being covered in the auditor’s opinion. Several commenters who agreed that specific identification was not necessary suggested that in addition to the report modification included in the proposed standard, the auditor’s report on this engagement should specifically direct the reader to the previous auditor’s report (issued under Auditing Standard No. 2), by either attaching a copy of the audit report or by providing direction as to where the report could be obtained. B78. The Board believes that including a complete specific identification of the previously reported material weaknesses not covered by this engagement would prove problematic. As noted by many commenters, it is possible that including this detail would confuse report readers regarding the scope of this narrow engagement and could imply that, unless told otherwise, a report user should assume that those other material weaknesses do continue to exist. In some of the material weakness descriptions included in management’s and the auditor’s reports on the effectiveness of the company’s PO 00000 Frm 00020 Fmt 4701 Sfmt 4703 internal control over financial reporting as of year-end, the description of multiple material weaknesses covered several pages. That level of detail in an auditor’s report specifically targeted at whether just one material weakness continues to exist could easily overwhelm the rest of the audit report, making the report prone to various kinds of misinterpretations. B79. The Board concluded that report readers would be better served by requiring the auditor to provide information regarding where to obtain the previously issued audit report— either by attaching it or referring to where it could be publicly obtained. Other Reporting Matters B80. No Requirement to Issue a Report. The proposed standard required that the auditor, if he or she concluded that the material weakness continues to exist, communicate that conclusion in writing to the audit committee. The proposed standard, however, did not require the issuance of a report. Rather, the proposed standard recognized that the auditor must consider this knowledge in connection with the auditor’s responsibilities under Auditing Standard No. 2 to determine whether management’s quarterly disclosures about internal control over financial reporting are not materially misleading. B81. Several auditors who commented recommended that the proposed standard should require the auditor to issue an adverse report in the event that the auditor concludes that the material weakness continues to exist. One suggested that issuance of an adverse report would be necessary only if the auditor believed that the company had previously publicly disclosed that the material weakness had been addressed. B82. The Board continues to believe that requiring the issuance of an adverse report to the company would serve no useful purpose in this circumstance because the company might not make such a report public. The Board believes, therefore, that requiring the auditor to communicate, in writing, with the audit committee his or her conclusion that a material weakness that was the subject of this engagement continues to exist would serve the same purpose as requiring the issuance of an adverse report. At the same time, such a requirement would provide the auditor with additional flexibility as to the form of communication that would be most meaningful to the audit committee. Regarding the potential for management to lead investors to incorrectly believe that the material E:\FR\FM\30DEN2.SGM 30DEN2 wwhite on PROD1PC65 with NOTICES2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices weakness no longer exists in its public disclosures, the Board believes that the federal securities laws, as well as auditor’s existing responsibilities related to management’s quarterly disclosures, are adequate safeguards to protect investors from misleading information. B83. No Distinction in Standard Between Unqualified and Adverse Opinion. As discussed in the note to paragraph 43 of the standard, the standard no longer distinguishes between an unqualified and an adverse opinion. The auditor’s opinion was revised to state that the material weakness exists or no longer exists. This revision is discussed further in the section ‘‘Form of Auditor’s Opinion’’ and is now referred to in the standard as the auditor’s opinion. B84. Inherent Limitations. The inherent limitations paragraph of the auditor’s report provided in the proposed standard discussed the inherent limitations of internal control over financial reporting overall, rather than the inherent limitations of the controls related to the material weakness being reported on. B85. One commenter suggested that the inherent limitations paragraph was too broad for this engagement and needed to be modified to more accurately reflect the narrow focus of this type of engagement. B86. The Board agreed that the inherent limitations paragraph, in this context, should be targeted to the specific controls identified in this auditor report. In addition, the Board continues to believe that the broader concept of inherent limitations in internal control over financial reporting overall is equally applicable. The inherent limitations paragraph in the auditor’s report has been modified to reflect both of these conclusions. B87. Obtaining an Understanding of Internal Control Over Financial Reporting. The proposed standard included a required report element stating that ‘‘the engagement includes obtaining an understanding of internal control over financial reporting, examining evidence supporting management’s assertion, and performing such other procedures as the auditor considered necessary in the circumstances.’’ This language also was included in the example report included in the proposed standard. B88. Several auditors expressed concern that the phrase, ‘‘the engagement includes obtaining an understanding of internal control over financial reporting,’’ implies that, as a part of the current engagement, the auditor spent a significant amount of VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 time understanding internal control over financial reporting overall rather than carrying forward his or her understanding from the prior annual audit. These commenters believed this implication conflicted with the direction in the body of the proposed standard that an auditor who has audited the company’s internal control over financial reporting within the past year in accordance with Auditing Standard No. 2 would be expected to have obtained a sufficient knowledge of the company and its internal control over financial reporting to perform this engagement. One commenter acknowledged that the proposed wording may be appropriate in cases in which a successor auditor is performing this engagement without previously gaining that understanding. B89. The Board continues to believe that an auditor who has audited the company’s internal control over financial reporting as of the company’s most recent annual assessment in accordance with Auditing Standard No. 2 would be expected to have obtained a sufficient knowledge of the company and its internal control over financial reporting to perform an engagement to report on whether a previously reported material weakness continues to exist. To require a continuing auditor to update and document his or her understanding of internal control over financial reporting overall (to the full measure required by Auditing Standard No. 2) would be unnecessarily burdensome and costly. The Board modified the report element for a continuing auditor to clarify that the auditor previously obtained an understanding of internal control over financial reporting overall at the company and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the specified material weakness. B90. The Board continues to believe, however, that a successor auditor that has not yet audited the company’s internal control over financial reporting in accordance with Auditing Standard No. 2 would need to obtain a current understanding of internal control over financial reporting in connection with this engagement. Therefore, the report element described in the proposed standard is appropriate and has been retained for a successor auditor’s reporting. B91. Example Reports. The proposed standard included only one example report, which illustrated reporting on one material weakness by a continuing auditor when no additional material weaknesses were reported previously. Several commenters requested PO 00000 Frm 00021 Fmt 4701 Sfmt 4703 77621 modification of the standard to address circumstances that the Board believed were already addressed by the proposed standard but were not illustrated in the single example report. Some commenters also made specific requests for additional example reports. B92. The Board determined, after considering the nature of the comments, that additional example reports, while not covering all possible situations, would provide additional clarity to the various reporting situations. The Board selected three reports to illustrate most facets of the reporting provisions of the standard. Appendix A includes those reports. Conforming Amendments to AT Sec. 101 B93. The proposed standard contained a proposed conforming amendment to AT sec. 101, Attest Engagements. The proposed conforming amendment would have required the proposed standard to be used, rather than AT sec. 101, for any engagements in which the subject matter is whether a material weakness continues to exist. This conforming amendment would have precluded the auditor from performing an agreed-upon procedures or review engagement (using AT sec. 101) when the subject matter of the engagement was whether a material weakness continues to exist. B94. The Board received few comments related to the proposed conforming amendment. One auditor agreed that a conforming amendment to preclude a review-level attestation was appropriate when the subject matter was whether a material weakness continues to exist. This commenter went on to suggest, however, that there could be appropriate uses for an agreed-upon procedures engagement and that the Board should not preclude agreed-upon procedures from being performed under the Board’s standards. Such reports, the commenter noted, would be restricted to the use of the specified parties who take responsibility for the sufficiency of the agreed-upon procedures for their purposes and, therefore, these reports would not generally be available to investors. Thus, these reports would not be a substitute for the engagements addressed in the proposed standard. Another commenter separately suggested broadly retaining the ability for the auditor to perform a review engagement when the subject matter is a previously reported material weakness. B95. The Board continues to believe that investors and other report users in the public domain will be best served by the Board’s standards permitting only E:\FR\FM\30DEN2.SGM 30DEN2 77622 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices positive assurance (i.e., an examinationlevel attestation) from the auditor when the subject matter is whether a material weakness continues to exist. The Board agrees, however, that private parties (such as audit committees) who wish to engage the auditor to perform specified procedures when the subject matter is whether a material weakness continues to exist should be allowed to negotiate such a private arrangement, as long as the results are not intended for public use. The Board, therefore, decided to modify the conforming amendment to AT sec. 101 of the Board’s interim standards. As adopted, an auditor may not use AT 101 to report on whether a material weakness in internal control over financial reporting continues to exist for any purpose other than the company’s internal use. Conforming Amendment to PCAOB Auditing and Related Professional Practice Standards Resulting from the Adoption of the Auditing Standard No. 4—Reporting on Whether a Previously Reported Material Weakness Continues to Exist Attestation Standards AT sec. 101, Attest Engagements AT sec. 101 is amended by adding as letter f. to paragraph .04, the following: Engagements in which the practitioner is engaged to report on whether a material weakness in internal control over financial reporting continues to exist for any purpose other than the company’s internal use. Such engagements must be conducted pursuant to PCAOB Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist. II. Board’s Statement of the Purpose of, and Statutory Basis for, the Proposed Rule wwhite on PROD1PC65 with NOTICES2 In its filing with the Commission, the Board included statements concerning the purpose of, and basis for, the proposed rule and discussed any comments it received on the proposed rule. The text of these statements may be examined at the places specified in Item IV below. The Board has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements. A. Board’s Statement of the Purpose of, and Statutory Basis for, the Proposed Rule (a) Purpose Section 404 of the Act requires the management of public companies each year to file an assessment of the VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 effectiveness of their companies’ internal control over financial reporting. The company’s independent auditor must attest to, and report on, management’s assessment. Under the SEC’s implementing rules, company management may not conclude that internal control over financial reporting is effective if one or more material weaknesses exists. When a company reports a material weakness, investors may be left uncertain about the reliability of the company’s financial reporting. Both companies and report users have recognized the importance of a mechanism for alerting investors that a previously disclosed material weakness no longer exists. A company may determine that disclosure under the framework already provided by the federal securities laws is sufficient for this purpose. Some investors and companies, however, have called for the ability to bolster confidence in management’s assertions about those internal control improvements with the added assurance of the company’s independent auditor. The Board, therefore, adopted an auditing standard that would be tailored narrowly to an engagement to report on whether a previously reported material weakness continues to exist. (b) Statutory Basis B. Board’s Statement on Burden on Competition The Board does not believe that the proposed rule will result in any burden on competition that is not necessary or appropriate in furtherance of the purposes of the Act. The proposed rule describes a voluntary engagement that would be available but not required for any company that previously reported a material weakness in internal control over financial reporting. The Board believes that, in some situations, companies will find that auditor assurance that a material weakness no longer exists leads to a higher level of investor confidence in the company’s financial reporting and that the costs of the engagement are therefore worth incurring. If a company believes, however, that these benefits may be outweighed in a particular case by the costs, or that the engagement is otherwise not in the company’s interest, the company may (and presumably would) determine not to engage its auditor to perform this work. Frm 00022 Fmt 4701 The Board released the proposed rule for public comment in Release No. 2005–002 (March 31, 2005). A copy of Release No. 2005–002 and the comment letters received in response to the PCAOB’s request for comment are available on the PCAOB’s Web site at www.pcaobus.org. The Board received 30 written comments. The Board has clarified and modified certain aspects of the proposed rule in response to the comments it received, as discussed in Appendix B, Background and Basis for Conclusions, to the proposed rule. III. Date of Effectiveness of the Proposed Rule and Timing for Commission Action Within 35 days of the date of publication of this notice in the Federal Register or within such longer period (i) as the Commission may designate up to 90 days of such date if it finds such longer period to be appropriate and publishes its reasons for so finding or (ii) as to which the Board consents the Commission will: (a) By order approve such proposed rule; or (b) institute proceedings to determine whether the proposed rule should be disapproved. IV. Solicitation of Comments The statutory basis for the proposed rule is Title I of the Act. PO 00000 C. Board’s Statement on Comments on the Proposed Rule Received from Members, Participants or Others Sfmt 4703 Interested persons are invited to submit written data, views, and arguments concerning the foregoing, including whether the proposed rule is consistent with the requirements of Title I of the Act. The Commission also requests specific comment on the following: 1. Are there unnecessary impediments to management’s use of AS 4? Will it be used? What are the ways AS 4 should be changed, if any, to encourage appropriate use by management? 2. Under AS 4, management is permitted to select the date for its assertion that a material weakness no longer exists. Is it clear that such date may fall outside of the quarterly review period? Comments may be submitted by any of the following methods: Electronic comments • Use the Commission’s Internet comment form (https://www.sec.gov/ rules/pcaob.shtml); or • Send an e-mail to rulecomments@sec.gov. Please include File No. PCAOB–2005–01 on the subject line. E:\FR\FM\30DEN2.SGM 30DEN2 Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / Notices wwhite on PROD1PC65 with NOTICES2 Paper comments • Send paper comments in triplicate to Jonathan G. Katz, Secretary, Securities and Exchange Commission, 100 F Street, NE., Washington, DC 20549–9303. All submissions should refer to File No. PCAOB–2005–01. This file number should be included on the subject line if e-mail is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission’s Internet Web site (https://www.sec.gov/ rules/pcaob.shtml). Copies of the VerDate Aug<31>2005 19:34 Dec 29, 2005 Jkt 208001 submission, all subsequent amendments, all written statements with respect to the proposed rule that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for inspection and copying in the Commission’s Public Reference Section, 100 F Street, NE., Washington, DC 20549. Copies of such filing also will be available for inspection and copying at the principal office of PCAOB. PO 00000 Frm 00023 Fmt 4701 Sfmt 4703 77623 All comments received will be posted without change; we do not edit personal identifying information from submissions. You should submit only information that you wish to make available publicly. All submissions should refer to File No. PCAOB–2005– 01 and should be submitted on or before January 20, 2006. By the Commission. Jonathan G. Katz, Secretary. [FR Doc. 05–24498 Filed 12–29–05; 8:45 am] BILLING CODE 8010–01–P E:\FR\FM\30DEN2.SGM 30DEN2

Agencies

SECURITIES AND EXCHANGE COMMISSION

[Federal Register Volume 70, Number 250 (Friday, December 30, 2005)]
[Notices]
[Pages 77602-77623]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-24498]



[[Page 77601]]

-----------------------------------------------------------------------

Part III





Securities and Exchange Commission





-----------------------------------------------------------------------



Public Company Accounting Oversight Board; Notice of Filing of Proposed 
Rule on Auditing Standard No. 4 Reporting on Whether a Previously 
Reported Material Weakness Continues to Exist; Notice

Federal Register / Vol. 70, No. 251 / Friday, December 30, 2005 / 
Notices

[[Page 77602]]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-52990; File No. PCAOB-2005-01]


Public Company Accounting Oversight Board; Notice of Filing of 
Proposed Rule on Auditing Standard No. 4, Reporting on Whether a 
Previously Reported Material Weakness Continues to Exist

December 21, 2005.
    Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the 
``Act''), notice is hereby given that on July 28, 2005, the Public 
Company Accounting Oversight Board (the ``Board'' or the ``PCAOB'') 
filed with the Securities and Exchange Commission (the ``Commission'' 
or ``SEC'') the proposed rules described in Items I and II below, which 
items have been prepared by the Board and are presented here in the 
form submitted by the Board. The Commission is publishing this notice 
to solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

    On July 26, 2005, the Board adopted Auditing Standard No. 4, 
Reporting on Whether a Previously Reported Material Weakness Continues 
to Exist. The text of the proposed rules is as follows:

Auditing Standard No. 4--Reporting on Whether a Previously Reported 
Material Weakness Continues to Exist

Table of Contents--(Paragraph)

Applicability of Standard--1-4
Auditor's Objective in an Engagement to Report on Whether a 
Previously Reported Material Weakness Continues to Exist--5-6
Conditions for Engagement Performance--7-8
Framework and Definitions for Evaluation--9-17
Performing an Engagement to Report on Whether a Previously Reported 
Material Weakness Continues to Exist--18-43
    Applying the Standards of the PCAOB--19-23
    Planning the Engagement--24
    Obtaining an Understanding of Internal Control Over Financial 
Reporting--25-27
    Testing and Evaluating Whether a Material Weakness Continues to 
Exist--28-35
    Using the Work of Others--36-39
    Opinions Based, in Part, on the Work of Another Auditor--40
    Forming an Opinion on Whether a Previously Reported Material 
Weakness Continues to Exist--41-43
Requirement for Written Representations--44-46
Documentation Requirements--47
Reporting on Whether a Previously Reported Material Weakness 
Continues To Exist--48-64
    Management's Report--48
    Auditor's Evaluation of Management's Report--49-50
    Auditor's Report--51-60
    Report modifications--54-55
    Other material weaknesses reported previously by the company as 
part of the company's annual assessment of internal control are not 
addressed by the auditor's opinion--56
    Subsequent events--57-58
    Management's report includes additional information--59-60
    Special Considerations When a Previously Reported Material 
Weakness Continues to Exist--61-64
Effective Date--65
    Appendix A--Illustrative Reports on Whether a Previously 
Reported Material Weakness Continues to Exist
    Appendix B--Background and Basis for Conclusions

Auditing and Related Professional Practice Standards

Auditing Standard--Reporting on Whether a Previously Reported Material 
Weakness Continues to Exist

Applicability of Standard
    1. This standard establishes requirements and provides direction 
that apply when an auditor is engaged to report on whether a previously 
reported material weakness in internal control over financial reporting 
(hereinafter referred to as a material weakness) continues to exist as 
of a date specified by management.

    Note 1: In this context, previously reported material weakness 
means a material weakness that was described previously in an 
auditor's report issued pursuant to Auditing Standard No. 2, An 
Audit of Internal Control Over Financial Reporting Performed in 
Conjunction with an Audit of Financial Statements.


    Note 2: The date specified by management as the date that the 
previously reported material weakness no longer exists must be a 
date after the date of management's most recent annual assessment.

    2. An auditor may conduct an engagement to report on whether a 
previously reported material weakness continues to exist if (1) the 
auditor has audited the company's financial statements and internal 
control over financial reporting in accordance with Auditing Standard 
No. 2, An Audit of Internal Control Over Financial Reporting Performed 
in Conjunction with an Audit of Financial Statements, as of the date of 
the company's most recent annual assessment of internal control over 
financial reporting, or (2) the auditor has been engaged to perform an 
audit of the financial statements and internal control over financial 
reporting in accordance with Auditing Standard No. 2 in the current 
year and has a sufficient basis for performing this engagement. (See 
paragraph 26 of this standard for additional requirements that apply 
specifically to a successor auditor's application of this standard.)

    Note: References in this standard to the company's most recent 
annual assessment of internal control over financial reporting apply 
to the company's most recent assessment of internal control over 
financial reporting overall, either as of the company's year-end or 
as of a more recent interim date, as audited by the auditor in 
accordance with Auditing Standard No. 2.

    3. The auditor may report on more than one previously reported 
material weakness as part of a single engagement.
    4. The engagement described by this standard is voluntary. The 
standards of the PCAOB do not require an auditor to undertake an 
engagement to report on whether a previously reported material weakness 
continues to exist. The auditor may audit the company's internal 
control over financial reporting in accordance with Auditing Standard 
No. 2 without ever performing an engagement in accordance with this 
standard.
Auditor's Objective in an Engagement To Report on Whether a Previously 
Reported Material Weakness Continues To Exist
    5. The auditor's objective in an engagement to report on whether a 
previously reported material weakness continues to exist is to obtain 
reasonable assurance about whether the previously reported material 
weakness exists as of a date specified by management and to express an 
opinion thereon. The auditor's opinion relates to the existence of a 
specifically identified material weakness as of a specified date and 
does not relate to the effectiveness of the company's internal control 
over financial reporting overall.
    6. To obtain reasonable assurance, the auditor should obtain and 
evaluate evidence about whether specified controls were designed and 
operated effectively as of the date specified by management and whether 
those controls satisfy the company's stated control objective.

    Note: Obtaining and evaluating evidence about whether the 
specified controls are designed effectively without also obtaining 
evidence about whether those controls operated effectively would not 
result in the auditor obtaining reasonable assurance for the purpose 
of expressing an opinion on whether a material weakness continues to 
exist.


[[Page 77603]]


Conditions for Engagement Performance
    7. The auditor may report on whether a previously reported material 
weakness continues to exist at a company only if all of the following 
conditions are met:
    a. Management accepts responsibility for the effectiveness of 
internal control over financial reporting;
    b. Management evaluates the effectiveness of the specific 
control(s) that it believes addresses the material weakness using the 
same control criteria that management used for its most recent annual 
assessment of internal control over financial reporting and 
management's stated control objective(s);
    c. Management asserts that the specific control(s) identified is 
effective in achieving the stated control objective;
    d. Management supports its assertion with sufficient evidence, 
including documentation; and
    e. Management presents a written report that will accompany the 
auditor's report that contains all the elements described in paragraph 
48 of this standard.
    8. If all the conditions in paragraph 7 of this standard are not 
met, the auditor is not permitted to complete the engagement to report 
on whether a previously reported material weakness continues to exist.
Framework and Definitions for Evaluation
    9. The terms internal control over financial reporting, control 
deficiency, significant deficiency, and material weakness have the same 
meanings as the definitions of those terms in paragraphs 7 through 10, 
respectively, of Auditing Standard No. 2.
    10. Paragraph 13 of Auditing Standard No. 2 states that management 
is required to base its annual assessment of the effectiveness of the 
company's internal control over financial reporting on a suitable, 
recognized control framework (also known as control criteria) and 
describes the characteristics that make a framework suitable for this 
purpose. For purposes of an engagement to report on whether a 
previously reported material weakness continues to exist, both 
management and the auditor must use both (1) the same control criteria 
used for the company's most recent annual assessment of internal 
control over financial reporting, and (2) the company's stated control 
objective(s) to evaluate whether a material weakness continues to 
exist.

    Note: The performance and reporting requirements in Auditing 
Standard No. 2 and in this standard are based on the Committee of 
Sponsoring Organizations (``COSO'') of the Treadway Commission's 
publication, Internal Control--Integrated Framework. Known as the 
COSO report, it provides a suitable and available framework for 
purposes of management's annual assessment of internal control over 
financial reporting. (More information about the COSO framework is 
included in paragraphs 14 and 15 of Auditing Standard No. 2, the 
COSO report, and AU sec. 319, Consideration of Internal Control in a 
Financial Statement Audit.)

    11. A control objective provides a specific target against which to 
evaluate the effectiveness of controls. A control objective for 
internal control over financial reporting generally relates to a 
relevant financial statement assertion and states a criterion for 
evaluating whether the company's control procedures in a specific area 
provide reasonable assurance that a misstatement to or omission in that 
relevant assertion is prevented or detected by controls on a timely 
basis.\1\
---------------------------------------------------------------------------

    \1\ See paragraphs 68 to 70 of Auditing Standard No. 2 for 
additional information on relevant assertions.
---------------------------------------------------------------------------

    12. Management establishes control objectives that are tailored to 
the individual company. The process of tailoring control objectives to 
the individual company allows the control criteria used for 
management's annual assessment to be applied to the facts and 
circumstances in a reasonable and appropriate manner. Although control 
objectives are used most frequently to evaluate the effectiveness of 
control activities, the other components of internal control over 
financial reporting (i.e., control environment, risk assessment, 
information and communication, and monitoring) also can be expressed in 
terms of control objectives.
    13. In an audit of internal control over financial reporting, the 
auditor is required to identify the company's control objectives in 
each area and to identify the controls that satisfy each control 
objective to evaluate whether the company's internal control over 
financial reporting is designed effectively.\2\
---------------------------------------------------------------------------

    \2\ See paragraph 88 of Auditing Standard No. 2.
---------------------------------------------------------------------------

    14. Table 1 includes examples of control objectives and their 
related assertions:

     Table 1.--Examples of Control Objectives and Related Assertions
------------------------------------------------------------------------
            Control objectives                       Assertions
------------------------------------------------------------------------
Recorded sales of product X initiated on    Existence or occurrence.
 the company's Web site are real.
Product X warranty losses that are          Completeness.
 probable and can be reasonably estimated
 are recorded as of the company's
 quarterly financial statement period-ends.
Interest rate swaps are recorded at fair    Valuation or allocation.
 value.
The company has legal title to recorded     Rights and obligations.
 product X inventory in the company's
 Dallas, TX warehouse.
Pending litigation that is reasonably       Presentation and disclosure.
 possible to result in a material loss is
 disclosed in the quarterly and annual
 financial statements.
------------------------------------------------------------------------

    15. If a material weakness has previously been reported, a 
necessary control objective (or objectives) has not been achieved.
    16. A stated control objective in the context of an engagement to 
report on whether a material weakness continues to exist is the 
specific control objective identified by management that, if achieved, 
would result in the material weakness no longer existing.
    17. Because the stated control objective, for purposes of this 
engagement, provides management and the auditor with a specific target 
against which to evaluate whether the material weakness continues to 
exist, management and the auditor must be satisfied that, if the stated 
control objective were achieved, the material weakness would no longer 
exist.

    Note: When a material weakness has a pervasive effect on the 
company's internal control over financial reporting, identifying the 
related control objectives that are not being achieved may be 
difficult because of the large number of control objectives 
affected. A material weakness related to an ineffective control 
environment would be an example of this circumstance. If management 
and the auditor have difficulty identifying all of the stated 
control objectives affected by a material weakness, the material 
weakness probably is not suitable for this engagement and should be 
addressed, instead, through the auditor's annual audit of internal 
control over financial reporting conducted under Auditing Standard 
No. 2.


[[Page 77604]]


Performing an Engagement to Report on Whether a Previously Reported 
Material Weakness Continues to Exist
    18. In an engagement to report on whether a previously reported 
material weakness continues to exist, the auditor must obtain 
sufficient competent evidence about the design and operating 
effectiveness of specified controls that provide reasonable assurance 
that the company's stated control objective is achieved in the context 
of the control criteria (e.g., COSO).

    Note 1: An individual material weakness may be associated with a 
single stated control objective or with more than one stated control 
objective, depending on the nature of the material weakness and the 
manner in which the company tailors its stated control objectives to 
its business.


    Note 2: Depending on the nature of the company's business, its 
organization, its internal control over financial reporting, and the 
specific material weakness that is the subject of this engagement, 
the auditor may determine that he or she is not able to obtain a 
sufficient basis for reporting on whether a previously reported 
material weakness continues to exist without performing a complete 
audit of internal control over financial reporting in accordance 
with Auditing Standard No. 2.

Applying the Standards of the PCAOB
    19. The auditor must adhere to the standards of the PCAOB in 
performing an engagement to report on whether a previously reported 
material weakness continues to exist. Adherence to the standards 
involves:
    a. Planning the engagement,
    b. Obtaining an understanding of internal control over financial 
reporting,
    c. Testing and evaluating whether a material weakness continues to 
exist, including using the work of others, and
    d. Forming an opinion on whether a previously reported material 
weakness continues to exist.
    20. Even though some requirements of this standard are set forth in 
a manner that suggests a sequential process, auditing whether a 
previously reported material weakness continues to exist involves a 
process of gathering, updating, and analyzing information. Accordingly, 
the auditor may perform some of the procedures and evaluations 
described in this section of the standard concurrently.
    21. The engagement to report on whether a previously reported 
material weakness continues to exist must be performed by a person or 
persons having adequate technical training and proficiency as an 
auditor. In all matters related to the assignment, an independence in 
mental attitude must be maintained. Due professional care must be 
exercised in the performance of the engagement and the preparation of 
the report. Paragraphs 30 through 36 of Auditing Standard No. 2 
describe the application of these standards in the context of an 
internal control-related service.
    22. This standard establishes the fieldwork and reporting standards 
applicable to an engagement to report on whether a previously reported 
material weakness continues to exist.
    23. The concept of materiality, as discussed in paragraphs 22 and 
23 of Auditing Standard No. 2, underlies the application of the general 
and fieldwork standards in an engagement to report on whether a 
previously reported material weakness continues to exist. Therefore, 
the auditor uses materiality at the financial-statement level, rather 
than at the individual account-balance level, in evaluating whether a 
material weakness exists. The auditor should assess materiality as of 
the date that management asserts that the previously reported material 
weakness no longer exists.
Planning the Engagement
    24. The auditor should properly plan the engagement to report on 
whether a previously reported material weakness continues to exist and 
should properly supervise any assistants. When planning the engagement, 
the auditor should evaluate how the matters described in paragraph 39 
of Auditing Standard No. 2 will affect the auditor's procedures.
Obtaining an Understanding of Internal Control Over Financial Reporting
    25. To perform this engagement, the auditor must have a sufficient 
knowledge of the company and its internal control over financial 
reporting. An auditor who has audited the company's internal control 
over financial reporting in accordance with Auditing Standard No. 2 as 
of the date of the company's most recent annual assessment of internal 
control over financial reporting would be expected to have obtained a 
sufficient knowledge of the company and its internal control over 
financial reporting to perform this engagement.

    Note: The second sentence of the paragraph above contemplates 
that the auditor's previous engagement under Auditing Standard No. 2 
resulted in rendering an opinion. If an auditor previously engaged 
to perform an audit of internal control over financial reporting in 
accordance with Auditing Standard No. 2 has not yet rendered an 
opinion on the effectiveness of the company's internal control over 
financial reporting as of the company's most recent year-end or more 
recently, then that auditor should follow the requirements for a 
successor auditor in paragraphs 26a-b and 27. Additionally, if an 
auditor has previously performed an audit of internal control over 
financial reporting at the company and is now a successor auditor 
(because another auditor has subsequently performed an audit of 
internal control over financial reporting at the company in 
intervening years), the auditor should follow the requirements in 
paragraphs 26 and 27 for a successor auditor.

    26. When a successor auditor \3\ performs an engagement to report 
on whether a previously reported material weakness continues to exist 
and he or she has not yet completed an audit of internal control over 
financial reporting at the company, he or she must perform procedures 
to obtain sufficient knowledge of the company's business and its 
internal control over financial reporting to achieve the objective of 
the engagement, as described in paragraph 5 of this standard. A 
successor auditor who has not yet completed an audit of internal 
control over financial reporting at the company must perform the 
following procedures as part of obtaining sufficient knowledge of the 
company's business and its internal control over financial reporting:
---------------------------------------------------------------------------

    \3\ The term successor auditor has the same meaning as the 
definition of that term in paragraph .02 of AU sec. 315, 
Communications Between Predecessor and Successor Auditors.
---------------------------------------------------------------------------

    a. Comply with paragraphs 47 through 51 of Auditing Standard No. 2 
regarding obtaining an understanding of internal control over financial 
reporting. The extent of understanding of internal control over 
financial reporting needed to satisfy these requirements in the context 
of an engagement to report on whether a previously reported material 
weakness continues to exist depends on the nature of the material 
weakness on which the auditor is reporting. The more pervasive the 
effects of the material weakness, the more extensive the understanding 
of internal control over financial reporting should be under these 
requirements. For example, if the material weakness affects company-
level controls, a more extensive understanding of internal control over 
financial reporting will be necessary than if the effects of the 
material weakness are isolated at the transaction level.
    b. Perform a walkthrough as described in paragraphs 79 through 82 
of Auditing Standard No. 2 for all major classes of transactions that 
are directly affected by controls specifically identified by management 
as addressing the material weakness.

    Note: Some controls have only an indirect effect on a major 
class of transactions, such as certain controls in the control

[[Page 77605]]

environment or risk assessment components of internal control over 
financial reporting. The auditor need not perform a walkthrough of 
major classes of transactions that are affected only indirectly by 
the controls specifically identified by management as addressing the 
material weakness.

    c. In addition to the communication requirements described in AU 
sec. 315, Communications Between Predecessor and Successor Auditors, 
the successor auditor should make specific inquiries of the predecessor 
auditor. These inquiries should address the basis for the predecessor 
auditor's determination that a material weakness existed in the 
company's internal control over financial reporting and the predecessor 
auditor's awareness of any information bearing on the company's ability 
to successfully address that material weakness.
    27. A successor auditor may determine that he or she needs to 
perform procedures in addition to those specified in paragraph 26 of 
this standard to obtain a sufficient knowledge of the company's 
business and its internal control over financial reporting. Depending 
on the nature of the company's business, its organization, its internal 
control over financial reporting, and the specific material weakness 
that is the subject of this engagement, a successor auditor may 
determine that he or she is not able to obtain a sufficient basis for 
reporting on whether a previously reported material weakness continues 
to exist without performing a complete audit of internal control over 
financial reporting in accordance with Auditing Standard No. 2.
Testing and Evaluating Whether a Material Weakness Continues to Exist
    28. The auditor must obtain an understanding of and evaluate 
management's evidence supporting its assertion that the specified 
controls related to the material weakness are designed and operated 
effectively, that these controls achieve the company's stated control 
objective(s) consistent with the control criteria, and that the 
identified material weakness no longer exists. If the auditor 
determines that management has not supported its assertion with 
sufficient evidence, the auditor cannot complete the engagement to 
report on whether a previously reported material weakness continues to 
exist, because one of the conditions for engagement completion 
described in paragraph 7 of this standard would not be met.

    Note: Paragraphs 40 through 46 of Auditing Standard No. 2 apply 
to the auditor's evaluation of management's annual assessment of 
internal control over financial reporting and management's related 
documentation. The auditor may apply the relevant concepts described 
in that section to the evaluation of management's evidence 
supporting management's assertion that a previously reported 
material weakness no longer exists.

    29. As a part of evaluating management's evidence supporting its 
assertion, the auditor should determine whether management has selected 
an appropriate date for its assertion. In making this determination, 
the auditor should take into consideration the following:
    a. Management's assertion that a previously reported material 
weakness no longer exists may be made as of any specified date that 
permits management to obtain sufficient evidence supporting its 
assertion.

    Note: The auditor also should determine whether the specified 
date of management's assertion permits the auditor to obtain 
sufficient evidence supporting his or her opinion.

    b. Depending on the nature of the material weakness, the stated 
control objective, and the specified controls, the specified date of 
management's assertion may need to be after the completion of one or 
more period-end financial reporting processes.
    c. Controls that operate daily and on a continuous, or nearly 
continuous, basis generally permit the auditor to obtain sufficient 
evidence as to their operating effectiveness as of almost any date 
management might choose to specify in its report.
    d. Controls that operate over the company's period-end financial 
reporting process typically can be tested only in connection with a 
period-end.
    30. The auditor should obtain evidence about the effectiveness of 
all controls specifically identified in management's assertion. The 
nature, timing, and extent of the testing that enables the auditor to 
obtain sufficient evidence supporting his or her opinion on whether a 
previously reported material weakness continues to exist will depend on 
both the nature of the controls specifically identified by management 
as meeting the company's stated control objectives and the date of 
management's assertion.
    31. All controls that are necessary to achieve the stated control 
objective(s) should, therefore, be specifically identified and 
evaluated. The specified controls will necessarily include controls 
that have been modified or newly implemented and also may include 
existing controls that previously were deemed effective during 
management's most recent annual assessment of internal control over 
financial reporting. As part of testing and evaluating the design 
effectiveness of the specified controls, the auditor should determine 
whether the specified controls would meet the stated control 
objective(s) if they operated as designed. In making this evaluation, 
the auditor should apply paragraphs 88 through 91 of Auditing Standard 
No. 2.
    32. Consistent with the direction in paragraph 92 of Auditing 
Standard No. 2, the auditor should evaluate the operating effectiveness 
of a specified control by determining whether the specified control 
operated as designed and whether the person performing the control 
possesses the necessary authority and qualifications to perform the 
control effectively. In determining the nature, timing, and extent of 
tests of controls, the auditor should apply paragraphs 93 through 102 
and 105 through 107 of Auditing Standard No. 2.
    33. The auditor should apply paragraph 98 of Auditing Standard No. 
2 regarding an adequate period of time to determine the operating 
effectiveness of a control in the context of an engagement to report on 
whether a previously reported material weakness continues to exist. 
Paragraph 98 of Auditing Standard No. 2 states (in part):

    The auditor must perform tests of controls over a period of time 
that is adequate to determine whether, as of the date specified in 
management's report, the controls necessary for achieving the 
objectives of the control criteria are operating effectively. The 
period of time over which the auditor performs tests of controls 
varies with the nature of the controls being tested and with the 
frequency with which specific controls operate and specific policies 
are applied.

For example, a transaction-based daily reconciliation generally would 
permit the auditor to obtain sufficient evidence as to its operating 
effectiveness in a shorter period of time than a pervasive, company-
level control, such as any of those described in paragraphs 52 and 53 
of Auditing Standard No. 2. Additionally, the auditor typically will be 
able to obtain sufficient evidence as to the operating effectiveness of 
controls over the company's period-end financial reporting process only 
by testing those controls in connection with a period-end.
    34. The auditor should determine whether, based on the nature of 
the material weakness, performing substantive procedures to support 
recorded financial statement amounts or disclosures affected by the 
specifically identified controls is necessary to obtain sufficient 
evidence regarding the operating effectiveness of those controls. For 
example, a material weakness in the

[[Page 77606]]

company's controls over the calculation of its bad debt reserve 
ordinarily would require that the auditor also perform substantive 
procedures to obtain sufficient evidence supporting an opinion about 
whether the material weakness continues to exist as of a specified 
date. In this circumstance, in addition to testing the design and 
operating effectiveness of the controls specifically identified as 
achieving the company's stated control objective that its bad debt 
reserve is reasonably estimated and recorded, the auditor ordinarily 
would need to perform substantive procedures to determine that, as of 
that same specified date, the company's bad debt reserve was fairly 
stated in relation to the company's financial statements taken as a 
whole.
    35. When the specified controls, stated control objectives, and 
material weakness affect multiple locations or business units of the 
company, the auditor may apply the relevant concepts in paragraphs B1 
through B13 of Appendix B of Auditing Standard No. 2 to determine the 
locations or business units at which to perform procedures.
Using the Work of Others
    36. The auditor should evaluate whether to use the work performed 
by others in an engagement to report on whether a previously reported 
material weakness continues to exist. To determine the extent to which 
the auditor may use the work of others to alter the nature, timing, or 
extent of the work the auditor otherwise would have performed, the 
auditor should apply paragraphs 109 through 115 and 117 through 125 of 
Auditing Standard No. 2.
    37. The auditor's opinion relates to whether a material weakness no 
longer exists at the company because the stated control objective(s) is 
met. Therefore, if the auditor has been engaged to report on more than 
one material weakness or on more than one stated control objective, the 
auditor must evaluate whether he or she has obtained the principal 
evidence that the control objectives related to each of the material 
weaknesses identified in management's assertion are achieved. The 
auditor may, however, use the work of others to alter the nature, 
timing, or extent of the work he or she otherwise would have performed. 
For these purposes, the work of others includes relevant work performed 
by internal auditors, company personnel (in addition to internal 
auditors), and third parties working under the direction of management 
or the audit committee that provide information about the effectiveness 
of internal control over financial reporting.
    38. Paragraph 122 of Auditing Standard No. 2 should be applied in 
the context of the engagement to report on whether a previously 
reported material weakness continues to exist. Paragraph 122 states, in 
part, ``As the significance of the factors listed in paragraph 112 
increases, the ability of the auditor to use the work of others 
decreases at the same time that the necessary level of competence and 
objectivity of those who perform the work increases.'' There may, 
therefore, be some circumstances in which the scope of the audit 
procedures to be performed in this engagement will be so limited that 
using the work of others will not provide any tangible benefit to the 
company or its auditor. Additionally, the auditor should perform any 
walkthroughs himself or herself because of the degree of judgment 
required in performing this work.

    Note: The requirement described in paragraph 26b of this 
standard for the auditor to perform a walkthrough applies only to an 
auditor who did not complete an audit of internal control over 
financial reporting as of the company's most recent annual 
assessment. An auditor who has rendered an opinion on the 
effectiveness of the company's internal control over financial 
reporting in accordance with Auditing Standard No. 2 as of the 
company's most recent annual assessment is not required to perform a 
walkthrough as part of this engagement.

    39. The following example illustrates how to apply this section on 
using the work of others to this engagement.

    In this example, the company's previously reported material 
weakness relates to the company's failure to perform bank 
reconciliations at its 50 subsidiaries. The specified controls 
identified by the company are the timely preparation of complete and 
accurate reconciliations between the company's recorded cash 
balances and the company's cash balances as reported by its 
financial institution.
    Although certain controls over bank reconciliations are 
centralized, the performance of the bank reconciliations themselves 
is not centralized because they occur at each individual operating 
unit. Further, each operating unit has, on average, three separate 
cash accounts. The cash accounts affected are not material 
individually but are material in the aggregate. Most of the controls 
over the preparation of bank reconciliations involve a low degree of 
judgment in evaluating their operating effectiveness, can be 
subjected to objective testing, and have a low potential for 
management override.
    If these conditions describe the specified controls over the 
preparation of bank reconciliations, the auditor could determine 
that, based on the nature of the controls as described above, he or 
she could use the work of others to a moderate extent, provided that 
the degree of competence and objectivity of the individuals 
performing the tests is high. The auditor might perform tests of 
controls that are centralized at the holding company level himself 
or herself; perform testing at a limited number of locations himself 
or herself; test the work of others performed at a limited number of 
other locations; review the results of the work of others at all 
other locations tested; and determine that, qualitatively and 
quantitatively, principal evidence had been obtained.
    On the other hand, if the company's previously reported material 
weakness related to the company's failure to perform a 
reconciliation of its only cash account, few controls and few 
operations of those controls would underlie management's assertion 
that the material weakness no longer exists. In this circumstance, 
it is unlikely that the auditor would be able to use a significant 
amount of the work of others because of the limited scope of the 
total amount of work needed to test management's assertion and due 
to the requirement that the auditor obtain the principal evidence 
himself or herself.


    Note: The examples provided in paragraph 126 of Auditing 
Standard No. 2 illustrate how to apply the requirements in Auditing 
Standard No. 2 regarding using the work of others in an audit of 
internal control over financial reporting. Because of the 
differences between the auditor obtaining the principal evidence 
supporting an opinion on the effectiveness of internal control over 
financial reporting overall and supporting an opinion on the much 
narrower subject of whether a specified material weakness in 
internal control over financial reporting continues to exist, the 
examples in Auditing Standard No. 2 may not illustrate the 
appropriate application of using the work of others in this narrower 
engagement. For instance, the examples in paragraph 126 of Auditing 
Standard No. 2 suggest that, for certain controls, the auditor could 
potentially use the work of others in its entirety. However, in most 
cases, the auditor could not solely use the work of others for a 
control specified in management's assertion regarding a material 
weakness no longer existing and, at the same time, obtain the 
principal evidence supporting his or her opinion. As another 
example, Auditing Standard No. 2 describes an example of 
appropriately alternating tests of controls. Alternating tests of 
controls is applicable only in the context of a recurring 
engagement, which is not the context for the auditor's reporting on 
whether a previously reported material weakness continues to exist.

Opinions, Based in Part, on the Work of Another Auditor
    40. The auditor may apply the relevant concepts in AU sec. 543, 
Part of Audit Performed by Other Independent Auditors, in an engagement 
to report on whether a previously reported material weakness continues 
to exist, with the following exception. If the auditor decides to serve

[[Page 77607]]

as the principal auditor and to use the work and reports of another 
auditor as a basis, in part, for his or her opinion, the principal 
auditor must not divide responsibility for the engagement with the 
other auditor. Therefore, the principal auditor must not make reference 
to the other auditor in his or her report.
Forming an Opinion on Whether a Previously Reported Material Weakness 
Continues to Exist
    41. When forming an opinion on whether a previously reported 
material weakness continues to exist, the auditor should evaluate all 
evidence obtained from all sources. This process should include an 
evaluation of the sufficiency of the evidence obtained by management 
and the results of the auditor's evaluation of the design and operating 
effectiveness of the specified controls.
    42. Management may conclude that a previously reported material 
weakness no longer exists because it has been reduced to a significant 
deficiency. If management does not plan to correct the significant 
deficiency within a reasonable period of time, the auditor should 
evaluate whether the remaining significant deficiency could be 
indicative of a material weakness in internal control over financial 
reporting. Under paragraph 140 of Auditing Standard No. 2, a 
significant deficiency not corrected after some reasonable period of 
time is a strong indicator of a material weakness. Because the auditor 
is not required to provide an opinion under this voluntary engagement, 
the auditor could reasonably decline to provide an opinion under such 
circumstances.
    43. The auditor may issue an opinion on whether a previously 
reported material weakness continues to exist only when there have been 
no restrictions on the scope of the auditor's work. Because of the 
scope of an engagement to report on whether a previously reported 
material weakness continues to exist, any limitations on the scope of 
the auditor's work require the auditor either to disclaim an opinion or 
to withdraw from the engagement. A qualified opinion is not permitted.

    Note: As described in paragraph 51 of this standard, the 
auditor's opinion on whether a previously reported material weakness 
continues to exist may be expressed as ``the material weakness 
exists'' or ``the material weakness no longer exists.'' Therefore, 
the provisions of this standard do not distinguish between an 
unqualified opinion and an adverse opinion and, instead, refer 
simply to ``an opinion'' or ``the auditor's opinion.''

Requirement for Written Representations
    44. In an engagement to report on whether a previously reported 
material weakness continues to exist, the auditor should obtain written 
representations from management:
    a. Acknowledging management's responsibility for establishing and 
maintaining effective internal control over financial reporting;
    b. Stating that management has evaluated the effectiveness of the 
specified controls using the specified control criteria and 
management's stated control objective(s);
    c. Stating management's assertion that the specified controls are 
effective in achieving the stated control objective(s) as of a 
specified date;
    d. Stating management's assertion that the identified material 
weakness no longer exists as of the same specified date;
    e. Stating that management believes that its assertions are 
supported by sufficient evidence;
    f. Describing any material fraud and any other fraud that, although 
not material, involves senior management or management or other 
employees who have a significant role in the company's internal control 
over financial reporting and that has occurred or come to management's 
attention since the date of management's most recent annual assessment 
of internal control over financial reporting; and
    g. Stating whether there were, subsequent to the date being 
reported on, any changes in internal control over financial reporting 
or other factors that might significantly affect the stated control 
objective(s) or indicate that the identified controls were not 
operating effectively as of, or subsequent to, the date specified in 
management's assertion.
    45. The written representations should be signed by those members 
of management with overall responsibility for the company's internal 
control over financial reporting whom the auditor believes are 
responsible for and knowledgeable about, directly or through others in 
the organization, the matters covered by the representations. Such 
members of management ordinarily include the chief executive officer 
and chief financial officer or others with equivalent positions in the 
company.
    46. The failure to obtain written representations from management, 
including management's refusal to furnish them, constitutes a 
limitation on the scope of the engagement. As discussed further in 
paragraph 43 of this standard, if there is a limitation on the scope of 
an engagement to report on whether a previously reported material 
weakness continues to exist, the auditor must either disclaim an 
opinion or withdraw from the engagement. Further, the auditor should 
evaluate the effects of management's refusal on his or her ability to 
rely on other representations of management, including, if applicable, 
representations obtained in an audit of the company's financial 
statements.
Documentation Requirements
    47. The documentation requirements in Auditing Standard No. 3, 
Audit Documentation, are modified in the following respect as they 
apply to this engagement. Paragraph 14 of Auditing Standard No. 3 
defines the report release date as the date the auditor grants 
permission to use the auditor's report in connection with the issuance 
of the company's financial statements. As described in paragraph 29 of 
this standard, management's assertion that a material weakness no 
longer exists may be made as of a date other than a period-end 
financial reporting date. Therefore, the auditor's release of a report 
on whether a previously reported material weakness continues to exist 
may not necessarily be associated with the issuance of financial 
statements of the company. Accordingly, in an engagement to report on 
whether a previously reported material weakness continues to exist, the 
report release date for purposes of applying Auditing Standard No. 3 is 
the date the auditor grants permission to use the auditor's report on 
whether a previously reported material weakness continues to exist.
Reporting on Whether a Previously Reported Material Weakness Continues 
To Exist
    Management's Report.
    48. As a condition for the auditor's performance of this voluntary 
engagement, management is required to present a written report that 
will accompany the auditor's report, as described in paragraph 7e of 
this standard. To satisfy this condition for the auditor's performance 
of this engagement, management's report should include:
    a. A statement of management's responsibility for establishing and 
maintaining effective internal control over financial reporting for the 
company;
    b. A statement identifying the control criteria used by management 
to conduct the required annual assessment of the effectiveness of the 
company's internal control over financial reporting;

[[Page 77608]]

    c. An identification of the material weakness that was identified 
as part of management's annual assessment;

    Note: This report element should be modified in the case in 
which management's annual assessment did not identify the material 
weakness, but, rather, only the auditor's report on management's 
annual assessment identified the material weakness.

    d. An identification of the control objective(s) addressed by the 
specified controls and a statement that the specified controls achieve 
the stated control objective(s) as of a specified date; and
    e. A statement that the identified material weakness no longer 
exists as of the same specified date because the specified controls 
address the material weakness.
Auditor's Evaluation of Management's Report
    49. With respect to management's report, the auditor should 
evaluate the following matters:
    a. Whether management has properly stated its responsibility for 
establishing and maintaining effective internal control over financial 
reporting;
    b. Whether the control criteria used by management to conduct the 
evaluation is suitable;
    c. Whether the material weakness, stated control objectives, and 
specified controls have been properly described; and
    d. Whether management's assertions, as of the date specified in 
management's report, are free of material misstatement.
    50. If, based on the results of this evaluation, the auditor 
determines that management's report does not include the elements 
described in paragraph 48 of this standard, the conditions for 
engagement performance have not been met.
Auditor's Report
    51. The auditor's report on whether a previously reported material 
weakness continues to exist must include the following elements:
    a. A title that includes the word independent;
    b. A statement that the auditor has previously audited and reported 
on management's annual assessment of internal control over financial 
reporting as of a specified date based on the control criteria, as well 
as a statement that the auditor's report identified a material 
weakness;

    Note: This report element should be modified in cases in which a 
successor auditor's performance of this engagement is occurring 
before he or she has opined on the effectiveness of internal control 
over financial reporting overall in accordance with Auditing 
Standard No. 2. In this circumstance, the auditor's report should 
refer to the predecessor auditor's report on management's annual 
assessment and the predecessor auditor's identification of the 
material weakness.

    c. A description of the material weakness;
    d. An identification of management's assertion that the identified 
material weakness in internal control over financial reporting no 
longer exists;
    e. An identification of the management report that includes 
management's assertion, such as identifying the title of the report (if 
the report is titled);
    f. A statement that management is responsible for its assertion;
    g. An identification of the specific controls that management 
asserts address the material weakness;

    Note: As discussed further in paragraph 31, all controls that 
are necessary to achieve the stated control objective should be 
identified.

    h. An identification of the company's stated control objective that 
is achieved by these controls;
    i. A statement that the auditor's responsibility is to express an 
opinion on whether the material weakness continues to exist as of the 
date of management's assertion based on his or her auditing procedures;
    j. A statement that the engagement was conducted in accordance with 
the standards of the Public Company Accounting Oversight Board (United 
States);
    k. A statement that the standards of the Public Company Accounting 
Oversight Board require that the auditor plan and perform the 
engagement to obtain reasonable assurance about whether a previously 
reported material weakness continues to exist at the company;
    l. A statement that the engagement includes examining evidence 
supporting management's assertion and performing such other procedures 
the auditor considered necessary in the circumstances and that the 
auditor obtained an understanding of internal control over financial 
reporting as part of his or her previous audit of management's annual 
assessment of internal control over financial reporting and updated 
that understanding as it specifically relates to changes in internal 
control over financial reporting associated with the material weakness;

    Note: This report element should be modified in cases in which a 
successor auditor's performance of this engagement is occurring 
before he or she has opined on the effectiveness of internal control 
over financial reporting overall in accordance with Auditing 
Standard No. 2. In this circumstance, the auditor's report should 
include a statement that the engagement includes obtaining an 
understanding of internal control over financial reporting, 
examining evidence supporting management's assertion, and performing 
such other procedures as the auditor considered necessary in the 
circumstances.

    m. A statement that the auditor believes the auditing procedures 
provide a reasonable basis for his or her opinion;
    n. The auditor's opinion on whether the identified material 
weakness exists (or no longer exists) as of the date of management's 
assertion;
    o. A paragraph that includes the following statements:
     That the auditor was not engaged to and did not conduct an 
audit of internal control over financial reporting as of the date of 
management's assertion, the objective of which would be the expression 
of an opinion on the effectiveness of internal control over financial 
reporting, and that the auditor does not express such an opinion, and
     That the auditor has not applied auditing procedures 
sufficient to reach conclusions about the effectiveness of any controls 
of the company as of any date after the date of management's annual 
assessment of the company's internal control over financial reporting, 
other than the controls specifically identified in the auditor's 
report, and that the auditor does not express an opinion that any other 
controls operated effectively after the date of management's annual 
assessment of the company's internal control over financial reporting.

    Note: This report element statement should be modified in the 
case in which a successor auditor's performance of this engagement 
is occurring before he or she has opined on the effectiveness of 
internal control over financial reporting overall in accordance with 
Auditing Standard No. 2 to read as follows: That the auditor has not 
applied auditing procedures sufficient to reach conclusions about 
the effectiveness of any controls of the company other than the 
controls specifically identified in the auditor's report and that 
the auditor does not express an opinion that any other controls 
operated effectively.

    p. A paragraph stating that, because of its inherent limitations, 
internal control over financial reporting may not prevent or detect 
misstatements and that projections of any evaluation of the 
effectiveness of specific controls or internal control over financial 
reporting overall to future periods are subject to the risk that 
controls may become inadequate because of changes in conditions, or 
that the degree of compliance with the policies or procedures may 
deteriorate;

[[Page 77609]]

    q. The manual or printed signature of the auditor's firm;
    r. The city and state (or city and country, in the case of non-U.S. 
auditors) from which the auditor's report has been issued; and
    s. The date of the auditor's report.
    52. Example A-1 in Appendix A is an illustrative auditor's report 
for an opinion that a material weakness no longer exists, expressed by 
an auditor who has previously reported on the company's internal 
control over financial reporting in accordance with Auditing Standard 
No. 2 as of the company's most recent year-end (herein after referred 
to as a continuing auditor). Example A-2 in Appendix A is an 
illustrative auditor's report for an opinion that a material weakness 
no longer exists expressed by a successor auditor.
    53. As stated in paragraph 3 of this standard, the auditor may 
report on more than one previously reported material weakness as part 
of the same engagement. In this circumstance, the auditor should modify 
the report elements described in paragraph 51 of this standard 
accordingly.
    54. Report modifications. The auditor should modify the standard 
report if any of the following conditions exist.
    a. Other material weaknesses that were reported previously by the 
company as part of the company's annual assessment of internal control 
are not addressed by the auditor's opinion. (See paragraph 56 of this 
standard.)
    b. A significant subsequent event has occurred since the date being 
reported on. (See paragraphs 57 and 58 of this standard.)
    c. Management's report on whether a material weakness continues to 
exist includes additional information. (See paragraphs 59 through 60 of 
this standard.)
    55. As described further in paragraph 43 of this standard, the form 
of the auditor's report resulting from an engagement to report on 
whether a previously reported material weakness continues to exist may 
be an opinion on whether a material weakness continues to exist, or it 
may be in the form of a disclaimer of opinion. A qualified opinion is 
not permitted. Any limitations on the scope of the auditor's work 
preclude the expression of an opinion. In addition to these reporting 
alternatives, an auditor may elect not to report on whether a material 
weakness continues to exist and, instead, withdraw from the engagement.
    56. Other material weaknesses reported previously by the company as 
part of the company's annual assessment of internal control are not 
addressed by the auditor's opinion. In the circumstance in which the 
company previously has reported more than one material weakness, the 
auditor may be engaged to report on whether any or all of the material 
weaknesses continue to exist. If the auditor reports on fewer than all 
of the previously reported material weaknesses, the auditor should 
include the following or similar language in the paragraph that states 
that the auditor was not engaged to perform an audit of internal 
control over financial reporting. When referring to his or her 
previously issued report on management's annual assessment, the auditor 
should either attach that report or include information about where it 
can be publicly obtained.

    Our report on management's annual assessment of XYZ Company's 
internal control over financial reporting, dated [date of report], 
[attached or identify location of where the report is publicly 
available] identified additional material weaknesses other than the one 
identified in this report. We are not reporting on those other material 
weaknesses and, accordingly, express no opinion regarding whether those 
material weaknesses continue to exist after [date of management's 
annual assessment, e.g., December 31, 200X]. [Revise this wording and 
references or attachments appropriately for use in a successor 
auditor's report.]
    Example A-3 in Appendix A is an illustrative report issued by a 
continuing auditor reporting on only one material weakness when 
additional material weaknesses previously were reported.
    57. Subsequent events. A change in internal control over financial 
reporting or other factors that might significantly affect the 
effectiveness of the identified controls or the achievement of the 
company's stated control objective might occur subsequent to the date 
of management's assertion but before the date of the auditor's report. 
Therefore, the auditor should inquire of management whether there was 
any such change or factors. As described in paragraph 44 of this 
standard, the auditor should obtain written representations from 
management regarding such matters. Additionally, to obtain information 
about whether such a change has occurred that might affect the 
effectiveness of the identified controls or the achievement of the 
company's stated control objective and, therefore, the auditor's 
report, the auditor should inquire about and examine, for this 
subsequent period, the following:
     Internal audit reports (or similar functions, such as loan 
review in a financial institution) relevant to the stated control 
objective or identified controls issued during the subsequent period;
     Independent auditor reports (if other than the auditor's) 
of significant deficiencies or material weaknesses relevant to the 
stated control objective or identified controls;
     Regulatory agency reports on the company's internal 
control over financial reporting relevant to the stated control 
objective or identified controls; and
     Information about the effectiveness of the company's 
internal control over financial reporting relevant to the stated 
control objective or identified controls obtained as a result of other 
engagements.
    58. If the auditor obtains knowledge about subsequent events that 
he or she believes adversely affect the effectiveness of the identified 
controls or the achievement of the stated control objective as of the 
date specified in management's assertion, the auditor should follow the 
requirements in paragraph 61 regarding special considerations when a 
material weakness continues to exist. If the auditor is unable to 
determine the effect of the subsequent event on the effectiveness of 
the identified controls or the achievement of the stated control 
objective, the auditor should disclaim an opinion.
    59. Management's report includes additional information. If 
management's report includes information in addition to the matters 
described in paragraph 48 of this standard, the auditor should disclaim 
an opinion on the additional information. For example, the auditor 
should use the following or similar language as the last paragraph of 
the report to disclaim an opinion on management's plans to implement 
new controls:

    We do not express an opinion or any other form of assurance on 
management's statement referring to its plans to implement new 
controls by the end of the year.

    60. If the auditor believes that management's additional 
information contains a material misstatement of fact, he or she should 
discuss the matter with management. If, after discussing the matter 
with management, the auditor concludes that a material misstatement of 
fact remains, the auditor should notify management and the audit 
committee, in writing, of the auditor's views concerning the 
information.

    Note: If management makes the types of disclosures described in 
paragraph 59

[[Page 77610]]

outside its report on whether a previously reported material 
weakness continues to exist and includes them elsewhere within a 
document that contains management's and the auditor's reports on 
whether a previously reported material weakness continues to exist, 
the auditor would not need to disclaim an opinion, as described in 
paragraph 59. However, in that situation, the auditor's 
responsibilities are the same as those described in this paragraph 
if the auditor believes that the additional information contains a 
material misstatement of fact.

Special Considerations When a Previously Reported Material Weakness 
Continues to Exist
    61. If the auditor determines that the previously reported material 
weakness continues to exist and the auditor reports on the results of 
the engagement, he or she must express an opinion that the material 
weakness exists as of the date specified by management.
    62. As described in paragraph 55, the auditor is not required to 
issue a report as a result of this engagement. If the auditor does not 
issue a report in this circumstance, he or she must communicate, in 
writing, his or her conclusion that the material weakness continues to 
exist to the audit committee. Similarly, if the auditor identifies a 
material weakness during this engagement that has not been previously 
communicated to the audit committee in writing, the auditor must 
communicate that material weakness, in writing, to the audit committee.
    63. Additionally, whenever the auditor concludes that a previously 
reported material weakness continues to exist, the auditor must 
consider that conclusion as part of his or her evaluation of 
management's quarterly disclosures about internal control over 
financial reporting, as required by paragraphs 202 through 206 of 
Auditing Standard No. 2.
    64. For example, if the auditor were engaged to report on whether 
two separate material weaknesses continue to exist and concluded that 
one no longer exists and one continues to exist, the auditor's report 
could comprise either of the following: (1) A report that contained two 
opinions, one on the material weakness that the auditor concluded no 
longer exists and one opinion on the material weakness that the auditor 
concluded continues to exist, or (2) a report that contained only a 
single opinion on the material weakness that the auditor concluded no 
longer exists if the company modifies its assertion to address only the 
material weakness that the auditor concluded no longer exists. In the 
second circumstance, the auditor must communicate, in writing, his or 
her conclusion that a material weakness continues to exist to the audit 
committee and also should apply paragraph 56 of this standard regarding 
other material weaknesses reported previously that are not addressed by 
the auditor's opinion. Additionally, the auditor must consider that 
conclusion as part of his or her evaluation of management's quarterly 
disclosures about internal control over financial reporting, as 
required by paragraphs 202 through 206 of Auditing Standard No. 2.
Effective Date
    65. This standard is effective [insert date of SEC approval].

Appendix A--Illustrative Reports on Whether a Previously Reported 
Material Weakness Continues to Exist

    Paragraphs 51 through 60 of this standard provide direction on the 
auditor's report on whether a previously reported material weakness 
continues to exist. The following examples illustrate the application 
of those paragraphs.
Example A-1--Illustrative Auditor's Report for a Continuing Auditor 
Expressing an Opinion that a Previously Reported Material Weakness No

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.