On July 25, 2007, the Securities and Exchange Commission (SEC) announced that it approved a new auditing standard designed to improve the implementation of Section 404 of the Sarbanes-Oxley Act of 2002. Specifically, the SEC approved the Public Company Accounting Oversight Board’s (PCAOB) proposed Auditing Standard No. 5 (Auditing Standard No. 5) and adopted a definition of “significant deficiency” in an effort to improve the accuracy of financial reports while reducing unnecessary costs, particularly for smaller public companies. Auditing Standard No. 5 is effective for audits of internal control over financial reporting required by Section 404 for fiscal years ending on or after November 15, 2007, however, early adoption is permitted. Auditing Standard No. 5 will supersede Auditing Standard No. 2 when it becomes effective.
The stated goal of Auditing Standard No. 5 is to increase the likelihood that material weaknesses in internal control over financial reporting will be found before they result in material misstatement of a company’s financial statements while allowing the auditor to tailor the audit to the company’s facts and circumstances. To achieve this goal, Auditing Standard No. 5 has the following four primary objectives:
Auditing Standard No. 5 is designed to be less prescriptive than the existing standard. The mandatory requirements have been significantly reduced such that auditors can focus on risk and materiality and not on rote compliance with a rulebook.
Auditing Standard No. 5 provides guidance on making the audit scalable to fit the size and complexity of any company, with particular attention paid to explaining how the principles should be applied to smaller or less complex companies. A company’s internal control systems won’t have to be designed with the goal of fitting the audit standard but instead to improve the quality of the financial statements.
Auditing Standard No. 5 directs auditors to focus on those areas that present the highest risk and allows auditors to use knowledge accumulated in previous years’ audits to reduce testing. This approach should eliminate unnecessary procedures and those designed to find deficiencies that don’t constitute material weaknesses.
Auditing Standard No. 5 includes a principles-based approach that allows auditors to apply professional judgment in determining the extent to which they will use the work of others. The auditor’s consideration of the objectivity and competence of those performing the work are the most important factors in this approach.
The Commission also adopted a definition of "significant deficiency," which is now defined as "a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant’s financial reporting.” The definition was adopted in an attempt to address uncertainties stemming from the previous definition which was defined only by reference to auditing literature.
Lastly, the Commission approved PCAOB Rule 3525, which requires auditors to seek audit committee pre-approval for internal control related non-audit services. PCAOB Rule 3525 also prescribes the steps auditors must take in seeking pre-approval including: a written description of the scope of the proposed service; a discussion of the potential effects of the proposed service on the firm’s independence; and documentation of the substance of the firm’s discussion. This Rule is consistent with the purposes of Auditing Standard No. 5 in allowing companies to further control costs incurred by auditors.