statement about the use of walkthroughs to determine whether controls
have been implemented. Auditing Standard No. 12 has been revised to
include a statement that walkthroughs that include the procedures
described in the standard ordinarily are sufficient to determine
whether a control has been implemented.\243\ Under Auditing Standard
No. 12, as under AU sec. 319,\244\ the amount of audit attention
devoted to design and operating effectiveness will vary based on the
auditor's plan for testing controls. For example, if the auditor plans
to test controls, more attention should be devoted to controls that the
auditor plans to test.
---------------------------------------------------------------------------

    \243\ Paragraph 20 of Auditing Standard No. 12.
    \244\ AU sec. 319.58.
---------------------------------------------------------------------------

(i). Obtaining an Understanding of Individual Components of Internal
Control Over Financial Reporting
    To describe the auditor's responsibilities for obtaining an
understanding of internal control, it was necessary to describe the
components of internal control over financial reporting. The components
described in Auditing Standard No. 12 are similar to those in AU sec.
319.\245\ Auditing Standard No. 12 also states that auditors may use
other suitable, recognized frameworks \246\ in accordance with the
provisions of the standard. If the auditor uses a suitable, recognized
internal control framework with components that differ from those in
the standard, the auditor should adapt the requirements in the standard
for the components in the framework used.\247\
---------------------------------------------------------------------------

    \245\ Paragraph 21 of Auditing Standard No. 12.
    \246\ See Securities Exchange Act Release No. 34-47986 (June 5,
2003) for a description of the characteristics of a suitable,
recognized framework.
    \247\ Paragraph 22 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(ii). Control Environment
    Auditing Standard No. 12 requires the auditor to assess the
following matters as part of obtaining an understanding of the control
environment:
     Whether management's philosophy and operating style
promote effective internal control over financial reporting;
     Whether sound integrity and ethical values, particularly
of top management, are developed and understood; and
     Whether the board or audit committee understands and
exercises oversight responsibility over financial reporting and
internal control.\248\
---------------------------------------------------------------------------

    \248\ Paragraph 24 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Although this requirement is aligned with a similar requirement in
Auditing Standard No. 5 for evaluating the control environment, the
auditor's process for assessing the control environment in an audit of
financial statements only is not expected to be the same as that
required when expressing an opinion on internal control over financial
reporting. For audits of financial statements only, Auditing Standard
No. 12 allows the auditor to base his or her assessment on evidence
obtained as part of obtaining an understanding of the control
environment and other relevant knowledge possessed by the auditor.\249\
---------------------------------------------------------------------------

    \249\ Ibid.
---------------------------------------------------------------------------

    Because of the importance of an effective control environment to
address fraud risks, Auditing Standard No. 12 states that if the
auditor identifies a control deficiency in the company's control
environment, the auditor should evaluate the extent to which this
control deficiency is indicative of a fraud risk factor.\250\
---------------------------------------------------------------------------

    \250\ Paragraph 25 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iii) The Company's Risk Assessment Process
    Auditing Standard No. 12 requires the auditor to obtain an
understanding of management's risk assessment process for (a)
identifying risks relevant to financial reporting objectives, including
risks of material misstatement due to fraud, (b) assessing the
likelihood and significance of misstatements resulting from those
risks, and (c) deciding about

actions to address those risks.\251\ The standard also requires the
auditor to obtain an understanding of the risks of material
misstatement identified and assessed by management and the actions
taken to address those risks.\252\ Compliance with these requirements
will help make sure that the auditor's risk assessments are
appropriately informed by management's risk assessments and the
controls that management put in place to address the risks.
---------------------------------------------------------------------------

    \251\ Paragraph 26 of Auditing Standard No. 12.
    \252\ Paragraph 27 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iv) Information and Communication
    The reproposed standard required the auditor to obtain an
understanding of the information system, including the related business
processes, relevant to financial reporting. One commenter suggested
removing the requirement to understand the company's business
processes. The requirement was retained as reproposed.\253\ Obtaining
an understanding of the company's business processes assists the
auditor in obtaining an understanding of how transactions are
initiated, authorized, processed, and recorded. Also, the requirement
to understand business processes is a recommendation in the PAE
Report.\254\ Auditing Standard No. 12 describes the necessary
understanding of business processes to help auditors identify those
business processes that are relevant to financial reporting.\255\
---------------------------------------------------------------------------

    \253\ Paragraph 28 of Auditing Standard No. 12.
    \254\ PAE Report, p. 15.
    \255\ Paragraphs 28-32 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 also contains requirements for
understanding the period-end financial reporting process \256\ and
describes important elements of that process.\257\ Because the period-
end financial reporting process is a common source of potential
misstatements, it is important for the auditor to have an adequate
understanding of the aspects of the period-end financial reporting
process in all audits, including audits of financial statements only.
Auditing Standard No. 12 requires the auditor only to obtain an
understanding \258\ of the process, as compared to Auditing Standard
No. 5, which requires the auditor also to evaluate that process in the
audit of internal control.
---------------------------------------------------------------------------

    \256\ AU sec. 319.49 used the term ``financial reporting process
used to prepare the entity's financial statements,'' but Auditing
Standard No. 12 uses the same term as used in Auditing Standard No.
5.
    \257\ Paragraphs 28 and 32 of Auditing Standard No. 12.
    \258\ Paragraph 20 of Auditing Standard No. 12 discusses
procedures that the auditor performs to obtain an understanding of
internal control.
---------------------------------------------------------------------------

    To appropriately highlight the importance of IT risks in
determining the scope of the audit, the standard requires the auditor
to obtain an understanding of how IT affects the company's flow of
transactions. The standard also contains a note that states that the
identification of risks and controls within IT is not a separate
evaluation. Instead, it is an integral part of the approach used to
identify significant accounts and disclosures and their relevant
assertions and, when applicable, to select the controls to test, as
well as to assess risk and allocate audit effort.
    Regarding the auditor's understanding of communication, one
commenter suggested that the standard clarify that the auditor should
understand how the company communicates financial reporting roles and
responsibilities and significant matters relating to financial
reporting. The requirement in Auditing Standard No. 12 has been revised
to clarify that point.\259\
---------------------------------------------------------------------------

    \259\ Paragraph 33 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(v) Control Activities
    The reproposed standard required the auditor to obtain an
understanding of control activities that is sufficient to assess the
factors that affect the risks of material misstatement and to design
further audit procedures. As under AU sec. 319, a more extensive
understanding of control activities is needed in areas in which the
auditor plans to test controls. Thus, for purposes of evaluating the
effectiveness of internal control over financial reporting in an
integrated audit, the auditor's understanding of control activities
encompasses a broader range of accounts and disclosures than that which
is normally obtained in an audit of financial statements only.
    Some commenters expressed concern that the language in the
requirement could be misinterpreted as requiring the auditor to obtain
an understanding of all controls, even in an audit of financial
statements only in which the auditor does not plan to test controls. A
few commenters suggested framing the requirement in terms of
understanding control activities relevant to the audit.
    The Board did not intend to expand the auditor's responsibilities
for obtaining an understanding of control activities beyond what is
required in AU sec. 319. The discussion in Auditing Standard No. 12 on
obtaining an understanding of control activities has been revised,
primarily using language adapted from AU sec. 319, to clarify that the
substance of the requirement has not changed.\260\
---------------------------------------------------------------------------

    \260\ AU sec. 319.42 and paragraph 34 of Auditing Standard No.
12.
---------------------------------------------------------------------------

(vi). Performing Walkthroughs
    The original proposed standard referred auditors to Auditing
Standard No. 5 for a discussion of the performance of walkthroughs.
Some commenters on the original proposed standard stated that the
standard should include a discussion of walkthroughs rather than
referring to Auditing Standard No. 5. The reproposed standard included
a discussion of performing walkthroughs as part of meeting certain
specified objectives, which paralleled a requirement in Auditing
Standard No. 5 \261\ regarding understanding likely sources of
potential misstatements. Some commenters expressed concerns that the
discussion would lead to unnecessary walkthroughs, particularly in
audits of financial statements only.
---------------------------------------------------------------------------

    \261\ Paragraph 34 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    The intention of including the discussion of walkthroughs was to
explain how to perform walkthroughs rather than to impose requirements
regarding when walkthroughs should be performed. The standard has been
revised to focus on how the auditor should perform walkthroughs, e.g.,
in connection with understanding the flow of transactions in the
information system relevant to financial reporting, evaluating the
design of controls relevant to the audit, and determining whether those
controls have been implemented.\262\ The discussion of the objectives
for understanding likely sources of potential misstatements has been
removed from Auditing Standard No. 12, so those objectives would
continue to apply only to integrated audits.
---------------------------------------------------------------------------

    \262\ Paragraph 37 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(vii). Relationship of Understanding of Internal Control to Tests of
Controls
    Auditing Standard No. 12, like the reproposed standard, contains a
discussion about the relationship between obtaining an understanding of
controls and testing controls, including entity-level controls.\263\
The requirements in Auditing Standard No. 12 clarify that the objective
of obtaining an understanding of internal control as a risk assessment
procedure is different from testing controls for the purpose of
assessing control risk \264\ or for the purpose of expressing an
opinion on internal control over financial reporting

in the audit of internal control.\265\ The standard allows the auditor
the flexibility of obtaining an understanding of internal control
concurrently with performing tests of controls if he or she obtains
sufficient appropriate evidence to achieve the objectives of both
procedures.\266\
---------------------------------------------------------------------------

    \263\ Paragraph 39 of Auditing Standard No. 12.
    \264\ Paragraphs 16-31 of Auditing Standard No. 13.
    \265\ Paragraph B1 of Auditing Standard No. 5.
    \266\ Paragraph 39 of Auditing Standard No. 12.
---------------------------------------------------------------------------

f. Information Obtained from Past Audits and Other Engagements
(i). Information from Past Audits
    The reproposed standard included a requirement for the auditor to
incorporate knowledge obtained during past audits into the auditor's
process for identifying risks of material misstatement. One commenter
asked for clarification of the meaning of the term ``incorporate.'' Two
commenters stated that the most important issue is to determine whether
information from past audits is still relevant.
    The term ``incorporate'' is not new and should be familiar to most
auditors. For example, it has been used in AU sec. 316 regarding the
requirement to incorporate an element of unpredictability in the audit
in response to fraud risks. The requirement in the reproposed standard
was similar to a requirement in Auditing Standard No. 5 to incorporate
knowledge obtained during past audits in subsequent year audits of
internal control.\267\ Accordingly the term has been retained in
Auditing Standard No. 12.
---------------------------------------------------------------------------

    \267\ Paragraph 57 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    Auditing Standard No. 12 also states that if the auditor plans to
limit the nature, timing, or extent of his or her risk assessment
procedures by relying on information from past audits, the auditor
should evaluate whether the prior-years' information remains relevant
and reliable.\268\
---------------------------------------------------------------------------

    \268\ Paragraph 43 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(ii). Information from Other Engagements
    The reproposed standard included a requirement for the auditor to
take into account relevant information obtained through other
engagements performed by the auditor for the company.\269\ This
requirement was intended to focus on the responsibility to take
relevant information into account in identifying and assessing risks
rather than to prescribe a particular method for obtaining that
information.
---------------------------------------------------------------------------

    \269\ PCAOB Rule 1001, Definitions of Terms Employed in Rules,
states that, when used in rules of the PCAOB, unless the context
otherwise requires, ``[t]he term `auditor' means both public
accounting firms registered with the Public Company Accounting
Oversight Board and associated persons thereof.''
---------------------------------------------------------------------------

    Some commenters suggested that the requirement should be limited to
consideration of other engagements performed by the engagement partner.
The suggested change would weaken the standard. Limiting the
consideration of information to engagements performed for the company
by the engagement partner is too narrow because it omits other
important information sources that are available to the engagement
team. Also, limiting the consideration to engagements performed by the
engagement partner is inconsistent with prior PCAOB standards. For
example, AU sec. 311.04 stated that procedures the auditor may consider
in planning an audit usually involve discussions with other firm
personnel, and includes the following example ``Discussing matters that
may affect the audit with firm personnel responsible for non-audit
services to the entity.'' Also, paragraph 03 of AU sec. 9311, Planning
and Supervision: Auditing Interpretations of Section 311, stated:

    The auditor should consider the nature of non-audit services
that have been performed. He should assess whether the services
involve matters that might be expected to affect the entity's
financial statements or the performance of the audit, for example,
tax planning or recommendations on a cost accounting system. If the
auditor decides that the performance of the non-audit services or
the information likely to have been gained from it may have
implications for his audit, he should discuss the matter with
personnel who rendered the services and consider how the expected
conduct and scope of his audit may be affected. In some cases, the
auditor may find it useful to review the pertinent portions of the
work papers prepared for the non-audit engagement as an aid in
determining the nature of the services rendered or the possible
audit implications.

    Other commenters suggested that the requirement be revised to use
more of the language from AU sec. 9311. The requirement in Auditing
Standard No. 12 \270\ has been revised as follows:
---------------------------------------------------------------------------

    \270\ Paragraph 45 of Auditing Standard No. 12.

    The auditor should obtain an understanding of the nature of the
services that have been performed for the company by the auditor or
affiliates of the firm\271\ and should take into account relevant
information obtained from those engagements in identifying risks of
material misstatement.\272\
---------------------------------------------------------------------------

    \271\ See PCAOB Rule 3501(a)(i), which defines ``affiliate of
the accounting firm.''
    \272\ Paragraph 7 of Auditing Standard No. 9.

    One commenter stated that audit firms will need to develop very
costly reporting systems to enable them to convey relevant information
about nonassurance engagements to audit engagement teams. Existing
PCAOB and SEC rules already require firms to track and report nonaudit
services provided to the company. Complying with these requirements
would mean that the audit firms have a mechanism in place to track
these services. For example, PCAOB Rules 3524 \273\ and 352 \274\
require the auditor to describe to the company's audit committee, among
other things, the scope of and the potential effect on independence of
other services provided by the firm. It is expected that the system
used to capture, track, and monitor these services for compliance with
these PCAOB independence rules would also be applicable to comply with
the requirements of Auditing Standard No. 12.
---------------------------------------------------------------------------

    \273\ PCAOB Rule 3524, Audit Committee Pre-approval of Certain
Tax Services.
    \274\ PCAOB Rule 3526, Communication With Audit Committees
Concerning Independence.
---------------------------------------------------------------------------

g. Performing Analytical Procedures
    The reproposed standard retained requirements from AU sec. 329,
Analytical Procedures, to perform analytical procedures during the
planning phase of the audit.\275\ Such analytical procedures are, in
essence, risk assessment procedures, so the respective requirements and
direction have been incorporated into Auditing Standard No. 12.\276\
One commenter stated that it is unclear whether the PCAOB intends a
change in practice regarding the execution of analytical procedures
performed as risk assessment procedures, e.g., because the requirements
in the reproposed standard discussed developing expectations and
comparing them to recorded amounts. AU sec. 329, states that analytical
procedures involve developing expectations and comparing those
expectations to recorded amounts.\277\
---------------------------------------------------------------------------

    \275\ AU secs. 329.06-.08.
    \276\ Paragraphs 46-48 of Auditing Standard No. 12.
    \277\ AU sec. 329.05.
---------------------------------------------------------------------------

    Auditing Standard No. 12 states that analytical procedures
performed as risk assessment procedures often use data that is
preliminary or data that is aggregated at a high level and that in
those instances such analytical procedures are not designed with the
level of precision necessary for substantive analytical
procedures.\278\ In those situations, the auditor's expectations in
performing analytical procedures as risk assessment procedures do not
require the same

degree of precision as substantive analytical procedures.
---------------------------------------------------------------------------

    \278\ Paragraph 48 of Auditing Standard No. 12.
---------------------------------------------------------------------------

h. Conducting a Discussion Among Engagement Team Members Regarding
Risks of Material Misstatement
    Like the reproposed standard, Auditing Standard No. 12 includes a
requirement that key engagement team members discuss (1) the company's
selection and application of accounting principles, including related
disclosure requirements and (2) the susceptibility of the company's
financial statements to material misstatement due to error or
fraud.\279\ The standard explains that key engagement team members
include the engagement partner and all engagement team members who have
significant engagement responsibilities.\280\ The term ``significant
engagement responsibilities'' should be familiar to auditors because it
is already used in AU sec. 316 regarding the appropriate assignment of
engagement team members in the overall responses to fraud risks.
---------------------------------------------------------------------------

    \279\ Paragraph 49 of Auditing Standard No. 12.
    \280\ Paragraph 50 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    One commenter stated that the requirement for participation in the
discussion among engagement team members on the reproposed standard
should be revised to use the language in ISA 315, Identifying and
Assessing the Risks of Material Misstatement through Understanding the
Entity and its Environment, so that the engagement partner makes the
determination of what needs to be reported to whom on a ``need to
know'' basis.
    The language in Auditing Standard No. 12 was retained as
reproposed. The Board believes that the discussion among engagement
team members is an important part of the auditor's risk assessment
procedures. Through its oversight activities, the Board has observed
deficiencies relating to discussions among engagement team members
regarding fraud risks, including instances in which key engagement team
members did not participate.\281\
---------------------------------------------------------------------------

    \281\ PCAOB Release 2007-001, Observations on Auditors'
Implementation of PCAOB Standards Relating to Auditors'
Responsibilities with Respect to Fraud (January 22, 2007).
---------------------------------------------------------------------------

(i). Discussion of the Potential for Material Misstatement Due to Fraud
    A number of comments were received regarding the requirements for
discussing the risks of material misstatement due to fraud.
    One commenter suggested that the standard should require the
auditor to consider using a fraud specialist. The Board believes that
this point is already covered by the requirement in Auditing Standard
No. 9 to evaluate whether a person with specialized skill or knowledge
is needed to assess risks.\282\
---------------------------------------------------------------------------

    \282\ Paragraphs 16-17 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    One commenter suggested that the requirement to discuss how the
financial statements could be materially misstated through omitting or
presenting incomplete disclosures also should include the possibility
of presenting inaccurate disclosures. The requirement has been revised
to include that topic.\283\Another commenter stated that the standard
should provide more ``guidance'' about how fraud risks relate to
disclosures. The manner in which management might intentionally omit
disclosures or present inaccurate or incomplete disclosures to commit
or conceal intentional misstatement of the financial statements
necessarily depends on the circumstances, including the incentives or
pressures and the opportunities to manipulate the financial statements.
The discussion of fraud risks required by the standard should prompt
engagement team members to consider ways in which omissions or
inaccuracies in disclosures might be involved with fraudulent financial
reporting.
---------------------------------------------------------------------------

    \283\ Paragraph 52 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Another commenter stated that the requirement for the auditor to
emphasize certain matters regarding fraud to the engagement team
members during the fraud risk discussion does not assign the
responsibility to a specific person. The requirement focuses on the
communication of important matters rather than on the person
communicating the matters. Since the engagement partner has the overall
responsibility for the audit engagement, the engagement partner is
likely to be the most appropriate person to make the communications.
However, Auditing Standard No. 12 allows the communications to be made
by another engagement team member, when appropriate.
(ii) Communication Among Engagement Team Members
    Auditing Standard No. 12 states that communication among the
engagement team members about significant matters affecting the risks
of material misstatement should continue throughout the audit,
including when conditions change. This requirement carries forward and
builds upon a requirement in AU sec. 316.\284\
---------------------------------------------------------------------------

    \284\ AU sec. 316.18.
---------------------------------------------------------------------------

i. Inquiring of the Audit Committee, Management, and Others Within the
Company About the Risks of Material Misstatement
    Like the reproposed standard, Auditing Standard No. 12 requires the
auditor to make inquiries of the audit committee, or equivalent (or its
chair), management, the internal audit function, and others within the
company who might reasonably be expected to have information that is
important to the identification and assessment of risks of material
misstatement.\285\ The requirement to inquire of others who ``might
reasonably be expected to have information'' is similar to a
requirement in AU sec. 316 for making inquiries of others about the
existence or suspicion of fraud, and it establishes a principle to
guide the auditor in determining those other persons to whom the
inquiries should be addressed.\286\
---------------------------------------------------------------------------

    \285\ Paragraph 54 of Auditing Standard No. 12.
    \286\ AU sec. 316.24.
---------------------------------------------------------------------------

(i). Inquiries Regarding Fraud Risks
    The reproposed standard also required the auditor to make inquiries
of the audit committee (or its chair), management, the internal audit
function, and others within the company about the risks of fraud.
Commenters suggested that the requirements for identifying other
individuals within the company to whom inquiries should be directed
should include determining the extent of such inquiries. Auditing
Standard No. 12 reflects the suggested revision to that requirement
because inquiries of other individuals should be designed to obtain
information relevant to identifying and assessing fraud risks.\287\
---------------------------------------------------------------------------

    \287\ Paragraph 57 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    The reproposed standard included a requirement to take into account
the fact that management is often in the best position to commit fraud
when evaluating management's responses to inquiries about fraud risks
and determining when it is necessary to corroborate management's
responses. One commenter stated that the requirement was unclear and
the use of the term ``take into account'' did not seem consistent with
the Board's explanation in the release accompanying the reproposed
standards. This requirement has been revised to clarify the requirement
and to use ``take into account'' in a manner that is consistent with
the other PCAOB standards.\288\
---------------------------------------------------------------------------

    \288\ Paragraph 58 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 requires that the auditor use his or her

knowledge of the company and its environment, as well as information
from other risk assessment procedures, to determine the nature of the
inquiries about risks of material misstatement. This requirement
carries forward and builds upon a requirement in AU sec. 316.\289\
---------------------------------------------------------------------------

    \289\ AU sec. 316.24.
---------------------------------------------------------------------------

    Auditing Standard No. 12 includes an additional required inquiry of
the internal auditor about whether he or she is aware of instances of
management override of controls and the nature and circumstances of
such overrides. Also, Auditing Standard No. 12 requires the auditor to
make inquiries of management and the audit committee, or equivalent
regarding tips or complaints about the company's financial
reporting.\290\ These required inquiries were added in light of
research indicating that many incidents of fraud are uncovered through
tips.\291\ These inquiries can provide important evidence about fraud
risks.
---------------------------------------------------------------------------

    \290\ Paragraph 56 of Auditing Standard No. 12.
    \291\ See, e.g., Association of Certified Fraud Examiners, 2008
Report to the Nation on Occupational Fraud & Abuse (2008).
---------------------------------------------------------------------------

    Auditing Standard No. 12 requires the auditor, when evaluating
management's responses to inquiries about fraud risks and determining
when it is necessary to corroborate management's responses, to take
into account the fact that management is often in the best position to
commit fraud. The standard also requires the auditor to obtain evidence
to address inconsistencies in responses to inquiries. This requirement
carries forward and builds upon a requirement in AU sec. 316.\292\
---------------------------------------------------------------------------

    \292\ AU sec. 316.27.
---------------------------------------------------------------------------

j. Identifying and Assessing the Risks of Material Misstatement
    Auditing Standard No. 12 sets forth a process for identifying and
assessing the risks of material misstatement using the information
obtained from the risk assessment procedures and other relevant
knowledge possessed by the auditor.\293\ This process involves:
---------------------------------------------------------------------------

    \293\ Under Auditing Standard No. 12, the auditor has a
responsibility to perform risk assessment procedures that provide an
appropriate basis for his or her risk assessment. Auditing Standard
No. 12 does not include the provision in the prior interim standards
that allowed the auditor to assess risk at the maximum solely for
efficiency reasons. Rather, the auditor needs to have a sufficient
understanding of the company and its environment, including its
internal control, in order to determine the risks of material
misstatement and, in turn, to design effective tests of controls and
substantive procedures.
---------------------------------------------------------------------------

     Identifying risks of misstatement using information
obtained from risk assessment procedures and considering the
characteristics of the accounts and disclosures in the financial
statements.
     Evaluating whether the identified risks relate pervasively
to the financial statements as a whole and potentially affect many
assertions.
     Evaluating the types of potential misstatements that could
result from the identified risks and the accounts, disclosures, and
assertions that could be affected. This includes evaluating how risks
at the financial statement level could affect risks at the assertion
level.
     Assessing the likelihood of misstatement, including the
possibility of multiple misstatements, and the magnitude of potential
misstatement to assess the possibility that the risk could result in
material misstatement of the financial statements. In making this
assessment, the auditor may take into account the planned degree of
reliance on controls that the auditor plans to test, if the auditor
performs tests of controls in accordance with PCAOB standards.
     Identifying significant accounts and disclosures and their
relevant assertions.
     Determining whether any of the identified and assessed
risks of material misstatement are significant risks.\294\
---------------------------------------------------------------------------

    \294\ Paragraph 59 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    One commenter suggested that the word ``material'' should be
inserted before the word ``misstatement'' in paragraph 56.a. of the
reproposed standard. No change was made to Auditing Standard No. 12
because inserting the word ``material'' would inappropriately narrow
the auditor's focus on only material risks too early in the process of
identifying and assessing risks of misstatement, i.e., before assessing
the likelihood and magnitude of potential misstatements related to the
risks.
    Commenters suggested that the standard should clarify that the
likelihood and magnitude of potential misstatements should be
considered in determining which risks are significant risks. Auditing
Standard No. 12 includes an additional requirement that states, ``To
determine whether an identified and assessed risk is a significant
risk, the auditor should evaluate whether the risk requires special
audit consideration because of the nature of the risk or the likelihood
and potential magnitude of misstatement related to the risk.'' \295\
Also, the list of factors that should be evaluated in determining which
risks are significant risks was expanded to include ``the effect of the
quantitative and qualitative risk factors discussed in paragraph 60 of
the standard [on identifying significant accounts and disclosures and
their relevant assertions] on the likelihood and potential magnitude of
misstatements.'' \296\ Including this new factor highlights the
relationship between the identification of significant accounts and
disclosures and their relevant assertions and the identification of
significant risks. Specifically, risk factors that form the basis for
identifying significant accounts and disclosures and their relevant
assertions also inform the identification of significant risks, and
significant risks affect one or more relevant assertions of significant
accounts or disclosures.
---------------------------------------------------------------------------

    \295\ Paragraph 70 of Auditing Standard No. 12.
    \296\ Paragraph 71 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Another commenter on the reproposed standard suggested that the
term ``likelihood'' be defined more in terms of reasonable possibility
as that term is used in Auditing Standard No. 5. However, that change
would be inconsistent with the requirement to assess the likelihood of
misstatements, i.e., the possibility that the risk would result in
misstatement of the financial statements.
    One commenter indicated that the requirement in the note to
paragraph 59.c. of the reproposed standard ``inappropriately infers
that the auditor should, and can, associate the risks at the financial
statement level with particular assertions in order to assess risks at
the assertion level.'' Auditing Standard No. 8 states that risks of
material misstatement at the financial statement level have a pervasive
effect on the financial statements as a whole and potentially affect
many assertions, and the standard provides examples of how risks at the
financial statement level can result in misstatements.\297\ It is
important for the auditor to take into account risks of material
misstatement at the financial statement level in order to evaluate
types of misstatements that could occur.
---------------------------------------------------------------------------

    \297\ Paragraph 6 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    Under PCAOB standards, significant accounts and disclosures and
their relevant assertions are identified based upon their risk
characteristics. Thus, the auditor needs to identify and assess the
risks in order to identify the relevant assertions of significant
accounts and disclosures in accordance with PCAOB standards. For
example, Auditing Standard No. 5 requires the auditor to identify
significant accounts and disclosures and their relevant assertions in
integrated audits.\298\ Also, AU sec. 319 required the auditor to
perform substantive procedures for the relevant assertions of
significant accounts and

disclosures for all audits of financial statements, which implicitly
required the auditor to identify those accounts, disclosures, and
assertions.\299\ Auditing Standard No. 12 imposes a more explicit
requirement on the auditor to identify significant accounts and
disclosures and their relevant assertions in all audits.
---------------------------------------------------------------------------

    \298\ Paragraph 28 of Auditing Standard No. 5.
    \299\ Ibid.
---------------------------------------------------------------------------

(i). Factors Relevant To Identifying Fraud Risks
    Auditing Standard No. 12 requires that the auditor evaluate whether
the information gathered from the risk assessment procedures indicates
that one or more fraud risk factors are present and should be taken
into account in identifying and assessing fraud risks.\300\ The
reproposed standard included a paragraph that stated that the auditor
should not assume that all of the fraud risk factors discussed in must
be observed to conclude that a fraud risk exists. Commenters suggested
that the language was not clear as to the action that auditors would
need to take to ``not assume.'' The paragraph has been revised to
clarify that all of the conditions are not required to be observed or
evident to conclude that a fraud risk exists.\301\
---------------------------------------------------------------------------

    \300\ Paragraph 65 of Auditing Standard No. 12.
    \301\ Paragraph 66 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    (ii). Consideration of the Risk of Omitted or Incomplete
Disclosures
    The reproposed standard stated that the auditor's evaluation of
fraud risk factors should include an evaluation of how fraud could be
perpetrated or concealed by omitting required disclosures or by
presenting incomplete disclosures. One commenter stated that the
requirement should also include consideration of the possibility of
presenting inaccurate disclosures. Other commenters stated that the
requirement should be revised to refer to disclosures required by the
applicable financial reporting framework. The requirement has been
revised to encompass inaccurate disclosures and to refer to disclosures
required for the fair presentation of the financial statements in
conformity with the applicable financial reporting framework.\302\
---------------------------------------------------------------------------

    \302\ Paragraph 67 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iii). Presumption of Fraud Risk Involving Improper Revenue Recognition
    Like the reproposed standard, Auditing Standard No. 12 contains a
requirement that the auditor should presume that there is a fraud risk
involving improper revenue recognition and evaluate which types of
revenue, revenue transactions, or assertions may give rise to such
risks.\303\ One commenter recommended rewording this paragraph to state
that while revenue recognition should be presumed to be a higher level
of risk, there are exceptions. The requirement was retained as stated
in the reproposed standard because a significant number of financial
reporting frauds relate to revenue recognition.\304\
---------------------------------------------------------------------------

    \303\ Paragraph 68 of Auditing Standard No. 12.
    \304\ See, e.g., Committee of Sponsoring Organizations of the
Treadway Commission, Fraudulent Financial Reporting: 1998-2007 (May
2010).
---------------------------------------------------------------------------

k. Definition of Significant Risk
    The reproposed standard defined significant risk as a risk of
material misstatement that requires special audit consideration. Some
commenters stated that the definition of ``significant risk'' in the
reproposed standard should be revised to indicate that significant
risks are ``identified risks'' and that they are determined using the
``auditor's judgment'' or risks that the auditor ``determines.'' Adding
a reference to the auditor's determination or auditor's judgment is
unnecessary because those points are inherent in the requirements for
identifying significant risks, e.g., in the required evaluation of the
likelihood and potential magnitude of misstatements related to the
risk. Similarly, the reference to ``identified risks'' is unnecessary
because it is already mentioned in the requirement for determining
significant risks. Accordingly, the definition of significant risk
included in the reproposed standard is retained.

8. Auditing Standard No. 13--The Auditor's Responses to the Risks of
Material Misstatement

a. Background
    Auditing Standard No. 13 establishes requirements for responding to
the risks of material misstatement, including responses regarding the
general conduct of the audit and responses involving audit procedures.
Auditing Standard No. 13 applies to integrated audits and audits of
financial statements only.
b. Linking Assessed Risks and Auditor's Responses
    The reproposed standard included a requirement for the auditor to
design and implement appropriate responses to the ``assessed risks of
material misstatement'' to address comments received on the original
proposed standard for improving the linkage between the auditor's
responses and the identification and assessment of risks of material
misstatement. Acknowledging the improvements in the reproposed
standard, some commenters continued to suggest that the objective also
should state that the auditor is to address the assessed risks of
material misstatement.
    In the Board's view, obtaining sufficient appropriate evidence to
support the auditor's opinion requires the auditor to adequately
respond to the risks of material misstatement. Accordingly, the title
and objective of the standard continue to refer to responding to the
risks of material misstatement. However, the Board recognizes that the
appropriate identification and assessment of the risks of material
misstatement in accordance with Auditing Standard No. 12 enable the
auditor to effectively respond to the risks of material misstatement.
Auditing Standard No. 13 continues to impose on auditors an
unconditional responsibility to design and implement responses that
address the risks of material misstatement identified and assessed in
accordance with Auditing Standard No. 12.\305\ As with the reproposed
standard, noncompliance with the requirements in Auditing Standard No.
12 that leads to a failure to identify or appropriately assess a risk
of material misstatement also could result in a failure to
appropriately respond to the risk of material misstatement in
accordance with this standard.\306\
---------------------------------------------------------------------------

    \305\ Paragraph 3 of Auditing Standard No. 13.
    \306\ Failure to address a risk of material misstatement also
might indicate a failure to comply with Auditing Standard No. 12.
---------------------------------------------------------------------------

c. Overall Responses to Risks
    The reproposed standard included a requirement for the auditor to
respond to the risks of material misstatement through overall responses
and responses involving the nature, timing, and extent of audit
procedures. Overall responses relate to the general conduct of the
audit, e.g., appropriately assigning and properly supervising
engagement team members, incorporating an element of unpredictability
into the audit, evaluating the company's selection and application of
significant accounting principles, and making pervasive changes to the
audit. Such responses are required by AU sec. 316 in response to fraud
risks, but the reproposed standard extended the requirement to apply to
risks of material misstatement due to error or fraud. These responses,
by their nature, are appropriate for addressing risks of material
misstatement due to error or fraud.
    Some commenters expressed concerns regarding the expansion of the
requirement for incorporating an

element of unpredictability to apply to risks of material misstatement
other than fraud risks.
    In the Board's view, although incorporating an element of
unpredictability is intended primarily to address fraud risks, it also
can enable the auditor to detect errors or control deficiencies that
could otherwise remain undetected. In addition, the requirement to
incorporate an element of unpredictability when testing controls
already exists in Auditing Standard No. 5. Auditing Standard No. 13
continues to indicate that the auditor should incorporate an element of
unpredictability as part of the response to the risks of material
misstatement, including fraud risks.\307\
---------------------------------------------------------------------------

    \307\ Paragraph 5.c. of Auditing Standard No. 13.
---------------------------------------------------------------------------

    One commenter requested clarification regarding the differences
between the first and third examples used to illustrate ways to
incorporate an element of unpredictability in paragraph 5.c. of the
reproposed standard. The first example in Auditing Standard No. 13 is
intended to illustrate that the auditor may decide to perform audit
procedures for a particular account, disclosure, or assertion even
though the auditor's risk assessment did not identify specific risks
associated with those accounts.\308\ The third example is intended to
illustrate that when sampling a particular financial statement amount,
the auditor may consider selecting items with amounts lower than the
threshold that the auditor had used in the past, or expanding the
selection to other sections of the population that the auditor had not
tested in the past.\309\
---------------------------------------------------------------------------

    \308\ Paragraph 5.c. (1) of Auditing Standard No. 13.
    \309\ Paragraph 5.c. (3) of Auditing Standard No. 13.
---------------------------------------------------------------------------

    The reproposed standard required the auditor to evaluate whether it
is necessary to make pervasive changes to the audit to adequately
address the assessed risks of material misstatement. The reproposed
standard did not require that pervasive changes be made in every audit.
Instead, it required the auditor to evaluate whether pervasive changes
that affect many aspects of the audit are needed to address the
assessed risks of material misstatement. Commenters questioned the use
of the term ``pervasive'' in the requirement. Auditing Standard No. 13
provides additional explanation of the types of circumstances in which
pervasive changes might be necessary.\310\
---------------------------------------------------------------------------

    \310\ Paragraph 6 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    Existing PCAOB standards require the auditor to apply professional
skepticism as part of due care,\311\ and Auditing Standard No. 13
states that the auditor's response to fraud risks involves the
application of professional skepticism in gathering and evaluating
audit evidence.\312\ The requirement is intended to emphasize the
importance of professional skepticism in responding to risks of
material misstatement without limiting its application to the auditor's
responses.
---------------------------------------------------------------------------

    \311\ AU secs. 230.07-.09.
    \312\ Paragraph 7 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    One commenter expressed concern that the reproposed standard did
not explicitly require the auditor to implement overall responses to
risks at the financial statement level. Such an explicit requirement
would inappropriately limit the auditor's overall responses to risks at
the financial statement level. Many of the overall responses also apply
to risks at the assertion level, e.g., assigning more experienced
personnel or applying a greater extent of supervision to accounts or
disclosures with higher risk.
d. Responses Involving the Nature, Timing, and Extent of Audit
Procedures
    The reproposed standard required the auditor to design and perform
audit procedures in a manner that addresses the assessed risks of
material misstatement for each relevant assertion of each significant
account and disclosure. Auditing Standard No. 13 retained this
requirement as reproposed. The requirement emphasizes that the auditor
should focus on each relevant assertion of each significant account and
disclosure and the risks of material misstatement associated with the
relevant assertion when designing and performing audit procedures.
    The reproposed standard also included requirements for the auditor
to design the testing of controls to accomplish the objectives of both
the audit of financial statements and the audit of internal control in
an integrated audit. This requirement is aligned with Auditing Standard
No. 5. One commenter suggested that that the requirement be removed
because it relates only to integrated audits. The requirement was
retained as reproposed because Auditing Standard No. 13 applies to
integrated audits as well as audits of financial statements only, and
tests of controls are a necessary response in the audit of internal
control.\313\
---------------------------------------------------------------------------

    \313\ Paragraph 9.c. of Auditing Standard No. 13.
---------------------------------------------------------------------------

e. Tests of Controls in an Audit of Internal Control
    Auditing Standard No. 13 includes requirements for performing tests
of controls in the audit of financial statements.\314\
---------------------------------------------------------------------------

    \314\ Paragraphs 16-35 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    In an integrated audit, the tests of controls performed in the
audit of internal control are part of the auditor's responses to the
risks of material misstatement, as indicated in paragraph 9-10 of
Auditing Standard No. 13.\315\ To help facilitate the integration of
tests of controls in an integrated audit, the standard continues to use
language similar to that of Auditing Standard No. 5 when describing
analogous terms and concepts relating to the testing of controls.
---------------------------------------------------------------------------

    \315\ Paragraph 39 of Auditing Standard No. 5 states, ``The
auditor should test those controls that are important to the
auditor's conclusion about whether the company's controls
sufficiently address the assessed risk of misstatement to each
relevant assertion.''
---------------------------------------------------------------------------

f. Tests of Controls and Control Risk Assessment in the Audit of
Financial Statements
(i). Requirements on When to Test Controls
    AU sec. 319 required auditors to obtain evidence about the design
effectiveness and operating effectiveness of controls (a) when the
auditor plans to rely on selected controls to reduce his or her
substantive procedures and (b) in those limited circumstances in which
the auditor cannot obtain sufficient appropriate evidence through
substantive procedures alone.\316\ Thus, except in those limited
circumstances, AU sec. 319 provided auditors with flexibility to decide
when or whether to test controls.
---------------------------------------------------------------------------

    \316\ AU sec. 319.66.
---------------------------------------------------------------------------

    Auditing Standard No. 13 does not change the requirements in AU
sec. 319 regarding when testing controls is necessary in audits of
financial statements only.\317\ In those audits, auditors continue to
have the same flexibility in deciding when or whether to test controls
to reduce their substantive procedures.\318\ Auditing Standard No. 13
includes additional statements that emphasize the flexibility that
auditors have in making these decisions and provides additional
examples, adapted from AU sec. 319.68, of situations in which auditors
cannot obtain sufficient appropriate audit evidence through substantive
procedures alone.\319\
---------------------------------------------------------------------------

    \317\ Certain clarifying revisions were made to the discussion
of relying on controls to modify the auditor's substantive
procedures, in response to comments on the reproposed standard. See
footnote 12 to paragraph 16 of Auditing Standard No. 13.
    \318\ Paragraph 16 of Auditing Standard No. 13.
    \319\ Paragraph 17 of Auditing Standard No. 13.

---------------------------------------------------------------------------

(ii). Period of Reliance
    Auditing Standard No. 13 states that when the auditor relies on
controls to assess control risk at less than the maximum, the auditor
must obtain evidence that the controls selected for testing are
designed effectively and operated effectively during the entire period
of reliance.\320\ The concept of the period of reliance was introduced
in Auditing Standard No. 5 and discussed further in the PCAOB staff
guidance, Staff Views: An Audit of Internal Control Over Financial
Reporting That Is Integrated with an Audit of Financial Statements--
Guidance for Auditors of Smaller Public Companies. Auditing Standard
No. 13 provides a definition of ``period of reliance'' that parallels
the language in paragraph B4 of Auditing Standard No. 5.\321\
---------------------------------------------------------------------------

    \320\ Paragraph 16 of Auditing Standard No. 13.
    \321\ Paragraph A.3 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(iii). Evidence About the Effectiveness of Controls
    Auditing Standard No. 13 describes the principle, adapted from AU
sec. 319,\322\ that the evidence necessary to support the auditor's
control risk assessment depends on the degree of reliance the auditor
plans to place on the effectiveness of a control. In applying that
principle, Auditing Standard No. 13 requires the auditor to obtain more
persuasive audit evidence from tests of controls the greater the
reliance the auditor places on the effectiveness of a control. In
addition, Auditing Standard No. 13 requires the auditor to obtain more
persuasive evidence about the effectiveness of controls for each
relevant assertion for which the audit approach consists primarily of
tests of controls, including situations in which substantive procedures
alone cannot provide sufficient appropriate audit evidence.\323\
---------------------------------------------------------------------------

    \322\ AU sec. 319.90.
    \323\ Paragraph 18 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(iv). Testing Operating Effectiveness
    Auditing Standard No. 13 requires the auditor to determine, among
other things, whether the person performing the control possesses the
necessary authority and competence to perform the control
effectively.\324\ This requirement is intended to call to the auditor's
attention that whether he or she possesses the appropriate level of
authority and the knowledge and skills necessary to perform the control
function is essential to whether a person can effectively perform the
control. Thus, the auditor is required to make such determination
before he or she can conclude about the effectiveness of the control.
---------------------------------------------------------------------------

    \324\ Paragraph 21 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(v). Timing of Tests of Controls--Evidence Obtained During an Interim
Period
    The reproposed standard stated that the auditor must obtain
evidence about the effectiveness of controls selected for testing for
the entire period of reliance. When the auditor tests controls during
an interim period, additional evidence that is necessary concerning the
operation of those controls for the remaining period of reliance
depends on a series of factors listed in the reproposed standard,
including, among other factors, the possibility of significant changes
in internal control over financial reporting occurring subsequent to
the interim date.
    One commenter suggested adding ``control environment'' to the list
of factors that could affect the auditor's determination of what
additional evidence is necessary. The control environment has an
important, but indirect, effect on the likelihood that a misstatement
will be prevented or detected on a timely basis. Also, unlike
monitoring controls, the control environment is not designed to
identify possible breakdowns in other controls. Accordingly, the
control environment, by itself, does not reduce the amount of evidence
needed concerning controls over specific relevant assertions for the
remaining period. The control environment is not included in the list
of factors in Auditing Standard No. 13.
    Another commenter suggested adding a requirement for the auditor to
obtain, when applicable, audit evidence about subsequent changes to the
controls tested during the interim period. A note has been added to
Auditing Standard No. 13 requiring the auditor to obtain evidence about
such subsequent changes, if significant.\325\
---------------------------------------------------------------------------

    \325\ Paragraph 30 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(vi). Timing of Tests of Controls--Evidence from Past Audits
    Auditing Standard No. 13 states that the auditor should obtain
evidence during the current year audit about the design and operating
effectiveness of controls upon which the auditor relies.\326\ This
requirement is based on the principle that auditors should support
their control risk assessments each year with current evidence.
However, when the auditor has tested the controls in the past and plans
to rely on the same controls for the current year audit, the amount of
evidence needed will vary based on the relevant factors listed in the
standard.\327\ These additional factors generally relate to the degree
of reliance on the control, the risk that the control will fail to
operate as designed, and the nature and amount of evidence that the
auditor has already obtained regarding the effectiveness of the
controls. These requirements are consistent with Auditing Standard No.
5. Also, the standard allows the auditor to use a benchmarking
strategy, when appropriate, for automated application controls for
subsequent years' audits, as do the provisions of Auditing Standard No.
5. However, the standard does not permit testing controls once every
third year because the standard requires evidence regarding the
effectiveness of controls to be obtained each year.
---------------------------------------------------------------------------

    \326\ Paragraph 31 of Auditing Standard No. 13.
    \327\ Ibid.
---------------------------------------------------------------------------

    Some commenters expressed concern that the requirements in the
reproposed standard for determining the amount of evidence needed in
the current year could be interpreted as requiring the auditor to
consider each factor listed for each of the controls that the auditor
tested in the past, regardless of whether or not the auditor plans to
rely on those controls for purposes of the current year audit. The
requirement was intended to apply when the auditor tested the controls
in the past audits and plans to rely on those controls and use evidence
about the effectiveness of those controls obtained in prior years for
purposes of the current year audit. That requirement is clarified in
Auditing Standard No. 13.\328\
---------------------------------------------------------------------------

    \328\ Ibid.
---------------------------------------------------------------------------

(vii). Assessing Control Risk
    Auditing Standard No. 13 requires the auditor to assess control
risk for relevant assertions.\329\ This requirement is not new. AU sec.
319 established requirements for the auditor to assess control risk,
and Auditing Standard No. 5 discusses control risk assessment in the
financial statement audit portion of the integrated audit.\330\
---------------------------------------------------------------------------

    \329\ Paragraphs 32-34 of Auditing Standard No. 13.
    \330\ AU secs. 319.70, .83-.90 and paragraphs B4-B5 of Auditing
Standards No. 5.
---------------------------------------------------------------------------

    Auditing Standard No. 13 requires the auditor to assess the control
risk at the maximum level for relevant assertions when the controls
necessary to sufficiently address the assessed risk of material
misstatement in those assertions are missing or ineffective or when the
auditor has not obtained sufficient appropriate evidence to support a
control risk assessment below the maximum level.\331\
---------------------------------------------------------------------------

    \331\ Paragraph 33 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    One commenter expressed a concern that the reproposed standard
seemed to

indicate that no reduction of the control risk assessment should occur
based on understanding the design effectiveness of controls. The
commenter suggested that a control that does not exist or is not
designed effectively should have a different impact on the auditor's
testing than a control that is designed effectively but not tested by
the auditor.
    The risk assessment standards already address the points raised by
the commenter regarding the effect of control deficiencies on the
auditor's testing. Auditing Standard No. 12 requires the auditor to
obtain an understanding of the design of the company's controls as part
of his or her risk assessment procedures.\332\ If the auditor
identifies design deficiencies in the company's controls, the auditor
would take that into account in identifying and assessing the risks of
material misstatement, and Auditing Standard No. 13 requires the
auditor to implement responses to address those risks of material
misstatement. When deficiencies are detected during the auditor's
testing of controls that the auditor plans to rely on, Auditing
Standard No. 13 requires the auditor to (1) perform tests of other
controls related to the same assertion as the ineffective controls, or
(2) revise the control risk assessment and modify the planned
substantive procedures as necessary in light of the increased
assessment of risk.\333\
---------------------------------------------------------------------------

    \332\ Paragraph 20 of Auditing Standard No. 12.
    \333\ Paragraph 34 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    Another commenter suggested that the reproposed standard provide
more direction about evaluating control deviations by adding a
paragraph from Auditing Standard No. 5 regarding evaluating control
deficiencies. The referenced paragraph does not apply specifically to
assessing control risk in a financial statement audit, and Auditing
Standard No. 13 requires the auditor to evaluate the evidence from all
sources, including the results of test of controls, when assessing
control risk for relevant assertions.\334\
---------------------------------------------------------------------------

    \334\ Paragraph 32 of Auditing Standard No. 13.
---------------------------------------------------------------------------

g. Substantive Procedures
    Auditing Standard No. 13 requires the auditor to perform
substantive procedures for each relevant assertion of each significant
account and disclosure, regardless of the assessed level of control
risk.\335\ By definition, a relevant assertion of a significant account
and disclosure has a reasonable possibility of containing a
misstatement or misstatements that would cause the financial statements
to be materially misstated.\336\ The requirement to obtain evidence
from substantive procedures for each relevant assertion of each
significant account and disclosure reflects the principle that the
auditors need to implement appropriate responses to address the
assessed risks of material misstatement.
---------------------------------------------------------------------------

    \335\ Paragraph 36 of Auditing Standard No. 13.
    \336\ Paragraph A9 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    Existing PCAOB standards indicate that some risks of material
misstatement might require more evidence from substantive procedures
because of certain inherent limitations of internal control.\337\ For
example, more evidence from substantive procedures ordinarily is needed
for relevant assertions that have a higher susceptibility to management
override or to lapses in judgment or breakdowns resulting from human
failures. Observations from the Board's oversight activities have
underscored the importance of this principle. Auditing Standard No. 13
includes this principle because it is particularly relevant to the
determination of the nature, timing, and extent of substantive
procedures. It is also consistent with the principles regarding
detection risk discussed in Auditing Standard No. 8.
---------------------------------------------------------------------------

    \337\ See, e.g., paragraph .14 of AU sec. 328, Auditing Fair
Value Measurements and Disclosures.
---------------------------------------------------------------------------

h. Timing of Substantive Procedures
    The reproposed standard included a requirement for the auditor to
take into account certain factors in determining whether it is
appropriate to perform substantive procedures at an interim date. One
commenter suggested that another point be added to the standard to
require the auditor to review ``the internal control changes that have
been made to date and the nature and extent of monitoring such changes
by the client staff.'' Auditing Standard No. 13 requires the auditor to
consider the effect of known or expected changes in the company, its
environment, and its internal control over financial reporting during
the remaining period on its risk assessments when determining whether
to perform substantive procedures at an interim date.\338\ This
additional requirement recognizes that both changes in controls and
other changes to the company and its environment can affect the risks
of material misstatement and, thus, the effectiveness of interim
substantive procedures. For example, significant changes in industry or
market conditions near year end could increase the risk of material
misstatement regarding the valuation of assets at year end, which, in
turn, would require significant audit attention during the remaining
period.
---------------------------------------------------------------------------

    \338\ Paragraph 44.a.(3) of Auditing Standard No. 13.
---------------------------------------------------------------------------

    The reproposed standard stated that when an auditor performs
substantive procedures as of an interim date, the auditor should
perform substantive procedures, or substantive procedures combined with
tests of controls, that provide a reasonable basis for extending the
audit conclusions from the interim date to the period end. The
reproposed standard also required that the auditor perform certain
procedures that were adapted from AU sec. 313.
    Some commenters suggested that the Board remove the mandatory
procedures in the reproposed standard, arguing that the procedures
should be determined by the auditor based on professional judgment.
Removing those requirements as suggested by the commenters would weaken
PCAOB standards. Observations from the Board's oversight activities
have included instances in which inadequate audit work was performed
when extending the conclusion reached at the interim date to the end of
the period covered by the financial statements. Therefore, retaining
the mandatory procedures in this standard continues to be
appropriate.\339\
---------------------------------------------------------------------------

    \339\ Paragraph 45 of Auditing Standard No. 13.
---------------------------------------------------------------------------

i. Substantive Procedures Responsive to Significant Risks
    Like the original proposed standard, the reproposed standard stated
that the auditor should perform substantive procedures, including tests
of details, that are specifically responsive to the significant risks.
AU sec. 329 indicates that tests of details should be performed in
response to significant risks.\340\
---------------------------------------------------------------------------

    \340\ AU sec. 329.09.
---------------------------------------------------------------------------

    One commenter continued to express concern about imposing a
presumptively mandatory responsibility for auditors to perform tests of
details in response to significant risks. Auditing Standard No. 13
retains the requirement as reproposed.\341\ The nature and importance
of significant risks warrant a high level of assurance from substantive
procedures to adequately address the risk. Also, analytical procedures
alone are not well suited to detecting certain types of misstatements
related to significant risks, including, in particular, fraud risks.
For example, when fraud risks are present, management might be able to
override controls to allow adjustments that result in artificial
changes to the financial statement relationships being analyzed,

causing the auditor to draw erroneous conclusions.
---------------------------------------------------------------------------

    \341\ Paragraph 11 of Auditing Standard No. 13.
---------------------------------------------------------------------------

j. Dual-purpose Test
    Auditing Standard No. 13 recognized that, in certain situations,
the auditor might perform a substantive test of a transaction
concurrently with a test of a control relevant to that transaction,
i.e., a dual-purpose test. The auditor is required to design the dual-
purpose test to achieve the objectives of both the test of the control
and the substantive test. In addition, the auditor is required to
evaluate the results of the test in forming conclusions about both the
assertion and the effectiveness of the control being tested.\342\ The
standard refers the auditors to the relevant requirements in AU sec.
350, Audit Sampling, for determining the proper sample size in a dual-
purpose test.
---------------------------------------------------------------------------

    \342\ Paragraph 47 of Auditing Standard No. 13.
---------------------------------------------------------------------------

9. Auditing Standard No. 14--Evaluating Audit Results

a. Background
    Auditing Standard No. 14 describes the auditor's responsibilities
regarding the process of evaluating the results of the audit and
determining whether sufficient appropriate audit evidence has been
obtained in order to form the opinion to be expressed in the auditor's
report. This standard consolidates into one auditing standard the
requirements that were previously included in five separate auditing
standards.\343\ The standard highlights matters that are important to
the auditor's conclusions about the financial statements and the
effectiveness of internal control.
---------------------------------------------------------------------------

    \343\ AU sec. 312, regarding evaluating audit results, including
uncorrected misstatements; AU sec. 316, regarding fraud
considerations that are relevant to evaluating audit results; AU
sec. 329, regarding performing the overall review; AU sec. 326,
regarding determining whether sufficient appropriate audit evidence
has been obtained; and AU sec. 431, regarding the evaluation of
disclosures.
---------------------------------------------------------------------------

b. Definition of Misstatement
    The reproposed standard defined the term ``misstatement'' as
follows:

    A misstatement, if material individually or in combination with
other misstatements, causes the financial statements not to be
presented fairly in conformity with the applicable financial
reporting framework.\344\ A misstatement may relate to a difference
between the amount, classification, presentation, or disclosure of a
reported financial statement item and the amount, classification,
presentation, or disclosure that should be reported in conformity
with the applicable financial reporting framework. Misstatements can
arise from error (i.e., unintentional misstatement) or fraud.
---------------------------------------------------------------------------

    \344\ The auditor should look to the requirements of the
Securities and Exchange Commission for the company under audit with
respect to accounting principles applicable to that company.

    Some commenters indicated that the definition applied to ``material
misstatement'' rather than ``misstatement'' and suggested revisions to
the definition, e.g., moving the second sentence to the beginning of
the definition.
    Auditing Standard No. 14 carries forward the definition of
``misstatement'' as reproposed.\345\ This definition is not a
definition of the term ``material misstatement.'' Rather, the
definition emphasizes that misstatements prevent financial statements
from being fairly presented in conformity with the applicable financial
reporting framework, as discussed in AU sec. 411, The Meaning of
Present Fairly in Conformity With Generally Accepted Accounting
Principles. The phrase used in the definition, ``if material
individually or in combination with other misstatements,'' is
equivalent to the phrase ``In the absence of materiality
considerations,'' which was used in the description of the term
``misstatement'' in an auditing interpretation of AU sec. 312.\346\ The
second sentence of the definition in Auditing Standard No. 14 describes
the most common types of misstatements.\347\
---------------------------------------------------------------------------

    \345\ Paragraph A2 of Appendix A to Auditing Standard No. 14.
    \346\ Paragraph .02 of AU sec. 9312, Audit Risk and Materiality
in Conducting an Audit: Auditing Interpretations of Section 312,
which is superseded by the risk assessment standards, stated ``In
the absence of materiality considerations, a misstatement causes the
financial statements not to be in conformity with generally accepted
accounting principles.''
    \347\ See also paragraph A2 of Auditing Standard No. 14.
---------------------------------------------------------------------------

c. Performing Analytical Procedures in the Overall Review
    Auditing Standard No. 14 adapted the requirements that were
previously included in AU secs. 316 and 329 to read the financial
statements and disclosures and perform analytical procedures in the
overall review. The standard imposes on auditors a responsibility to
read the financial statements and disclosures and perform analytical
procedures to (a) evaluate the auditor's conclusions formed regarding
significant accounts and disclosures and (b) assist in forming an
opinion on whether the financial statements as a whole are free of
material misstatement.\348\ In particular, Auditing Standard No. 14
requires the auditor to evaluate whether (a) evidence gathered in
response to unusual or unexpected transactions, events, amounts, or
relationships previously identified during the audit is sufficient and
(b) unusual or unexpected transactions, events, amounts, or
relationships indicate risks of material misstatement that were not
identified previously.\349\ Performing analytical procedures in the
overall review assists the auditor in assessing the conclusions reached
and in evaluating the overall financial statement presentation.
---------------------------------------------------------------------------

    \348\ Paragraph 5 of Auditing Standard No. 14.
    \349\ Paragraph 6 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 adapted a requirement, which previously
existed in AU sec. 316, for the auditor to perform analytical
procedures relating to revenue through the end of the period.\350\
These procedures are intended to identify unusual or unexpected
relationships involving revenue accounts that might indicate a material
misstatement, including a material misstatement due to fraud.
Performing analytical procedures relating to revenue is important in
light of the generally higher risk of financial statement fraud
involving revenue accounts.
---------------------------------------------------------------------------

    \350\ Paragraph 7 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 requires the auditor to corroborate
management's explanations regarding significant unusual or unexpected
transactions, events, amounts, or relationships. The standard also
states that if management's responses to the auditor's inquiries appear
to be implausible, inconsistent with other audit evidence, imprecise,
or not at a sufficient level of detail to be useful, the auditor should
perform procedures to address the matter.\351\ Auditing Standard No.
15, Audit Evidence, states that inquiry of company personnel, by
itself, does not provide sufficient audit evidence to reduce audit risk
to an appropriately low level.\352\ Therefore, obtaining corroboration
of management's responses is important in obtaining sufficient
appropriate audit evidence.
---------------------------------------------------------------------------

    \351\ Paragraph 8 of Auditing Standard No. 14.
    \352\ Paragraph 17 of Auditing Standard No. 15.
---------------------------------------------------------------------------

d. Clearly Trivial
    Auditing Standard No. 14 requires the auditor to accumulate
misstatements identified during the audit, other than those that are
clearly trivial.\353\ Like AU sec. 312, the standard allows the auditor
to set a threshold for accumulating misstatements, provided that the
threshold is set at a de minimis level that could not result in
material misstatement of the financial statements, individually or in
combination with other misstatements, after considering the possibility
of

further undetected misstatement.\354\ The specific limitation on
setting a threshold for accumulating misstatements is important to
assure a proper evaluation of the effect of uncorrected misstatements
on the financial statements.
---------------------------------------------------------------------------

    \353\ Paragraph 10 of Auditing Standard No. 14.
    \354\ Paragraph 11 of Auditing Standard No. 14.
---------------------------------------------------------------------------

e. Accumulating Misstatements
    The reproposed standard required the auditor to accumulate
identified misstatements other than those that are clearly trivial. The
reproposed standard also required the auditor to use his or her best
estimate of the total misstatement in the accounts and disclosures that
the auditor has tested, not just the amount of misstatements
specifically identified. This includes misstatements related to
accounting estimates and projected misstatements from substantive
procedures that involve audit sampling.\355\
---------------------------------------------------------------------------

    \355\ Paragraphs 10-12 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Commenters suggested that the standard should use terms such as
``known and likely misstatement'' or other terms to categorize the
misstatements. Auditing Standard No. 14 uses the term ``identified
misstatement'' to refer to misstatements that are identified during the
audit and the term ``accumulated misstatements'' to refer to
misstatements that are more than clearly trivial and, thus, should be
accumulated by the auditor. Because Auditing Standard No. 14 requires
the auditor to use his or her best estimate of the misstatements (which
is how AU sec. 312 described ``likely misstatements''), it is not
necessary to use the term ``known and likely misstatements.''
f. Correction of Misstatements
    Auditing Standard No. 14 requires that if management made
corrections to accounts or disclosures in response to misstatements
detected by the auditor, the auditor should evaluate management's work
to determine whether the corrections have been recorded properly and to
determine whether uncorrected misstatements remain.\356\ The standard
imposes on auditors a responsibility to determine whether misstatements
identified by the auditor and communicated to management are correctly
recorded in the accounting records.
---------------------------------------------------------------------------

    \356\ Paragraph 16 of Auditing Standard No. 14.
---------------------------------------------------------------------------

g. Considerations When Accumulated Misstatements Approach the
Materiality Level or Levels Used in Planning and Performing Audit
Procedures
    Auditing Standard No. 14 requires the auditor to determine whether
the overall strategy needs to be revised when the aggregate of
misstatements accumulated during the audit approaches the materiality
level or levels used in planning and performing the audit. When the
aggregate of misstatements approaches the materiality level or levels
used in planning and performing an audit, there likely will be greater
than an appropriately low level of risk that possible undetected
misstatements, combined with uncorrected misstatements accumulated
during the audit, could be material to the financial statements. If the
auditor assesses this risk to be unacceptably high, he or she should
perform additional audit procedures or determine that management has
adjusted the financial statements so that the risk that the financial
statements are materially misstated has been reduced to an
appropriately low level.\357\
---------------------------------------------------------------------------

    \357\ Paragraph 14 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard stated that when the aggregate of
accumulated misstatements approaches the materiality used in planning
and performing the audit, the auditor should perform additional
procedures or determine that management has adjusted the financial
statements so that the risk of material misstatement has been reduced
to an appropriately low level. One commenter suggested that it is not
clear what the additional procedures are and that more work is not
always the answer. The additional procedures that are necessary depend
upon, among other things, the procedures performed by the auditor to
date and the nature of the misstatements that were detected.
h. Requirement to Reevaluate the Materiality Level
    Auditing Standard No. 11 includes a requirement to reevaluate the
established materiality level or levels in certain circumstances.
Auditing Standard No. 14 states that if the reevaluation of the
materiality level or levels established in accordance with Auditing
Standard No. 11 results in a lower amount for the materiality level or
levels, the auditor should take into account that lower materiality
level in the evaluation of uncorrected misstatements.\358\ The
requirements are intended to prevent the auditor from incorrectly
concluding that uncorrected misstatements are immaterial because he or
she used outdated financial statement information. However, the
standard does not allow the auditor to establish a higher level or
levels of materiality when uncorrected misstatements exceed the
initially established level or levels of materiality.
---------------------------------------------------------------------------

    \358\ Paragraph 17 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Reevaluating the established materiality level or levels prior to
evaluating the effect of uncorrected misstatements will cause audit
results to be evaluated based on the latest financial information.
i. Evaluating Uncorrected Misstatements
    The reproposed standard stated that the auditor should evaluate the
uncorrected misstatements in relation to accounts and disclosures and
to the financial statements as a whole, taking into account relevant
quantitative and qualitative factors. The reproposed standard retained
the provisions regarding qualitative factors that were included in an
auditing interpretation to AU sec. 312,\359\ with some minor revisions
to align the factors more closely to the terminology in the reproposed
standard and to omit qualitative factors that apply only to nonissuers.
A commenter indicated that the term ``profitability,'' which is
included in the qualitative factors in Appendix B, is not defined, and
the commenter suggested including examples of profitability in the
reproposed standard. Although this term is not explicitly defined in
Auditing Standard No. 14, it should be familiar to auditors because the
related auditing interpretation was issued in 2000. Auditing Standard
No. 14 carries forward the requirements and the related list of
qualitative factors that are substantially the same as those in the
auditing interpretation.\360\
---------------------------------------------------------------------------

    \359\ AU sec. 9312.15-17.
    \360\ AU sec. 9312 and paragraph 17 and Appendix B of Auditing
Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 requires an evaluation of the effects of
both uncorrected misstatements detected in prior years and
misstatements detected in the current year that relate to prior
years.\361\ The standard does not address how to evaluate the effects
of prior period misstatements because that is an accounting and
financial reporting matter. For example, the SEC staff has provided
guidance in SEC Staff Accounting Bulletin (``SAB'') Topic 1.N,
Considering the Effects of Prior Year Misstatements when Quantifying
Misstatements in Current Year Financial Statements, on the effects of
prior year misstatements when quantifying

misstatements in the current year financial statements. This SAB
provides the SEC staff's views regarding evaluating the quantitative
and qualitative factors regarding the materiality of uncorrected
misstatements and evaluating the effects of prior year misstatements.
---------------------------------------------------------------------------

    \361\ Paragraph 18 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 states that the auditor cannot assume that
an instance of error or fraud is an isolated occurrence and that the
auditor should evaluate the nature and effects of the individual
misstatements accumulated during the audit on the assessed risks of
material misstatement.\362\ This procedure is important to inform the
auditor's conclusions about whether the auditor's risk assessments
remain appropriate and whether he or she has obtained sufficient
appropriate evidence to support his or her opinion.
---------------------------------------------------------------------------

    \362\ Paragraph 19 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard included a requirement to evaluate the
nature and effects of the individual misstatements accumulated during
the audit on the assessed risks of material misstatement. A commenter
suggested that this evaluation should be performed at the time the
misstatement is identified. In the Board's view, it is not necessary to
prescribe the timing for the evaluation of the nature and effects of
misstatements on the risk assessments. However, performing this
evaluation during the course of the audit could allow the auditor to
make the necessary modifications to his or her planned audit procedures
on a more timely basis.
    The reproposed standard required the auditor to evaluate whether
identified misstatements might be indicative of fraud and, in turn, how
they affect the auditor's evaluation of materiality and the related
audit responses. This requirement is adapted from AU sec. 316.\363\ One
commenter suggested that when there is an indicator of fraud, the
requirement should make clear that clearly trivial misstatements may
need to be evaluated to determine if they should be included in the
accumulated misstatements. Like AU sec. 316, the requirement in the
reproposed standard was phrased in terms of identified misstatements
rather than accumulated misstatements because fraud of relatively small
amounts can be material to the financial statements.
---------------------------------------------------------------------------

    \363\ AU sec. 316.75.
---------------------------------------------------------------------------

    Auditing Standard No. 14 retains the requirement as
reproposed.\364\ If an auditor detects a misstatement, he or she should
evaluate whether the misstatement is indicative of fraud when deciding
whether a misstatement is clearly trivial and thus does not warrant
being included with accumulated misstatements. Additionally, in
situations in which the auditor believes that a misstatement is or
might be intentional and the effect on the financial statements could
be material or cannot be readily determined, Auditing Standard No. 14
requires that the auditor perform procedures to obtain additional audit
evidence to determine whether the fraud has occurred or is likely to
have occurred. If the fraud has occurred or is likely to have occurred,
the auditor is required to determine its effect on the financial
statements and the auditor's report thereon.
---------------------------------------------------------------------------

    \364\ Paragraph 20 of Auditing Standard No. 14.
---------------------------------------------------------------------------

j. Communication of Accumulated Misstatements to Management
    The reproposed standard required the auditor to communicate
accumulated misstatements to management on a timely basis to provide
management with an opportunity to correct them. The reproposed standard
also required the auditor to obtain an understanding of the reasons
that management decided not to correct misstatements communicated by
the auditor.
    Some commenters suggested that the standard should specifically
require the auditor to request management to correct the misstatements.
    Auditing Standard No. 14 retains the requirement as
reproposed.\365\ It is not necessary to specifically require the
auditor to request that management correct the misstatements because
management has its own legal responsibilities in relation to the
preparation and maintenance of the company's books, records, and
financial statements. Section 13(i) of the Securities and Exchange Act
of 1934, 15 U.S.C. 78m(i), requires the financial statements filed with
the SEC to reflect all material correcting adjustments identified by
the auditor.
---------------------------------------------------------------------------

    \365\ Paragraphs 15 and 25 of Auditing Standard No. 14.
---------------------------------------------------------------------------

k. Communication of Illegal Acts
    Auditing Standard No. 14 requires the auditor to determine his or
her responsibility under AU secs. 316.79-.82A, AU sec. 317, and Section
10A of the Securities and Exchange Act of 1934, 15 U.S.C. 78j-1, if the
auditor becomes aware of information indicating that fraud or another
illegal act has occurred or might have occurred.\366\
---------------------------------------------------------------------------

    \366\ Paragraph 23 of Auditing Standard No. 14.
---------------------------------------------------------------------------

l. Evaluating the Qualitative Aspects of the Company's Accounting
Practices
    Auditing Standard No. 14 requires the auditor to evaluate the
qualitative aspects of the company's accounting practices, including
potential bias in management's judgments regarding the amounts and
disclosures in the financial statements.\367\
---------------------------------------------------------------------------

    \367\ Paragraph 24 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 also states that if the auditor identifies
bias in management's judgments about the amounts and disclosures in the
financial statements, the auditor should evaluate whether the effect of
that bias, together with the effect of uncorrected misstatements,
results in material misstatement of the financial statements. Also, the
standard states that the auditor should evaluate whether the auditor's
risk assessments, including, in particular, the assessment of fraud
risks, and the related audit responses remain appropriate.\368\
---------------------------------------------------------------------------

    \368\ Paragraph 26 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard included an example of management bias,
which was based on observations from the Board's oversight activities.
This example indicated that when management identifies adjusting
entries that offset misstatements identified by the auditor, the
auditor should perform procedures to determine why the underlying
misstatement was not identified previously. The auditor also should
evaluate the implications on the integrity of management, and the
auditor's risk assessments, including fraud risk assessments, and
perform additional procedures as necessary to address the risk of
further undetected misstatements. A commenter suggested using the
phrase ``identified misstatements other than those that are * * *
clearly trivial'' instead of ``identified misstatements.'' The
requirement has been revised to refer to misstatements accumulated by
the auditor as required by paragraph 10 of Auditing Standard No.
14.\369\
---------------------------------------------------------------------------

    \369\ Paragraph 25 of Auditing Standard No. 14.
---------------------------------------------------------------------------

m. Assessment of Fraud Risks
    The reproposed standard required the auditor to evaluate whether
the accumulated results of auditing procedures and other observations
affect the auditor's assessment of fraud risks made throughout the
audit and whether the audit procedures need to be modified to respond
to those risks.\370\ The reproposed standard included a reference to
Appendix C, which listed matters that might affect the assessment of
fraud risks. Appendix C stated that if

the matters listed in the appendix are identified during the audit, the
auditor should determine whether the assessment of fraud risks remains
appropriate or needs to be revised. This requirement was included
because the evaluation provides additional insight regarding the fraud
risks and the potential need to perform additional procedures to
support the opinion to be expressed in the auditor's report.
---------------------------------------------------------------------------

    \370\ Paragraph 28 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Some commenters indicated that the requirement in Appendix C seems
to indicate that the auditor is required to determine if each item
identified during the audit individually affects the assessment of
fraud risks, which appears to be inconsistent with paragraph 28. Those
commenters suggested revisions to the first sentence of Appendix C.
After considering these comments, the first sentence of Appendix C has
been revised to state that if the matters listed in the appendix are
identified during the audit, the auditor should take into account these
matters in the evaluation of the assessment of fraud risks, as
discussed in paragraph 28.\371\
---------------------------------------------------------------------------

    \371\ Paragraph C1 of Appendix C to Auditing Standard No. 14.
---------------------------------------------------------------------------

    One commenter suggested including in Appendix C specific procedures
that the auditor could perform to evaluate fraud risk, such as
evaluating journal entries with round numbers or amounts slightly below
a specified threshold. This type of procedure could be appropriate for
selecting journal entries for testing, but it is different in nature
from the matters listed in Appendix C.
    Auditing Standard No. 14 includes a requirement for the engagement
partner to determine whether there has been appropriate communication
with the other engagement team members throughout the audit regarding
information or conditions that are indicative of fraud risks.\372\ This
requirement is adapted from the existing PCAOB standards.\373\
---------------------------------------------------------------------------

    \372\ Paragraph 29 of Auditing Standard No. 14.
    \373\ AU sec. 316.18.
---------------------------------------------------------------------------

n. Evaluating Financial Statement Disclosures
    The reproposed standard included a requirement, adapted from AU
sec. 431, for the auditor to evaluate whether the financial statements
contain the required disclosures and, if the required disclosures are
not included in the financial statements, to express a qualified or
adverse opinion in accordance with AU sec. 508, Reports on Audited
Financial Statements. The reproposed standard also stated that
evaluation of disclosures includes consideration of the form,
arrangement, and content of the financial statements (including the
accompanying notes), encompassing matters such as the terminology used,
the amount of detail given, the classification of items in the
statements, and the bases of amounts set forth. These requirements were
included in the reproposed standard because of the importance of
disclosures to the fair presentation of financial statements.
    Some commenters stated that the requirements regarding evaluation
of disclosures should be qualified based on materiality considerations.
Auditing Standard No. 14 states that the auditor should evaluate
whether the financial statements contain the information essential for
a fair presentation of the financial statements in conformity with the
applicable financial reporting framework, which is aligned with an
analogous requirement in AU sec. 508.41.\374\ AU sec. 411 discusses the
concept of materiality regarding the auditor's opinion that financial
statements are presented fairly.\375\
---------------------------------------------------------------------------

    \374\ Paragraph 31 of Auditing Standard No. 14.
    \375\ AU sec. 411.04.
---------------------------------------------------------------------------

    Another commenter questioned whether the statement that
``Evaluation of disclosures includes consideration of the form,
arrangement, and content of the financial statements (including the
accompanying notes), encompassing matters such as the terminology used,
the amount of detail given, the classification of items in the
statements, and the bases of amounts set forth'' is a requirement. The
statement in the reproposed standard, which is retained in Auditing
Standard No. 14, explains that the scope of the auditor's required
evaluation of the information disclosed in the financial statements
includes matters such as the form, arrangement, and content of the
financial statements.\376\
---------------------------------------------------------------------------

    \376\ Paragraph 31 of Auditing Standard No. 14.
---------------------------------------------------------------------------

o. Evaluating the Sufficiency and Appropriateness of Audit Evidence
    The reproposed standard required the auditor to conclude whether
sufficient appropriate audit evidence has been obtained to support his
or her opinion on the financial statements. The reproposed standard
also presented a list of factors that are relevant to the auditor's
conclusion on whether sufficient appropriate audit evidence has been
obtained. Consideration of the listed factors is essential to reaching
an informed conclusion about whether sufficient appropriate audit
evidence has been obtained. Accordingly, both the requirement and the
list of factors contained in the reproposed standard have been
retained.\377\
---------------------------------------------------------------------------

    \377\ Paragraphs 33-34 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    A commenter suggested that corrected adjustments also should be
considered in concluding whether sufficient appropriate audit evidence
has been obtained. Auditing Standard No. 14 already requires the
auditor to evaluate the results of audit procedures in evaluating
whether sufficient appropriate evidence has been obtained, and this
would include misstatements identified by the auditor, regardless of
whether they were corrected by management.\378\
---------------------------------------------------------------------------

    \378\ Paragraph 34 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard expanded the requirements regarding
situations in which the auditor has not obtained sufficient appropriate
audit evidence to include situations in which the auditor has
substantial doubt about a relevant assertion. This additional provision
was adapted from AU sec. 326. A commenter suggested that the
requirement be revised to state that the auditor should attempt to
obtain additional evidence if the auditor has not obtained sufficient
appropriate evidence about a relevant assertion. The requirement has
been retained as stated in the reproposed standard because it covers
situations in which the evidence is inadequate and situations in which
the auditor has concerns about whether an assertion is misstated.\379\
---------------------------------------------------------------------------

    \379\ Paragraph 35 of Auditing Standard No. 14.
---------------------------------------------------------------------------

p. Evaluating the Results of the Audit of Internal Control
    The reproposed standard included a section relating to evaluating
audit results in the audit of internal control, which references
Auditing Standard No. 5 for the requirements on evaluating the results
of the audit of internal control.\380\ A commenter suggested removing
this paragraph from the reproposed standard. Auditing Standard No. 14
retains this paragraph, although it does not impose additional
requirements. Including this paragraph emphasizes that, in integrated
audits, the evaluation of audit results is an integrated process that
affects both audits.
---------------------------------------------------------------------------

    \380\ Paragraph 37 of Auditing Standard No. 14.
---------------------------------------------------------------------------

10. Auditing Standard No. 15--Audit Evidence

a. Background
    Auditing Standard No. 15 explains what constitutes audit evidence,
establishes requirements regarding designing and performing audit
procedures to obtain sufficient

appropriate audit evidence to support the opinion in the auditor's
report, and discusses methods for selecting items for testing.
b. Nature of Audit Evidence
    The reproposed standard stated that audit evidence is all the
information, whether obtained from audit procedures or other sources,
that is used by the auditor in arriving at the conclusions on which the
auditor's opinion is based. Audit evidence consists of both information
that supports and corroborates management's assertions regarding the
financial statements or internal control over financial reporting and
any information that contradicts such assertions.
    One commenter indicated that the meaning of the phrase ``and any
information that contradicts such assertions'' was unclear. The
commenter suggested that the Board clarify whether the requirement
meant the auditor should look for such contradictory information, or if
the requirement should apply only when such information comes to the
auditor's attention.
    PCAOB standards require the auditor to plan and perform the audit
to obtain sufficient appropriate evidence to support an opinion about
whether the financial statements are free of material misstatement and,
in the audit of internal control, whether material weaknesses
exist.\381\ Thus, the auditor is required to perform the audit
procedures necessary to test the accounts and controls, regardless of
whether the results of those procedures support or contradict the
assertions. The requirement in Auditing Standard No. 15 means that when
contradictory evidence is obtained, the auditor should evaluate it when
forming a conclusion on the financial statements and, in integrated
audits, on internal control over financial reporting. To clarify the
requirement, Auditing Standard No. 15 omits the word ``any.'' \382\
---------------------------------------------------------------------------

    \381\ Paragraph 3 of Auditing Standard No. 8 and paragraph 3 of
Auditing Standard No. 5, respectively.
    \382\ Paragraph 2 of Auditing Standard No. 15.
---------------------------------------------------------------------------

c. Objective
    The objective in the reproposed standard acknowledged the auditor's
responsibility to plan and perform the audit to obtain sufficient
appropriate audit evidence to support the opinion expressed in the
auditor's report. Commenters suggested revising the wording in
paragraph 4 of the reproposed standard to be consistent with the
objective in paragraph 3 of the reproposed standard. The requirement in
paragraph 4 of Auditing Standard No. 15 has been revised to be
consistent with the objective of the standard.
d. Sufficient Appropriate Audit Evidence
    The reproposed standard explained the meaning of the words
``sufficient'' and ``appropriate'' as used in the phrase ``sufficient
appropriate audit evidence.'' Commenters suggested that the Board
provide formal definitions for terms like ``sufficiency'' and
``appropriate'' so the terms can be easily located within the
standards. Adding definitions is unnecessary because Auditing Standard
No. 15 already describes the terms ``sufficiency'' and
``appropriateness'' and explains the relevant characteristics of
each.\383\
---------------------------------------------------------------------------

    \383\ Paragraphs 5-6 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    Commenters stated that the term ``persuasive'' was used in the
reproposed standard, The Auditor's Responses to the Risks of Material
Misstatement, and recommended that the Board clarify in the reproposed
audit evidence standard the manner in which the persuasiveness of
evidence affects the evaluation of audit evidence. The concept of
``persuasiveness of evidence'' is discussed in Auditing Standard No.
13.\384\
---------------------------------------------------------------------------

    \384\ Paragraph 39 of Auditing Standard No. 13.
---------------------------------------------------------------------------

e. Relevance and Reliability
    The reproposed standard contained a discussion about the relevance
and reliability of audit evidence. The reproposed standard stated that
the audit evidence must be both relevant and reliable to support the
auditor's conclusions about the subject of the audit procedure. The
reproposed standard stated that ``[e]vidence provided by original
documents is more reliable than evidence provided by photocopies or
facsimiles, or documents that have been filmed, digitized, or otherwise
converted into electronic form, the reliability of which depends on the
controls over the conversion and maintenance of those documents.''
    One commenter suggested that the standard be revised to indicate
that electronic information, subject to proper controls, is in many
ways more reliable than physical documentation. The language from the
reproposed standard was retained in Auditing Standard No. 15.\385\
Although evidence sometimes is available only in electronic form and
the reliability of electronic evidence depends on the controls over
that information, an authentic original document generally is more
reliable than an electronic form of that document.
---------------------------------------------------------------------------

    \385\ Paragraph 8 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    The reproposed standard stated that the relevance of audit evidence
refers to its relationship to the assertion or to the objective of the
control being tested. The relevance of audit evidence depends on (a)
the design of the audit procedure used to test the assertion or
control, and (b) the timing of the audit procedure used to test the
assertion or control. One commenter recommended the description of the
term ``relevance'' should be expanded to include the following
statements:

    Relevance deals with the logical connection with, or bearing
upon, the purpose of the audit procedure and, when appropriate, the
assertion under consideration. The relevance of information to be
used as audit evidence may be affected by the direction of testing.

    Auditing Standard No. 15 retains the description included in the
reproposed standard because it is clearer than the suggested
revision.\386\
---------------------------------------------------------------------------

    \386\ Paragraph 7 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    The reproposed standard indicated that ``[t]he auditor is not
expected to be an expert in document authentication. However, if
conditions indicate that a document may not be authentic or that the
terms in a document have been modified but that the modifications have
not been disclosed to the auditor, the auditor should modify the
planned audit procedures or perform additional audit procedures to
respond to those conditions and should evaluate the effect, if any, on
the other aspects of the audit.''
    One commenter suggested that the requirement for the auditor to
modify the planned audit procedures or perform additional audit
procedures in response to concerns about the authenticity of documents
should be linked to professional skepticism. The commenter also stated
that many modifications are routine. The requirement was not meant to
require the auditor to perform unlimited procedures but, rather, to
perform the procedures necessary to address the issue in the
circumstances. Auditing Standard No. 15 retains this requirement as
reproposed.\387\Although professional skepticism is important in these
situations, it is not the only factor that determines the procedures
necessary to address the matter.
---------------------------------------------------------------------------

    \387\ Paragraph 9 of Auditing Standard No. 15.
---------------------------------------------------------------------------

f. Financial Statement Assertions
    In representing that the financial statements are presented fairly
in conformity with the applicable financial reporting framework,
management

implicitly or explicitly makes assertions regarding the recognition,
measurement, presentation, and disclosure of the various elements of
financial statements and related disclosures. Financial statement
assertions are an important consideration for audits performed in
accordance with PCAOB standards. For example, AU sec. 319 required
auditors to perform substantive procedures for relevant assertions in
audits of financial statements. Auditing Standard No. 5 requires
auditors to obtain evidence about the design and operating
effectiveness of controls over relevant assertions in audits of
internal control.
    The reproposed standard retained the five categories of financial
statement assertions in AU sec. 326 and Auditing Standard No. 5. Two
commenters suggested that the Board use different descriptions for
financial statement assertions. One commenter suggested using other
standard-setters' descriptions of financial statement assertions. The
other commenter suggested using a different description of assertions.
Auditing Standard No. 15 retains the categories of assertions as
reproposed.\388\ Like Auditing Standard No. 5,\389\Auditing Standard
No. 15 allows auditors the flexibility to use categories of assertions
that differ from the assertions listed in the standard under specified
conditions.\390\
---------------------------------------------------------------------------

    \388\ Paragraph 11 of Auditing Standard No. 15.
    \389\ See the note to paragraph 28 of Auditing Standard No. 5.
    \390\ Paragraph 12 of Auditing Standard No. 15.
---------------------------------------------------------------------------

g. Inquiry
    The reproposed standard stated that inquiry of company personnel,
by itself, does not provide sufficient audit evidence to reduce audit
risk to an appropriately low level for a relevant assertion or to
support a conclusion about the effectiveness of a control. One
commenter suggested that the note to paragraph 17 of the reproposed
standard be revised to include ``design and operating effectiveness of
a control'' and that the auditor should perform audit procedures in
addition to the use of inquiry to obtain sufficient appropriate audit
evidence. Auditing Standard No. 15 retains the language from the
reproposed standard. The phrase ``effectiveness of a control''
encompasses both design and operating effectiveness. It is not
considered necessary to add that the auditor should perform additional
procedures, since Auditing Standard No. 15 states that inquiry, by
itself, does not provide sufficient audit evidence.\391\
---------------------------------------------------------------------------

    \391\ Paragraph 17 of Auditing Standard No. 15.
---------------------------------------------------------------------------

h. Confirmation
    The reproposed standard stated that a confirmation represents audit
evidence obtained by the auditor as a direct response to the auditor
from a third party. Some commenters suggested that the reproposed
standard clarify that a confirmation be written. Auditing Standard No.
15 has been revised to state that a confirmation response represents a
particular form of audit evidence obtained by the auditor from a third
party in accordance with PCAOB standards.\392\ The Board has a separate
standards-setting project on confirmations that, among other things,
will address the use of written confirmation or other alternative forms
of confirmation.\393\
---------------------------------------------------------------------------

    \392\ Paragraph 18 of Auditing Standard No. 15.
    \393\ PCAOB Release No. 2010-003, Proposed Auditing Standard
Related to Confirmation and Related Amendments to PCAOB Standards
(July 13, 2010).
---------------------------------------------------------------------------

i. Analytical Procedures
    The reproposed standard described analytical procedures as an audit
procedure for obtaining evidence. One commenter suggested adding
``scanning'' as part of analytical procedures. Scanning is a means for
selecting items for testing, not a separate audit procedure. The
description of analytical procedures in Auditing Standard No. 15 is
retained as reproposed.\394\
---------------------------------------------------------------------------

    \394\ Paragraph 21 of Auditing Standard No. 15.
---------------------------------------------------------------------------

j. Selecting Items for Testing To Obtain Audit Evidence
    Auditing Standard No. 15 contains a section on selecting items for
testing that is adapted from an auditing interpretation of AU sec.
350.\395\ The standard also states that the auditor should determine
the means of selecting items for testing to obtain evidence that, in
combination with other relevant evidence, is sufficient to meet the
objective of the audit procedure.\396\
---------------------------------------------------------------------------

    \395\ AU sec. 9350, Audit Sampling: Auditing Interpretations of
AU sec. 350.
    \396\ Paragraph 22 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    The reproposed standard defined audit sampling as the application
of an audit procedure to less than 100 percent of the occurrences of a
control or items comprising an account for the purpose of evaluating
some characteristic of the control or account. One commenter stated
that the definition in the standard should be conformed to AU sec. 350.
Auditing Standard No. 15 reflects revisions that align the standard
with AU sec. 350.
k. Other Changes
    As noted in the reproposing release, certain topics that were
included in AU sec. 326 were not carried forward to the reproposed
standard and Auditing Standard No. 15. AU sec. 326 discussed the use of
audit objectives, and an appendix to that standard illustrated how
auditors might use assertions to develop audit objectives and
substantive tests of inventory. Such a discussion is not necessary
because the auditing standards do not require auditors to establish
audit objectives to link assertions to substantive procedures. However,
omission of this discussion would not preclude auditors from using
audit objectives in designing their audit procedures.

11. Amendments to PCAOB Standards

a. Amendments to Auditing Standard No. 3
    In the release accompanying the original proposed standards, the
Board sought comment on the need for specific documentation
requirements regarding the risk assessment procedures. Responses from
commenters were mixed. Some commenters supported adding specific
documentation requirements, other commenters stated that the
requirements in Auditing Standard No. 3, Audit Documentation, were
adequate, and one commenter was ambivalent.
    After consideration of these comments and additional analysis, the
amendments accompanying the reproposed standards included certain
amendments to Auditing Standard No. 3 to (a) specify certain required
documentation regarding the auditor's risk assessments and related
responses, (b) align certain terms and provisions of Auditing Standard
No. 3 with the risk assessment standards, and (c) incorporate the
principles for documentation of disagreements among engagement team
members. For example, the amendments indicated that the auditor's
documentation should include the following:
     A summary of the identified risks of misstatement and the
auditor's assessment of risks of material misstatement at the financial
statement and assertion levels; and
     The auditor's responses to the risks of material
misstatement, including linkage of the responses to those risks.
    Also, the requirements regarding documentation of significant
findings or issues and related matters were expanded to require
documentation regarding the significant risks identified and the
results of the auditing procedures performed in response to those
risks.
    A commenter indicated that the additional documentation requirement

will result in ``unnecessary linkage'' and ``a matrix-like mentality''
to the audit documentation. The documentation requirements are intended
to enhance the auditor's ability to link identified and assessed risks
to appropriate responses and could help reviewers understand the areas
of greatest risk and the auditor's responses to those risks. In
addition to these documentation requirements, the auditor would
continue to be responsible for preparing documentation as required by
other provisions of Auditing Standard No. 3, e.g., to demonstrate that
the engagement complied with the standards of the PCAOB.\397\
---------------------------------------------------------------------------

    \397\ Paragraph 5.a. of Auditing Standard No. 3.
---------------------------------------------------------------------------

    Some commenters suggested placing the documentation requirements in
the respective risk assessment standards rather than amending Auditing
Standard No. 3. The risk assessment standards are foundational
standards; therefore, the required documentation related to the risk
assessment standards is included in Auditing Standard No. 3.\398\
Future decisions about the placement of new documentation requirements
will be made during the course of the respective standards-setting
projects.
---------------------------------------------------------------------------

    \398\ Paragraphs 9, 12, and 19 of Auditing Standard No. 3, as
amended.
---------------------------------------------------------------------------

b. Amendments to Auditing Standard No. 4
    The amendment to Auditing Standard No. 4, Reporting on Whether a
Previously Reported Material Weakness Continues To Exist, is limited to
changing the word ``competent'' to ``appropriate'' when that word is
used in reference to audit evidence.
c. Amendments to Auditing Standard No. 5
    The amendments to Auditing Standard No. 5 that accompanied the
reproposed standards were limited to changing the phrase ``any
assistants'' to ``the members of the engagement team,'' changing the
word ``competent'' to ``appropriate'' when that word is used in
reference to audit evidence, and updating references to auditing
standards that are being superseded or amended. These amendments are
retained as reproposed.
    One commenter suggested a series of additional amendments to
Auditing Standard No. 5, which primarily involved removing certain
paragraphs from Auditing Standard No. 5 that relate to risk assessment
procedures or other requirements that are included in the risk
assessment standards. The Board is not removing the requirements
regarding risk assessment procedures from Auditing Standard No. 5
because those requirements are important to understanding the other
provisions of Auditing Standard No. 5 for performing an audit of
internal control.
d. Amendments to Auditing Standard No. 6
    The amendments to Auditing Standard No. 6, Evaluating Consistency
of Financial Statements, are limited to removing a footnote stating
that the term ``error'' as used in Statement of Financial Accounting