e. Within the note to paragraph 30, the reference to paragraphs
147-149 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraphs 6-8 and paragraphs B1-B5 of Appendix B,
Special Topics, of PCAOB Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.

AU sec. 313, ``Substantive Tests Prior to the Balance-Sheet Date''

    SAS No. 45, ``Omnibus Statement on Auditing Standards--1983''
(AU sec. 313, ``Substantive Tests Prior to the Balance-Sheet
Date''), is amended as follows--
    Within the note to paragraph 1, the reference to paragraphs 98-
103 of PCAOB Auditing Standard No. 2 is replaced with a reference to
paragraphs 52-53 of PCAOB Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.

AU sec. 315, ``Communications Between Predecessor and Successor
Auditors''

    SAS No. 84, ``Communications Between Predecessor and Successor
Auditors'' (AU sec. 315, ``Communications Between Predecessor and
Successor Auditors''), as amended, is amended as follows--
    The last sentence of paragraph 16 is replaced with--
    Furthermore, the predecessor auditor is not a specialist as
defined in AU sec. 336, Using the Work of a Specialist, nor does the
predecessor auditor's work constitute the work of others as
described in AU sec. 322, The Auditor's Consideration of the
Internal Audit Function in an Audit of Financial Statements, or
paragraphs 16-19 of PCAOB Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.

AU sec. 316, ``Consideration of Fraud in a Financial Statement
Audit''

    SAS No. 99, ``Consideration of Fraud in a Financial Statement
Audit'' (AU sec. 316, ``Consideration of Fraud in a Financial
Statement Audit''), is amended as follows--
    Within the note to paragraph 1, the reference to paragraphs 24-
26 of PCAOB Auditing Standard No. 2 is replaced with a reference to
paragraphs 14-15 of PCAOB Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.

AU sec. 319, ``Consideration of Internal Control in a Financial
Statement Audit''

    SAS No. 55, ``Consideration of Internal Control in a Financial
Statement Audit'' (AU sec. 319, ``Consideration of Internal Control
in a Financial Statement Audit''), as amended, is amended as
follows--
    a. The note to paragraph 2 is replaced with--

    Note: Refer to paragraph A9 of Appendix A, Definitions, of PCAOB
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements
for the definition of a relevant assertion and paragraphs 28-33 of
PCAOB Auditing Standard No. 5, An Audit of Internal Control Over
Financial Reporting That Is Integrated with An Audit of Financial
Statements for discussion of identifying relevant assertions.

    b. Within the note to paragraph 9, the reference to Appendix B,
Additional Performance Requirements and Directions; Extent of
Testing Examples, of PCAOB Auditing Standard No. 2 is replaced with
a reference to paragraphs B10-B16 of Appendix B, Special Topics, of
PCAOB Auditing Standard No. 5, An Audit of Internal Control Over
Financial Reporting That Is Integrated with An Audit of Financial
Statements.
    c. The last sentence of paragraph 33 is deleted.
    d. The note to paragraph 65 is deleted.
    e. The note to paragraph 83 is deleted.
    f. Within the note to paragraph 97, the reference to paragraphs
104-105 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraph 54 of PCAOB Auditing Standard No. 5, An Audit
of Internal Control Over Financial Reporting That Is Integrated with
An Audit of Financial Statements.
    g. The appendix at paragraph 110 is deleted.

AU sec. 322, ``The Auditor's Consideration of the Internal Audit
Function in an Audit of Financial Statements''

    SAS No. 65, ``The Auditor's Consideration of the Internal Audit
Function in an Audit of Financial Statements'' (AU sec. 322, ``The
Auditor's Consideration of the Internal Audit Function in an Audit
of Financial Statements''), is amended as follows--
    a. Within the note to paragraph 1, the reference to paragraphs
108-126 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraphs 16-19 of PCAOB Auditing Standard No. 5, An
Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    b. The note to paragraph 20 is deleted.
    c. Within the note to paragraph 22, the reference to paragraph
122 of PCAOB Auditing Standard No. 2 is replaced with a reference to
paragraphs 18-19 of PCAOB Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.

AU sec. 324, ``Service Organizations''

    SAS No. 70, ``Service Organizations'' (AU sec. 324, ``Service
Organizations''), as amended, is amended as follows--
    Within the note to paragraph 1, the reference to Appendix B,
Additional Performance Requirements and Directions; Extent-of-
Testing Examples, of PCAOB Auditing Standard No. 2 is replaced with
a reference to paragraphs B17-B27 of Appendix B, Special Topics, of
PCAOB Auditing Standard No. 5, An Audit of Internal Control Over
Financial Reporting That Is Integrated with An Audit of Financial
Statements.

AU sec. 325, ``Communications About Control Deficiencies in an
Audit of Financial Statements'' \4\
---------------------------------------------------------------------------

    \4\ When the Board adopted Auditing Standard No. 2, it
superseded SAS No. 60 in the context of an integrated audit of
financial statements and internal control over financial reporting
by paragraphs 207-214 of Auditing Standard No. 2. See PCAOB Release
No. 2004-008, Conforming Amendments to PCAOB Interim Standards
Resulting From the Adoption of PCAOB Auditing Standard No. 2, ``An
Audit of Internal Control Over Financial Reporting Performed in
Conjunction with An Audit of Financial Statements'' (Sept. 15,
2004). As a result of superseding Auditing Standard No. 2,
paragraphs 78-84 of Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements, now supersede SAS No. 60 in the context of an
integrated audit.
---------------------------------------------------------------------------

    AU sec. 325, ``Communications About Control Deficiencies in an
Audit of Financial Statements'' is amended as follows--
    a. The first bullet point before paragraph 1 is amended as
follows--
    The reference to paragraphs 207-214 of PCAOB Auditing Standard
No. 2 is replaced with a reference to paragraphs 78-84 of PCAOB
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
    b. The first bullet point in paragraph 1 is replaced with--
    A deficiency in design exists when (a) A control necessary to
meet the control objective is missing or (b) an existing control is
not properly designed so that, even if the control operates as
designed, the control objective would not be met.
    c. Paragraph 2 is replaced with--
    A significant deficiency is a deficiency, or a combination of
deficiencies, in internal control over financial reporting, that is
less severe than a material weakness yet important enough to merit
attention by those responsible for oversight of the company's
financial reporting.
    d. The notes to paragraph 2 are deleted.
    e. Paragraph 3 is replaced with--
    A material weakness is a deficiency, or a combination of
deficiencies, in internal control over financial reporting, such
that there is a reasonable possibility that a material misstatement
of the company's annual or interim financial statements will not be
prevented or detected on a timely basis.

    Note: There is a reasonable possibility of an event when the
likelihood of the event is either ``reasonably possible'' or
``probable,'' as those terms are used in paragraph 3 of Financial
Accounting Standards Board Statement No. 5, Accounting for
Contingencies.

    Note: In evaluating whether a deficiency exists and whether
deficiencies, either individually or in combination with other
deficiencies, are material weaknesses, the auditor should follow the
direction in paragraphs 62-70 of PCAOB Auditing Standard No. 5, An
Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.

    f. Paragraph 5 is replaced with--
    If oversight of the company's external financial reporting and
internal control over financial reporting by the company's audit
committee is ineffective, that circumstance should be regarded as an
indicator that a material weakness in internal control over
financial reporting exists. Although there is not an explicit
requirement to evaluate the effectiveness of the audit committee's
oversight in an audit of only the financial statements, if the
auditor becomes aware that the oversight of the company's external
financial reporting and internal control over financial reporting by
the company's audit committee is ineffective, the auditor must
communicate that information in writing to the board of directors.
    g. The last sentence of paragraph 9 is replaced with--
    In an audit of financial statements only, auditing
interpretation 1 to AU sec. 325, ``Reporting on the Existence of
Material Weaknesses,'' continues to apply except that the term
``reportable condition'' means ``significant deficiency'' as defined
in paragraph 2 of this standard.

AU sec. 9325, ``Communication of Internal Control Related Matters
Noted in an Audit: Auditing Interpretations of Section 325''

    AU sec. 9325, ``Communication of Internal Control Related
Matters Noted in an Audit: Auditing Interpretations of Section 325''
is amended as follows--
    The note prior to paragraph 1 is replaced with--

    Note: In an audit of financial statements only, auditing
interpretation 1 to AU sec. 325, ``Reporting on the Existence of
Material Weaknesses,'' continues to apply except that the term
``reportable condition'' means ``significant deficiency'' as defined
in paragraph 2 of this standard. Within the example report within
paragraph 4 of the interpretation, the third sentence is replaced
with the definition of a material weakness in paragraph A7 of
Appendix A, Definitions, of PCAOB Auditing Standard No. 5, An Audit
of Internal Control Over Financial Reporting That Is Integrated with
An Audit of Financial Statements.

AU sec. 328, ``Auditing Fair Value Measurements and Disclosures''

    SAS No. 101, ``Auditing Fair Value Measurements and
Disclosures'' (AU sec. 328, ``Auditing Fair Value Measurements and
Disclosures''), is amended as follows--
    The first sentence of paragraph 41 is replaced with--
    Events and transactions that occur after the balance-sheet date
but before the date of the auditor's report (for example, a sale of
an investment shortly after the balance-sheet date), may provide
audit evidence regarding management's fair value measurements as of
the balance-sheet date \7\

    \7\ The auditor's consideration of a subsequent event or
transaction, as contemplated in this paragraph, is a substantive
test and thus differs from the review of subsequent events performed
pursuant to section 560, Subsequent Events.

AU sec. 332, ``Auditing Derivative Instruments, Hedging Activities,
and Investments in Securities''

    SAS No. 92, ``Auditing Derivative Instruments, Hedging
Activities, and Investments in Securities'' (AU sec. 332, ``Auditing
Derivative Instruments, Hedging Activities, and Investments in
Securities''), is amended as follows--
    The note to paragraph 11 is replaced with--

    Note: When performing an integrated audit of financial
statements and internal control over financial reporting, paragraph
39 of PCAOB Auditing Standard No. 5, An Audit of Internal Control
Over Financial Reporting That Is Integrated with An Audit of
Financial Statements, states ``[t]he auditor should test those
controls that are important to the auditor's conclusion about
whether the company's controls sufficiently address the assessed
risk of misstatement to each relevant assertion.'' Therefore, in an
integrated audit of financial statements and internal control over
financial reporting, if there are relevant assertions related to the
company's investment in derivatives and securities, the auditor's
understanding of controls should include controls over derivatives
and securities transactions from their initiation to their inclusion
in the financial statements and should encompass controls placed in
operation by the entity and service organizations whose services are
part of the entity's information system.

AU sec. 333, ``Management Representations''

    SAS No. 85, ``Management Representations'' (AU sec. 333,
``Management Representations''), as amended, is amended as follows--
    a. Within the note to paragraph 5, the reference to paragraphs
142-144 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraphs 75-77 of PCAOB Auditing Standard No. 5, An
Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    b. The second sentence of paragraph 9 is replaced with--
    Because the auditor is concerned with events occurring through
the date of his or her report that may require adjustment to or
disclosure in the financial statements, the representations should
be made as of the date of the auditor's report.

AU sec. 9337, ``Inquiry of a Client's Lawyer Concerning Litigation,
Claims, and Assessments: Auditing Interpretations of Section 337''

    AU sec. 9337, ``Inquiry of a Client's Lawyer Concerning
Litigation, Claims, and Assessments: Auditing Interpretations of
Section 337'' is amended as follows--
    a. The last sentence of paragraph 4 is replaced with--
    What is the relationship between the effective date of the
lawyer's response and the date of the auditor's report?
    b. Paragraph 5 is replaced with--
    Interpretation--Section 560.10 through .12 indicates that the
auditor is concerned with events, which may require adjustment to,
or disclosure in, the financial statements, occurring through the
date of his or her report. Therefore, the latest date of the period
covered by the lawyer's response (the ``effective date'') should be
as close to the date of the auditor's report as is practicable in
the circumstances. Consequently, specifying the effective date of
the lawyer's response to reasonably approximate the expected date of
the auditor's report will in most instances obviate the need for an
updated response from the lawyer.

AU sec. 341, ``The Auditor's Consideration of an Entity's Ability
to Continue as a Going Concern''

    SAS No. 59, ``The Auditor's Consideration of an Entity's Ability
to Continue as a Going Concern'' (AU sec. 341, ``The Auditor's
Consideration of an Entity's Ability to Continue as a Going
Concern''), as amended, is amended as follows--
    The second sentence of paragraph 2 is replaced with--
    The auditor's evaluation is based on his or her knowledge of
relevant conditions and events that exist at or have occurred prior
to the date of the auditor's report.

AU sec. 342, ``Auditing Accounting Estimates''

    SAS No. 57, ``Auditing Accounting Estimates'' (AU sec. 342,
``Auditing Accounting Estimates''), is amended as follows--
    a. Subparagraph c. of paragraph 10 is replaced with--
    c. Review subsequent events or transactions occurring prior to
the date of the auditor's report.
    b. Paragraph 13 is replaced with--
    Review subsequent events or transactions. Events or transactions
sometimes occur subsequent to the date of the balance sheet, but
prior to the date of the auditor's report, that are important in
identifying and evaluating the reasonableness of accounting
estimates or key factors or assumptions used in the preparation of
the estimate. In such circumstances, an evaluation of the estimate
or of a key factor or assumption may be minimized or unnecessary as
the event or transaction can be used by the auditor in evaluating
their reasonableness.

AU sec. 380, ``Communication With Audit Committees''

    SAS No. 61, ``Communication With Audit Committees'' (AU sec.
380, ``Communication With Audit Committees''), as amended, is
amended as follows--
    Within footnote 1 to paragraph 1, the reference to PCAOB
Auditing Standard No. 2 is replaced with a reference to PCAOB
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.

AU sec. 508, ``Reports on Audited Financial Statements''

    SAS No. 58, ``Reports on Audited Financial Statements'' (AU sec.
508, ``Reports on Audited Financial Statements''), as amended, is
amended as follows--
    Within the note to paragraph 1, the reference to paragraphs 162-
199 of PCAOB Auditing Standard No. 2 is replaced with a reference to
paragraphs 85-98 of PCAOB Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements and Appendix C, Special Reporting
Situations, of PCAOB Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements. The sentence that reads ``In addition, see
Appendix A, Illustrative Reports on Internal Control Over Financial
Reporting, of PCAOB Auditing Standard No. 2, which includes an
illustrative combined audit report and examples of separate
reports,'' is replaced with, ``In addition, see paragraphs 86-88 of
PCAOB Auditing Standard No. 5, An Audit of Internal Control Over
Financial Reporting That Is Integrated with An Audit of Financial
Statements which includes an illustrative combined audit report.''

AU sec. 530, ``Dating of the Independent Auditor's Report''

    SAS No. 1, ``Codification of Auditing Standards and
Procedures,'' section 530, ``Dating of the Independent Auditor's
Report'' (AU sec. 530, ``Dating of the Independent Auditor's
Report''), as amended, is amended as follows--
    a. Paragraph .01 is replaced with--
    The auditor should date the audit report no earlier than the
date on which the auditor has obtained sufficient competent evidence
to support the auditor's opinion. Paragraph .05 describes the
procedure to be followed when a subsequent event occurring after the
report date is disclosed in the financial statements.

    Note: When performing an integrated audit of financial
statements and internal control over financial reporting, the
auditor's reports on the company's financial statements and on
internal control over financial reporting should be dated the same
date.

    Note: If the auditor concludes that a scope limitation will
prevent the auditor from obtaining the reasonable assurance
necessary to express an opinion on the financial statements, then
the auditor's report date is the date that the auditor has obtained
sufficient competent evidence to support the representations in the
auditor's report.

    b. Paragraph .05 is replaced with--
    The independent auditor has two methods for dating the report
when a subsequent event disclosed in the financial statements occurs
after the auditor has obtained sufficient competent evidence on
which to base his or her opinion, but before the issuance of the
related financial statements. The auditor may use ``dual dating,''
for example, ``February 16, 20----, except for Note ----, as to
which the date is March 1, 20----,'' or may date the report as of
the later date. In the former instance, the responsibility for
events occurring subsequent to the original report date is limited
to the specific event referred to in the note (or otherwise
disclosed). In the latter instance, the independent auditor's
responsibility for subsequent events extends to the later report
date and, accordingly, the procedures outlined in section 560.12
generally should be extended to that date.
    c. Within the heading before paragraph .03, the reference to
``completion of field work'' is replaced with ``the date of the
independent auditor's report.''

AU sec. 543, ``Part of Audit Performed by Other Independent
Auditors''

    SAS No. 1, ``Codification of Auditing Standards and
Procedures,'' section 543, ``Part of Audit Performed by Other
Independent Auditors'' (AU sec. 543, ``Part of Audit Performed by
Other Independent Auditors''), as amended, is amended as follows--
    Within the note to paragraph .01, the reference to paragraphs
182-185 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraphs C8-C11 of Appendix C, Special Reporting
Situations, of PCAOB Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.

AU sec. 560, ``Subsequent Events''

    SAS No. 1, ``Codification of Auditing Standards and
Procedures,'' section 560, ``Subsequent Events'' (AU sec. 560,
``Subsequent Events''), as amended, is amended as follows--
    a. Within the note to paragraph .01, the reference to paragraphs
186-189 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraphs 93-97 of PCAOB Auditing Standard No. 5, An
Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.

    b. The second sentence of paragraph .12 is replaced with--
    These procedures should be performed at or near the date of the
auditor's report.

AU sec. 561, ``Subsequent Discovery of Facts Existing at the Date
of the Auditor's Report''

    SAS No. 1, ``Codification of Auditing Standards and
Procedures,'' section 561, ``Subsequent Discovery of Facts Existing
at the Date of the Auditor's Report'' (AU sec. 561, ``Subsequent
Discovery of Facts Existing at the Date of the Auditor's Report''),
as amended, is amended as follows--
    Within the note to paragraph .01, the reference to paragraph 197
of PCAOB Auditing Standard No. 2 is replaced with a reference to
paragraph 98 of PCAOB Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.

AU sec. 711, ``Filings Under Federal Securities Statutes''

    SAS No. 37, ``Filings Under Federal Securities Statutes'' (AU
sec. 711, ``Filings Under Federal Securities Statutes''), is amended
as follows--
    a. Within the note to paragraph 2, the reference to paragraphs
198-199 of PCAOB Auditing Standard No. 2 is replaced with a
reference to paragraphs C16-C17 of Appendix C, Special Reporting
Situations, of PCAOB Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.
    b. The third sentence of paragraph 10 is replaced with--
    The likelihood that the auditor will discover subsequent events
necessarily decreases following the date of the auditor's report,
and, as a practical matter, after that time the independent auditor
may rely, for the most part, on inquiries of responsible officials
and employees.

AU sec. 722, ``Interim Financial Information''

    SAS No. 100, ``Interim Financial Information'' (AU sec. 722,
``Interim Financial Information''), is amended as follows--
    a. The following is inserted after the first sentence of
paragraph 3--
    The SEC also requires management, with the participation of the
principal executive and financial officers (the certifying officers)
to make certain quarterly and annual certifications with respect to
the company's internal control over financial reporting.\2\

    \2\ See Section 302 of the Sarbanes-Oxley Act of 2002, and
Securities Exchange Act Rule 13a-14(a) or 15d-14(a), (17 CFR
240.13a-14a or 17 CFR 240.15d-14a), whichever applies.

    b. The note to paragraph 3 is deleted.
    c. The following is added to the end of paragraph 7--
    Likewise, the auditor's responsibility as it relates to
management's quarterly certifications on internal control over
financial reporting is different from the auditor's responsibility
as it relates to management's annual assessment of internal control
over financial reporting. The auditor should perform limited
procedures quarterly to provide a basis for determining whether he
or she has become aware of any material modifications that, in the
auditor's judgment, should be made to the disclosures about changes
in internal control over financial reporting in order for the
certifications to be accurate and to comply with the requirements of
Section 302 of the Act.

    Note: The auditor's responsibilities for evaluating management's
certification disclosures about internal control over financial
reporting take effect beginning with the first quarter after the
company's first annual assessment of internal control over financial
reporting as described in Item 308(a)(3) of Regulations S-B and S-K.

    d. The following lettered section is added to the end of
paragraph 18--
    g. Evaluating management's quarterly certifications about
internal control over financial reporting by performing the
following procedures--
     Inquiring of management about significant changes in
the design or operation of internal control over financial reporting
as it relates to the preparation of annual as well as interim
financial information that could have occurred subsequent to the
preceding annual audit or prior review of interim financial
information;
     Evaluating the implications of misstatements identified
by the auditor as part of the auditor's other interim review
procedures as they relate to effective internal control over
financial reporting; and
     Determining, through a combination of observation and
inquiry, whether any change in internal control over financial
reporting has materially affected, or is reasonably likely to
materially affect, the company's internal control over financial
reporting.
    e. Paragraph 29 is replaced with--
    As a result of conducting a review of interim financial
information, the accountant may become aware of matters that cause
him or her to believe that--
    a. Material modification should be made to the interim financial
information for it to conform with generally accepted accounting
principles;
    b. Modification to the disclosures about changes in internal
control over financial reporting is necessary for the certifications
to be accurate and to comply with the requirements of Section 302 of
the Act and Securities Exchange Act Rule 13a-14(a) or 15d-14(a),
whichever applies; and
    c. The entity filed the Form 10-Q or Form 10-QSB before the
completion of the review.
    In such circumstances, the accountant should communicate the
matter(s) to the appropriate level of management as soon as
practicable.
    f. Paragraph 32 is replaced with--
    If the auditor becomes aware of information indicating that
fraud or an illegal act has or may have occurred, the auditor must
also determine his or her responsibilities under AU sec. 316,
Consideration of Fraud in a Financial Statement Audit, AU sec. 317,
Illegal Acts by Clients, and Section 10A of the Securities Exchange
Act of 1934.\1\

    \1\ See 15 U.S.C. 78j-1

    g. Within paragraph 33, the third sentence is replaced with--
    A significant deficiency is a deficiency, or a combination of
deficiencies, in internal control over financial reporting, that is
less severe than a material weakness yet important enough to merit
attention by those responsible for oversight of the company's
financial reporting.

Auditing Standard No. 3, Audit Documentation

    Auditing Standard No. 3, Audit Documentation is amended as
follows--
    Within footnote 2 to paragraph 6, the reference to paragraphs
68-70 of Auditing Standard No. 2 is replaced with a reference to
paragraphs 28-33 of Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.

Auditing Standard No. 4, Reporting on Whether a Previously Reported
Material Weakness Continues to Exist

    Auditing Standard No. 4, Reporting on Whether a Previously
Reported Material Weakness Continues to Exist is amended as
follows--
    a. Within note 1 to paragraph 1, the reference to Auditing
Standard No. 2 is replaced with a reference to Auditing Standard No.
5, An Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    b. Within paragraph 2, the two references to Auditing Standard
No. 2 are replaced with references to Auditing Standard No. 5, An
Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    c. Within the note to paragraph 2, the reference to Auditing
Standard No. 2 is replaced with a reference to Auditing Standard No.
5, An Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    d. Within paragraph 4, the reference to Auditing Standard No. 2
is replaced with a reference to Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.
    e. Paragraph 9 is replaced with--
    The terms internal control over financial reporting, deficiency,
significant deficiency, and material weakness have the same meanings
as the definitions of those terms in Appendix A, Definitions, of
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
    f. The first sentence of paragraph 10 is replaced with--
    Paragraph 5 of Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements, states ``[t]he auditor should use the same
suitable, recognized control framework to perform his or her audit
of internal control over financial reporting as management uses for
its annual evaluation of the effectiveness of the company's internal
control over financial reporting.''
    g. Within the note to paragraph 10, the reference to Auditing
Standard No. 2 in the first sentence is replaced with a reference to
Auditing Standard No. 5, An Audit of

Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements, and the last sentence is amended as
follows--
    More information about the COSO framework is included within the
COSO report.
    h. Paragraph 11 is replaced with--
    The terms relevant assertion and control objective have the same
meaning as the definitions of those terms in Appendix A,
Definitions, of Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.
    i. Paragraph 13 is replaced with--
    In an audit of internal control over financial reporting, the
auditor should test the design effectiveness of controls by
determining whether the company's controls, if they are operated as
prescribed by persons possessing the necessary authority and
competence to perform the control effectively, satisfy the company's
control objectives and can effectively prevent or detect errors or
fraud that could result in material misstatements in the financial
statements.\2\

    \2\ See paragraph 42 of Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.

    j. Within the note to paragraph 17, the reference to Auditing
Standard No. 2 is replaced with a reference to Auditing Standard No.
5, An Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    k. Within note 2 to paragraph 18, the reference to Auditing
Standard No. 2 is replaced with a reference to Auditing Standard No.
5, An Audit of Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements.
    l. Within paragraph 21, the last sentence is deleted.
    m. Within paragraph 23, the reference to paragraphs 22 and 23 of
Auditing Standard No. 2 is replaced with a reference to paragraph 20
of Auditing Standard No. 5, An Audit of Internal Control Over
Financial Reporting That Is Integrated with An Audit of Financial
Statements. Additionally, the second sentence is deleted.
    n. Within paragraph 24, the reference to paragraph 39 of
Auditing Standard No. 2 is replaced with a reference to paragraph 9
of Auditing Standard No. 5, An Audit of Internal Control Over
Financial Reporting That Is Integrated with An Audit of Financial
Statements.
    o. Within paragraph 25, the reference to Auditing Standard No. 2
is replaced with a reference to Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.
    p. Within the note to paragraph 25, the two references to
Auditing Standard No. 2 are replaced with references to Auditing
Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
    q. Within subparagraph a. of paragraph 26, the reference to
paragraphs 47 through 51 of Auditing Standard No. 2 is replaced with
a reference to paragraphs 22-27 of Auditing Standard No. 5, An Audit
of Internal Control Over Financial Reporting That Is Integrated with
An Audit of Financial Statements.
    r. Subparagraph b. of paragraph 26 is replaced with--
    Perform the procedures described in paragraphs 34-38 of Auditing
Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements,
for those transactions that are directly affected by controls
specifically identified by management as addressing the material
weakness.
    s. The note to subparagraph b. of paragraph 26 is deleted.
    t. Within paragraph 27, the reference to Auditing Standard No. 2
is replaced with a reference to Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.
    u. The note to paragraph 28 is deleted.
    v. Within paragraph 31, the reference to paragraphs 88 through
91 of Auditing Standard No. 2 is replaced with a reference to
paragraphs 42-43 of Auditing Standard No. 5, An Audit of Internal
Control Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.
    w. Paragraph 32 is replaced with--
    Consistent with the direction in paragraphs 44-45 of Auditing
Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements,
the auditor should test the operating effectiveness of a specified
control by determining whether the specified control operated as
designed and whether the person performing the control possesses the
necessary authority and qualifications to perform the control
effectively. In determining the nature, timing, and extent of tests
of controls, the auditor should apply paragraphs 50-54 of Auditing
Standard No. 5.
    x. Paragraph 33 is replaced with--
    The auditor should perform tests of the specified controls over
a period of time that is adequate to determine whether, as of the
date specified in management's assertion, the controls necessary for
achieving the stated control objective are operating effectively.
The timing of the auditor's tests should vary with the risk
associated with the control being tested. For example, a
transaction-based, daily reconciliation generally would permit the
auditor to obtain sufficient evidence as to its operating
effectiveness in a shorter period of time than a pervasive, entity-
level control, such as any of those described in paragraphs 22-24 of
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
Additionally, the auditor typically will be able to obtain
sufficient evidence as to the operating effectiveness of controls
over the company's period-end financial reporting process only by
testing those controls in connection with a period-end.
    y. Within paragraph 35, the reference to paragraphs B1 through
B13 of Appendix B of Auditing Standard No. 2 is replaced with a
reference to paragraphs B10-B16 of Appendix B, Special Topics, of
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
    z. Within paragraph 36, the reference to paragraphs 109 through
115 and 117 through 125 of Auditing Standard No. 2 is replaced with
a reference to paragraphs 16-19 of Auditing Standard No. 5, An Audit
of Internal Control Over Financial Reporting That Is Integrated with
An Audit of Financial Statements.
    aa. The second sentence of paragraph 37 is replaced with--
    Therefore, if the auditor has been engaged to report on more
than one material weakness or on more than one stated control
objective, the auditor must evaluate whether he or she has obtained
sufficient evidence that the control objectives related to each of
the material weaknesses identified in management's assertion are
achieved.
    bb. The first two sentences of paragraph 38 are replaced with--
    Paragraphs 18-19 of Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements, should be applied in the context of
the engagement to report on whether a previously reported material
weakness continues to exist.
    cc. The note to paragraph 38 is deleted.
    dd. The note to paragraph 39 is deleted.
    ee. Paragraph 42 is replaced with--
    Management may conclude that a previously reported material
weakness no longer exists because its severity has been sufficiently
reduced such that it is no longer a material weakness.
    ff. Subparagraph f. of paragraph 44 is replaced with--
    Describing any fraud resulting in a material misstatement to the
company's financial statements and any other fraud that does not
result in a misstatement in the company's financial statements but
involves senior management or management or other employees who have
a significant role in the company's internal control over financial
reporting and that has occurred or come to management's attention
since the date of management's most recent annual assessment of
internal control over financial reporting.
    gg. Within the note to subparagraph b. of paragraph 51, the
reference to Auditing Standard No. 2 is replaced with a reference to
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
    hh. Within the note to subparagraph l. of paragraph 51, the
reference to Auditing Standard No. 2 is replaced with a reference to
Auditing Standard No. 5, An Audit of Internal Control Over Financial
Reporting That Is Integrated with An Audit of Financial Statements.
    ii. Within the note to the second bullet point of subparagraph
o. of paragraph 51, the reference to Auditing Standard No. 2 is
replaced with a reference to Auditing Standard No. 5, An Audit of
Internal Control Over Financial Reporting That Is Integrated with An
Audit of Financial Statements.
    jj. Within paragraph 52, the reference to Auditing Standard No.
2 is replaced with a

reference to Auditing Standard No. 5, An Audit of Internal Control
Over Financial Reporting That Is Integrated with An Audit of
Financial Statements.
    kk. Within paragraph 63, the reference to paragraphs 202 through
206 of Auditing Standard No. 2 is replaced with a reference to
paragraphs 7 and 29-32 of AU sec. 722, Interim Financial
Information.
    ll. Within paragraph 64, the reference to paragraphs 202 through
206 of Auditing Standard No. 2 is replaced with a reference to
paragraphs 7 and 29-32 of AU sec. 722, Interim Financial
Information.

II. Board's Statement of the Purpose of, and Statutory Basis for, the
Proposed Rules

    In its filing with the Commission, the Board included statements
concerning the purpose of, and basis for, the proposed rule and
discussed any comments it received on the proposed rule. The text of
these statements may be examined at the places specified in Item IV
below. The Board has prepared summaries, set forth in sections A, B,
and C below, of the most significant aspects of such statements.

A. Board's Statement of the Purpose of, and Statutory Basis for,
the Proposed Rules

(a) Purpose

    In 2002, Congress passed the Act, which, among other things,
established new provisions related to internal control over
financial reporting. Section 404 of the Act requires company
management to assess and report on the effectiveness of the
company's internal control. It also requires a company's independent
auditor, registered with the Board, to attest to management's
disclosures regarding the effectiveness of its internal control. As
directed by Sections 103 and 404 of the Act, the Board established a
standard to govern the newly required audit by adopting Auditing
Standard No. 2, An Audit of Internal Control Over Financial
Reporting Performed in Conjunction with an Audit of Financial
Statements (``Auditing Standard No. 2''). The SEC approved Auditing
Standard No. 2 on June 17, 2004.
    Since Auditing Standard No. 2 became effective, the Board has
closely monitored the progress registered firms have made in
implementing its requirements. The PCAOB's monitoring has included
gathering information during inspections of registered public
accounting firms; participating, along with the SEC, in two
roundtable discussions with representatives of issuers, auditors,
investor groups, and others; meeting with its Standing Advisory
Group; receiving feedback from participants in the Board's Forums on
Auditing in the Small Business Environment; and reviewing academic,
government, and other reports and studies.
    As a result of this monitoring, two basic propositions emerged.
First, the audit of internal control over financial reporting has
produced significant benefits, including an enhanced focus on
corporate governance and controls and higher quality financial
reporting. Second, these benefits have come at a significant cost.
Costs have been greater than expected and, at times, the related
effort has appeared greater than necessary to conduct an effective
audit of internal control over financial reporting.
    As part of a four-point plan to improve implementation of the
internal control requirements, the Board determined to amend
Auditing Standard No. 2. On December 19, 2006, the Board proposed
for comment a new standard on auditing internal control, An Audit of
Internal Control Over Financial Reporting That Is Integrated with an
Audit of Financial Statements, that would replace Auditing Standard
No. 2. After careful consideration of the comments it received and
the input from the SEC, the Board has refined its proposals to
provide additional clarity and further help auditors to focus on the
most important matters. The Board adopted the revised standard on
auditing internal control as Auditing Standard No. 5, to supersede
Auditing Standard No. 2.
    Under Section 10A(i) of the Exchange Act, as amended by Section
202 of the Act, all non-audit services that the auditor proposes to
perform for an issuer client ``shall be pre-approved by the audit
committee of the issuer.'' Rule 3525 would further implement the
Act's pre-approval requirement by requiring auditors to take certain
steps as part of seeking audit committee pre-approval of internal
control related non-audit services. These steps are intended to
ensure that audit committees are provided relevant information for
them to make an informed decision on how the performance of internal
control-related services may affect independence. Rule 3525 requires
a registered public accounting firm that seeks pre-approval of an
issuer audit client's audit committee to perform internal control-
related non-audit services that are not otherwise prohibited by the
Act or the rules of the SEC or the Board to: Describe, in writing,
to the audit committee the scope of the proposed service; discuss
with the audit committee the potential effects of the proposed
service on the firm's independence; and document the substance of
the firm's discussion with the audit committee.
    The conforming amendments update the Board's other auditing
standards in light of Auditing Standard No. 5, move information
contained in Auditing Standard No. 2 to the Board's interim
standards, and change the existing requirement that ``generally, the
date of completion of the field work should be used as the date of
the independent auditor's report'' to ``the auditor should date the
audit report no earlier than the date on which the auditor has
obtained sufficient competent evidence to support the auditor's
opinion.'' This change is consistent with a recent change adopted by
both the International Auditing and Assurance Standards Board and
the AICPA Auditing Standards Board.

(b) Statutory Basis

    The statutory basis for the proposed rule is Title I and II and
Section 404 of the Act.

B. Board's Statement on Burden on Competition

    The Board does not believe that the proposed rule will result in
any burden on competition that is not necessary or appropriate in
furtherance of the purposes of the Act. The proposed rules would
apply equally to all registered public accounting firms and their
associated persons. Moreover, Auditing Standard No. 5 explains how
to tailor internal control audits to fit the size and complexity of
the company being audited.

C. Board's Statement on Comments on the Proposed Rule Received From
Members, Participants or Others

    The Board released the proposed rules for public comment in
Release No. 2006-007 (December 19, 2006). A copy of Release No.
2006-007 and the comment letters received in response to the PCAOB's
request for comment are available on the PCAOB's Web site at http://www.pcaobus.org.
 The Board received 175 written comments. The Board

also discussed the proposals with its Standing Advisory Group on
February 22, 2007.\1\ The Board has clarified and modified certain
aspects of the proposed rules in response to the comments it
received, as discussed below.
---------------------------------------------------------------------------

    \1\ A transcript of the portion of the meeting that related to
the proposals and an archived web cast of the entire meeting are
available on the Board's Web site at http://www.pcaobus.org/Standards/Standing_Advisory_Group/Meetings/2007/02-22/SAG_Transcript.pdf
.

---------------------------------------------------------------------------

    The Board issued these proposals with the primary objectives of
focusing auditors on the most important matters in the audit of
internal control over financial reporting and eliminating procedures
that the Board believes are unnecessary to an effective audit of
internal control. The proposals were designed to both increase the
likelihood that material weaknesses in companies' internal control
will be found before they cause material misstatement of the
financial statements and steer the auditor away from procedures that
are not necessary to achieve the intended benefits. The Board also
sought to make the internal control audit more clearly scalable for
smaller and less complex public companies and to make the text of
the standard easier to understand. In formulating these proposals,
the Board re-evaluated every significant aspect of Auditing Standard
No. 2.
    A large majority of commenters were generally supportive of the
Board's proposals, particularly the top-down, risk-based approach
and focus on the most important matters. Based on the comments
received, the Board believes that the proposal achieves, in large
part, the objectives the Board set out when deciding to amend
Auditing Standard No. 2. Many commenters also offered suggestions to
improve the final standard, which the Board has carefully analyzed.
    In considering the comments received and formulating a final
standard, the Board closely coordinated its work with the SEC, which
proposed guidance for management on evaluating internal control at
the same time that the Board issued its proposals.\2\ In addition to
its role in implementing Section 404(a) of the Act, the SEC must
approve new PCAOB auditing standards before they can become
effective.\3\ On April 4, 2007, the Commission held a public meeting
to discuss the Board's proposals and the coordination of those
proposals with the Commission's

proposed management guidance. At the meeting, the SEC staff provided
the Commission its analysis of the public comments on the PCAOB's
proposal and the proposed management guidance. The Commission
endorsed the recommendations of its staff and directed its staff to
focus its remaining work in four areas:
---------------------------------------------------------------------------

    \2\ See Securities Exchange Act Release No. 54976 (Dec. 20,
2006).
    \3\ See Section 107 of the Act.
---------------------------------------------------------------------------

     ``Aligning the PCAOB's new auditing standard * * * with
the SEC's proposed new management guidance under Section 404,
particularly with regard to prescriptive requirements, definitions,
and terms'';
     ``Scaling the 404 audit to account for the particular
facts and circumstances of companies, particularly smaller
companies'';
     ``Encouraging auditors to use professional judgment in
the 404 process, particularly in using risk-assessment''; and
     ``Following a principles-based approach to determining
when and to what extent the auditor can use the work of others.''
\4\
---------------------------------------------------------------------------

    \4\ See SEC Press Release, ``SEC Commissioners Endorse Improved
Sarbanes-Oxley Implementation To Ease Smaller Company Burdens,
Focusing Effort On `What Truly Matters' '' (Apr. 4, 2007).
---------------------------------------------------------------------------

    After careful consideration of the comments it received and the
input from the SEC, the Board has refined its proposals to provide
additional clarity and further help auditors to focus on the most
important matters. The Board has decided to adopt the revised
standard on auditing internal control as Auditing Standard No. 5, to
supersede Auditing Standard No. 2. The Board has also decided to
adopt the independence rule and conforming amendments to the
auditing standards.\5\
---------------------------------------------------------------------------

    \5\ As discussed below, the Board has determined not to adopt
the proposed auditing standard on considering and using the work of
others.
---------------------------------------------------------------------------

Notable Areas of Change in the Final Standard

    The Board believes that the changes made to the proposal reflect
refinements, rather than significant shifts in approach. This
section describes the areas of change to the proposals that are most
notable. Additional discussion of comments received on the proposals
and the Board's response is included below.

Alignment With Management Guidance

    On December 20, 2006, the SEC issued proposed guidance to help
management evaluate internal control for purposes of its annual
assessment. In formulating a new standard on auditing internal
control, the Board sought to describe an audit process that would be
coordinated with management's evaluation process. Many commenters
suggested, however, that the SEC's management guidance and the
Board's standard should be more closely aligned.
    After considering the comments in this area, the Board has
decided to make changes that will improve the coordination between
the SEC's management guidance and the Board's standard. In doing so,
the Board has been mindful of the inherent differences in the roles
of management and the auditor. Management's daily involvement with
its internal control system provides it with knowledge and
information that may influence its judgments about how best to
evaluate internal control and the sufficiency of the evidence it
needs for its annual assessment. Management also should be able to
rely on self-assessment and, more generally, the monitoring
component of internal control, provided the monitoring component is
properly designed and operates effectively.
    The auditor is required to provide an independent opinion on the
effectiveness of the company's internal control over financial
reporting. The auditor does not have the familiarity with the
company's controls that management has and does not interact with or
observe these controls with the same frequency as management.
Therefore, the auditor cannot obtain sufficient evidence to support
an opinion on the effectiveness of internal control based solely on
observation of or interaction with the company's controls. Rather,
the auditor needs to perform procedures such as inquiry,
observation, and inspection of documents, or walkthroughs, which
consist of a combination of those procedures, in order to fully
understand and identify the likely sources of potential
misstatements, while management might be aware of those risk areas
on an on-going basis.
    The Board believes, however, that the general concepts necessary
to an understanding of internal control should be described in the
same way in the Board's standard and in the SEC's guidance.
Accordingly, the Board has decided to use the same definition of
material weakness in its standard that the SEC uses in its final
management guidance and related rules. In addition, the Board is
adopting the definition of significant deficiencies that the SEC has
proposed. The final standard and final management guidance also
describe the same indicators of a material weakness. In addition, as
described more fully below, the final standard on auditing internal
control uses the term ``entity-level controls'' instead of
``company-level controls,'' which was used in the proposed standard,
in order to use the same term as the SEC uses in its final
management guidance.\6\ Auditing Standard No. 5's discussion of the
effect of these controls is also consistent with the discussion of
the same topic in the SEC's final guidance.
---------------------------------------------------------------------------

    \6\ These terms were used interchangeably in the proposed
standard and SEC's proposed management guidance and, for these
purposes, they mean the same thing. See Securities Exchange Act
Release No. 54976 (Dec. 20, 2006), at 12 fn. 29.
---------------------------------------------------------------------------

The Top-Down Approach

    The proposed standard on auditing internal control was
structured around the top-down approach to identifying the most
important controls to test. This approach follows the same
principles that apply to the financial statement audit--the auditor
determines the areas of focus through the identification of
significant accounts and disclosures and relevant assertions. Under
the proposed standard, the auditor would specifically identify major
classes of transactions and significant processes before identifying
the controls to test.
    In response to comments about the level of detail in the
requirements of the proposed standard, the Board has reconsidered
whether the final standard should include the identification of
major classes of transactions and significant processes as a
specifically required step in the top-down approach. As a practical
matter, the auditor will generally need to understand the company's
processes to appropriately identify the correct controls to test.
The Board believes, however, that specific requirements directing
the auditor how to obtain that understanding are unnecessary and
could contribute to a ``checklist approach'' to compliance,
particularly for auditors who have a longstanding familiarity with
the company. Accordingly, the Board has removed the requirements to
identify major classes of transactions and significant processes
from the final standard. While this should allow auditors to apply
more professional judgment as they work through the top-down
approach, the end point is the same as in the proposed standard--the
requirement to test those controls that address the assessed risk of
misstatement to each relevant assertion.\7\
---------------------------------------------------------------------------

    \7\ See paragraph 21.
---------------------------------------------------------------------------

Emphasis on Fraud Controls

    The proposed standard on auditing internal control discussed
fraud controls and the auditor's procedures related to these
controls among the testing concepts included near the end of the
standard. Commenters suggested that the placement of the discussion,
or the lack of specificity regarding the controls that should be
deemed fraud controls, failed to properly emphasize these controls
or provide auditors with sufficient direction on how to test fraud
controls. In response, the Board has made several changes in the
final standard.
    First, the discussion of fraud risk and anti-fraud controls has
been moved closer to the beginning of the standard to emphasize to
auditors the relative importance of these matters in assessing risk
throughout the top-down approach.\8\ Incorporating the auditor's
fraud risk assessment--required in the financial statement audit--
into the auditor's planning process for the audit of internal
control should promote audit quality as well as better integration.
While internal control cannot provide absolute assurance that fraud
will be prevented or detected, these controls should help to reduce
instances of fraud, and, therefore, a concerted focus on fraud
controls in the internal control audit should enhance investor
protection. Second, management fraud has also been identified in the
final standard as an area of higher risk; accordingly, the auditor
should focus more of his or her attention on this area.\9\ Finally,
the standard, as adopted, provides additional guidance on the types
of controls that might address fraud risk.\10\
---------------------------------------------------------------------------

    \8\ See paragraphs 14 and 15.
    \9\ See paragraph 11.
    \10\ See paragraph 14.
---------------------------------------------------------------------------

Entity-Level Controls

    The proposed standard on auditing internal control emphasized
entity-level controls because of their importance both to the
auditor's ability to appropriately tailor the audit through a top-
down approach--

specifically by identifying and testing the most important
controls--and to effective internal control. Additionally, the
proposed standard emphasized that these controls might, depending on
the circumstances, allow the auditor to reduce the testing of
controls at the process level. Commenters suggested that the
proposed standard did not provide enough direction on how entity-
level controls can significantly reduce testing, and some suggested
that controls that operate at the level of precision necessary to do
so are uncommon. Many commenters suggested incorporating in the
final standard the discussion of direct versus indirect entity-level
controls that was included in the SEC's proposed management
guidance.
    The Board continues to believe that entity-level controls,
depending on how they are designed and operate, can reduce the
testing of other controls related to a relevant assertion. This is
either because the entity-level control sufficiently addresses the
risk related to the relevant assertion, or because the entity-level
controls provide some assurance so that the testing of other
controls related to that assertion can be reduced. In response to
comments and in order to clarify these concepts, the Board included
in the final standard a discussion of three broad categories of
entity-level controls, which vary in nature and precision, along
with an explanation of how each category might have a different
effect on the performance of tests of other controls.\11\
---------------------------------------------------------------------------

    \11\ See paragraph 23. The Board believes that expertise of
auditors and companies in the area of entity-level controls will
continue to evolve. For example, the Committee of Sponsoring
Organizations of the Treadway Commission has begun a project on the
monitoring component of internal control that may provide some
guidance in this area.
---------------------------------------------------------------------------

    The final standard explains that some controls, such as certain
control environment controls, have an important, but indirect
effect, on the likelihood that a misstatement will be detected or
prevented on a timely basis. These controls might affect the other
controls the auditor selects for testing and the nature, timing, and
extent of procedures the auditor performs on other controls.
    The final standard explains that other entity-level controls may
not operate at the level of precision necessary to eliminate the
need for testing of other controls, but can reduce the required
level of testing of other controls, sometimes substantially. This is
because the auditor obtains some of the supporting evidence related
to a control from an entity-level control and the remaining
necessary evidence from the testing of the control at the process
level. Controls that monitor the operation of other controls are the
best example of these types of controls. These monitoring controls
help provide assurance that the controls that address a particular
risk are effective and, therefore, they can provide some evidence
about the effectiveness of those lower-level controls, reducing the
testing of those controls that otherwise would be necessary.
    Lastly, the final standard explains that some entity-level
controls might operate at a level of precision that, without the
need for other controls, sufficiently addresses the risk of
misstatement to a relevant assertion. If a control sufficiently
addresses the risk in this manner, the auditor does not need to test
other controls related to that risk.

Walkthroughs

    The proposed standard on auditing internal control would have
required auditors to perform a walkthrough of each significant
process each year. This proposed requirement represented a change
from Auditing Standard No. 2, which required a walkthrough of each
major class of transactions within a significant process. Commenters
were split on the question of whether the re-calibration from major
class of transactions to significant process in the proposed
standard would result in a reduction of effort. Some issuers and
auditors suggested that walkthroughs are already being performed on
significant processes, while other issuers and auditors commented
that this proposed requirement would make a difference. A few
commenters suggested that a walkthrough of each significant process
was insufficient and would negatively affect audit quality, but many
others stated that walkthroughs should not be required at all.
    In evaluating these comments, the Board focused principally on
the objectives it believes are achieved through a properly performed
walkthrough. The Board firmly believes that those objectives should
be met for the auditor to verify that he or she has a sufficient
understanding of the points within the processes where misstatements
could occur and to properly identify the controls to test.\12\
Procedures that fulfill those objectives also play an important role
in the evaluation of the effectiveness of the design of the
controls. The Board believes that, in some instances, the
requirement to perform a walkthrough may have overshadowed the
objectives it was meant to achieve. This may have resulted in some
walkthroughs being performed to meet the requirement but failing to
achieve the intended purpose.
---------------------------------------------------------------------------

    \12\ See paragraph 34, which describes these objectives.
---------------------------------------------------------------------------

    The final standard, therefore, focuses specifically on achieving
certain important objectives, and the performance requirement is
based on fulfilling those objectives as they relate to the
understanding of likely sources of misstatement and the selection of
controls to test.\13\ While a walkthrough will frequently be the
best way of attaining these goals, the auditor's focus should be on
the objectives, not on the mechanics of the walkthrough. In some
cases, other procedures may be equally or more effective means of
achieving them.
---------------------------------------------------------------------------

    \13\ See paragraph 34.
---------------------------------------------------------------------------

Evaluation and Communication of Deficiencies

    The proposed standard on auditing internal control required the
auditor to evaluate the severity of identified control deficiencies
to determine whether they are significant deficiencies or material
weaknesses. It then required the auditor to communicate, in writing,
to management and the audit committee all significant deficiencies
and material weaknesses identified during the audit. The proposed
standard defined ``significant deficiency'' as ``a control
deficiency, or combination of control deficiencies, such that there
is a reasonable possibility that a significant misstatement of the
company's annual or interim financial statements will not be
prevented or detected.'' The term ``significant misstatement'' was
defined, in turn, to mean ``a misstatement that is less than
material yet important enough to merit attention by those
responsible for oversight of the company's financial reporting.''
    Commenters generally supported the proposed definition of the
term ``significant misstatement,'' though some were concerned that
it was too subjective. Other commenters questioned whether the
standard should include a definition of significant deficiency and a
requirement to communicate significant deficiencies to the audit
committee. At least one commenter suggested that the term be removed
from the standard.
    After considering these comments, the Board has determined to
make changes to the definition of significant deficiency and related
requirements.\14\ The Board continues to believe that the standard
should require auditors to provide relevant information about
important control deficiencies--even those less severe than a
material weakness--to management and to the audit committee. The
final standard, therefore, requires the auditor to consider and
communicate any identified significant deficiencies to the audit
committee. In order to emphasize that the auditor need not scope the
audit to identify all significant deficiencies, however, the Board
placed these provisions in the section of the final standard that
describes communications requirements.\15\
---------------------------------------------------------------------------

    \14\ The Board also made minor changes to the definition of
material weakness in order to use the same definition in the SEC's
management guidance and related rule. In the final standard,
material weakness is defined as ``a deficiency, or a combination of
deficiencies, in internal control over financial reporting, such
that there is a reasonable possibility that a material misstatement
of the company's annual or interim financial statements will not be
prevented or detected on a timely basis.''
    \15\ See paragraph 80. The final standard also includes the
proposed requirement for the auditor to communicate, in writing, to
management, all deficiencies in internal control identified during
the audit and inform the audit committee when such a communication
has been made, and the proposed requirement to inform, when
applicable, the board of directors of the auditor's conclusion that
the audit committee's oversight is ineffective. See paragraphs 79
and 81. Some commenters believed that the requirement to communicate
all identified deficiencies to management would result in an
unnecessary administrative exercise. The Board continues to believe,
however, that auditors should provide information about identified
control deficiencies to management.
---------------------------------------------------------------------------

    The relatively minor changes that the Board made to the
definition of significant deficiency are also intended to focus the
auditor on the communication requirement and away from scoping
issues. The final definition is based on the proposed definition of
``significant misstatement,'' which commenters generally supported,
and is aligned with the SEC's proposed definition of the same term.
Under the final standard, a significant deficiency is ``a
deficiency, or a

combination of deficiencies, in internal control over financial
reporting that is less severe than a material weakness yet important
enough to merit attention by those responsible for oversight of the
company's financial reporting.''

Scaling the Audit

    The proposed standard on auditing internal control indicated
that a company's size and complexity are important considerations
and that the procedures an auditor should perform depend upon where
along the size and complexity continuum a company falls. The
proposed standard included a section on scaling the audit for
smaller, less complex companies and would have required auditors to
evaluate and document the effect of the company's size and
complexity on the audit. This documentation requirement applied to
audits of companies of all sizes. The proposed standard also
included a list of the attributes of smaller, less complex companies
and a description of how the auditor might tailor his or her
procedures when these attributes are present. In general, commenters
were supportive of the proposed standard's general approach to
scalability, but had several recommendations for change.
    Some commenters suggested that scalability should not be covered
as a stand-alone discussion applicable only to smaller companies and
that other companies, regardless of size, might have areas that are
less complex. The Board agrees that the direction on scaling will be
most effective if it is a natural extension of the risk-based
approach and applicable to all companies. Consequently, the Board
shortened the separate section on ``scaling the audit,'' and
incorporated a discussion of scaling concepts, similar to what was
proposed, throughout the final standard. Specifically, notes to
relevant paragraphs describe how to tailor the audit to the
particular circumstances of a smaller, less complex company or unit.
The Board also retained the list of attributes of smaller, less
complex companies and acknowledged that, even within larger
companies, some business units or processes may be less complex than
others. Discussion of these attributes has been incorporated in the
section on the auditor's planning procedures in the final
standard.\16\ As described in the proposing release, the provisions
on scalability in the final standard will form the basis for
guidance on auditing internal control in smaller companies to be
issued this year.
---------------------------------------------------------------------------

    \16\ See paragraph 9.
---------------------------------------------------------------------------

    Several commenters, mostly auditors, suggested that the
performance requirements that applied to all companies, including
large, complex companies, would lead to unnecessary and costly
documentation requirements. These commenters were particularly
concerned about the requirement to document the effects of size and
complexity on all aspects of the audit, even if a particular
engagement could not be tailored as a result of these factors. After
considering these comments, the Board agreed that this documentation
requirement is not necessary to promote audit quality and,
therefore, has not included it in the final standard.

Use of the Work of Others in an Integrated Audit

    At the time the Board proposed Auditing Standard No. 5 for
public comment, the Board also proposed an auditing standard
entitled Considering and Using the Work of Others in an Audit that
would have superseded the Board's interim standard AU sec. 322, The
Auditor's Consideration of the Internal Audit Function in an Audit
of Financial Statements (``AU sec. 322''), and replaced the
direction on using the work of others in an audit of internal
control in Auditing Standard No. 2. As discussed in the proposing
release, the Board had several objectives in proposing this
standard. The first was to better integrate the financial statement
audit and the audit of internal control by having only one framework
for using the work of others in both audits. Additionally, the Board
wanted to encourage auditors to use the work of others to a greater
extent when the work is performed by sufficiently competent and
objective persons. Among other things, under the proposed standard,
auditors would have been able to use the work of sufficiently
competent and objective company personnel--not just internal
auditors--and third parties working under the direction of
management or the audit committee for purposes of the financial
statement audit as well as the audit of internal control.
    The Board received numerous comments on the proposed standard on
using the work of others. Commenters generally indicated support for
a single framework regarding the auditor's use of the work of others
in an integrated audit. Some, however, suggested retaining existing
AU sec. 322 as the basis for that single framework. They expressed
the view that the objective of removing barriers to integration and
using the work of others to the fullest extent appropriate could be
achieved by retaining AU sec. 322 and going forward with the
proposed removal of the ``principal evidence'' provision. At the
same time, some other commenters suggested that the proposed
standard did not go far enough in encouraging auditors to use the
work of others.
    After considering these comments, the Board continues to believe
that a single framework for the auditor's use of the work of others
is preferable to separate frameworks for the audit of internal
control and the audit of financial statements. The factors used to
determine whether and to what extent it is appropriate to use the
work of others should be the same for both audits. At the same time,
the Board agreed with those commenters who suggested that better
integration of the audits could be achieved without replacing the
existing auditing standard. The Board therefore has decided to
retain AU sec. 322 for both audits and incorporate language into
Auditing Standard No. 5 that establishes these integration concepts
rather than adopt the proposed standard on considering and using the
work of others.
    Consistent with the proposal, however, Auditing Standard No. 5
allows the auditor to use the work of others to obtain evidence
about the design and operating effectiveness of controls and
eliminates the principal evidence provision. Recognizing that
issuers might employ personnel other than internal auditors to
perform activities relevant to management's assessment of internal
control over financial reporting, the final standard allows the
auditor to use the work of company personnel other than internal
auditors, as well as third parties working under the direction of
management or the audit committee.\17\
---------------------------------------------------------------------------

    \17\ See paragraph 17.
---------------------------------------------------------------------------

    In line with the overall risk-based approach to the audit of
internal control over financial reporting, the extent to which the
auditor may use the work of others depends, in part, on the risk
associated with the control being tested. As the risk decreases, so
does the need for the auditor to perform the work him or herself.
The impact of the work of others on the auditor's work also depends
on the relationship between the risk and the competence and
objectivity of those who performed the work. As the risk decreases,
the necessary level of competence and objectivity decreases as
well.\18\ Likewise, in higher risk areas (for example, controls that
address specific fraud risks), use of the work of others would be
limited, if it could be used at all.
---------------------------------------------------------------------------

    \18\ See paragraph 18.
---------------------------------------------------------------------------

    Finally, the Board understands that some of the work performed
by others for the purposes of management's assessment of internal
controls can be relevant to the audit of financial statements.
Therefore, in an integrated audit, the final standard allows the
auditor to use the work of these sufficiently competent and
objective others--not just internal auditors--to obtain evidence
supporting the auditor's assessment of control risk for purposes of
the audit of financial statements.\19\ The Board believes that this
provision will promote better integration of the audit of internal
control with the audit of financial statements.
---------------------------------------------------------------------------

    \19\ See paragraph 17.
---------------------------------------------------------------------------

Rule 3525--Audit Committee Pre-Approval of Non-Audit Services Related
to Internal Control Over Financial Reporting

    The Board also proposed a new rule related to the auditor's
responsibilities when seeking audit committee pre-approval of
internal control related non-audit services. As proposed, the rule
required a registered public accounting firm that seeks pre-approval
of an issuer audit client's audit committee to perform internal
control-related non-audit services that are not otherwise prohibited
by the Act or the rules of the SEC or the Board to: describe, in
writing, to the audit committee the scope of the proposed service;
discuss with the audit committee the potential effects of the
proposed service on the firm's independence; and document the
substance of the firm's discussion with the audit committee. These
requirements parallel the auditor's responsibility in seeking audit
committee pre-approval to perform tax services for an audit client
under PCAOB Rule 3524. Most commenters were supportive of the rule
as proposed, though some offered suggestions about what should

be included in the required communication. After considering the
comments on the proposed rule, the Board has adopted it without
change.

Conforming Amendments

    As part of the proposal issued for public comment, the Board
proposed amendments to certain of the Board's other auditing
standards. Only one comment letter specifically addressed the
proposed amendments. That letter expressed support for the
amendments and suggested a few additional amendments that might be
necessary. The Board has considered this comment and added these
additional amendments, as well as others, as necessary based on the
final standard.

Effective Date

    The proposing release solicited commenters' feedback on how the
Board could structure the effective date of the final requirements
so as to best minimize disruption to ongoing audits, but make
greater flexibility available to auditors as early as possible. Most
commenters on this topic suggested making the final standard on
auditing internal control effective as soon as possible in order to
be available for 2007 audits.
    The Board agrees that the improvements in Auditing Standard No.
5 should be available as soon as possible. Accordingly, the Board
has determined that Auditing Standard No. 5, Rule 3525, and the
conforming amendments will be effective, subject to approval by the
SEC, for audits of fiscal years ending on or after November 15,
2007. Earlier adoption is permitted, however, at any point after SEC
approval. Auditors who elect to comply with Auditing Standard No. 5
after SEC approval but before its effective date must also comply,
at the same time, with Rule 3525 and other PCAOB standards as
amended by this release.
    Auditing Standard No. 2 will be superseded when Auditing
Standard No. 5 becomes effective. Auditors who do not elect to
comply with Auditing Standard No. 5 before that date (but after SEC
approval) must continue to comply with Auditing Standard No. 2 until
it is superseded. Such auditors should, however, apply the
definition of ``material weakness'' contained in Auditing Standard
No. 5, rather than the one contained in Auditing Standard No. 2. The
SEC has adopted a rule to define the term ``material weakness,'' and
the definition in Auditing Standard No. 5 parallels the new SEC
definition.

Additional Discussion of Comments and the Board's Response Alignment of
Board's Internal Control Auditing Standard and the SEC's Guidance to
Management

    Many commenters suggested that the SEC's guidance to management
and the Board's auditing standard should be more closely aligned.
The commenters appeared to hold different opinions, however, about
what alignment should mean in this context. Some commenters
suggested that the most important issue was the need to use the same
definitions of important terms in both documents. Some focused on
perceived differences in scope, testing, and documentation
requirements, while others suggested that the tone of the two
documents was different and that the Board's proposals were more
prescriptive. A few commenters suggested that the standard on
auditing internal control should merely refer to the SEC management
guidance without providing additional direction to the auditor.
    As discussed above, in formulating a new standard on auditing
internal control, the Board intended to describe an audit process
that would be coordinated with management's evaluation process.
After considering the comments in this area, the Board made several
changes, described above, that improve coordination while
recognizing the inherent differences in the roles of management and
the independent auditor under Section 404. The Board also adopted,
as proposed, the final standard without a requirement for the
auditor to perform an evaluation of management's assessment process.
Commenters generally supported this aspect of the proposal, which
was intended to respond to concerns that the requirements of
Auditing Standard No. 2 had become de facto guidance for
management's process. The absence of this requirement in the final
standard should also allow for improved coordination between
management and the auditor.

Level of Prescriptive Detail

    Some commenters suggested that there remained too many instances
of the use of the terms ``should'' and ``must'' in the proposed
standard and that this might drive excessive documentation and
possibly unnecessary work. The Board's Rule 3101 describes the level
of responsibility that these imperatives impose on auditors when
used in PCAOB standards, and the Board uses these terms in its
standards to clearly convey its expectations. In response to these
comments, the Board analyzed each requirement in the proposed
standard to determine whether more reliance could be placed on
general principles rather than detailed requirements. Where
appropriate, the Board made modifications to make the final standard
more principles-based. As discussed more fully above, areas in which
changes were made include the focus on fulfilling the objectives of
a walkthrough and in the description of the top-down approach. Some
of these changes also contributed to better coordination with the
SEC's guidance for management.
    In addition, several commenters expressed concern over the
creation of presumptively mandatory responsibilities related to
efficiency concepts. The example cited most often was the note to
paragraph 3 of the proposed standard on auditing internal control,
which stated--

    Note: The auditor should select for testing only those controls
that are important to the auditor's conclusion about whether the
company's controls sufficiently address the assessed risk of
misstatement to a given relevant assertion that could result in a
material misstatement to the company's financial statements.

    Commenters suggested that because of this requirement for the
auditor to select ``only those controls that are important'' for
testing, an auditor would have violated the Board's standards if he
or she tested even one control that was later shown to be not
important. Commenters believed that this would undermine audit
effectiveness and recommended removal of such statements.
    One of the objectives of the revised standard is to encourage
auditors to focus on those areas that present the greatest risk of
allowing a material misstatement in the financial statements.
However, the Board agrees that its standards should not define a
ceiling or maximum amount of work which the auditor may not exceed.
While this statement (and others like it) in the proposed standard
was not intended to imply that the Board would, with hindsight,
suggest that an auditor violated the standard through testing of a
control that was later determined to be not important to the audit,
the Board has removed the note to paragraph 3 in response to these
comments. Similar statements throughout the standard have also
either been removed or modified.

Walkthroughs

    The proposed standard required that the auditor perform a
walkthrough of each significant process each year and allowed the
auditor to use others, such as management personnel and internal
auditors, to directly assist the auditor in this work. The proposed
standard also indicated that the walkthrough provides audit evidence
but did not prescribe further requirements regarding the
circumstances in which a walkthrough might provide the auditor with
sufficient evidence of operating effectiveness for a particular
control. The proposing release, however, noted that a walkthrough
could be sufficient for some low-risk controls in subsequent years.
    As discussed above, the Board received a significant number of
comments on this topic. While several commenters expressed support
for the importance of the walkthrough to audit quality, many
commenters suggested that the proposed provisions in this area were
more prescriptive than necessary, and suggested risk concepts as a
way to add flexibility. While these commenters acknowledged the
value of a walkthrough and its importance to the evaluation of
design effectiveness, many stated that the requirement to perform a
walkthrough in an area that is either low-risk, not complex, or
unchanged appears inconsistent with the other areas in the proposed
standard that rely upon auditor judgment to a much greater extent.

Use of Others in Achieving the Objectives of a Walkthrough

    Commenters supported allowing the auditor to use others to
provide the auditor with direct assistance, particularly in low-risk
areas, with only a few commenters believing that this change could
jeopardize the quality of the audit. In addition, many commenters
believed that the standard should allow full use of the work of
others in performing walkthroughs, although some commenters strongly
disagreed with this point.
    As discussed above, the final standard focuses the auditor on
achieving four objectives related to the identification of

where within the company's processes misstatements could arise,
rather than specifically on performing walkthroughs. Due to the
importance of achieving these objectives to the auditor's conclusion
about internal control, the Board believes that allowing the use of
the work of others to a greater extent than what was proposed would
not provide the auditor with an adequate understanding of the
relevant risks and the related controls. Therefore, similar to the
proposed standard, Auditing Standard No. 5 allows the auditor to use
the work of others in achieving the objectives of a walkthrough, but
only as direct assistance. That is, the auditor will be required to
supervise, review, evaluate, and test the work performed by
others.\20\
---------------------------------------------------------------------------

    \20\ See paragraph 27 of AU sec. 322, The Auditor's
Consideration of the Internal Audit Function in an Audit of
Financial Statements.
---------------------------------------------------------------------------

Using Walkthroughs To Test Operating Effectiveness

    On the subject of using walkthroughs to test operating
effectiveness, commenters suggested that walkthroughs can provide
sufficient evidence of operating effectiveness, but held different
views about situations in which this would be the case. Some
commenters supported the use of walkthroughs in low-risk areas,
while others focused on whether the control itself should be low-
risk. Several commenters suggested that a walkthrough could provide
sufficient evidence of operating effectiveness for lower-risk
controls but only when entity-level controls are strong. Almost all
commenters agreed that the proposed standard focused on the
appropriate conditions for using such an approach--specifically,
when risk is low, when past audits indicate effective design and
operation of the control, and when no changes have been made to the
control or process in which the control resides.
    After considering these comments, the Board has decided that the
risk-based approach that is described in the final standard is the
appropriate framework for determining the evidence necessary to
support the auditor's opinion. Therefore, Auditing Standard No. 5
articulates the principle that performance of a walkthrough might
provide sufficient evidence of operating effectiveness, depending on
the risk associated with the control being tested, the specific
procedures performed as part of the walkthroughs and the results of
the procedures performed.\21\ The Board believes that establishing
more detailed requirements in this area is not necessary, because
application of the general principle in the standard will depend on
the particular facts and circumstances presented.
---------------------------------------------------------------------------

    \21\ See paragraph 49.
---------------------------------------------------------------------------

Assessing Risk

    The Board's May 16, 2005 guidance emphasized the importance of
risk assessment in the audit of internal control, and that element
of the guidance was incorporated and enhanced in the proposed
standard. The proposed standard required risk assessment at each of
the decision points in a top-down approach, including the auditor's
identification of significant accounts and disclosures and their
relevant assertions. The proposed standard also required an
assessment of risk at the individual control level, and required
that the auditor determine the evidence necessary for a given
control based on this risk assessment.
    The Board received many comments on the risk assessment
provisions in the proposed standard. Comments on the proposed risk
assessment approach were generally supportive, with some commenters
suggesting ways for improving the risk assessment emphasis in the
standard. Many commenters discussed the requirement in the proposed
standard for the auditor to assess the risk that the control might
not be effective and, if not effective, the risk that a material
weakness would result for each control the auditor selected for
testing. Commenters suggested that this requirement conflicted with
both current practice and the requirements within the interim
standards for the financial statement audit, which involve risk
assessment at the financial statement assertion level. These
commenters believed that this requirement would result in risk
assessments at both the assertion level and the individual control
level and suggested that assessing (and documenting) risk at the
relevant assertion level is sufficiently precise to drive
appropriate audits. Furthermore, they believed that a specific
requirement to assess risk at the individual control level and its
associated documentation requirement would be unnecessary.
    After considering these comments, the Board continues to believe
that the auditor may vary the nature, timing, and extent of testing
based on the assessed risk related to a control. Making this
assessment a presumptively mandatory requirement, as it was in the
proposed standard, however, does not appear necessary to achieve the
intended benefits of varied testing based on the risk associated
with a control. Auditing Standard No. 5, therefore, requires the
auditor to assess the risk related to the relevant assertion, but
not the risk at the individual control level. The standard permits
the auditor to consider the risk at the control level, however, and
alter the nature, timing, and extent of testing accordingly.
    Several commenters expressed concern about the advisability of
taking a risk-based approach and the adequacy of the Board's interim
standards regarding risk assessment. These commenters suggested that
auditors have frequently been unsuccessful at applying a risk-based
approach to the financial statement audit in the past.
    The Board has found the arguments for a more principles-based
approach to internal control auditing convincing, and the principle
that the auditor should vary the testing to respond to the risk is
one of the most important in the standard. Early implementation of
Auditing Standard No. 2 demonstrated that, when internal control is
audited without adequate consideration of risk, the areas that pose
the greatest danger of material misstatement may be obscured or
lost. The emphasis on risk, therefore, drives an audit that is more
effective and focused. While the Board believes that auditors can
appropriately assess risk based on the interim auditing standards,
it has committed to examining the existing standards in this area to
see where improvements can be made. This is currently one of the
Board's standard setting priorities.

Evaluation of Deficiencies

    The Board received a substantial number of comments on the topic
of evaluating deficiencies, including comments on the proposed
definitions of material weakness and significant deficiency, the
``strong indicators'' of a material weakness, and the requirement to
evaluate all identified deficiencies. While a number of commenters
stated that auditors do identify material weaknesses in the absence
of an actual material misstatement, some noted that, in many cases,
material weaknesses are identified only when material misstatements
are discovered. Several commenters suggested that the proposed
standard, with its focus on using a top-down approach and scoping to
identify material weaknesses, would allow auditors to do a more
thorough review of the most important controls with less effort
expended on reviewing lower risk controls. These commenters often
stated that this approach should increase the likelihood of the
auditor detecting material weaknesses before a material misstatement
occurs.

Definition of a Material Weakness

    The proposed standard retained the basic framework in Auditing
Standard No. 2 that described material weaknesses by reference to
the likelihood and magnitude of a potential misstatement. While the
Board believed that framework to be sound, it made an effort to
clarify the definition in the proposed standard by replacing the
reference to ``more than remote likelihood'' with ``reasonable
possibility.'' Financial Accounting Standards Board (``FASB'')
Statement No. 5 describes the likelihood of a future event occurring
as ``probable,'' ``reasonably possible,'' or ``remote.'' The
definition in Auditing Standard No. 2 referred to a ``more than
remote'' likelihood of a misstatement occurring. In accordance with
FASB Statement No. 5, the likelihood of an event is ``more than
remote'' when it is either ``reasonably possible'' or ``probable.''
    As the Board noted in the proposing release, however, some
auditors and issuers have misunderstood the term ``more than
remote'' to mean something significantly less likely than a
reasonable possibility. This, in turn, could have caused these
issuers and auditors to evaluate the likelihood of a misstatement at
a much lower threshold than the Board intended. Because the term
``more than remote'' could have resulted in auditors and issuers
evaluating likelihood at a more stringent level than originally
intended, the Board proposed changing the definition to refer to a
``reasonable possibility.''
    Commenters on this change were split between those that felt the
change would reduce unnecessary effort spent on identifying and
analyzing deficiencies, and those who believed it would not. Several
commenters noted that the replacement of the term ``more than remote
likelihood'' with the term ``reasonable possibility'' does not raise
the auditor's threshold for classifying

deficiencies. According to those commenters, the change simply
attempts to align the description of the threshold for identifying
deficiencies with previous guidance issued by the PCAOB. The Board
continues to believe that the proposed definition--as well as
Auditing Standard No. 2--established an appropriate threshold for
the likelihood part of the definition of material weakness. While
the Board agrees that, as a definitional matter, ``reasonable
possibility'' and ``more than remote'' describe the same threshold,
it believes that ``reasonable possibility'' describes that threshold
more appropriately and clearly, and will therefore avoid the
misunderstanding of the threshold created by the way it was
described in Auditing Standard No. 2. As a result, it retained that
term in the final definition in the standard.
    In addition, some commenters noted that the definitions of
material weakness and significant deficiency in the proposed
standard, like the definitions in Auditing Standard No. 2, referred
to the likelihood of a material misstatement in both the interim and
annual financial statements. Most of these commenters suggested that
the Board remove the term ``interim'' from the definitions of
material weakness and significant deficiency because, according to
the commenters, it causes confusion when scoping the audit of
internal control and unnecessarily complicates the evaluation of
deficiencies, particularly in the absence of guidance from the SEC
and FASB regarding interim materiality. Some commenters, however,
said that the Board should not remove the term ``interim'' from the
definitions because the evaluation of deficiencies should be
performed to consider the effectiveness of internal control for both
the interim and annual financial statements. After carefully
considering these comments, and in order to use the same definition
that the SEC uses in its guidance to management, the Board
determined to retain the reference to interim financial statements
in the final definition of material weakness.\22\
---------------------------------------------------------------------------

    \22\ The provisions in the final standard relating to
significant deficiencies are discussed above. As discussed above,
the Board also made minor wording changes to the definition of
material weakness in order to use the same definition as the SEC in
its guidance to management and related rules.
---------------------------------------------------------------------------

Indicators of a Material Weakness

    The proposed standard described circumstances that should be
regarded as strong indicators of a material weakness in internal
control. The proposing release noted that the identification of one
of these strong indicators should bias the auditor toward a
conclusion that a material weakness exists but does not require the
auditor to reach that conclusion. Under the proposal, the auditor
could determine that these circumstances do not rise to the level of
a material weakness, and in some cases, are not deficiencies at all.
    Many commenters supported the proposed changes from Auditing
Standard No. 2 relating to strong indicators, agreeing that, by
allowing greater use of professional judgment in this area, practice
will improve. A few commenters stated that these changes may lead to
some inconsistency in practice, but consistent with other
commenters, they still supported the use of greater professional
judgment in the evaluation of deficiencies. At least one commenter
suggested that several of the strong indicators were not indicators
of a material weakness but should be, under all circumstances, a
material weakness. A few commenters also suggested that the list of
strong indicators in Auditing Standard No. 2 actually stifles the
auditor's judgment to the point that auditors fail to identify
material weaknesses that exist because the deficiency is not on the
list of strong indicators. These commenters suggested that removing
the list of strong indicators entirely would be best.
    The Board believes that auditor judgment is imperative in
determining whether a deficiency is a material weakness and that the
standard should encourage auditors to use that judgment. At the same
time, the Board continues to believe that highlighting certain
circumstances that are indicative of a material weakness provides
practical information about the application of the standard. As a
result, the Board has included this information in the final
standard but has taken a more principles-based approach.
Additionally, the Board has coordinated with the SEC so that the
indicators in the auditing standard parallel those in the SEC's
management guidance.
    Rather than referring to ``strong indicators,'' the final
standard refers simply to ``indicators'' of material weakness.\23\
The standard also makes clear that the list of indicators is not
exhaustive and should not be used as a checklist. Specifically,
under the final standard, the presence of one of the indicators does
not mandate a conclusion that a material weakness exists. At the
same time, a deficiency that is not a listed indicator may be a
material weakness.
---------------------------------------------------------------------------

    \23\ The Board included as an indicator the proposed standard's
requirement to determine the level of assurance that would satisfy
prudent officials in the conduct of their own affairs that they have
reasonable assurance that transactions are recorded as necessary to
permit the preparation of financial statements in conformity with
generally accepted accounting principles. In the proposal, if the
auditor determined that a deficiency would prevent prudent officials
from concluding that they have such reasonable assurance, the
auditor was required to deem the deficiency to be at least a
significant deficiency. Under the final standard, if the auditor
determines that a deficiency might prevent prudent officials from
concluding that they have such reasonable assurance, this
circumstance is an indicator of material weakness.
---------------------------------------------------------------------------

    The Board did not adopt as indicators in the final standard
certain proposed strong indicators. The Board believes, as at least
one commenter suggested, that some of these proposed strong
indicators are better characterized as material weaknesses rather
than as indicators of a material weakness.\24\ Including them in the
list of indicators, as adopted, would therefore be inconsistent with
the degree of judgment required to evaluate whether an indicator of
a material weakness is, under particular facts and circumstances, a
material weakness.
---------------------------------------------------------------------------

    \24\ One such proposed strong indicator was an ineffective
control environment. Under the proposal, indicators of an
ineffective control environment included identification of fraud on
the part of senior management and significant deficiencies that have
been communicated to management and the audit committee and remain
uncorrected after some reasonable period of time. The final standard
includes the identification of fraud on the part of senior
management as an indicator of a material weakness. In order to
simplify the list and make it more principles-based, as well as to
align it with the SEC management guidance, however, the Board did
not include significant deficiencies that remain uncorrected as an
indicator in the final standard.
---------------------------------------------------------------------------

Requirement To Evaluate All Identified Deficiencies

    The proposed standard required the auditor to evaluate the
severity of each control deficiency that comes to his or her
attention. The same provision in the proposed standard made clear,
however, that the auditor need not scope the audit to find control
deficiencies that are less severe than material weaknesses. A few
commenters believed that this requirement is not necessary and
suggested that an acceptable alternative would be for the auditor to
verify that management has evaluated all deficiencies.
    The Board continues to believe that the auditor needs to
evaluate all deficiencies that come to his or her attention. Without
such an evaluation, there would not be a sufficient basis for the
auditor's opinion.

Additional Scoping and Materiality Issues

    The proposed standard clarified that the auditor should plan and
perform the audit of internal control using the same materiality
measures used to plan and perform the audit of the annual financial
statements. This direction was intended to address concerns that
auditors have interpreted Auditing Standard No. 2 as directing them
to search for potential defects in internal control at a lower
materiality level than that used in the audit of the annual
financial statements.
    The Board received many comments on materiality and scoping, and
a large portion of the commenters expressed support for the proposed
standard's approach. Some commenters, however, recommended providing
clear quantitative guidelines for calculating materiality. Other
commenters expressed concern about such an approach, fearing that
material areas would be inappropriately excluded from the audit
scope. Finally, some commenters suggested that the Board should
provide additional guidance on scoping and extent of control testing
decisions, such as guidance on sample sizes related to testing of
high-risk controls versus low-risk controls or more specific
guidance on the scope of the internal control audit for entities
with multiple locations.\25\
---------------------------------------------------------------------------

    \25\ The proposed standard focused on the auditor's assessment
of risk of material misstatement and how the auditor could carry
that assessment process into the scoping of a multi-location audit.
Commenters were very supportive of the Board's approach in this area
and, consequently, the Board has determined to adopt these
provisions as proposed.
---------------------------------------------------------------------------

    After considering these comments, the Board has determined to
adopt its discussion of materiality in the internal control audit as
proposed. The Board believes that the auditing standard on internal
control is an inappropriate place to redefine or refine the

meaning of materiality, which is a long-established concept in the
federal securities laws. With respect to requests for more specific
guidance on scoping or extent of testing issues, the Board has, as
discussed above, endeavored to adopt a standard that relies more on
general principles than detailed requirements. Accordingly, the
Board believes that auditors should make specific determinations of
how to comply with the general scoping and testing requirements in
the standard using professional judgment in the particular
circumstances presented.

Scaling the Audit for Smaller Companies

    As discussed above, the Board received many comments on the
proposed section on scaling the audit from commenters with a variety
of perspectives. The comments covered a wide range of issues. In
addition to the matters discussed above, commenters suggested:
     That the proposed section on scalability should be
focused more closely on how complexity relates to a risk-based
audit;
     That the proposed standard did not provide sufficient
flexibility for smaller companies and that the standard should
provide for more ``credit'' for control testing based on work done
as part of the financial statement audit;
     That the resulting costs of these proposed changes
would need to be studied for several years to determine if they are
appropriate;
     That the attributes of smaller, less complex companies
that were included in the proposed standard were appropriate and
that the tailoring directions for auditors were adequate;
     That some of the attributes of smaller, less complex
companies that might allow the auditor to tailor the audit might be,
instead, risk factors that require more testing;
     That the emphasis on entity-level controls might not be
appropriate; and
     That the Board's project to develop guidance on
auditing internal control in smaller public companies is necessary.
    As discussed above, the Board made several changes in response
to comments in the final standard. The new standard provides
direction on how to tailor internal control audits to fit the size
and complexity of the company being audited. It does so by including
notes throughout the standard on how to apply the principles in the
standard to smaller, less complex companies, and by including a
discussion of the relevant attributes of smaller, less complex
companies as well as less complex units of larger companies. The
Board believes that the final standard appropriately considers the
circumstances of smaller and less complex public companies (and
other companies with less complex business units) while requiring a
high-quality audit regardless of company size or complexity. The
planned guidance on this topic will provide additional practical
information for auditors of smaller companies.

Information Technology Principles

    In gaining an understanding of the effect of information
technology (``IT'') on internal control over financial reporting and
the risks the auditor should assess, the proposed standard directed
the auditor to apply guidance in AU sec. 319, Consideration of
Internal Control in a Financial Statement Audit. Additionally, the
proposed standard included a discussion of IT operations at smaller
and less complex companies. A number of commenters discussed the
importance of IT risks to determining the scope of the audit and
recommended that the final standard include additional guidance on
how the risk assessment related to IT is incorporated in the audit
of internal control.
    In response to these comments, the Board included in Auditing
Standard No. 5 a note to paragraph 36 that clarifies that the
identification of risks and controls within IT should not be a
separate evaluation but, rather, an integral part of the auditor's
top-down risk assessment, including identification of significant
accounts and disclosures and their relevant assertions, as well as
the controls to test.

Roll-forward Procedures

    The proposed standard discussed the procedures the auditor
should perform to obtain additional evidence concerning the
operation of the control when the auditor reports on the
effectiveness of the control ``as of'' a specific date, but has
tested the effectiveness of the control at an interim date. The
Board received a few comments on this topic, mainly from auditors.
The comments were consistent in their view that the proposed
standard improperly implies, by using the expression ``if any'' in
relation to additional evidence the auditor is required to obtain,
that the auditor may not need to do any roll-forward work.
Commenters suggested that such an approach would be inconsistent
with paragraph .99 of AU sec. 319 and suggested that the words ``if
any'' be removed from the final standard. The Board believes that
its standard should be consistent with AU sec. 319.99 in that the
auditor should perform some level of roll-forward procedures.
Consequently, the Board removed the words ``if any'' from the
relevant paragraphs of Auditing Standard No. 5 to correct the
inconsistency. The Board also noted that, in some circumstances,
inquiry alone might be a sufficient roll-forward procedure.

Cumulative Knowledge and Rotation

    The proposed standard on auditing internal control allowed the
auditor to incorporate knowledge from previous years' audits into
his or her decision making process for determining the nature,
timing, and extent of testing necessary. The section in the proposed
standard on special considerations for subsequent years' audits
built upon the risk-based framework in the proposed standard for
determining the nature, timing, and extent of testing by describing
certain additional factors for the auditor to evaluate in subsequent
years. These factors included the results of prior years' testing
and any change that may have taken place in the controls or the
business since that testing was performed. This section retained the
requirement in Auditing Standard No. 2 that each control deemed
important to the auditor's conclusion be tested every year, but
allowed for a reduction in testing when the additional risk factors
indicated that the risk was lower than in the past.
    Many commenters strongly supported these provisions as proposed.
Many investors, in particular, stated that while they supported the
proposed approach, they would not be supportive of rotation of
control testing over a multiple-year period. These commenters were
generally concerned that rotation of control testing would
negatively affect audit quality. Among supporters of the approach in
the proposed standard, several requested further clarification in
the standard or additional guidance on how this approach should
affect the level of testing.
    Many issuers suggested that the standard should allow for full
rotation--which exempts some important controls from testing each
year--of at least controls in low-risk areas. Other commenters
recommended that all controls should be tested on a multi-year
rotating basis. These comments often focused on the fact that while
the proposed standard required the auditor to evaluate whether there
had been any relevant changes since the control was tested, it still
required testing at some level even when there had been no change.
These commenters considered this requirement to be unnecessary.
    The Board shares the concern that multi-year rotation of control
testing would not provide sufficient evidence for the auditor's
opinion on internal control effectiveness, which is required by the
Act to be issued each year. In the financial statement audit,
control testing plays a supporting role--to the extent that controls
have been tested and are effective, the auditor can reduce the level
of (but not eliminate) the necessary substantive testing. In
contrast, in the internal control audit, control testing does not
play a supporting role but is the sole basis for the auditor's
opinion. Additionally, even if the design of the control and its
related process does not change from the prior year, it is not
possible to assess the control's operating effectiveness without
performing some level of testing. For these reasons, rotation is not
a viable option in the audit of internal control. Instead, the
approach described in the proposed standard has been clarified in
the final standard and continues to focus the auditor on relevant
changes since a particular control was last tested, as many
commenters suggested. Under this approach, the auditor would
consider, in addition to the risk factors described in the standard
that are always relevant to determining the nature, timing, and
extent of testing, whether there has been a change in the controls
or in the business that might necessitate a change in controls; the
nature, timing, and extent of procedures performed in previous
audits; and the results of the previous years' testing of the
control.\26\ After taking into account these additional factors, the
additional information in subsequent years' audits might permit the
auditor to assess risk as lower than in the

initial year and, thus, might permit the auditor to reduce testing.
---------------------------------------------------------------------------

    \26\ See paragraph 55.
---------------------------------------------------------------------------

    This treatment of cumulative knowledge is analogous to the roll-
forward provisions in the final standard. In the case of subsequent
years, the auditor, in essence, rolls forward the prior years'
testing when the control was found to be effective in the past and
no change has occurred (or would have been expected to occur due to
changes in the environment or process that contains the control).
Because the auditor might be able to assess the risk lower in the
subsequent years, a walkthrough, or equivalent procedures, might be
sufficient for low-risk controls. This approach appropriately
factors in the effect of cumulative knowledge, while maintaining
audit quality and providing a sufficient basis for the auditor's
opinion.

Reporting the Results of the Audit

    In the proposed standard, the Board attempted to address
concerns that the separate opinion on management's assessment
required by Auditing Standard No. 2 contributed to the complexity of
the standard and caused confusion regarding the scope of the
auditor's work.\27\ Accordingly, to emphasize the proper scope of
the audit and to simplify the reporting, the proposed standard
required that the auditor express only one opinion on internal
control--a statement of the auditor's opinion on the effectiveness
of the company's internal control over financial reporting. The
proposal eliminated the separate opinion on management's assessment
because it was redundant of the opinion on internal control itself
and because the opinion on the effectiveness of controls more
clearly conveys the same information--specifically, whether the
company's internal control is effective.
---------------------------------------------------------------------------

    \27\ Although Auditing Standard No. 2 requires the auditor to
evaluate management's process, the auditor's opinion on management's
assessment is not an opinion on management's internal control
evaluation process. Rather, it is the auditor's opinion on whether
management's statements about the effectiveness of the company's
internal controls are fairly stated.
---------------------------------------------------------------------------

    Many commenters agreed with the Board that eliminating the
separate opinion on management's assessment would reduce confusion
and clarify the reporting. Some commenters, however, suggested that
the Board should instead require only an opinion on management's
assessment. These commenters expressed their belief that the Act
requires only that the auditor review management's assessment
process and not the company's internal control. Additionally, a few
commenters expressed confusion about why the proposed standard
continued to reference an audit of management's assessment in
paragraph 1 of the proposed standard and the auditor's report.
    The Board has determined, after considering these comments, to
adopt the provision requiring only an opinion on internal
control.\28\ The Board continues to believe that the overall scope
of the audit that was described by Auditing Standard No. 2 and the
proposed standard is correct; that is, to attest to and report on
management's assessment, as required by Section 404(b) of the Act,
the auditor must test controls directly to determine whether they
are effective.\29\ Accordingly, paragraphs 1 and 2 of the proposed
standard provided that the auditor audits management's assessment--
the statement in management's annual report about whether internal
control is effective--by auditing whether that statement is
correct--that is, whether internal control is, in fact, effective.
The final standard similarly makes this clear. In response to
commenters, however, the Board has clarified the auditor's report so
that it will consistently refer to the required audit as the audit
of internal control.
---------------------------------------------------------------------------

    \28\ The SEC has adopted changes to its rules that require the
auditor to express an opinion directly on internal control.
    \29\ In addition, Section 103 of the Act requires the Board's
standard on auditing internal control to include ``testing of the
internal control structure and procedures of the issuer * * *.''
Under Section 103, the Board's standard also must require the
auditor to present in the audit report, among other things, ``an
evaluation of whether such internal control structure and procedures
* * * provide reasonable assurance that transactions are recorded as
necessary to permit preparation of financial statements in
accordance with generally accepted accounting principles * * *.''
---------------------------------------------------------------------------

Implementation

    Some commenters urged the Board to focus on implementation
issues after it adopts a final standard, and noted that effective
implementation by the Board is crucial to the internal control
reporting process. Some of these commenters focused on the
inspections process, which they suggested is key to promoting audit
efficiency. Some stated that auditors would be unlikely to change
their audit approach until they are confident that the inspections
will be similarly focused. The Board is committed to effective
monitoring of firms' compliance with the new standard and will
continue to promote proper implementation through other means,
including the Board's Forums on Auditing in the Small Business
Environment and guidance for auditors of smaller companies.

III. Date of Effectiveness of the Proposed Rules and Timing for
Commission Action

    Within 35 days of the date of publication of this notice in the
Federal Register or within such longer period (i) As the Commission
may designate up to 90 days of such date if it finds such longer
period to be appropriate and publishes its reasons for so finding or
(ii) as to which the Board consents, the Commission will:
    (a) By order approve such proposed rule; or
    (b) Institute proceedings to determine whether the proposed rule
should be disapproved.

IV. Solicitation of Comments

    Interested persons are invited to submit written data, views and
arguments concerning the foregoing, including whether the proposed
rules are consistent with the Act. Comments may be submitted by any
of the following methods:

Electronic Comments

     Use the Commission's Internet comment form (http://www.sec.gov.
); or     Send an e-mail to<EMAIL_ADDRESS>Please include

File Number PCAOB-2007-02 on the subject line.

Paper Comments

     Send paper comments in triplicate to Nancy M. Morris,
Secretary, Securities and Exchange Commission, 100 F Street, NE.,
Washington, DC 20549-1090.

All submissions should refer to File No. PCAOB-2007-02. This file
number should be included on the subject line if e-mail is used. To
help process and review your comments more efficiently, please use
only one method. The Commission will post all comments on the
Commission's Internet Web site (http://www.sec.gov). Copies of the

submission, all subsequent amendments, all written statements with
respect to the proposed rule that are filed with the Commission, and
all written communications relating to the proposed rule change
between the Commission and any person, other than those that may be
withheld from the public in accordance with the provisions of 5
U.S.C. 552, will be available for inspection and copying in the
Commission's Public Reference Section, 100 F Street, NE.,
Washington, DC 20549. All comments received will be posted without
change; we do not edit personal identifying information from
submissions. You should submit only information that you wish to
make available publicly. All submissions should refer to File Number
PCAOB-2007-02. In light of the significant public interest in the
implementation of section 404 of the Sarbanes-Oxley Act, the
Commission is providing a 30-day comment period. Comments should be
submitted on or before July 12, 2007. The Commission intends to act
on the proposed rule no later than 45 days after publication in the
Federal Register.

    By the Commission.
Florence E. Harmon,
Deputy Secretary.

[FR Doc. E7-11311 Filed 6-11-07; 8:45 am]

BILLING CODE 8010-01-P