[Federal Register: December 30, 2005 (Volume 70, Number 251)]
[Notices]
[Page 77601-77623]
[DOCID:fr30de05-117]

-----------------------------------------------------------------------

Part III

Securities and Exchange Commission

-----------------------------------------------------------------------

Public Company Accounting Oversight Board; Notice of Filing of Proposed
Rule on Auditing Standard No. 4 Reporting on Whether a Previously
Reported Material Weakness Continues to Exist; Notice

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-52990; File No. PCAOB-2005-01]

Public Company Accounting Oversight Board; Notice of Filing of
Proposed Rule on Auditing Standard No. 4, Reporting on Whether a
Previously Reported Material Weakness Continues to Exist

December 21, 2005.
    Pursuant to section 107(b) of the Sarbanes-Oxley Act of 2002 (the
``Act''), notice is hereby given that on July 28, 2005, the Public
Company Accounting Oversight Board (the ``Board'' or the ``PCAOB'')
filed with the Securities and Exchange Commission (the ``Commission''
or ``SEC'') the proposed rules described in Items I and II below, which
items have been prepared by the Board and are presented here in the
form submitted by the Board. The Commission is publishing this notice
to solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

    On July 26, 2005, the Board adopted Auditing Standard No. 4,
Reporting on Whether a Previously Reported Material Weakness Continues
to Exist. The text of the proposed rules is as follows:

Auditing Standard No. 4--Reporting on Whether a Previously Reported
Material Weakness Continues to Exist

Table of Contents--(Paragraph)

Applicability of Standard--1-4
Auditor's Objective in an Engagement to Report on Whether a
Previously Reported Material Weakness Continues to Exist--5-6
Conditions for Engagement Performance--7-8
Framework and Definitions for Evaluation--9-17
Performing an Engagement to Report on Whether a Previously Reported
Material Weakness Continues to Exist--18-43
    Applying the Standards of the PCAOB--19-23
    Planning the Engagement--24
    Obtaining an Understanding of Internal Control Over Financial
Reporting--25-27
    Testing and Evaluating Whether a Material Weakness Continues to
Exist--28-35
    Using the Work of Others--36-39
    Opinions Based, in Part, on the Work of Another Auditor--40
    Forming an Opinion on Whether a Previously Reported Material
Weakness Continues to Exist--41-43
Requirement for Written Representations--44-46
Documentation Requirements--47
Reporting on Whether a Previously Reported Material Weakness
Continues To Exist--48-64
    Management's Report--48
    Auditor's Evaluation of Management's Report--49-50
    Auditor's Report--51-60
    Report modifications--54-55
    Other material weaknesses reported previously by the company as
part of the company's annual assessment of internal control are not
addressed by the auditor's opinion--56
    Subsequent events--57-58
    Management's report includes additional information--59-60
    Special Considerations When a Previously Reported Material
Weakness Continues to Exist--61-64
Effective Date--65
    Appendix A--Illustrative Reports on Whether a Previously
Reported Material Weakness Continues to Exist
    Appendix B--Background and Basis for Conclusions

Auditing and Related Professional Practice Standards

Auditing Standard--Reporting on Whether a Previously Reported Material
Weakness Continues to Exist

Applicability of Standard
    1. This standard establishes requirements and provides direction
that apply when an auditor is engaged to report on whether a previously
reported material weakness in internal control over financial reporting
(hereinafter referred to as a material weakness) continues to exist as
of a date specified by management.

    Note 1: In this context, previously reported material weakness
means a material weakness that was described previously in an
auditor's report issued pursuant to Auditing Standard No. 2, An
Audit of Internal Control Over Financial Reporting Performed in
Conjunction with an Audit of Financial Statements.

    Note 2: The date specified by management as the date that the
previously reported material weakness no longer exists must be a
date after the date of management's most recent annual assessment.

    2. An auditor may conduct an engagement to report on whether a
previously reported material weakness continues to exist if (1) the
auditor has audited the company's financial statements and internal
control over financial reporting in accordance with Auditing Standard
No. 2, An Audit of Internal Control Over Financial Reporting Performed
in Conjunction with an Audit of Financial Statements, as of the date of
the company's most recent annual assessment of internal control over
financial reporting, or (2) the auditor has been engaged to perform an
audit of the financial statements and internal control over financial
reporting in accordance with Auditing Standard No. 2 in the current
year and has a sufficient basis for performing this engagement. (See
paragraph 26 of this standard for additional requirements that apply
specifically to a successor auditor's application of this standard.)

    Note: References in this standard to the company's most recent
annual assessment of internal control over financial reporting apply
to the company's most recent assessment of internal control over
financial reporting overall, either as of the company's year-end or
as of a more recent interim date, as audited by the auditor in
accordance with Auditing Standard No. 2.

    3. The auditor may report on more than one previously reported
material weakness as part of a single engagement.
    4. The engagement described by this standard is voluntary. The
standards of the PCAOB do not require an auditor to undertake an
engagement to report on whether a previously reported material weakness
continues to exist. The auditor may audit the company's internal
control over financial reporting in accordance with Auditing Standard
No. 2 without ever performing an engagement in accordance with this
standard.
Auditor's Objective in an Engagement To Report on Whether a Previously
Reported Material Weakness Continues To Exist
    5. The auditor's objective in an engagement to report on whether a
previously reported material weakness continues to exist is to obtain
reasonable assurance about whether the previously reported material
weakness exists as of a date specified by management and to express an
opinion thereon. The auditor's opinion relates to the existence of a
specifically identified material weakness as of a specified date and
does not relate to the effectiveness of the company's internal control
over financial reporting overall.
    6. To obtain reasonable assurance, the auditor should obtain and
evaluate evidence about whether specified controls were designed and
operated effectively as of the date specified by management and whether
those controls satisfy the company's stated control objective.

    Note: Obtaining and evaluating evidence about whether the
specified controls are designed effectively without also obtaining
evidence about whether those controls operated effectively would not
result in the auditor obtaining reasonable assurance for the purpose
of expressing an opinion on whether a material weakness continues to
exist.

Conditions for Engagement Performance
    7. The auditor may report on whether a previously reported material
weakness continues to exist at a company only if all of the following
conditions are met:
    a. Management accepts responsibility for the effectiveness of
internal control over financial reporting;
    b. Management evaluates the effectiveness of the specific
control(s) that it believes addresses the material weakness using the
same control criteria that management used for its most recent annual
assessment of internal control over financial reporting and
management's stated control objective(s);
    c. Management asserts that the specific control(s) identified is
effective in achieving the stated control objective;
    d. Management supports its assertion with sufficient evidence,
including documentation; and
    e. Management presents a written report that will accompany the
auditor's report that contains all the elements described in paragraph
48 of this standard.
    8. If all the conditions in paragraph 7 of this standard are not
met, the auditor is not permitted to complete the engagement to report
on whether a previously reported material weakness continues to exist.
Framework and Definitions for Evaluation
    9. The terms internal control over financial reporting, control
deficiency, significant deficiency, and material weakness have the same
meanings as the definitions of those terms in paragraphs 7 through 10,
respectively, of Auditing Standard No. 2.
    10. Paragraph 13 of Auditing Standard No. 2 states that management
is required to base its annual assessment of the effectiveness of the
company's internal control over financial reporting on a suitable,
recognized control framework (also known as control criteria) and
describes the characteristics that make a framework suitable for this
purpose. For purposes of an engagement to report on whether a
previously reported material weakness continues to exist, both
management and the auditor must use both (1) the same control criteria
used for the company's most recent annual assessment of internal
control over financial reporting, and (2) the company's stated control
objective(s) to evaluate whether a material weakness continues to
exist.

    Note: The performance and reporting requirements in Auditing
Standard No. 2 and in this standard are based on the Committee of
Sponsoring Organizations (``COSO'') of the Treadway Commission's
publication, Internal Control--Integrated Framework. Known as the
COSO report, it provides a suitable and available framework for
purposes of management's annual assessment of internal control over
financial reporting. (More information about the COSO framework is
included in paragraphs 14 and 15 of Auditing Standard No. 2, the
COSO report, and AU sec. 319, Consideration of Internal Control in a
Financial Statement Audit.)

    11. A control objective provides a specific target against which to
evaluate the effectiveness of controls. A control objective for
internal control over financial reporting generally relates to a
relevant financial statement assertion and states a criterion for
evaluating whether the company's control procedures in a specific area
provide reasonable assurance that a misstatement to or omission in that
relevant assertion is prevented or detected by controls on a timely
basis.\1\
---------------------------------------------------------------------------

    \1\ See paragraphs 68 to 70 of Auditing Standard No. 2 for
additional information on relevant assertions.
---------------------------------------------------------------------------

    12. Management establishes control objectives that are tailored to
the individual company. The process of tailoring control objectives to
the individual company allows the control criteria used for
management's annual assessment to be applied to the facts and
circumstances in a reasonable and appropriate manner. Although control
objectives are used most frequently to evaluate the effectiveness of
control activities, the other components of internal control over
financial reporting (i.e., control environment, risk assessment,
information and communication, and monitoring) also can be expressed in
terms of control objectives.
    13. In an audit of internal control over financial reporting, the
auditor is required to identify the company's control objectives in
each area and to identify the controls that satisfy each control
objective to evaluate whether the company's internal control over
financial reporting is designed effectively.\2\
---------------------------------------------------------------------------

    \2\ See paragraph 88 of Auditing Standard No. 2.
---------------------------------------------------------------------------

    14. Table 1 includes examples of control objectives and their
related assertions:

     Table 1.--Examples of Control Objectives and Related Assertions
------------------------------------------------------------------------
            Control objectives                       Assertions
------------------------------------------------------------------------
Recorded sales of product X initiated on    Existence or occurrence.
 the company's Web site are real.
Product X warranty losses that are          Completeness.
 probable and can be reasonably estimated
 are recorded as of the company's
 quarterly financial statement period-ends.
Interest rate swaps are recorded at fair    Valuation or allocation.
 value.
The company has legal title to recorded     Rights and obligations.
 product X inventory in the company's
 Dallas, TX warehouse.
Pending litigation that is reasonably       Presentation and disclosure.
 possible to result in a material loss is
 disclosed in the quarterly and annual
 financial statements.
------------------------------------------------------------------------

    15. If a material weakness has previously been reported, a
necessary control objective (or objectives) has not been achieved.
    16. A stated control objective in the context of an engagement to
report on whether a material weakness continues to exist is the
specific control objective identified by management that, if achieved,
would result in the material weakness no longer existing.
    17. Because the stated control objective, for purposes of this
engagement, provides management and the auditor with a specific target
against which to evaluate whether the material weakness continues to
exist, management and the auditor must be satisfied that, if the stated
control objective were achieved, the material weakness would no longer
exist.

    Note: When a material weakness has a pervasive effect on the
company's internal control over financial reporting, identifying the
related control objectives that are not being achieved may be
difficult because of the large number of control objectives
affected. A material weakness related to an ineffective control
environment would be an example of this circumstance. If management
and the auditor have difficulty identifying all of the stated
control objectives affected by a material weakness, the material
weakness probably is not suitable for this engagement and should be
addressed, instead, through the auditor's annual audit of internal
control over financial reporting conducted under Auditing Standard
No. 2.

Performing an Engagement to Report on Whether a Previously Reported
Material Weakness Continues to Exist
    18. In an engagement to report on whether a previously reported
material weakness continues to exist, the auditor must obtain
sufficient competent evidence about the design and operating
effectiveness of specified controls that provide reasonable assurance
that the company's stated control objective is achieved in the context
of the control criteria (e.g., COSO).

    Note 1: An individual material weakness may be associated with a
single stated control objective or with more than one stated control
objective, depending on the nature of the material weakness and the
manner in which the company tailors its stated control objectives to
its business.

    Note 2: Depending on the nature of the company's business, its
organization, its internal control over financial reporting, and the
specific material weakness that is the subject of this engagement,
the auditor may determine that he or she is not able to obtain a
sufficient basis for reporting on whether a previously reported
material weakness continues to exist without performing a complete
audit of internal control over financial reporting in accordance
with Auditing Standard No. 2.

Applying the Standards of the PCAOB
    19. The auditor must adhere to the standards of the PCAOB in
performing an engagement to report on whether a previously reported
material weakness continues to exist. Adherence to the standards
involves:
    a. Planning the engagement,
    b. Obtaining an understanding of internal control over financial
reporting,
    c. Testing and evaluating whether a material weakness continues to
exist, including using the work of others, and
    d. Forming an opinion on whether a previously reported material
weakness continues to exist.
    20. Even though some requirements of this standard are set forth in
a manner that suggests a sequential process, auditing whether a
previously reported material weakness continues to exist involves a
process of gathering, updating, and analyzing information. Accordingly,
the auditor may perform some of the procedures and evaluations
described in this section of the standard concurrently.
    21. The engagement to report on whether a previously reported
material weakness continues to exist must be performed by a person or
persons having adequate technical training and proficiency as an
auditor. In all matters related to the assignment, an independence in
mental attitude must be maintained. Due professional care must be
exercised in the performance of the engagement and the preparation of
the report. Paragraphs 30 through 36 of Auditing Standard No. 2
describe the application of these standards in the context of an
internal control-related service.
    22. This standard establishes the fieldwork and reporting standards
applicable to an engagement to report on whether a previously reported
material weakness continues to exist.
    23. The concept of materiality, as discussed in paragraphs 22 and
23 of Auditing Standard No. 2, underlies the application of the general
and fieldwork standards in an engagement to report on whether a
previously reported material weakness continues to exist. Therefore,
the auditor uses materiality at the financial-statement level, rather
than at the individual account-balance level, in evaluating whether a
material weakness exists. The auditor should assess materiality as of
the date that management asserts that the previously reported material
weakness no longer exists.
Planning the Engagement
    24. The auditor should properly plan the engagement to report on
whether a previously reported material weakness continues to exist and
should properly supervise any assistants. When planning the engagement,
the auditor should evaluate how the matters described in paragraph 39
of Auditing Standard No. 2 will affect the auditor's procedures.
Obtaining an Understanding of Internal Control Over Financial Reporting
    25. To perform this engagement, the auditor must have a sufficient
knowledge of the company and its internal control over financial
reporting. An auditor who has audited the company's internal control
over financial reporting in accordance with Auditing Standard No. 2 as
of the date of the company's most recent annual assessment of internal
control over financial reporting would be expected to have obtained a
sufficient knowledge of the company and its internal control over
financial reporting to perform this engagement.

    Note: The second sentence of the paragraph above contemplates
that the auditor's previous engagement under Auditing Standard No. 2
resulted in rendering an opinion. If an auditor previously engaged
to perform an audit of internal control over financial reporting in
accordance with Auditing Standard No. 2 has not yet rendered an
opinion on the effectiveness of the company's internal control over
financial reporting as of the company's most recent year-end or more
recently, then that auditor should follow the requirements for a
successor auditor in paragraphs 26a-b and 27. Additionally, if an
auditor has previously performed an audit of internal control over
financial reporting at the company and is now a successor auditor
(because another auditor has subsequently performed an audit of
internal control over financial reporting at the company in
intervening years), the auditor should follow the requirements in
paragraphs 26 and 27 for a successor auditor.

    26. When a successor auditor \3\ performs an engagement to report
on whether a previously reported material weakness continues to exist
and he or she has not yet completed an audit of internal control over
financial reporting at the company, he or she must perform procedures
to obtain sufficient knowledge of the company's business and its
internal control over financial reporting to achieve the objective of
the engagement, as described in paragraph 5 of this standard. A
successor auditor who has not yet completed an audit of internal
control over financial reporting at the company must perform the
following procedures as part of obtaining sufficient knowledge of the
company's business and its internal control over financial reporting:
---------------------------------------------------------------------------

    \3\ The term successor auditor has the same meaning as the
definition of that term in paragraph .02 of AU sec. 315,
Communications Between Predecessor and Successor Auditors.
---------------------------------------------------------------------------

    a. Comply with paragraphs 47 through 51 of Auditing Standard No. 2
regarding obtaining an understanding of internal control over financial
reporting. The extent of understanding of internal control over
financial reporting needed to satisfy these requirements in the context
of an engagement to report on whether a previously reported material
weakness continues to exist depends on the nature of the material
weakness on which the auditor is reporting. The more pervasive the
effects of the material weakness, the more extensive the understanding
of internal control over financial reporting should be under these
requirements. For example, if the material weakness affects company-
level controls, a more extensive understanding of internal control over
financial reporting will be necessary than if the effects of the
material weakness are isolated at the transaction level.
    b. Perform a walkthrough as described in paragraphs 79 through 82
of Auditing Standard No. 2 for all major classes of transactions that
are directly affected by controls specifically identified by management
as addressing the material weakness.

    Note: Some controls have only an indirect effect on a major
class of transactions, such as certain controls in the control

environment or risk assessment components of internal control over
financial reporting. The auditor need not perform a walkthrough of
major classes of transactions that are affected only indirectly by
the controls specifically identified by management as addressing the
material weakness.

    c. In addition to the communication requirements described in AU
sec. 315, Communications Between Predecessor and Successor Auditors,
the successor auditor should make specific inquiries of the predecessor
auditor. These inquiries should address the basis for the predecessor
auditor's determination that a material weakness existed in the
company's internal control over financial reporting and the predecessor
auditor's awareness of any information bearing on the company's ability
to successfully address that material weakness.
    27. A successor auditor may determine that he or she needs to
perform procedures in addition to those specified in paragraph 26 of
this standard to obtain a sufficient knowledge of the company's
business and its internal control over financial reporting. Depending
on the nature of the company's business, its organization, its internal
control over financial reporting, and the specific material weakness
that is the subject of this engagement, a successor auditor may
determine that he or she is not able to obtain a sufficient basis for
reporting on whether a previously reported material weakness continues
to exist without performing a complete audit of internal control over
financial reporting in accordance with Auditing Standard No. 2.
Testing and Evaluating Whether a Material Weakness Continues to Exist
    28. The auditor must obtain an understanding of and evaluate
management's evidence supporting its assertion that the specified
controls related to the material weakness are designed and operated
effectively, that these controls achieve the company's stated control
objective(s) consistent with the control criteria, and that the
identified material weakness no longer exists. If the auditor
determines that management has not supported its assertion with
sufficient evidence, the auditor cannot complete the engagement to
report on whether a previously reported material weakness continues to
exist, because one of the conditions for engagement completion
described in paragraph 7 of this standard would not be met.

    Note: Paragraphs 40 through 46 of Auditing Standard No. 2 apply
to the auditor's evaluation of management's annual assessment of
internal control over financial reporting and management's related
documentation. The auditor may apply the relevant concepts described
in that section to the evaluation of management's evidence
supporting management's assertion that a previously reported
material weakness no longer exists.

    29. As a part of evaluating management's evidence supporting its
assertion, the auditor should determine whether management has selected
an appropriate date for its assertion. In making this determination,
the auditor should take into consideration the following:
    a. Management's assertion that a previously reported material
weakness no longer exists may be made as of any specified date that
permits management to obtain sufficient evidence supporting its
assertion.

    Note: The auditor also should determine whether the specified
date of management's assertion permits the auditor to obtain
sufficient evidence supporting his or her opinion.

    b. Depending on the nature of the material weakness, the stated
control objective, and the specified controls, the specified date of
management's assertion may need to be after the completion of one or
more period-end financial reporting processes.
    c. Controls that operate daily and on a continuous, or nearly
continuous, basis generally permit the auditor to obtain sufficient
evidence as to their operating effectiveness as of almost any date
management might choose to specify in its report.
    d. Controls that operate over the company's period-end financial
reporting process typically can be tested only in connection with a
period-end.
    30. The auditor should obtain evidence about the effectiveness of
all controls specifically identified in management's assertion. The
nature, timing, and extent of the testing that enables the auditor to
obtain sufficient evidence supporting his or her opinion on whether a
previously reported material weakness continues to exist will depend on
both the nature of the controls specifically identified by management
as meeting the company's stated control objectives and the date of
management's assertion.
    31. All controls that are necessary to achieve the stated control
objective(s) should, therefore, be specifically identified and
evaluated. The specified controls will necessarily include controls
that have been modified or newly implemented and also may include
existing controls that previously were deemed effective during
management's most recent annual assessment of internal control over
financial reporting. As part of testing and evaluating the design
effectiveness of the specified controls, the auditor should determine
whether the specified controls would meet the stated control
objective(s) if they operated as designed. In making this evaluation,
the auditor should apply paragraphs 88 through 91 of Auditing Standard
No. 2.
    32. Consistent with the direction in paragraph 92 of Auditing
Standard No. 2, the auditor should evaluate the operating effectiveness
of a specified control by determining whether the specified control
operated as designed and whether the person performing the control
possesses the necessary authority and qualifications to perform the
control effectively. In determining the nature, timing, and extent of
tests of controls, the auditor should apply paragraphs 93 through 102
and 105 through 107 of Auditing Standard No. 2.
    33. The auditor should apply paragraph 98 of Auditing Standard No.
2 regarding an adequate period of time to determine the operating
effectiveness of a control in the context of an engagement to report on
whether a previously reported material weakness continues to exist.
Paragraph 98 of Auditing Standard No. 2 states (in part):

    The auditor must perform tests of controls over a period of time
that is adequate to determine whether, as of the date specified in
management's report, the controls necessary for achieving the
objectives of the control criteria are operating effectively. The
period of time over which the auditor performs tests of controls
varies with the nature of the controls being tested and with the
frequency with which specific controls operate and specific policies
are applied.

For example, a transaction-based daily reconciliation generally would
permit the auditor to obtain sufficient evidence as to its operating
effectiveness in a shorter period of time than a pervasive, company-
level control, such as any of those described in paragraphs 52 and 53
of Auditing Standard No. 2. Additionally, the auditor typically will be
able to obtain sufficient evidence as to the operating effectiveness of
controls over the company's period-end financial reporting process only
by testing those controls in connection with a period-end.
    34. The auditor should determine whether, based on the nature of
the material weakness, performing substantive procedures to support
recorded financial statement amounts or disclosures affected by the
specifically identified controls is necessary to obtain sufficient
evidence regarding the operating effectiveness of those controls. For
example, a material weakness in the

company's controls over the calculation of its bad debt reserve
ordinarily would require that the auditor also perform substantive
procedures to obtain sufficient evidence supporting an opinion about
whether the material weakness continues to exist as of a specified
date. In this circumstance, in addition to testing the design and
operating effectiveness of the controls specifically identified as
achieving the company's stated control objective that its bad debt
reserve is reasonably estimated and recorded, the auditor ordinarily
would need to perform substantive procedures to determine that, as of
that same specified date, the company's bad debt reserve was fairly
stated in relation to the company's financial statements taken as a
whole.
    35. When the specified controls, stated control objectives, and
material weakness affect multiple locations or business units of the
company, the auditor may apply the relevant concepts in paragraphs B1
through B13 of Appendix B of Auditing Standard No. 2 to determine the
locations or business units at which to perform procedures.
Using the Work of Others
    36. The auditor should evaluate whether to use the work performed
by others in an engagement to report on whether a previously reported
material weakness continues to exist. To determine the extent to which
the auditor may use the work of others to alter the nature, timing, or
extent of the work the auditor otherwise would have performed, the
auditor should apply paragraphs 109 through 115 and 117 through 125 of
Auditing Standard No. 2.
    37. The auditor's opinion relates to whether a material weakness no
longer exists at the company because the stated control objective(s) is
met. Therefore, if the auditor has been engaged to report on more than
one material weakness or on more than one stated control objective, the
auditor must evaluate whether he or she has obtained the principal
evidence that the control objectives related to each of the material
weaknesses identified in management's assertion are achieved. The
auditor may, however, use the work of others to alter the nature,
timing, or extent of the work he or she otherwise would have performed.
For these purposes, the work of others includes relevant work performed
by internal auditors, company personnel (in addition to internal
auditors), and third parties working under the direction of management
or the audit committee that provide information about the effectiveness
of internal control over financial reporting.
    38. Paragraph 122 of Auditing Standard No. 2 should be applied in
the context of the engagement to report on whether a previously
reported material weakness continues to exist. Paragraph 122 states, in
part, ``As the significance of the factors listed in paragraph 112
increases, the ability of the auditor to use the work of others
decreases at the same time that the necessary level of competence and
objectivity of those who perform the work increases.'' There may,
therefore, be some circumstances in which the scope of the audit
procedures to be performed in this engagement will be so limited that
using the work of others will not provide any tangible benefit to the
company or its auditor. Additionally, the auditor should perform any
walkthroughs himself or herself because of the degree of judgment
required in performing this work.

    Note: The requirement described in paragraph 26b of this
standard for the auditor to perform a walkthrough applies only to an
auditor who did not complete an audit of internal control over
financial reporting as of the company's most recent annual
assessment. An auditor who has rendered an opinion on the
effectiveness of the company's internal control over financial
reporting in accordance with Auditing Standard No. 2 as of the
company's most recent annual assessment is not required to perform a
walkthrough as part of this engagement.

    39. The following example illustrates how to apply this section on
using the work of others to this engagement.

    In this example, the company's previously reported material
weakness relates to the company's failure to perform bank
reconciliations at its 50 subsidiaries. The specified controls
identified by the company are the timely preparation of complete and
accurate reconciliations between the company's recorded cash
balances and the company's cash balances as reported by its
financial institution.
    Although certain controls over bank reconciliations are
centralized, the performance of the bank reconciliations themselves
is not centralized because they occur at each individual operating
unit. Further, each operating unit has, on average, three separate
cash accounts. The cash accounts affected are not material
individually but are material in the aggregate. Most of the controls
over the preparation of bank reconciliations involve a low degree of
judgment in evaluating their operating effectiveness, can be
subjected to objective testing, and have a low potential for
management override.
    If these conditions describe the specified controls over the
preparation of bank reconciliations, the auditor could determine
that, based on the nature of the controls as described above, he or
she could use the work of others to a moderate extent, provided that
the degree of competence and objectivity of the individuals
performing the tests is high. The auditor might perform tests of
controls that are centralized at the holding company level himself
or herself; perform testing at a limited number of locations himself
or herself; test the work of others performed at a limited number of
other locations; review the results of the work of others at all
other locations tested; and determine that, qualitatively and
quantitatively, principal evidence had been obtained.
    On the other hand, if the company's previously reported material
weakness related to the company's failure to perform a
reconciliation of its only cash account, few controls and few
operations of those controls would underlie management's assertion
that the material weakness no longer exists. In this circumstance,
it is unlikely that the auditor would be able to use a significant
amount of the work of others because of the limited scope of the
total amount of work needed to test management's assertion and due
to the requirement that the auditor obtain the principal evidence
himself or herself.

    Note: The examples provided in paragraph 126 of Auditing
Standard No. 2 illustrate how to apply the requirements in Auditing
Standard No. 2 regarding using the work of others in an audit of
internal control over financial reporting. Because of the
differences between the auditor obtaining the principal evidence
supporting an opinion on the effectiveness of internal control over
financial reporting overall and supporting an opinion on the much
narrower subject of whether a specified material weakness in
internal control over financial reporting continues to exist, the
examples in Auditing Standard No. 2 may not illustrate the
appropriate application of using the work of others in this narrower
engagement. For instance, the examples in paragraph 126 of Auditing
Standard No. 2 suggest that, for certain controls, the auditor could
potentially use the work of others in its entirety. However, in most
cases, the auditor could not solely use the work of others for a
control specified in management's assertion regarding a material
weakness no longer existing and, at the same time, obtain the
principal evidence supporting his or her opinion. As another
example, Auditing Standard No. 2 describes an example of
appropriately alternating tests of controls. Alternating tests of
controls is applicable only in the context of a recurring
engagement, which is not the context for the auditor's reporting on
whether a previously reported material weakness continues to exist.

Opinions, Based in Part, on the Work of Another Auditor
    40. The auditor may apply the relevant concepts in AU sec. 543,
Part of Audit Performed by Other Independent Auditors, in an engagement
to report on whether a previously reported material weakness continues
to exist, with the following exception. If the auditor decides to serve

as the principal auditor and to use the work and reports of another
auditor as a basis, in part, for his or her opinion, the principal
auditor must not divide responsibility for the engagement with the
other auditor. Therefore, the principal auditor must not make reference
to the other auditor in his or her report.
Forming an Opinion on Whether a Previously Reported Material Weakness
Continues to Exist
    41. When forming an opinion on whether a previously reported
material weakness continues to exist, the auditor should evaluate all
evidence obtained from all sources. This process should include an
evaluation of the sufficiency of the evidence obtained by management
and the results of the auditor's evaluation of the design and operating
effectiveness of the specified controls.
    42. Management may conclude that a previously reported material
weakness no longer exists because it has been reduced to a significant
deficiency. If management does not plan to correct the significant
deficiency within a reasonable period of time, the auditor should
evaluate whether the remaining significant deficiency could be
indicative of a material weakness in internal control over financial
reporting. Under paragraph 140 of Auditing Standard No. 2, a
significant deficiency not corrected after some reasonable period of
time is a strong indicator of a material weakness. Because the auditor
is not required to provide an opinion under this voluntary engagement,
the auditor could reasonably decline to provide an opinion under such
circumstances.
    43. The auditor may issue an opinion on whether a previously
reported material weakness continues to exist only when there have been
no restrictions on the scope of the auditor's work. Because of the
scope of an engagement to report on whether a previously reported
material weakness continues to exist, any limitations on the scope of
the auditor's work require the auditor either to disclaim an opinion or
to withdraw from the engagement. A qualified opinion is not permitted.

    Note: As described in paragraph 51 of this standard, the
auditor's opinion on whether a previously reported material weakness
continues to exist may be expressed as ``the material weakness
exists'' or ``the material weakness no longer exists.'' Therefore,
the provisions of this standard do not distinguish between an
unqualified opinion and an adverse opinion and, instead, refer
simply to ``an opinion'' or ``the auditor's opinion.''

Requirement for Written Representations
    44. In an engagement to report on whether a previously reported
material weakness continues to exist, the auditor should obtain written
representations from management:
    a. Acknowledging management's responsibility for establishing and
maintaining effective internal control over financial reporting;
    b. Stating that management has evaluated the effectiveness of the
specified controls using the specified control criteria and
management's stated control objective(s);
    c. Stating management's assertion that the specified controls are
effective in achieving the stated control objective(s) as of a
specified date;
    d. Stating management's assertion that the identified material
weakness no longer exists as of the same specified date;
    e. Stating that management believes that its assertions are
supported by sufficient evidence;
    f. Describing any material fraud and any other fraud that, although
not material, involves senior management or management or other
employees who have a significant role in the company's internal control
over financial reporting and that has occurred or come to management's
attention since the date of management's most recent annual assessment
of internal control over financial reporting; and
    g. Stating whether there were, subsequent to the date being
reported on, any changes in internal control over financial reporting
or other factors that might significantly affect the stated control
objective(s) or indicate that the identified controls were not
operating effectively as of, or subsequent to, the date specified in
management's assertion.
    45. The written representations should be signed by those members
of management with overall responsibility for the company's internal
control over financial reporting whom the auditor believes are
responsible for and knowledgeable about, directly or through others in
the organization, the matters covered by the representations. Such
members of management ordinarily include the chief executive officer
and chief financial officer or others with equivalent positions in the
company.
    46. The failure to obtain written representations from management,
including management's refusal to furnish them, constitutes a
limitation on the scope of the engagement. As discussed further in
paragraph 43 of this standard, if there is a limitation on the scope of
an engagement to report on whether a previously reported material
weakness continues to exist, the auditor must either disclaim an
opinion or withdraw from the engagement. Further, the auditor should
evaluate the effects of management's refusal on his or her ability to
rely on other representations of management, including, if applicable,
representations obtained in an audit of the company's financial
statements.
Documentation Requirements
    47. The documentation requirements in Auditing Standard No. 3,
Audit Documentation, are modified in the following respect as they
apply to this engagement. Paragraph 14 of Auditing Standard No. 3
defines the report release date as the date the auditor grants
permission to use the auditor's report in connection with the issuance
of the company's financial statements. As described in paragraph 29 of
this standard, management's assertion that a material weakness no
longer exists may be made as of a date other than a period-end
financial reporting date. Therefore, the auditor's release of a report
on whether a previously reported material weakness continues to exist
may not necessarily be associated with the issuance of financial
statements of the company. Accordingly, in an engagement to report on
whether a previously reported material weakness continues to exist, the
report release date for purposes of applying Auditing Standard No. 3 is
the date the auditor grants permission to use the auditor's report on
whether a previously reported material weakness continues to exist.
Reporting on Whether a Previously Reported Material Weakness Continues
To Exist
    Management's Report.
    48. As a condition for the auditor's performance of this voluntary
engagement, management is required to present a written report that
will accompany the auditor's report, as described in paragraph 7e of
this standard. To satisfy this condition for the auditor's performance
of this engagement, management's report should include:
    a. A statement of management's responsibility for establishing and
maintaining effective internal control over financial reporting for the
company;
    b. A statement identifying the control criteria used by management
to conduct the required annual assessment of the effectiveness of the
company's internal control over financial reporting;

    c. An identification of the material weakness that was identified
as part of management's annual assessment;

    Note: This report element should be modified in the case in
which management's annual assessment did not identify the material
weakness, but, rather, only the auditor's report on management's
annual assessment identified the material weakness.

    d. An identification of the control objective(s) addressed by the
specified controls and a statement that the specified controls achieve
the stated control objective(s) as of a specified date; and
    e. A statement that the identified material weakness no longer
exists as of the same specified date because the specified controls
address the material weakness.
Auditor's Evaluation of Management's Report
    49. With respect to management's report, the auditor should
evaluate the following matters:
    a. Whether management has properly stated its responsibility for
establishing and maintaining effective internal control over financial
reporting;
    b. Whether the control criteria used by management to conduct the
evaluation is suitable;
    c. Whether the material weakness, stated control objectives, and
specified controls have been properly described; and
    d. Whether management's assertions, as of the date specified in
management's report, are free of material misstatement.
    50. If, based on the results of this evaluation, the auditor
determines that management's report does not include the elements
described in paragraph 48 of this standard, the conditions for
engagement performance have not been met.
Auditor's Report
    51. The auditor's report on whether a previously reported material
weakness continues to exist must include the following elements:
    a. A title that includes the word independent;
    b. A statement that the auditor has previously audited and reported
on management's annual assessment of internal control over financial
reporting as of a specified date based on the control criteria, as well
as a statement that the auditor's report identified a material
weakness;

    Note: This report element should be modified in cases in which a
successor auditor's performance of this engagement is occurring
before he or she has opined on the effectiveness of internal control
over financial reporting overall in accordance with Auditing
Standard No. 2. In this circumstance, the auditor's report should
refer to the predecessor auditor's report on management's annual
assessment and the predecessor auditor's identification of the
material weakness.

    c. A description of the material weakness;
    d. An identification of management's assertion that the identified
material weakness in internal control over financial reporting no
longer exists;
    e. An identification of the management report that includes
management's assertion, such as identifying the title of the report (if
the report is titled);
    f. A statement that management is responsible for its assertion;
    g. An identification of the specific controls that management
asserts address the material weakness;

    Note: As discussed further in paragraph 31, all controls that
are necessary to achieve the stated control objective should be
identified.

    h. An identification of the company's stated control objective that
is achieved by these controls;
    i. A statement that the auditor's responsibility is to express an
opinion on whether the material weakness continues to exist as of the
date of management's assertion based on his or her auditing procedures;
    j. A statement that the engagement was conducted in accordance with
the standards of the Public Company Accounting Oversight Board (United
States);
    k. A statement that the standards of the Public Company Accounting
Oversight Board require that the auditor plan and perform the
engagement to obtain reasonable assurance about whether a previously
reported material weakness continues to exist at the company;
    l. A statement that the engagement includes examining evidence
supporting management's assertion and performing such other procedures
the auditor considered necessary in the circumstances and that the
auditor obtained an understanding of internal control over financial
reporting as part of his or her previous audit of management's annual
assessment of internal control over financial reporting and updated
that understanding as it specifically relates to changes in internal
control over financial reporting associated with the material weakness;

    Note: This report element should be modified in cases in which a
successor auditor's performance of this engagement is occurring
before he or she has opined on the effectiveness of internal control
over financial reporting overall in accordance with Auditing
Standard No. 2. In this circumstance, the auditor's report should
include a statement that the engagement includes obtaining an
understanding of internal control over financial reporting,
examining evidence supporting management's assertion, and performing
such other procedures as the auditor considered necessary in the
circumstances.

    m. A statement that the auditor believes the auditing procedures
provide a reasonable basis for his or her opinion;
    n. The auditor's opinion on whether the identified material
weakness exists (or no longer exists) as of the date of management's
assertion;
    o. A paragraph that includes the following statements:
     That the auditor was not engaged to and did not conduct an
audit of internal control over financial reporting as of the date of
management's assertion, the objective of which would be the expression
of an opinion on the effectiveness of internal control over financial
reporting, and that the auditor does not express such an opinion, and
     That the auditor has not applied auditing procedures
sufficient to reach conclusions about the effectiveness of any controls
of the company as of any date after the date of management's annual
assessment of the company's internal control over financial reporting,
other than the controls specifically identified in the auditor's
report, and that the auditor does not express an opinion that any other
controls operated effectively after the date of management's annual
assessment of the company's internal control over financial reporting.

    Note: This report element statement should be modified in the
case in which a successor auditor's performance of this engagement
is occurring before he or she has opined on the effectiveness of
internal control over financial reporting overall in accordance with
Auditing Standard No. 2 to read as follows: That the auditor has not
applied auditing procedures sufficient to reach conclusions about
the effectiveness of any controls of the company other than the
controls specifically identified in the auditor's report and that
the auditor does not express an opinion that any other controls
operated effectively.

    p. A paragraph stating that, because of its inherent limitations,
internal control over financial reporting may not prevent or detect
misstatements and that projections of any evaluation of the
effectiveness of specific controls or internal control over financial
reporting overall to future periods are subject to the risk that
controls may become inadequate because of changes in conditions, or
that the degree of compliance with the policies or procedures may
deteriorate;

    q. The manual or printed signature of the auditor's firm;
    r. The city and state (or city and country, in the case of non-U.S.
auditors) from which the auditor's report has been issued; and
    s. The date of the auditor's report.
    52. Example A-1 in Appendix A is an illustrative auditor's report
for an opinion that a material weakness no longer exists, expressed by
an auditor who has previously reported on the company's internal
control over financial reporting in accordance with Auditing Standard
No. 2 as of the company's most recent year-end (herein after referred
to as a continuing auditor). Example A-2 in Appendix A is an
illustrative auditor's report for an opinion that a material weakness
no longer exists expressed by a successor auditor.
    53. As stated in paragraph 3 of this standard, the auditor may
report on more than one previously reported material weakness as part
of the same engagement. In this circumstance, the auditor should modify
the report elements described in paragraph 51 of this standard
accordingly.
    54. Report modifications. The auditor should modify the standard
report if any of the following conditions exist.
    a. Other material weaknesses that were reported previously by the
company as part of the company's annual assessment of internal control
are not addressed by the auditor's opinion. (See paragraph 56 of this
standard.)
    b. A significant subsequent event has occurred since the date being
reported on. (See paragraphs 57 and 58 of this standard.)
    c. Management's report on whether a material weakness continues to
exist includes additional information. (See paragraphs 59 through 60 of
this standard.)
    55. As described further in paragraph 43 of this standard, the form
of the auditor's report resulting from an engagement to report on
whether a previously reported material weakness continues to exist may
be an opinion on whether a material weakness continues to exist, or it
may be in the form of a disclaimer of opinion. A qualified opinion is
not permitted. Any limitations on the scope of the auditor's work
preclude the expression of an opinion. In addition to these reporting
alternatives, an auditor may elect not to report on whether a material
weakness continues to exist and, instead, withdraw from the engagement.
    56. Other material weaknesses reported previously by the company as
part of the company's annual assessment of internal control are not
addressed by the auditor's opinion. In the circumstance in which the
company previously has reported more than one material weakness, the
auditor may be engaged to report on whether any or all of the material
weaknesses continue to exist. If the auditor reports on fewer than all
of the previously reported material weaknesses, the auditor should
include the following or similar language in the paragraph that states
that the auditor was not engaged to perform an audit of internal
control over financial reporting. When referring to his or her
previously issued report on management's annual assessment, the auditor
should either attach that report or include information about where it
can be publicly obtained.

    Our report on management's annual assessment of XYZ Company's
internal control over financial reporting, dated [date of report],
[attached or identify location of where the report is publicly
available] identified additional material weaknesses other than the one
identified in this report. We are not reporting on those other material
weaknesses and, accordingly, express no opinion regarding whether those
material weaknesses continue to exist after [date of management's
annual assessment, e.g., December 31, 200X]. [Revise this wording and
references or attachments appropriately for use in a successor
auditor's report.]
    Example A-3 in Appendix A is an illustrative report issued by a
continuing auditor reporting on only one material weakness when
additional material weaknesses previously were reported.
    57. Subsequent events. A change in internal control over financial
reporting or other factors that might significantly affect the
effectiveness of the identified controls or the achievement of the
company's stated control objective might occur subsequent to the date
of management's assertion but before the date of the auditor's report.
Therefore, the auditor should inquire of management whether there was
any such change or factors. As described in paragraph 44 of this
standard, the auditor should obtain written representations from
management regarding such matters. Additionally, to obtain information
about whether such a change has occurred that might affect the
effectiveness of the identified controls or the achievement of the
company's stated control objective and, therefore, the auditor's
report, the auditor should inquire about and examine, for this
subsequent period, the following:
     Internal audit reports (or similar functions, such as loan
review in a financial institution) relevant to the stated control
objective or identified controls issued during the subsequent period;
     Independent auditor reports (if other than the auditor's)
of significant deficiencies or material weaknesses relevant to the
stated control objective or identified controls;
     Regulatory agency reports on the company's internal
control over financial reporting relevant to the stated control
objective or identified controls; and
     Information about the effectiveness of the company's
internal control over financial reporting relevant to the stated
control objective or identified controls obtained as a result of other
engagements.
    58. If the auditor obtains knowledge about subsequent events that
he or she believes adversely affect the effectiveness of the identified
controls or the achievement of the stated control objective as of the
date specified in management's assertion, the auditor should follow the
requirements in paragraph 61 regarding special considerations when a
material weakness continues to exist. If the auditor is unable to
determine the effect of the subsequent event on the effectiveness of
the identified controls or the achievement of the stated control
objective, the auditor should disclaim an opinion.
    59. Management's report includes additional information. If
management's report includes information in addition to the matters
described in paragraph 48 of this standard, the auditor should disclaim
an opinion on the additional information. For example, the auditor
should use the following or similar language as the last paragraph of
the report to disclaim an opinion on management's plans to implement
new controls:

    We do not express an opinion or any other form of assurance on
management's statement referring to its plans to implement new
controls by the end of the year.

    60. If the auditor believes that management's additional
information contains a material misstatement of fact, he or she should
discuss the matter with management. If, after discussing the matter
with management, the auditor concludes that a material misstatement of
fact remains, the auditor should notify management and the audit
committee, in writing, of the auditor's views concerning the
information.

    Note: If management makes the types of disclosures described in
paragraph 59

outside its report on whether a previously reported material
weakness continues to exist and includes them elsewhere within a
document that contains management's and the auditor's reports on
whether a previously reported material weakness continues to exist,
the auditor would not need to disclaim an opinion, as described in
paragraph 59. However, in that situation, the auditor's
responsibilities are the same as those described in this paragraph
if the auditor believes that the additional information contains a
material misstatement of fact.

Special Considerations When a Previously Reported Material Weakness
Continues to Exist
    61. If the auditor determines that the previously reported material
weakness continues to exist and the auditor reports on the results of
the engagement, he or she must express an opinion that the material
weakness exists as of the date specified by management.
    62. As described in paragraph 55, the auditor is not required to
issue a report as a result of this engagement. If the auditor does not
issue a report in this circumstance, he or she must communicate, in
writing, his or her conclusion that the material weakness continues to
exist to the audit committee. Similarly, if the auditor identifies a
material weakness during this engagement that has not been previously
communicated to the audit committee in writing, the auditor must
communicate that material weakness, in writing, to the audit committee.
    63. Additionally, whenever the auditor concludes that a previously
reported material weakness continues to exist, the auditor must
consider that conclusion as part of his or her evaluation of
management's quarterly disclosures about internal control over
financial reporting, as required by paragraphs 202 through 206 of
Auditing Standard No. 2.
    64. For example, if the auditor were engaged to report on whether
two separate material weaknesses continue to exist and concluded that
one no longer exists and one continues to exist, the auditor's report
could comprise either of the following: (1) A report that contained two
opinions, one on the material weakness that the auditor concluded no
longer exists and one opinion on the material weakness that the auditor
concluded continues to exist, or (2) a report that contained only a
single opinion on the material weakness that the auditor concluded no
longer exists if the company modifies its assertion to address only the
material weakness that the auditor concluded no longer exists. In the
second circumstance, the auditor must communicate, in writing, his or
her conclusion that a material weakness continues to exist to the audit
committee and also should apply paragraph 56 of this standard regarding
other material weaknesses reported previously that are not addressed by
the auditor's opinion. Additionally, the auditor must consider that
conclusion as part of his or her evaluation of management's quarterly
disclosures about internal control over financial reporting, as
required by paragraphs 202 through 206 of Auditing Standard No. 2.
Effective Date
    65. This standard is effective [insert date of SEC approval].

Appendix A--Illustrative Reports on Whether a Previously Reported
Material Weakness Continues to Exist

    Paragraphs 51 through 60 of this standard provide direction on the
auditor's report on whether a previously reported material weakness
continues to exist. The following examples illustrate the application
of those paragraphs.
Example A-1--Illustrative Auditor's Report for a Continuing Auditor
Expressing an Opinion that a Previously Reported Material Weakness No
Longer Exists
Example A-2--Illustrative Auditor's Report for a Successor Auditor
Expressing an Opinion that a Previously Reported Material Weakness No
Longer Exists
Example A-3--Illustrative Auditor's Report for a Continuing Auditor
Expressing an Opinion on Only One Previously Reported Material Weakness
When Additional Material Weaknesses Previously Were Reported

Example A-1--Illustrative Auditor's Report for a Continuing Auditor
Expressing an Opinion That a Previously Reported Material Weakness No
Longer Exists

Report of Independent Registered Public Accounting Firm
    We have previously audited and reported on management's annual
assessment of XYZ Company's internal control over financial reporting
as of December 31, 200X based on [Identify control criteria, for
example, ``criteria established in Internal Control--Integrated
Framework issued by the Committee of Sponsoring Organizations of the
Treadway Commission (COSO).'']. Our report, dated [date of report],
identified the following material weakness in the Company's internal
control over financial reporting:

[Describe material weakness]

    We have audited management's assertion, included in the
accompanying [title of management's report], that the material weakness
in internal control over financial reporting identified above no longer
exists as of [date of management's assertion] because the following
control(s) addresses the material weakness:

[Describe control(s)]

    Management has asserted that the control(s) identified above
achieves the following stated control objective, which is consistent
with the criteria established in [identify control criteria used for
management's annual assessment of internal control over financial
reporting]: [state control objective addressed]. Management also has
asserted that it has tested the control(s) identified above and
concluded that the control(s) was designed and operated effectively as
of [date of management's assertion]. XYZ Company's management is
responsible for its assertion. Our responsibility is to express an
opinion on whether the identified material weakness continues to exist
as of [date of management's assertion] based on our auditing
procedures.
    Our engagement was conducted in accordance with the standards of
the Public Company Accounting Oversight Board (United States). Those
standards require that we plan and perform the engagement to obtain
reasonable assurance about whether a previously reported material
weakness continues to exist at the company. Our engagement included
examining evidence supporting management's assertion and performing
such other procedures as we considered necessary in the circumstances.
We obtained an understanding of the company's internal control over
financial reporting as part of our previous audit of management's
annual assessment of XYZ Company's internal control over financial
reporting as of December 31, 200X and updated that understanding as it
specifically relates to changes in internal control over financial
reporting associated with the material weakness described above. We
believe that our auditing procedures provide a reasonable basis for our
opinion. In our opinion, the material weakness described above no
longer exists as of [date of management's assertion].
    We were not engaged to and did not conduct an audit of internal
control over financial reporting as of [date of management's
assertion], the objective of which would be the expression of an
opinion on the effectiveness of internal control over financial
reporting. Accordingly, we do not express such an opinion. This means
that we have not

applied auditing procedures sufficient to reach conclusions about the
effectiveness of any controls of the company as of any date after
December 31, 200X, other than the control(s) specifically identified in
this report. Accordingly, we do not express an opinion that any other
controls operated effectively after December 31, 200X.
    Because of its inherent limitations, internal control over
financial reporting may not prevent or detect misstatements. Also,
projections of any evaluation of the effectiveness of specific controls
or internal control over financial reporting overall to future periods
are subject to the risk that controls may become inadequate because of
changes in conditions or that the degree of compliance with the
policies or procedures may deteriorate.

[Signature]

[City and State or Country]

[Date]

Example A-2--Illustrative Auditor's Report for a Successor Auditor
Expressing an Opinion That a Previously Reported Material Weakness No
Longer Exists

Report of Independent Registered Public Accounting Firm
    We were engaged to report on whether a previously reported material
weakness continues to exist at XYZ Company as of [date of management's
assertion] and to audit management's next annual assessment of XYZ
Company's internal control over financial reporting. Another auditor
previously audited and reported on management's annual assessment of
XYZ Company's internal control over financial reporting as of December
31, 200X based on [Identify control criteria, for example, ``criteria
established in Internal Control--Integrated Framework issued by the
Committee of Sponsoring Organizations of the Treadway Commission
(COSO).'']. The other auditor's report, dated [date of report],
identified the following material weakness in the Company's internal
control over financial reporting:
[Describe material weakness]
    We have audited management's assertion, included in the
accompanying [title of management's report], that the material weakness
in internal control over financial reporting identified above no longer
exists as of [date of management's assertion] because the following
control(s) addresses the material weakness:
[Describe control(s)]
    Management has asserted that the control(s) identified above
achieves the following stated control objective, which is consistent
with the criteria established in [identify control criteria used for
management's annual assessment of internal control over financial
reporting]: [state control objective addressed]. Management also has
asserted that it has tested the control(s) identified above and
concluded that the control(s) was designed and operated effectively as
of [date of management's assertion]. XYZ Company's management is
responsible for its assertion. Our responsibility is to express an
opinion on whether the identified material weakness continues to exist
as of [date of management's assertion] based on our auditing
procedures.
    Our engagement was conducted in accordance with the standards of
the Public Company Accounting Oversight Board (United States). Those
standards require that we plan and perform the engagement to obtain
reasonable assurance about whether a previously reported material
weakness continues to exist at the company. Our engagement included
obtaining an understanding of internal control over financial
reporting, examining evidence supporting management's assertion, and
performing such other procedures as we considered necessary in the
circumstances. We believe that our auditing procedures provide a
reasonable basis for our opinion.
    In our opinion, the material weakness described above no longer
exists as of [date of management's assertion].
    We were not engaged to and did not conduct an audit of internal
control over financial reporting as of [date of management's
assertion], the objective of which would be the expression of an
opinion on the effectiveness of internal control over financial
reporting. Accordingly, we do not express such an opinion. This means
that we have not applied auditing procedures sufficient to reach
conclusions about the effectiveness of any controls of the company
other than the control(s) specifically identified in this report.
Accordingly, we do not express an opinion that any other controls
operated effectively.
    Because of its inherent limitations, internal control over
financial reporting may not prevent or detect misstatements. Also,
projections of any evaluation of the effectiveness of specific controls
or internal control over financial reporting overall to future periods
are subject to the risk that controls may become inadequate because of
changes in conditions or that the degree of compliance with the
policies or procedures may deteriorate.

[Signature]
[City and State or Country]
[Date]

Example A-3--Illustrative Auditor's Report for a Continuing Auditor
Expressing an Opinion on Only One Previously Reported Material Weakness
When Additional Material Weaknesses Previously Were Reported

Report of Independent Registered Public Accounting Firm

    We have previously audited and reported on management's annual
assessment of XYZ Company's internal control over financial reporting
as of December 31, 200X based on [Identify control criteria, for
example, ``criteria established in Internal Control--Integrated
Framework issued by the Committee of Sponsoring Organizations of the
Treadway Commission (COSO).'']. Our report, dated [date of report],
identified the following material weakness in the Company's internal
control over financial reporting:

[Describe Material Weakness]

    We have audited management's assertion, included in the
accompanying [title of management's report], that the material weakness
in internal control over financial reporting identified above no longer
exists as of [date of management's assertion] because the following
control(s) addresses the material weakness:

[Describe Control(s)]

    Management has asserted that the control(s) identified above
achieves the following stated control objective, which is consistent
with the criteria established in [identify control criteria used for
management's annual assessment of internal control over financial
reporting]: [state control objective addressed]. Management also has
asserted that it has tested the control(s) identified above and
concluded that the control(s) was designed and operated effectively as
of [date of management's assertion]. XYZ Company's management is
responsible for its assertion. Our responsibility is to express an
opinion on whether the identified material weakness continues to exist
as of [date of management's assertion] based on our auditing
procedures.
    Our engagement was conducted in accordance with the standards of
the Public Company Accounting Oversight Board (United States). Those
standards

require that we plan and perform the engagement to obtain reasonable
assurance about whether a previously reported material weakness
continues to exist at the company. Our engagement included examining
evidence supporting management's assertion and performing such other
procedures as we considered necessary in the circumstances. We obtained
an understanding of the company's internal control over financial
reporting as part of our previous audit of management's annual
assessment of XYZ Company's internal control over financial reporting
as of December 31, 200X and updated that understanding as it
specifically relates to changes in internal control over financial
reporting associated with the material weakness described above. We
believe that our auditing procedures provide a reasonable basis for our
opinion.
    In our opinion, the material weakness described above no longer
exists as of [date of management's assertion].
    We were not engaged to and did not conduct an audit of internal
control over financial reporting as of [date of management's
assertion], the objective of which would be the expression of an
opinion on the effectiveness of internal control over financial
reporting. Accordingly, we do not express such an opinion. This means
that we have not applied auditing procedures sufficient to reach
conclusions about the effectiveness of any controls of the company as
of any date after December 31, 200X, other than the control(s)
specifically identified in this report. Accordingly, we do not express
an opinion that any other controls operated effectively after December
31, 200X. Our report on management's annual assessment of XYZ Company's
internal control over financial reporting, dated [date of report],
[attached or identify location of where the report is publicly
available] identified additional material weaknesses other than the one
identified in this report. We are not reporting on those other material
weaknesses and, accordingly, express no opinion regarding whether those
material weaknesses continue to exist after [date of management's
annual assessment, e.g., December 31, 200X].
    Because of its inherent limitations, internal control over
financial reporting may not prevent or detect misstatements. Also,
projections of any evaluation of the effectiveness of specific controls
or internal control over financial reporting overall to future periods
are subject to the risk that controls may become inadequate because of
changes in conditions or that the degree of compliance with the
policies or procedures may deteriorate.

[Signature]

[City and State or Country]

[Date]

Appendix B: Background and Basis for Conclusions

Table of Contents (Paragraph)

Introduction, B1
Background, B2-B6
Voluntary Nature of Engagement, B7-B9
Form of the Auditor's Opinion, B10-B14
As-of Date of Report, B15-B20
Applicability of the Standard to Material Weaknesses Not Previously
Reported, B21-B27
Focus on Control Objectives, B28-B42
Concept of Materiality, B43-B50
Performance of Substantive Procedures, B51-B54
Using the Work of Others, B55-B64
Dividing Responsibility, B65-B68
New Material Weaknesses Identified, B69-B75
Specific Identification of All Previously Reported Material
Weaknesses, B76-B79
Other Reporting Matters, B80-B92
Conforming Amendments to AT sec. 101, B93-B95

Introduction

    B1. This appendix summarizes factors that the Public Company
Accounting Oversight Board (the ``Board'') deemed significant in
reaching the conclusions in the standard. This appendix includes
reasons for accepting certain views and not accepting others.

Background

    B2. Section 404 of the Sarbanes-Oxley Act of 2002 (the ``Act'')
requires the management of public companies each year to file an
assessment of the effectiveness of their companies' internal control
over financial reporting. The company's independent auditor must attest
to, and report on, management's assessment. Under the Securities and
Exchange Commission's (the ``SEC'' or ``Commission'') implementing
rules, company management may not conclude that internal control over
financial reporting is effective if one or more material weaknesses
exists.
    B3. When a company reports a material weakness, investors may be
left uncertain about the reliability of the company's financial
reporting. Both companies and report users have recognized the
importance of a mechanism for alerting investors that a previously
disclosed material weakness no longer exists.\4\ The federal securities
laws provide part of that mechanism. Those laws require the company to
disclose to investors any changes in internal control over financial
reporting that occurred during the company's most recent fiscal quarter
that have materially affected, or are reasonably likely to materially
affect, the company's internal control over financial reporting.\5\
Therefore, investors will learn of material improvements, such as the
remediation of a material weakness, on a timely basis through quarterly
disclosures.\6\
---------------------------------------------------------------------------

    \4\ The Board's Standing Advisory Group (``SAG'') discussed
possible auditor involvement with the elimination of a material
weakness at its November 18, 2004, public meeting. The webcast of
the November 18, 2004 SAG discussion and the related briefing paper
on this topic, ``Reporting on the Correction of a Material
Weakness,'' are available on the Board's Web site at http://www.pcaobus.org
.

    \5\ See Item 308(c) of Regulation S-K, 17 CFR 229.308(c).
    \6\ In addition, even if internal control over financial
reporting is effective as of the end of a company's fiscal year,
investors also could potentially learn if it deteriorates materially
during the year through these quarterly disclosures.
---------------------------------------------------------------------------

    B4. When a company determines that a material weakness has been
remediated, it may determine that disclosure is sufficient. Some
investors and companies, however, have called for the ability to
bolster confidence in management's assertions about those internal
control improvements with the added assurance of the company's
independent auditor.\7\
---------------------------------------------------------------------------

    \7\ The Standing Advisory Group's November 18, 2004 discussion
included this type of encouragement.
---------------------------------------------------------------------------

    B5. The Board reviewed its existing auditing and attestation
standards to determine whether adequate standards governing such an
engagement already existed. The Board's interim attestation standards
provide requirements for general attest engagements; however, the Board
determined that these standards lack sufficient specificity for this
purpose.\8\ The Board, therefore,

proposed an auditing standard that would be tailored narrowly to an
engagement to report on whether a previously reported material weakness
continues to exist.
---------------------------------------------------------------------------

    \8\ See AT sec. 101, ``Attest Engagement'' of the Board's
interim standards. Effective April 16, 2003, the PCAOB adopted, on
an initial, transitional basis, five temporary interim standards
rules (PCAOB Rules 3200T, 3300T, 3400T, 3500T, and 3600T) that refer
to pre-existing professional standards of auditing, attestation,
quality control, ethics, and independence (the ``interim
standards''). These rules were approved by the SEC on April 25,
2003. See SEC Release No. 33-8222. On December 17, 2003, the Board
approved technical amendments to the interim standards rules
indicating that, ``when the Board adopts a new auditing and related
professional practice standard that addresses a subject matter that
also is addressed in the interim standards, the affected portion of
the interim standards will be superseded or effectively amended.
Accordingly, the Board approved adding the phrase `to the extent not
superseded or amended by the Board' to each of the interim standards
rules.'' Technical Amendments to Interim Standards Rules, PCAOB
Release No. 2003-26 (Dec. 17, 2003); Exchange Act Release No. 49624
(Apr. 28, 2004) (SEC Approval). The interim standards are available
on the Board's Web site at http://www.pcaobus.org.

---------------------------------------------------------------------------

    B6. The Board received 30 comment letters on its proposal,
primarily from auditor and investor groups as well as from two issuers.
Those comments led to changes in the standard, intended to make the
requirements of the standard clearer and more operational. This
appendix summarizes significant views expressed in those comment
letters and the Board's responses.

Voluntary Nature of Engagement

    B7. The proposed standard explicitly stated that the engagement
described by this standard is voluntary and that the standards of the
PCAOB did not require an auditor to undertake this engagement when a
material weakness was previously reported. In addition, the Board
stressed the voluntary nature of this engagement at the public meeting
proposing this standard.
    B8. The value and importance of the Board's standards providing the
option of this type of auditor reporting on a material weakness was
confirmed unanimously in the comment letters from investors and
investor-related parties. Auditors were also supportive of the standard
overall and its voluntary nature. Both of the issuers who commented
indicated that they would be concerned if issuers become compelled to
obtain such opinions. One of these commenters stressed that the
disclosure requirements of management, coupled with enhanced criminal
penalties, should provide investors with information regarding the
continued existence or correction of a material weakness.
    B9. The Board continues to believe that providing for this type of
auditor reporting in its standards will serve the public interest. At
the same time, the Board reaffirms that reporting on whether a material
weakness continues to exist is a voluntary engagement and is not
required by the standards of the PCAOB.

Form of the Auditor's Opinion

    B10. The proposed standard called for the auditor to express a
single opinion directly on the subject matter (i.e., the material
weakness itself), rather than on management's assertion, as follows:

    In our opinion, XYZ Company has eliminated the material weakness
described above as of [date of management's assertion] because the
stated control objective is met as of [date of management's
assertion.]

    B11. Primarily auditors commented on the form of the opinion in the
proposed standard and their comments reflected a wide spectrum of
ideas. Some commenters expressed support for the auditor's report,
including the form of the opinion as proposed. Other comments included
a suggestion for two opinions, consistent with Auditing Standard No.
2--one on the subject matter (the elimination of the material weakness)
and one on management's assertion. Other commenters suggested that just
one opinion was sufficient, though these commenters were split
regarding whether the one opinion should be on management's assertion
or on the subject matter. Other commenters suggested that an opinion
stating that the material weakness had been eliminated, without the
phrase ``because the stated control objective is met'' would be a
better alternative, while others asked the Board to consider an opinion
stating that the identified controls were effective because the stated
control objective was met, without stating that the material weakness
had been eliminated.
    B12. A number of commenters expressed concern with the phrasing
``the material weakness has been eliminated,'' including the use of
that phrase in the auditor's opinion and in the title of the proposed
standard. These commenters believed that terminology such as
``elimination'' or ``eliminated'' might be too definite a term that
might mislead report users into believing that there were no remaining
deficiencies in the internal control over financial reporting in the
area related to the specified material weakness, even though control
deficiencies of a lesser severity than a material weakness might
persist.
    B13. After considering these suggestions, the Board decided to
retain a single opinion on the subject matter and to revise the opinion
wording. The Board continues to believe that a single opinion expressed
directly on the subject matter is the simplest and clearest form of
communication related to this engagement. Further, the Board believes
that an auditor's opinion directly on the subject matter (i.e., the
material weakness itself) will best achieve the overarching objective
of this engagement--to clearly communicate as of an interim date
auditor assurance about whether a previously reported material weakness
continues to exist.
    B14. The Board agreed with commenters that use of the term
``elimination'' might increase the risk that a report user would
misunderstand the assurance provided by an auditor's opinion on a
previously reported material weakness. As a result, the Board changed
the form of the opinion to ``In our opinion, the material weakness
described above no longer exists as of [date of management's
assertion]'' and the title of the standard to ``Reporting on Whether a
Previously Reported Material Weakness Continues to Exist.'' The text of
the standard was modified throughout to delete references to
``eliminated'' or ``elimination'' and to reflect wording consistent
with the revised opinion and title.
As-of Date of Report
    B15. The proposed standard provided for significant flexibility by
allowing the engagement to be undertaken at any time during the year,
limited only by implications associated with the nature of the material
weakness. In other words, the proposed standard did not require the
engagement to be performed in conjunction with an audit or review of
financial statements. Instead, the proposed standard required the
auditor to determine whether management had selected an appropriate
date for its assertion and specified several matters for the auditor to
consider in making this determination.
    B16. A number of auditors suggested that the engagement described
by the proposed standard should be performed only as of quarterly
financial reporting dates instead of as of any date during the year.
These commenters believed that such a requirement would allow the
auditor to integrate this work with the auditor's interim review
procedures under AU sec. 722, Interim Financial Information, and
provide a link between the auditor's report on the material weakness
and management's quarterly disclosures of material changes in internal
control. Commenters noted that many of the material weaknesses that
have been disclosed to date are related to the period-end financial
reporting process and that the auditor would therefore need to test
controls in connection with a period-end to determine whether the
material weakness continues to exist. Several commenters linked their
suggestion that this engagement be performed only as of a quarterly
financial reporting date to the view that the standard's direction on
performing substantive procedures as part of this engagement should be
bolstered (see separate discussion on performance of substantive
procedures beginning at paragraph B51). One commenter pointed out,
however, that if this engagement could be conducted only in connection
with a quarterly financial reporting date, special guidance for
applying the standard to foreign filers would be necessary because
foreign filers are not required to

report quarterly in the same manner as domestic filers.
    B17. The Board believes that the flexibility provided in the
proposed standard regarding the timing of the engagement is an
important and appropriate feature of the standard. Although the Board
agrees with commenters' observations that many of the material
weaknesses disclosed during the past year were related to the period-
end financial reporting process, the Board determined that the existing
provisions of the proposed standard address this circumstance. In
determining whether management has selected an appropriate date for its
assessment, the standard requires the auditor to consider that controls
that operate over the company's period-end financial reporting process
typically can be tested only in connection with a period-end.
    B18. Moreover, some material weaknesses--such as those that involve
transaction-based controls that operate daily--are well suited for a
management assertion and an auditor opinion that the material weakness
no longer exists as of almost any date. Restricting an auditor's
reporting on whether a material weakness continues to exist to only
quarterly financial reporting dates could impose unnecessary delay on a
company seeking auditor assurance that this type of material weakness
no longer exists. For example, assume that a calendar year-end company
had previously disclosed a material weakness that was the type that
would lend itself well to reporting that it no longer existed as of any
date. Further, management could not yet assert that the material
weakness no longer existed as of March 31, but believed that it could
make the assertion as of a date in April. If the standard restricted
auditor reporting to a quarterly financial reporting date, the auditor
would have to wait until June 30 to be able to attest to whether the
material weakness continued to exist (and, presumably, would not be
able to issue his or her report until July, at the earliest). While
management could, in this example, provide timely disclosure to
investors that the material weakness no longer existed, the Board
concluded that structuring the provisions of the standard to
potentially result in this kind of delay in auditor assurance would not
serve the public interest.
    B19. In light of these considerations, the Board decided to retain
the provisions of the proposed standard that would permit the auditor
to report on whether a previously reported material weakness continues
to exist as of any date.
    B20. At least one auditor asked for clarification about whether a
report issued pursuant to Auditing Standard No. 2 that identified a
material weakness could be issued at the same time as a report pursuant
to this standard indicating that the material weakness no longer exists
as of a later date. The degree of flexibility regarding the timing of
this engagement would permit the company (depending on the company's
ability to assert that a material weakness no longer exists and the
auditor's ability to timely audit that assertion) to simultaneously
distribute its annual reports and the management assertion and auditor
report described in this standard. Consistent with this flexible
approach, nothing in this standard or Auditing Standard No. 2 would
preclude the auditor from issuing a single, combined report on the
results of an audit of internal control over financial reporting
pursuant to Auditing Standard No. 2 and the results of an engagement
performed pursuant to this standard.

Applicability of the Standard to Material Weaknesses Not Previously
Reported

    B21. The proposed standard was structured to allow an auditor to
report only on a previously reported material weakness. The proposed
standard defined a previously reported material weakness as a material
weakness that was previously described by an auditor's report issued
pursuant to Auditing Standard No. 2. A material weakness initially
identified after the company's annual assessment date could not,
therefore, be the subject of an auditor's report under the proposed
standard.
    B22. Virtually all of the investors who submitted comment letters
suggested that the standard should allow for auditor reporting on
material weaknesses identified subsequent to the company's most recent
annual assessment of internal control over financial reporting.
Although some of these commenters expressed concern about the level of
work that might be required of the auditor to thoroughly understand a
material weakness not previously reported upon by an auditor, they did
not believe that the standard should prohibit such reporting. One
commenter stated that if a successor auditor could gain an
understanding of a company's internal control sufficient to report on a
material weakness that was identified and reported on by a predecessor
auditor, an auditor should be able to gain the understanding necessary
to report on a material weakness identified by management as of an
interim date.
    B23. The majority of the auditors who commented indicated strong
opposition to allowing auditors to report in this engagement on
material weaknesses not previously reported. These commenters suggested
that the initial identification of a material weakness requires a level
of understanding of the company's controls and the specific facts and
circumstances surrounding the material weakness that can result only
from a complete evaluation of the effectiveness of internal control
over financial reporting. Additionally, at least one commenter
expressed concern that the identification of a material weakness
subsequent to the annual assessment is a strong indicator of a material
change within the company's internal control over financial reporting.
This commenter believed that in such a circumstance the auditor would
not have sufficient knowledge of the current state of internal control
over financial reporting to be able to consider the interaction and
potential implications of the change on other controls. This commenter
also believed that this situation would prevent the auditor, in most
cases, from being able to determine whether the newly identified
material weakness no longer exists.
    B24. The Board decided to retain the approach described by the
proposed standard. The Board believes that the issue of a newly
identified material weakness being an indicator of a material change
within a company's internal control over financial reporting is a valid
concern. Although the change in internal control over financial
reporting giving rise to any new material weakness may be confined
specifically to the area in which the material weakness originally was
identified, the change also could be more far-reaching. In such
circumstances, the auditor may not be able to determine the effect of
the change without performing a full audit of internal control over
financial reporting.
    B25. The Board also notes that there is an important distinction
between material weaknesses previously identified in an auditor's
report issued pursuant to Auditing Standard No. 2 and other newly
identified material weaknesses. The primary purpose of the narrow
engagement described by this standard is to establish a timely and
reasonable mechanism that a company can use to remove any perceived
``stain'' upon its financial reporting due to an outstanding adverse
audit opinion on internal control over financial reporting that
identified a material weakness. In the case of a new material weakness
that

is identified and addressed by management as of an interim date, an
adverse auditor opinion previously attesting to the material weakness
would not exist and, therefore, the new material weakness would not be
the subject of the same type of market focus.
    B26. There is also a fundamental difference between the auditor
reporting on a material weakness not previously reported and a
successor auditor reporting on a material weakness that was reported in
a predecessor auditor's opinion on internal control over financial
reporting. The fundamental difference is the concept of material change
described above. The successor auditor must obtain a sufficient
understanding of the company's internal control over financial
reporting to report on the existence of a material weakness that was
previously reported. This successor auditor, however, has the benefit
of knowing that the material weakness was identified in the context of
an audit of the internal control over financial reporting as a whole
and that the predecessor auditor should have adequately described the
nature of the material weakness (particularly its pervasiveness and the
extent of its effect on the company's financial reporting). In
contrast, in situations in which a material change has taken place and
a new material weakness has arisen after the previous annual assessment
of internal control over financial reporting, neither the predecessor
nor the successor auditor has obtained this level of understanding as
it relates to the newly identified material weakness.
    B27. These considerations, taken together, resulted in the Board's
decision to retain the provisions of the proposed standard that limit
this engagement only to material weaknesses that have been previously
described in an auditor's report issued pursuant to Auditing Standard
No. 2. The Board also made changes to the standard, as suggested by one
commenter, to make these provisions clearer. These changes included
changing the title of the standard to ``Reporting on Whether a
Previously Reported Material Weakness Continues to Exist'' as well as
conforming changes to the text of the standard to refer explicitly to a
previously reported material weakness as the subject matter of this
engagement.

Focus on Control Objectives

    B28. The proposed standard focused on stated control objectives to
determine whether a material weakness continues to exist and posited
that if a material weakness has been disclosed previously, a necessary
control objective at the company has not been achieved. Because the
term ``stated control objective'' was not precisely defined elsewhere
in the Board's auditing standards, the proposed standard provided a
definition as well as examples of stated control objectives.
    B29. A stated control objective in the context of this engagement
is the specific control objective identified by management that, if
achieved, would result in the material weakness no longer existing. The
stated control objective would provide management and the auditor with
a specific target against which to evaluate whether the material
weakness continues to exist. For this reason, the proposed standard
required that management and the auditor be satisfied that if the
stated control objective were achieved the material weakness would no
longer exist.
    B30. Comments on the proposed standard's focus on control
objectives came primarily from auditors. Many auditors, either
explicitly or implicitly, supported the focus on control objectives.
One auditor suggested that, given the importance of control objectives,
the proposed standard should explicitly state that documentation of
control objectives is required.
    B31. Several auditors, however, expressed concerns about the
proposed standard's focus on control objectives. A couple of these
commenters suggested that the proposed standard's emphasis on control
objectives might inappropriately establish a framework for evaluating
the effectiveness of internal control over financial reporting that
differs from, or otherwise adversely affects the proper application of,
the Committee of Sponsoring Organizations of the Treadway Commission's
publication Internal Control--Integrated Framework (``COSO'').
    B32. Most concerned commenters expressed apprehension that report
users might be misled by an auditor's opinion that a material weakness
had been eliminated because the control objectives had been met. They
believed that this type of opinion might lead report users to
mistakenly believe that if the control objectives were met, there were
no remaining deficiencies in the internal control over financial
reporting in the area related to the material weakness--when, in fact,
a significant deficiency or deficiency could continue to exist.
    B33. Another commenter noted that the examples in the proposed
standard illustrated only control objectives for the control activities
component of internal control over financial reporting--not for the
other components (control environment, risk assessment, monitoring,
information and communication). This commenter suggested that examples
of control objectives in the other components would be helpful. Another
commenter suggested that, given the importance of the control objective
concept, if the Board's standards were to specifically address the
concept, such a definition and discussion should reside in Auditing
Standard No. 2. One concerned auditor concluded that, given the
importance of control objectives, more guidance was needed, including
clarification that if more than one control is necessary to achieve a
stated control objective, all such controls must be identified and
tested as part of this engagement.
    B34. In response to comments, the Board decided to retain the
definition of, and focus on, control objectives and provide additional
guidance. The Board views the auditor's use of the concept of control
objectives as analogous to the use of the concept of relevant
assertions. The concept of relevant assertions was already familiar to
experienced auditors and was specifically defined for the first time in
Auditing Standard No. 2 because of that standard's focus on testing
controls over all relevant assertions related to all significant
accounts. Similarly, the concept of control objectives is familiar to
most experienced auditors and is already used to describe the auditor's
responsibilities under Auditing Standard No. 2).\9\ A definition of
control objectives (and stated control objectives) is provided in this
standard because of the standard's focus on control objectives as a
specific measure for determining whether a material weakness continues
to exist. This is consistent with the Board's objective for its
standards to be clear as well as the

focus on control objectives in the engagement described by this
standard.
---------------------------------------------------------------------------

    \9\ For example, paragraph 12 of Auditing Standard No. 2 states,
``Therefore, effective internal control over financial reporting
often includes a combination of preventive and detective controls to
achieve a specific control objective.'' Paragraph 85 of Auditing
Standard No. 2 elaborates on this idea, including the example that,
when performing tests of preventive and detective controls, the
auditor might conclude that a deficient preventive control could be
compensated for by an effective detective control and, therefore,
not result in a significant deficiency or material weakness. That
paragraph concludes with the statement, ``When determining whether
the detective control is effective, the auditor should evaluate
whether the detective control is sufficient to achieve the control
objective to which the [deficient] preventive control relates.''
Perhaps most notably, paragraph 88 of Auditing Standard No. 2
requires the auditor to identify the company's control objectives in
each area and identify the controls that satisfy each control
objective to evaluate whether the company's internal control over
financial reporting is designed effectively.
---------------------------------------------------------------------------

    B35. The Board believes that the standard's focus on control
objectives is sound and helpful and is an appropriate complement to the
control criteria, such as COSO, for the purposes of this engagement.
The process of tailoring control objectives to the individual company
allows the control criteria (i.e., the evaluation framework) used for
management's annual assessment to be applied to the facts and
circumstances in a reasonable and appropriate manner. Accordingly, the
emphasis in this standard on control objectives is consistent with, and
supports a correct application of, COSO.
    B36. The focus on whether the stated control objectives have been
met as the target for determining whether a material weakness continues
to exist does accommodate the circumstance in which a deficiency or
significant deficiency continues to exist in that area of the company's
internal control over financial reporting. Although several commenters
linked this result with the focus on control objectives, this potential
result would exist in any case within the overall construct of this
standard, completely apart from the focus on control objectives. The
potential for less severe deficiencies to persist in an area in which a
previously reported material weakness no longer exists parallels the
reporting results of an engagement performed under Auditing Standard
No. 2. According to that standard, only material weaknesses (not less
severe weaknesses) are disclosed in an auditor's report and only the
existence of a material weakness and not less severe weaknesses affects
the auditor's opinion on the effectiveness of the company's internal
control over financial reporting. As an illustration, assume that a
company that had previously reported a material weakness in internal
control over financial reporting elected to wait until the auditor's
next annual report issued pursuant to Auditing Standard No. 2 to obtain
auditor assurance related to the existence of the material weakness. If
the control weakness that had previously risen to the level of material
weakness were reduced to a significant deficiency or deficiency as of
the company's next year-end, the auditor's next report issued under
Auditing Standard No. 2 would present an unqualified opinion indicating
that the company's internal control over financial reporting was
effective. The Board concluded that the users of an auditor's report on
whether a previously reported material weakness continues to exist need
only receive auditor assurance that the material weakness no longer
exists and not more detailed information about whether less severe
control deficiencies continue to persist.
    B37. The Board notes, however, that paragraph 140 of Auditing
Standard No. 2 states (in part) that strong indicators of a material
weakness include circumstances in which significant deficiencies that
have been communicated to management and the audit committee remain
uncorrected after some reasonable period of time. If management does
not plan to correct the significant deficiency within a reasonable
period of time, the auditor should evaluate whether the remaining
significant deficiency could be indicative of a material weakness in
internal control over financial reporting. An auditor is not required
to provide an opinion under this voluntary engagement, and could
reasonably decline to provide an opinion under such circumstances.
    B38. In response to comments that report users will mistakenly
believe that an auditor's report issued pursuant to the standard's
provisions is communicating auditor assurance that no control
deficiencies exist in the area related to the former material weakness,
the Board decided that the change in the title of the standard and the
form of the auditor's opinion (discussed further in paragraph B14),
coupled with this discussion, would sufficiently mitigate any potential
for report users to misunderstand the assurance being provided by an
engagement conducted under this standard. Removing the concept of
control objectives from the standard would not address the potential
for misunderstanding because this potential exists independently of the
focus on control objectives.
    B39. With regard to the recommendation that the standard provide
additional examples of stated control objectives, including stated
control objectives related to components of internal control over
financial reporting other than control activities, the Board determined
that the provisions of the standard should remain largely at the
conceptual level and state that the other components of internal
control over financial reporting can be expressed in terms of control
objectives. The Board also determined to emphasize, in the note to
paragraph 17 of the standard, that when a material weakness has a
pervasive effect on the company's internal control over financial
reporting, it may be difficult to identify all of the relevant control
objectives and the material weakness probably is not suitable for this
type of narrow, interim reporting.
    B40. For the purposes of this engagement, a stated control
objective need not be more precise than to describe an objective that
relates to whether there is a more than remote risk that the company's
financial statements are materially misstated in a given area. For
instance, paragraph 14 of the standard includes the example control
objective, ``The company has legal title to recorded product X
inventory in the company's Dallas, TX warehouse.'' This example assumes
that the product X inventory account related to the company's Dallas,
TX warehouse represents a more than remote risk of material
misstatement to the company's financial statements taken as a whole and
has been identified as a separate significant account. This example
does not suggest that a company should establish separate control
objectives for all of its various types of inventory, by inventory
location, regardless of materiality.
    B41. Although the Board believes that the proposed standard made
clear that in performing this engagement, the auditor should identify
and test all controls necessary to achieve the stated control
objective, based on the importance of this concept and in response to
commenters, the Board concluded that an explicit clarification should
be added. Not only must newly implemented or modified controls be
identified and tested in this engagement, but all controls necessary to
achieve the stated control objective must be identified and tested. For
example, in a circumstance in which four controls must operate
effectively for a given control objective to be achieved, the failure
of one of those controls could result in a material weakness. In the
context of this engagement, all four controls necessary to achieve the
stated control objective would need to be specifically identified and
tested. This must be the case because of the inherent limitations in
internal control over financial reporting. If three of the four
controls were found to be effective as of year-end, they cannot be
assumed to be effective as of a later date. To render an opinion as of
a current date about whether the material weakness exists, the auditor
must have current evidence about whether all controls (in this example,
all four controls) necessary to achieve the control objective are
designed and operating effectively.
    B42. Regarding the suggestion to include a requirement that control
objectives be documented, the Board notes that neither COSO nor
Auditing Standard No. 2 currently contain such a requirement. As with
many aspects of

assessing the effectiveness of internal control over financial
reporting, the better the documentation, the easier and more efficient
the evaluation, especially from the auditor's perspective. In the
context of this engagement, by virtue of creating a stated control
objective, the company and the auditor would document the stated
control objective, even if that documentation appeared only in their
respective reports. Therefore, documentation is effectively required
for the stated control objectives encompassed by an engagement
conducted under this standard. The Board does not believe, however,
that establishing a broad requirement for documenting all control
objectives related to a company's internal control over financial
reporting is needed at this time or would be appropriately placed
within this standard.

Concept of Materiality

    B43. To provide direction on the concept of materiality, the
proposed standard largely referred to Auditing Standard No. 2. The
proposed standard stated that the concept of materiality, as discussed
in paragraphs 22 and 23 of Auditing Standard No. 2, underlies the
application of the general and fieldwork standards in an engagement to
report on whether a previously reported material weakness continues to
exist. Therefore, the auditor uses materiality at the financial-
statement level, rather than at the individual account-balance level,
in evaluating whether a material weakness exists.
    B44. Several auditors commented that the proposed standard should
provide additional direction on how the auditor considers materiality
in performing this engagement. Commenters believed that clarification
was necessary regarding the appropriate time context for management's
and the auditor's materiality judgments. These commenters asked whether
materiality should be assessed as of the date management asserts to be
the date at which the material weakness no longer exists, or as of the
end of the prior year when the material weakness was originally
reported.
    B45. Most commenters on this issue suggested that the date for
assessing materiality should be the date management asserts to be the
date at which the material weakness no longer exists. Commenters noted,
however, that this position would allow a material weakness to no
longer exist merely as a result of a business acquisition or
disposition, for example, because either of those actions would change
materiality as of that point in time (and, in the case of a
disposition, send the material weakness along with the disposed
business).
    B46. Several auditors suggested that the auditor's opinion should
explicitly recognize the concept of materiality. Commenters suggested
the following as alternatives that would recognize materiality:
``Management's assertion that XYZ Company has eliminated the material
weakness described above as of [date of management's assertion] is
fairly stated, in all material respects* * *'' and ``XYZ Company has
eliminated the material weakness with respect to the Company's internal
control over financial reporting as described above as of [date
specified in management's assertion], in all material respects.'' These
commenters were concerned that the opinion described by the proposed
standard misrepresented the precision of the auditor's assessment and
neglected the notion of reasonable assurance.
    B47. The Board decided that the provisions in the standard
regarding materiality should be clarified to specify that materiality
should be assessed as of the date management asserts that the material
weakness no longer exists. The as-of date of management's assertion and
the auditor's opinion is fundamental to the auditor's decisions about
whether he or she has obtained sufficient evidence to support an
opinion and to the auditor's evaluation of that evidence to form an
opinion on whether the material weakness exists as of that point in
time. The Board believes that the logical and internally consistent
position regarding the time context for assessing materiality is to
assess materiality as of the date that management asserts the material
weakness no longer exists. The Board also believes that materiality can
be assessed as of a date other than a financial reporting period-end.
This is consistent with the Board's decision, discussed further
beginning at paragraph B15, that the standard permit the auditor to
report on whether a previously reported material weakness continues to
exist as of any date.
    B48. The Board also believes that auditors should exercise caution
in circumstances in which the only aspect of a previously reported
material weakness that has changed is materiality (in other words, the
size of the financial statement accounts has changed due to an
acquisition or other activity rather than any changes in the design or
operation of controls). In many such cases, the company will have
undergone significant changes, with an associated change in internal
control over financial reporting overall. In this circumstance, the
auditor would need to perform procedures beyond the scope of work
ordinarily contemplated under this standard to have a sufficient basis
for his or her new assessment of materiality and an adequate
understanding of the company's internal control over financial
reporting overall. The Board believes that, in many cases in which the
company has undergone a change of this magnitude, the auditor would
need to perform a full audit of internal control over financial
reporting in accordance with Auditing Standard No. 2 to have a
sufficient basis for assessing materiality, understanding the company's
internal control over financial reporting overall, and rendering an
opinion about whether a material weakness continues to exist. Also, as
discussed in paragraph B37, a previously reported material weakness may
no longer exist because it has been reduced to a significant
deficiency. In this circumstance, if management does not plan to
correct the significant deficiency within a reasonable period of time,
the auditor should evaluate whether the remaining significant
deficiency could be indicative of a material weakness.
    B49. Regarding the form of the auditor's opinion and concerns that
the opinion suggested by the proposed standard implied an inappropriate
degree of precision and neglected the concept of reasonable assurance,
the Board concluded that the provisions of the proposed standard were
sufficiently clear that the auditor's objective in this engagement was
to plan and perform the engagement to obtain reasonable assurance about
whether a previously reported material weakness continues to exist as
of the date specified by management. Furthermore, the auditor's report
described by the proposed standard included disclosure of this
objective. The Board does not, therefore, believe that report users
would mistakenly believe that the auditor's opinion, as proposed, would
convey absolute assurance.
    B50. In addition, the Board believes that including another
reference to materiality in the auditor's opinion would not add
anything of substance to the auditor's conclusion and could instead
impair its readability. The determination of whether a material
weakness exists is inherently linked to materiality. Stating that the
material weakness no longer exists in all material respects would be
redundant--the equivalent of saying that the financial statements are
not materially misstated in all material respects. Accordingly, the
Board has not added another reference to materiality in the auditor's
opinion.

Performance of Substantive Procedures

    B51. The proposed standard, consistent with its reliance on the
existing provisions of Auditing Standard No. 2, focused largely on the
tests of controls that the auditor must perform to obtain reasonable
assurance that a material weakness no longer exists. The proposed
standard additionally recognized that, in some cases, the auditor also
would need to perform substantive procedures on account balances to
obtain sufficient evidence as to whether a material weakness no longer
exists.
    B52. Several auditors believed that the proposed standard was too
mild in its wording that the auditor ``may determine'' that performing
substantive procedures was necessary. Those commenters believed that,
to be consistent with the integrated audit concept of Auditing Standard
No. 2 and to reflect the fact that identification of many material
weaknesses during the past year occurred during the performance of
substantive audit procedures, such wording did not adequately convey
the importance of performing substantive procedures in an engagement to
report on whether a previously reported material weakness continues to
exist. Some commenters recommended that the standard set forth a
presumptively mandatory requirement for the auditor to perform
substantive audit procedures in all cases, while others suggested that
strengthening the language or providing additional guidance about when
substantive procedures are necessary would be sufficient.
    B53. The Board continues to believe that in some circumstances,
substantive procedures will not be necessary for the auditor to obtain
sufficient evidence about whether a material weakness continues to
exist. Like many aspects of this standard, the auditor's judgment in
this area will depend on the nature of the material weakness. An
auditor can obtain sufficient evidence to support an opinion on whether
some material weaknesses continue to exist without the need for
substantive procedures. Other material weaknesses necessitate
substantive procedures for the auditor to obtain sufficient evidence.
Therefore, the Board determined that it would be inappropriate to
establish a presumptively mandatory requirement that substantive
procedures be performed in all cases.
    B54. The Board agreed, however, that the proposed standard did not
sufficiently stress the potential importance of performing substantive
procedures, depending on the nature of the material weakness. Paragraph
34 of the standard has, therefore, been modified in a manner that the
Board believes better articulates the potential need to perform
substantive procedures. An example also has been added to this
paragraph of the standard to illustrate a circumstance in which
substantive procedures ordinarily would need to be performed.

Using the Work of Others

    B55. Similar to PCAOB Auditing Standard No. 2, the proposed
standard permitted the auditor to use the work of others to alter the
nature, timing, and extent of the auditor's performance of this work.
Specifically, the proposed standard applied the framework for using the
work of others described in PCAOB Auditing Standard No. 2. That
framework requires the auditor to obtain the principal evidence
supporting his or her opinion and to evaluate the nature of the
controls being tested, together with the competence and objectivity of
the persons performing the work.
    B56. Under both PCAOB Auditing Standard No. 2 and the proposed
standard, the framework measures principal evidence in relation to the
overall assurance provided by the auditor. In PCAOB Auditing Standard
No. 2, the principal evidence supporting the auditor's opinion should
be evaluated in relation to the auditor's opinion on internal control
over financial reporting overall. In contrast, the evaluation of
whether the auditor has obtained the principal evidence supporting his
or her opinion as to whether a material weakness no longer exists would
need to be applied at the control objective level.
    B57. There were few comments on the provisions for using the work
of others in this proposed standard. Most commenters who commented on
these provisions expressed confusion about a passage in the example of
proposed paragraph 36, which stated that ``the auditor might perform a
walkthrough of the reconciliation process himself or herself [emphasis
added].'' Commenters believed that walkthroughs were required in the
proposed standard in all cases and that walkthroughs must be conducted
by the auditor himself or herself.
    B58. One auditor suggested clarifying within the proposed standard
that the auditor will be able to use the work of others only in limited
circumstances. This same commenter also believed that the bank
reconciliation example presented in the proposed standard to illustrate
how the auditor could use the work of others in this type of engagement
was too simplistic and requested additional, more realistic examples.
    B59. The Board continues to believe that the framework for using
the work of others that was established in Auditing Standard No. 2 is