SEC Advisory Committee 

on Small and Emerging 

Companies

September 13, 2017

www.pwc.com
PwC

Agenda

 404(b) Exemption Background

 Evolution of the ICFR Integrated Audit Landscape

• Key elements of the SEC and PCAOB’s 2007 reforms (AS 2201)

 Integrated Audit Approach

 Key Benefits

2

SEC Advisory Committee on Small and Emerging Companies September 13, 2017
PwC

404(b) Exemption Background

Current state

• Approximately 50% of companies today are non-accelerated filers 

and as a result are exempt from 404(b)

• Emerging Growth Companies are able to forgo an ICFR audit 

generally for their first 5 years as a public company (JOBS Act)

3

SEC Advisory Committee on Small and Emerging Companies September 13, 2017 *Source: Audit Analytics

21% 29% 50%

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

2016

Public Filers by Filing Status*

Accelerated Filer Large Accelerated Filer Non-Accelerated Filer/SRC
PwC

Evolution of the ICFR Integrated Audit Landscape

• Auditors and management have gained significant experience over time and 

refined approaches

• Control audit closely aligned with financial statement audit

• Auditing standards are aligned with Commission guidance for management

- Focus is on risk and materiality; top-down, risk based approach integrated with the 

audit of financial statements

- ELCs can reduce the need for testing of process-level controls

• Significant regulatory reforms (AS 2201 /AS 5) and COSO guidance for smaller 

public companies aimed at cost effectiveness

Ongoing incremental effort to audit ICFR is a fraction rather than 

double the cost of the financial statement audit

4

SEC Advisory Committee on Small and Emerging Companies September 13, 2017
PwC

Key elements of the SEC and PCAOB’s 2007 reforms (AS 2201)

• Expanded options to use work of others (company personnel, 3rd parties)

• Removed requirement for auditors to perform transaction-level controls tests for 

a “large portion” of company’s operations

• Auditor’s ability to scale the audit based on company’s size and complexity 

• Paragraph 13: “A smaller, less complex company, or even a larger, less complex 

company might achieve its control objectives differently than a more complex 

company.”

• Examples relevant to smaller, less complex companies:

 Acceptance of alternative controls when segregation of duties is limited

 Acceptance of alternative forms of evidence when control documentation is limited 

Ability to scale IT testing

 Use of knowledge from prior years

 Satisfy requirement to understand process without a full walkthrough of transactions

For issuers with public float between $75 and $250 million, the average declines in audit 

fees and outside vendor costs resulting from the reforms were 13% and 21%, respectively*

5

SEC Advisory Committee on Small and Emerging Companies *Source: 2011 SEC Study September 13, 2017
PwC

Integrated Audit Approach

• Plan the audit

• Establish materiality for planning and performing the audit (AS 2015/AS 11)

Materiality is the same for both integrated and financial statement only audits 

• Perform risk assessment procedures (AS 2110/AS 12)

- Obtain an understanding of the company and its environment

- Obtain an understanding of business processes and controls

- Perform analytical procedures and conduct inquiries

- Consider the potential for material misstatement due to error or fraud

Risk assessment procedures are substantially the same for both integrated and 

financial statement only audits

• Identify significant accounts and disclosures and determine the likely sources of 

potential misstatement 

Significant accounts are the same for both integrated and financial statement 

only audits

6

SEC Advisory Committee on Small and Emerging Companies September 13, 2017
PwC

Integrated Audit Approach (cont’d)

• Perform an audit of ICFR (AS 2201/AS 5, and AS 2301/AS 13)

- Identify controls that respond to the risks identified

- Select controls to test using a top-down approach

- Determine the nature, timing and extent of work, including use of others

- Evaluate deficiencies identified

- Consider impact on ICFR opinion (integrated audit only)

- Consider impact on financial statement audit

Unless we plan to take a fully substantive approach over a particular account, 

we test the design and operating effectiveness of controls even for a financial 

statement only audit

7

SEC Advisory Committee on Small and Emerging Companies September 13, 2017
PwC

Integrated Audit Approach (cont’d)

• Perform substantive audit procedures for each financial statement account 

(AS 2300)

- Determine the nature, timing and extent of substantive work

◦ Vary based on planned reliance on controls and evidence obtained 

regarding design and operating effectiveness 

• Evaluate the results of work performed (AS 2810/AS 14) and evidence 

obtained (AS 1105/AS 15)

• Perform concluding audit procedures (AS 2800)

• Form opinions on ICFR and financial statements

8

SEC Advisory Committee on Small and Emerging Companies September 13, 2017
PwC

Key Benefits

• Investors continue to support management and auditor reporting on control effectiveness

• Reductions in cost of ICFR assessments/audits have occurred over time

• More reliable financial reporting

• Restatement rates of non-accelerated filers are noticeably higher than those of 

accelerated filers*

• Rates at which companies report ineffective ICFR continue to be noticeably 

higher for companies with smaller market capitalization*

 *Source: GAO Study – July 2013

9

SEC Advisory Committee on Small and Emerging Companies September 13, 2017

6% 7% 7% 9% 11% 10% 11%

94% 93% 93% 91% 89% 90% 89%

0%

20%

40%

60%

80%

100%

120%

2010 2011 2012 2013 2014 2015 2016

% Ineffective ICFR

$75m-$250m Market Cap**

Ineffective Effective

2% 3% 3% 4% 5% 5% 5%

98% 97% 97% 96% 95% 95% 95%

0%

20%

40%

60%

80%

100%

120%

2010 2011 2012 2013 2014 2015 2016

% Ineffective ICFR

> $250m Market Cap**

Ineffective Effective

**Source: Audit Analytics
PwC

Key Benefits (cont’d)

SEC and GAO studies regarding 404(b) audits have generally shown reductions in the 

cost of 404(b) audits over time as well as other benefits:

• 2011 SEC Staff study* found:

- 404(b) costs have declined since implementation, particularly with the 2007 reforms

- Investors generally view the auditor’s attestation on ICFR as beneficial

- Financial reporting more reliable when auditor is involved with ICFR assessments

• 2013 GAO study** found:

- Companies exempt from 404(b) have had more restatements, and percentage of 

exempt companies restating generally has exceeded that of non-exempt companies 

- Costs associated with 404(b) have declined since 2004

- Companies and others reported benefits of compliance, including improved 

reliability of financial reports

* Source: SEC Study: Study and Recommendations on Section 404(b) of the Sarbanes-Oxley Act of 2002 For Issuers With Public Float Between 

$75 and $250 Million (April 2011)

** Source: GAO Study: Internal Controls – SEC Should Consider Requiring Companies to Disclose Whether They Obtained an Auditor 

Attestation (July 2013)

10

SEC Advisory Committee on Small and Emerging Companies September 13, 2017
PwC

Key Benefits (cont’d)

• A number of studies have shown economic benefits of Section 404(b)

• One 2014 study* that evaluated the costs and benefits of Section 404(b) found results 

that suggested:

- Section 404(b) decreases filers’ cost of debt while increasing compliance costs 

modestly

- Companies subject to 404(b) on average experienced higher valuation premiums 

and higher credit ratings, which decreases the cost of debt

* Source: An Analysis of the Costs and Benefits of Auditor Attestation of Internal Control over Financial Reporting (October 2014); Hongmei 

Jia, Louisiana Tech University; Hong Xie, University of Kentucky; David A. Ziebart, University of Kentucky

11

SEC Advisory Committee on Small and Emerging Companies September 13, 2017