1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

UNITED STATES SECURITIES AND EXCHANGE COMMISSION 

UNOFFICIAL TRANSCRIPT OF 

 MEETING OF COMMISSIONERS 

 April 4, 2007 

Diversified Reporting Services, Inc. 

(202) 467-9200 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

C O N T E N T S 

PAGE 

Opening Remarks - Chairman Christopher Cox 3 

Mark Olson, Chairman 6 

Public Company Accounting Oversight Board 

Jeff Steinhoff, Managing Director, 

Financial Management and Assurance 

US Government Accountability Office 18 

Conrad Hewitt, Chief Accountant 

Office of the Chief Accountant 24 

John White, Director 

Division of Corporation Finance 25 

Zoe-Vonna Palmrose, Deputy Chief Accountant 

31 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

P R O C E E D I N G S 

CHAIRMAN COX: Good morning. This is a meeting of 

the Securities and Exchange Commission under the Government 

in the Sunshine Act on April 4th, 2007. 

Today the Commission is meeting to consider the 

progress of revisions to the auditing standard under Section 

404 of the Sarbanes-Oxley Act and the coordination of those 

revisions with the new 404 guidance for management that was 

proposed by the Commission in December. This is a 

continuation of the process that the Commission and the 

Public Company Accounting Oversight Board began jointly in 

May 2006. The comment periods for both the new Management 

Guidance and the new 404 audit standard ended more than a 

month ago so now we're entering the home stretch of 

completing this important work. Today's discussion is 

intended to keep us on track to consider final adoption of 

our proposed Management Guidance by perhaps the end of May. 

There is another reason it is vitally important 

that we meet today in particular because today is April 4th 

-- "4-04." Opportunities like this don't happen very often. 

It will be almost 6,000 years, for example, before we will 

have the same propitious conditions for considering 

amendments to our Form 8-K in the year 8K. 

The order of events for today's meeting is as 

follows. We will hear first from Mark Olson, Chairman of the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Public Company Accounting Oversight Board, whom we have 

invited to report on the Board's progress in revising the 404 

audit standard and also on the status of our efforts to align 

the 404 guidance for management and the 404 standard for 

auditors. 

Next, we will hear from Jeff Steinhoff, the 

Managing Director for Financial Management and Assurance at 

the U.S. Government Accountability Office. Mr. Steinhoff 

will present the results of the GAO's investigation into the 

implementation of Section 404 and its impact on smaller 

public companies and also the GAO's recommendations for 

improvements in the implementation of Section 404. 

Finally, we will hear from the Commission's 

professional staff, including the Office of the Chief 

Accountant and the Division of Corporation Finance who will 

provide a status report on our work with the PCAOB and make 

recommendations for finalizing our respective proposals. 

So let's begin by welcoming Chairman Mark Olson of 

the Public Company Accounting Oversight Board. 

Thank you, Mr. Chairman, for appearing before the 

Commission today and for your leadership toward an improved 

Section 404 process for companies of all sizes. The PCAOB 

has been hard at work to replace the existing 404 audit 

standard with a more risk-based top-down approach that is 

scalable for companies of all sizes. And in that effort, the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Board under Chairman Olson's leadership has established a 

solid working relationship with the SEC. 

The Sarbanes-Oxley Act, which created the PCAOB, 

has made our agencies partners in regulation. The SEC's 

responsibility for supervision of the PCAOB requires that not 

only the Board but also the Commission agree to and vote 

for new auditing standards before they can become effective. 

This requires a high level of coordination between the SEC 

and the PCAOB. If a standard were approved by the Board but 

not by the Commission, not only could it never take effect 

but valuable time would be lost when the entire effort would 

have to begin anew. Our intent is to have a new audit 

standard and Management Guidance in place for use during the 

2007 audit cycle, so there is no time to waste. 

And for that reason, the Commission is particularly 

appreciative, Mr. Chairman, of the collaborative approach 

that you have taken to addressing this important priority. 

As Chairman Barney Frank succinctly put it, our job as 

regulators is to make the implementation of 404 "more 

flexible" and to "cut back on some of the excessive rules and 

regulations without compromising the core." You have shown a 

keen appreciation of that objective and your leadership has 

been and will continue to be vitally important to the success 

of our joint efforts. 

So, Chairman Olson, welcome. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

CHAIRMAN OLSON: Thank you very much, Mr. Chairman. 

It would have even been more appropriate if we could have 

talked about 404 in the sunshine, but that didn't occur 

today, but we came very close. 

Chairman Cox, Commissioners Atkins, Campos, Casey 

and Nazareth, thank you for the invitation to be with you 

today to provide a sense of the analysis underway at the 

PCAOB as we move to adopt a final standard for auditing 

internal control over financial reporting. 

This effort continues to be the Board's highest 

priority and we are committed, just as the Commission is, to 

the goal of completing the process of replacing Auditing 

Standard Number 2 as soon as possible so that the new 

standard will be in place for 2007 audits as you indicated. 

In achieving that goal we are also committed to 

working in partnership with the Commission throughout this 

process. The PCAOB and the Commission also are partners more 

broadly in our common mission to protect investors. 

Every public company and every investor relies on 

financial reporting. The importance of effective internal 

control to reliable financial reporting cannot be understated 

and Congress recognized this when it enacted Section 404, the 

Sarbanes-Oxley Act. 

As you are aware, in December of last year, the 

PCAOB issued a set of proposals that would supersede the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Board's existing standard in auditing internal control, AS2. 

The proposals were the culmination of two years of in-depth 

efforts to understand the positive and negative aspects of 

the implementation of Section 404. 

We have worked hard to understand how the language 

of AS2 has been understood and implemented by auditors. This 

understanding has helped us identify changes that will 

preserve the benefits of the standard and meet the statutory 

objectives of Section 404 without resulting in the routine 

performance of unnecessary audit procedures. 

In addition to monitoring implementation the Board 

has also made a concerted effort to obtain the views of all 

stakeholders. Among other things, the Board participated 

with the Commission in two round-table discussions with 

representatives of issuers, auditors, investor groups and 

others. The PCAOB Standing Advisory Group has focused 

discussion on issues related to the standard over the course 

of the last few years. 

The Board also made a special effort to hear from 

smaller registered public accounting firms through our forums 

on auditing in the small business environment which continue 

to be held around the country and sometimes include sessions 

with smaller issuers. 

In response to our proposal in December, we 

received over 170 comment letters totaling some 1200 pages of 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

comments. These comments reflect a broad range of views. In 

general they articulate considerable support for the 

proposals as well as many helpful suggestions. Since the 

first comments came in, our staff has been reviewing, 

compiling and analyzing these comments. Indeed, my 

colleagues and I on the Board have spent many hours reading 

and thinking about the comments. 

Owing to the thoughtful and constructive public 

input we have received, our staff has already begun to 

identify potential ways to revise the proposed standard. I 

anticipate the Board will be able to make several 

improvements including further streamlining the standard in 

order to provide additional flexibility to promote 

scalability, avoid unintended consequences and address other 

valid concerns. 

While the Board has been carefully considering and 

describing the key issues, it is premature to say how the 

Board will act on any particular issue nor to commit to any 

course of action on behalf of the Board. 

As with the Commission's process the PCAOB brings 

the perspective of its five Board members to bear in 

deliberating on and eventually voting on final board 

standards. I can assure you, however, that we are open to 

and are carefully considering all comments we have received 

and that we are committed to adopting a standard that 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

fulfills the mandate of Section 404 without resulting in the 

performance of unnecessary audit procedures. 

Under the Sarbanes-Oxley Act, the Board's role is 

to determine in the first instance what the auditing 

standards should be based on -- should be based on its 

knowledge and experience and in light of the statutory 

criteria and to submit for Commission's approval standards 

that reflect that judgment. 

We understand our responsibility and value the 

Commission's role in the process. Of course, in addition to 

the oversight role, the Commission is charged with 

implementing Section 404(a) of the Act which requires 

management to assess the effectiveness of internal controls. 

Because implementing Section 404 is a responsibility shared 

by the SEC and the PCAOB our staffs regularly meet and the 

Board members and I have met with the SEC commissioners to 

further coordinate that work. 

And may I say on behalf of the PCAOB that we have 

been very appreciative of the accessibility of you, Mr. 

Chairman, and also the members of the Commission in this 

effort. 

This collaboration is important and I am pleased to 

describe for you today some of the issues that in light of 

the comments received on the proposal are commanding 

particular attention as we move toward adoption of a final 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

standard. 

Let me highlight a few key areas where we received 

substantial comment. We're looking closely at the comments 

on the topic of the alignment between the Board's standard 

and the SEC's Management Guidance and anticipate making some 

changes to address this issue. 

Management's assessment and the audit of internal 

controls are distinct yet complementary steps in the Section 

404 process of providing assurance to investors about the 

reliability of companies’ financial reporting. It is 

important, therefore, that these steps be coordinated. 

At the same time we must not lose sight of the fact 

that management and the auditor have different perspectives 

on the company's internal controls and the assessment and 

audit have different objectives under Section 404. 

Management is more directly involved with the daily 

operations of the company and therefore works with the 

company's controls on a constant basis. Therefore, 

management's assessment of the effectiveness of the company's 

internal control can and should reflect that familiarity. 

The auditor's perspective, however, is quite 

different. Like the financial statement audit, the audit of 

internal controls is intended to provide investors with an 

independent accountant's opinion formed on the basis of 

procedures performed with appropriate professional skepticism 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

about whether the internal control is effective. The 

standard must therefore establish a process through which an 

independent auditor can form a sufficient basis for 

expressing such an opinion. 

Because of the fundamentally different roles 

management and the independent auditors serve, the standard 

the Board proposed in December would not require the auditor 

to specifically evaluate management's assessment process. 

Our intention was to recognize that management may perform 

its assessment in a manner that may be different from the 

process the auditor uses to reach an independent opinion. 

Removal of the requirement to specifically evaluate 

management's process together with the SEC's guidance to 

management should see to it that the auditing standard does 

not become the de facto guide to performing a management 

assessment. 

Just as management must prepare the financial 

statements to be audited, management also must establish 

internal controls over financial reporting within the company 

and assess the effectiveness of its internal control which 

the independent auditor must then audit. 

While there was a close relationship between 

management's and the auditor's work, this does not mean that 

the audit should not consist of any different or additional 

procedures other than what management has already performed 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

as part of its assessment. 

By requiring an audit of internal control, the Act 

clearly mandated an independent process of testing and 

reporting on management's assessment of whether the company's 

internal controls are effective. 

We will carefully consider recommendations in this 

area and continue to work with the Commission to make sure 

that our final standard and the SEC's Management Guidance 

appropriately complement each other. 

The proposed standard includes a section on scaling 

the audit for smaller, less complex companies. This section 

incorporates discussion of both size and complexity. We 

received many comments on this section from all affiliation 

groups, auditors, issuers, investors, academics and others. 

In general, most commenters were supportive of the 

concept of scalability and the proposed standard's general 

approach but made several recommendations for change. 

Regarding the proposal's overall approach to scaling, a number 

of commenters held the view that scaling is an implicit aspect 

of the risk-based approach and specific tailoring approaches 

are a natural extension of complexity as a risk factor. 

Many commenters stated emphatically that this should 

not be a stand-alone discussion that applies only to smaller 

companies. Most commenters felt strongly that all audits 

should be tailored based on the complexity of the company 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

even though the benefits of scaling are likely to be of great 

benefit to smaller companies. 

Regarding the practical implications of 

scalability, there was general agreement among commenters that 

the attributes listed were sufficient and that the tailoring 

directions for auditors were adequate. A few commenters 

believed that the standard did not provide sufficient relief 

for smaller companies. These commenters suggested that the 

standard should include more credit for controls testing 

based on the work done as part of the financial statement 

audit. 

These are useful perspectives and the Board will 

carefully evaluate the relevant provisions within the 

proposed standard and consider whether additional changes 

should be made to enhance the application of the scalability 

concept for issuers of all sizes and complexity. 

As I mentioned earlier, the Board's proposed 

standard is written to provide a clear statement of the 

principles that auditors should apply when performing an 

audit of internal control. Those who rely on financial 

statements should have some level of confidence that all 

internal control audit opinions afford the same level of 

assurance about the effectiveness of companies controls. 

Accordingly the proposals provide a framework that 

is designed to enable the auditor to obtain the reasonable 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

assurance necessary to support his or her opinion. 

Some commenters, primarily auditors, pointed out 

that the proposed standard includes a large number of 

mandatory and presumptively mandatory requirements. Based on 

documentation requirements and other PCAOB standards for each 

of these requirements the auditor would need to document the 

performance of the requirement which these commenters believe 

would substantially increase the burden of the audit. 

Other commenters referred to the documentation 

required as one of the largest impediments to the auditor's 

use of the work of others particularly in light of the 

different nature of the SEC's Management Guidance. 

Based on the comments received, the Board intends 

to apply a critical eye to each of the “must” and “should” 

requirements in the proposed standard to ensure that each of 

them is necessary. 

The Board is committed to issuing a standard that 

affords auditors the flexibility they need to perform an 

effective and efficient audit of internal control. 

In conclusion, there are a number of other 

significant areas such as use of cumulative knowledge, use of 

the work of others, company-level controls, and risk 

assessment where comments were thoughtful yet mixed. The 

Board also is working through those issues. 

As we move towards adopting a final standard, we 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

know that we must get the language of the standard calibrated 

correctly and we intend to make that happen. What ultimately 

will matter most, however, is what happens in the field. To 

that end we plan to continue our dialogue with stakeholders 

including our focused outreach to accounting firms of all 

sizes but with a special emphasis for small firms. We also 

plan to continue to use our inspection process to monitor 

implementation of the new standard governing audit of 

internal controls. 

The PCAOB looks forward to continuing to coordinate 

with the Commission in implementing Section 404 and other 

aspects of Sarbanes-Oxley. We share the common objective, 

investor protection, and are committed to implementing the 

internal control provisions of the Act in a way that 

maximizes their benefits to public companies and their 

investors. 

Thank you, again, for the opportunity to be here 

today and we look forward to receiving the Commission's 

input. Thank you. 

CHAIRMAN COX: Thank you very much, Mr. Chairman, 

for laying out some of the salient comments that we have 

received in this process and also for giving us an up-to-date 

assessment of where the PCAOB is in the process and where you 

are focused. 

As I mentioned during the introduction, you are 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

doing an outstanding job of making rationalizing 404 

implementation the top priority for the PCAOB and I hope that 

you will share with all the Board members and your 

professional staff the deep appreciation that we have at the 

Commission and throughout our professional organization the 

deep appreciation that we have for the hard work, the energy, 

the commitment that you have shown to getting this problem 

solved. I think we are very close to getting this long 

process completed in time for the 2007 audits and that will 

be in great measure a tribute to you and your leadership. So 

thank you once again. 

CHAIRMAN OLSON: Well, thank you. I will accept 

that on behalf of my colleagues and I will be sure to pass 

the comments back to them. Thank you. 

CHAIRMAN COX: Thank you very much. 

Next, I'd like to welcome Jeff Steinhoff of the 

Government Accountability Office. Mr. Steinhoff is the 

Managing Director for Financial Management Assurance at the 

U.S. Government Accountability Office and in this capacity, 

he leads the GAO's largest audit unit with responsibility for 

oversight of financial management and auditing issues across 

the federal government. Among those responsibilities is the 

annual audit of the SEC's own financial statements. In 

addition, he represents the GAO on the PCAOB's Standing 

Advisory Group. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Over the past several years, the GAO has undertaken 

extensive work in studying the implementation of the 

Sarbanes-Oxley Act. This work includes at least nine studies 

and analyses of various aspects of Sarbanes-Oxley 

implementation and it is focused in particular on the special 

challenges of applying the Section 404 requirements to 

smaller public companies. 

Thus far, smaller public companies have not had to 

comply with Section 404. But beginning next year, smaller 

companies will be expected to come into compliance, and so it 

is vitally important that we have a scalable approach that 

works for them. Both the Commission and, as we've just heard, 

the PCAOB are focused on this and we have been urged by 

congressional leaders including House Financial 

Services Committee Chairman Barney Frank, 

Senate Small Business Committee Chairman John 

Kerry, and House Small Business Committee Chair, 

Nydia Velazquez -- to ensure that the Section 404 

process is scalable for small businesses. And because these 

committees have cited to us the importance of GAO's report on 

the implementation of Section 404 for smaller companies, I am 

especially pleased that Mr. Steinhoff can be here with us 

today. We look forward to hearing from you about the GAO's 

views on the implementation of Sarbanes-Oxley Act for smaller 

public companies. 
 1 Mr. Steinhoff, welcome. 

 2 MR. STEINHOFF: Thank you so much. Chairman Cox, 

 3 members of the Commission, I am pleased to be here today to 

 4 discuss the Commission's proposed guidance for Section 404 of 

 5 the Sarbanes-Oxley Act and the PCAOB's proposed revisions to 

 6 Auditing Standard No. 2. 

 7 Let me say at the outset we support the thrust of 

 8 the current proposals by the Commission and the PCAOB. Also 

 9 I support Chairman Olson's comments earlier today. These 

 10 proposals are responsive to the recommendations in our April 

 11 2006, report on the application of the Sarbanes-Oxley Act to 

 12 smaller companies. In that report we recommended that the 

 13 Commission do three things. First, assess the sufficiency of 

 14 internal control guidance for smaller public companies. 

 15 Second, coordinate with the PCAOB to ensure consistency of 

 16 Section 404 auditing standards with any additional internal 

 17 control guidance for public companies. And, finally, if 

 18 further relief is deemed appropriate, to analyze the unique 

 19 characteristics of smaller companies and their investors to 

 20 ensure that the objectives of investor protection are met and 

 21 any relief provided is targeted and limited. 

 22 Investor protection is the heart of what we are 

 23 speaking about today and my remarks that follow will 

 24 address not only smaller companies, but all companies because 

 25 we think the manner in which Auditing Standard No. 2 
 1 was applied added burdens to all companies. 

 2 Today I would like to briefly highlight three 

 3 issues that are critical to effective implementation of 

 4 Section 404, which we continue to strongly support, 

 5 and the current proposals of the Commission and the PCAOB. 

 6 First, we strongly support the emphasis on using a 

 7 top-down risk-based approach in both management's evaluation 

 8 of internal control over financial reporting and in the audit 

 9 of management's evaluation. We were doing this prior to 

 12 Sarbanes-Oxley. This is the approach we use at 

 10 GAO in our financial statement audits, which provide an 

 11 opinion on internal control and include the consolidated 

 13 financial statements of the U.S. Government, the IRS, the 

 14 Bureau of Public Debt, the FDIC and, as Chairman Cox pointed 

 15 out, the SEC. 

 16 We urged use of a top-down risk-based approach 

 17 when the current Auditing Standard No. 2 was first 

 18 considered and continue to strongly believe that this 

 19 approach, if done properly -- and I emphasize done properly -- 

 20 can maximize efficiency and effectiveness in the assessment 

 21 of internal control. Such an approach provides needed 

 22 flexibility for both management and auditors to make informed 

 23 decisions based on relative risk and cost benefit considerations 

 24 versus having overly prescriptive “one-size-fits-all” requirements. 

 25 As the Commission and the PCAOB move in this 
 1 direction, the challenge will shift to the need to properly 

 2 implement this approach and to hold company management and 

 3 its auditors accountable for doing so. Effective 

 

 4 implementation of a top-down risk-based 

 5 approach requires the involvement of highly knowledgeable 

 6 senior management and audit professionals in order to make 

 7 sound judgments about the risk of material financial 

 8 statement misstatement. Reaching the proper balance is 

 9 challenging but very achievable if the assessment is 

 10 approached with a goal of protecting the investor and with 

 11 the right amount of expertise and professional skepticism 

 12 going in. 

 13 If a top-down risk-based approach is not properly 

 14 implemented by company management and/or the auditors, its 

 15 effectiveness can be compromised. Therefore, if the proposed 

 16 changes are adopted, it will be critical that the Commission 

 17 and the PCAOB closely monitor implementation. In the case 

 18 of the PCAOB, it can use its inspection program to monitor 

 19 auditor implementation. Again, we're very supportive of a 

 20 risk based approach. We think it can be effective and 

 21 efficient, but it must be done in a proper manner. 

 22 Second, the SEC and the PCAOB should continue to 

 23 emphasize management and auditor responsibilities related to 

 24 fraud. Management's evaluation of financial reporting risks 

 25 should also consider the vulnerability of the entity to 
 1 fraudulent activity. The auditors’ responsibility for 

 2 detecting and reporting fraud overlaps with their 

 3 responsibility for reporting on internal control over 

 4 financial reporting under Section 404 since effective internal 

 5 control generally serves as the first line of defense in 

 6 preventing and detecting fraud. These things are intertwined. 

 7 This is where professional skepticism becomes 

 8 paramount in the auditor's work. In assessing fraud risk, 

 9 auditors have to be inquisitive and vigilant. Auditors must 

 10 not just ask basic questions, such as whether management has in 

 11 place a comprehensive fraud program that includes continuous 

 12 fraud oversight but they must dig deeper if things do not 

 13 look right or if there is a risk that they feel could result 

 14 in the financial statements being misstated, whether caused by 

 15 error or fraud. Really, this whole thing is about substance over 

 16 form. We need to look at the substance of what's going on 

 17 versus having a checklist mentality where every control is 

 18 reviewed, every control is documented. This has to be raised 

 19 up to where you are looking at risk and you're doing that for 

 20 the purpose of protecting the investor against those things 

 21 that are significant and those things that are important. 

 22 Third, coordination among regulators and standard 

 23 setters is very important. Continued coordination such as 

 24 today between the Commission and the PCAOB will be needed to 

 25 monitor implementation of Section 404 and to identify any 
 1 additional ways for achieving economical, effective and 

 2 efficient implementation. 

 3 It will be important that company management and 

 4 their auditors agree on what is expected and resolve any 

 5 implementation problems early on in the process. They need 

 6 to have a dialogue. Again, this shouldn't be viewed as just 

 7 a compliance approach on both sides, it should be focused and 

 8 tailored. 

 9 Also important is the need for the PCAOB to 

 10 continue to coordinate with other U.S. audit standard 

 11 setters––GAO and the AICPA––and with international standard 

 12 setters on key issues, such as the terminology and definitions 

 13 used to communicate internal control deficiencies. At this 

 14 time, all the U.S. auditing standard setters are in 

 15 sync and have adopted consistent definitions of a material 

 16 weakness and a significant deficiency. Everyone will be best 

 17 served by having standard setters develop consistent core 

 18 auditing standards and, where there are any differences, 

 19 to articulate why there is a difference or a need in the 

 20 particular environment we're in. 

 21 Inconsistencies in core standards can increase 

 22 audit costs and lead to potential confusion among management, 

 23 users and auditors. In this context, the U.S. auditing standard 

 24 setters meet roughly three times a year collectively. We had a 

 25 meeting a couple of weeks ago which David Walker hosted at the GAO 
 1 and we're very appreciative of the very open environment that 

 2 the PCAOB has fostered. 

 3 In closing, we support the efforts of the 

 4 Commission and the PCAOB to address Section 404 

 5 implementation issues. Public companies must be able to 

 6 strike an appropriate balance between costs and benefits 

 7 while at the same time achieving an appropriate level of 

 8 internal control and strong investor protection. 

 9 At the end of the day, public companies need to 

 10 have the right controls in the right place at the right time. 

 11 We view this as a basic management responsibility 

 12 irrespective of Section 404. At the same time, auditors have 

 13 an important role. They must be vigilant but practical, which 

 14 a top-down risk-based approach provides for, and must always 

 15 maintain independence and professional skepticism in doing 

 16 their work. 

 17 It will be very important that the Commission and 

 18 the PCAOB continue to reinforce the over-arching goal of 

 19 investor protection, as well as the principles I have just 

 20 highlighted in order to achieve sensible, effective, and 

 21 responsible implementation of Section 404 and to ensure that 

 22 investors never again suffer from another 

 23 Enron or a WorldCom. 

 24 Thank you again for inviting me and for permitting 

 25 GAO to participate in this forum. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

CHAIRMAN COX: Thank you very much, Mr. Steinhoff, 

not only for your excellent summary of the issues that we're 

facing in scaling 404 for smaller companies but also for the 

extensive and substantial amount of work that you and the GAO 

have done in this area that provides the basis for your 

presentation this morning. And that presentation I think is 

an excellent scene setter for us to go to the final item on 

our agenda which is to hear from our professional staff on 

this same topic. 

I'd like to begin now by recognize Conrad Hewitt, 

the Chief Accountant of the Commission, and John White, the 

Director of the Division of Corporation Finance and their 

staff on the subjects of revising the 404 auditing standard 

and also the progress that we have made in coordinating this 

with our proposed Management Guidance. 

And following the staff presentations and 

discussion on each topic, we'll have the opportunity for 

Commissioner questions and discussion. And following that 

I'll ask whether the Commissioners support the staff's 

approach on the particular topics. 

So, if we may, let's begin with Conrad Hewitt, the 

Commission's Chief Accountant. 

MR. HEWITT: Thank you very much, Mr. Chairman. 

Chairman Cox and members of the Commission, the 

increased focus on companies' internal controls over 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

financial reporting, commonly known as ICFR, under Section 

404 of the Sarbanes-Oxley Act in the Commission rules has 

improved investors' confidence in our financial markets. 

Overall, the public disclosures relating to ICFR have led 

many issuers to establish and maintain more effective 

internal controls which has resulted in financial reports 

that are more reliable and transparent. 

Although there clearly have been benefits, it is 

also true that the cost to implement the related Commission 

rules and the PCAOB auditing standard are significantly 

greater than expected. Of particular concern are indications 

of audit and compliance costs for small companies. 

Concerns with Section 404, of course, are not new. 

Efforts by the Commission and PCAOB have been underway for 

sometime to meet the challenge of providing new guidance and 

revisiting the prior requirements to better balance 

implementation costs with the benefits. 

Now I would like to turn to my colleague, John 

White, the Director of the Division of Corporation Finance to 

summarize some of those important efforts over the last year. 

MR. WHITE: Thank you, Conrad. 

And good morning. Chairman Cox, you mentioned and 

actually the Commission's press release announcing today's 

meeting also specifically noted that we are here today to 

discuss the PCAOB's proposed new auditing standard under 404, 
 1 of course, but also in particular you noted and the press 

2 release noted that we are here to discuss its coordination 

3 with the Commission's proposed Management Guidance. 

4 Now, as I think all of us know, the Commission and 

5 the PCAOB have actually been working together now for 

6 sometime to improve the implementation of Section 404. 

7 Actually, a little less than a year ago many of us were here 

8 in this very room, this very auditorium as the Commission and 

9 the PCAOB jointly hosted a round table on second-year 

10 experiences under Section 404. 

11 That round table was followed a week later by press 

12 releases in which the Commission and the PCAOB each announced 

13 a series of steps that they planned to take to improve the 

14 implementation of 404. The Commission specifically announced 

15 that it expected to propose and then adopt guidance for

management 

16 regarding its evaluation of internal control and that that 

17 process would begin with a Concept Release to gather input. 

18 And I believe, as all of us can see, those May 17 

19 press releases were really important in previewing most of 

20 the things that have actually happened in the last year in 

21 the 404 arena. Of the Commission's four steps which were laid 

22 out, the first was the Management Guidance which I have 

23 described and the second was revisions to Auditing Standard 2. 

24 The third was the SEC’s oversight of the PCAOB inspection 

25 process which was designed last year to focus on the efficiency 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

of Section 404 implementation and the fourth step was the 

extension of the compliance deadlines for non-accelerated 

filers which was finalized in December. 

Now, the last two steps, the inspection process and 

the extension of the deadlines, are not the focus of today's 

meeting, but I think it is important to realize that all four 

of these steps are coordinated components in a 

comprehensive project that has been undertaken by the PCAOB 

and the Commission and our respective staffs. 

And I think you all appreciate that this has very 

much been a priority of all of us here at the table during 

the last year as I know it has been a priority of all of you 

for the last year. 

So getting back to the steps laid out last May, the 

first step, of course, was to move forward on management 

guidance. The Concept Release went out last summer and the 

proposal went out last December. 

The second step was for both the SEC and the PCAOB 

to move forward in the revision of Auditing Standard Number 2 

and that is certainly a critical part of all of this. So, 

again, in following through on that, in December the PCAOB, 

as you know, actually proposed two standards to achieve this, 

two new auditing standards. 

One was called An Audit of Internal Control Over 

Financial Reporting That Is Integrated With An Audit Of 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Financial Statements. That's the standard that was designed 

to replace AS2. And, as you know, we commonly refer to that 

as AS5 even though it hasn't actually earned that number yet. 

And the second standard was a new standard on 

Considering And Using The Work Of Others in an Audit. 

The comment periods for both our proposal and the 

PCAOB's proposals ended in February. We received over 200 

letters the PCAOB received about 170. The staff's analysis of 

those letters has, I think it's fair to say, very much 

reinforced the importance of this critical interplay between 

our proposal on Management Guidance and the PCAOB's proposed 

auditing standard. And, really, in a moment, Conrad and the OCA 

staff will take us through and elaborate on that theme. 

I guess I just wanted to make one further comment, 

and that is that I really wanted to acknowledge the 

cooperative efforts that have occurred both within the SEC 

staff and in particular between the SEC staff and the PCAOB 

staff on this project. And, finally, I fully appreciate 

that investors are relying on us and deserve our 

hard work and our team work in all of this as we seek 

to find the right balance to improve the implementation 

of 404. I believe we are moving in that 

direction. 

So that's it on my comments. I’d also, like to 

mention to my right is Carol Stacey who is the Chief Accountant 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

in the Division of Corporation Finance and one of the key 

participants in this project. 

And, Conrad, when the time comes, Carol and I will 

be available to participate in answering the questions. 

MR. HEWITT: Thank you, John. 

As John emphasized, for both the Commission and the 

PCAOB, replacing the auditing standard on ICFR known as 

Auditing Standard 2 or AS2, represents a critical element in 

the plans to improve the implementation of Section 404. 

The PCAOB's December proposal was an important step 

in the right direction towards encouraging external auditors 

to adopt a top-down and risk-based approach to auditing a 

company's internal controls. 

As Chairman Olson noted, a large number of PCAOB 

comment letters expressed support for the PCAOB's proposed 

standards. However, the commentaries also provide a number 

of suggestions for additional improvements. 

A major theme on the comment letters is the 

importance of considering whether the Commission and PCAOB 

proposals work together to improve both the effectiveness and 

efficiency of the implementation of Section 404. 

To emphasize this point, a number of commentaries 

sent the same letter to both the SEC and the PCAOB. For 

example, commentaries believe that the differences between 

the two proposals and the degree of detailed rules versus 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

objective-based guidance and the amount of professional 

judgment each approach permits may make the auditing standard 

and management guidance more difficult and costly to 

implement. 

The SEC staff currently is working closely with the 

PCAOB staff as we revise our respective documents with the 

goal of having them implemented this year. We are confident 

that listening to your comments and questions this morning 

will help us work through the remaining issues and result in 

cost-effective guidance and standards that will maintain and 

even further enhance investors' confidence in the financial 

information that underlies our securities markets for large 

and small companies alike. 

The staff appreciates the time that each of you and 

your staffs have already given to us through our work and 

this important project. And let me thank you in advance for 

the long hours that we will ask each of you to give us over 

the next few weeks. 

The staff has identified four significant issues 

for discussion this morning. I will now turn it over to my 

Deputy for Auditing and Professional Practical Issues, ZoeVonna Palmrose, who along with the OCA staff members, Michael 

Gaynor, Nancy Salisbury, Brian Croteau, and Josh 

Jones, will describe each of the four issues in turn giving 

you an opportunity to discuss each issue before we proceed to 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

the next one. 

We, of course, would be happy to answer any 

questions that any Commissioners might have about any of the 

issues. 

MS. PALMROSE: Thank you, Conrad. 

Chairman Cox and members of the Commission, as 

Conrad said, the staff has identified four issues which we 

believe are the most significant matters that the PCAOB staff 

should address prior to recommending final audit guidance to 

the Board. 

We have some thoughts on these issues we'd like to 

communicate to the PCAOB staff provided that the Commission 

supports such communications. 

The issues that we would like to discuss with the 

Commission today and obtain your support for communications 

with the PCAOB staff are the following. First, more closely 

alighn the proposed audit standards with the Commission's 

Management Guidance. 

Second, improve the section and related guidance in 

AS5 on scaling the audit for smaller companies. 

Third, clarify the auditor's ability to exercise 

judgment based on the circumstances of the individual 

auditing engagement to determine the audit procedures and 

tests required to support the opinion on internal control 

over financial reporting. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

And, fourth, utilize broader principles in 

proposing guidance on considering and using the work of 

others in the audit. 

Let me now focus on the first issue, alignment. 

The Commission and the Board both received a great deal of 

feedback in the comment period that indicated the need for 

the two sets of guidance to be better aligned. 

This essentially considers how the Commission's 

proposed interpretive guidance and the PCAOB's proposed 

auditing standards interact. Although the letters covered a 

number of areas in which the proposed auditing standards and 

our interpretive guidance could be better aligned, the 

comments can be summarized into two broad categories. 

The first category receiving many comments is the 

apparent difference in the overall approaches of the two 

proposals. A general reaction from comment letters on both 

the Commission's and the PCAOB's proposals is that the 

Commission's proposed interpretive guidance is more 

principles-based and allows management to exercise 

appropriate judgment in designing and conducting an 

evaluation that is tailored to its company's individual facts 

and circumstances. 

On the other hand, some commenters raised concerns 

that the PCAOB's proposed guidance, while improved from AS2, is 

still very prescriptive and more prescriptive relative to the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

SEC's guidance. As such, commenters were concerned that it 

reduces the auditor's ability to use professional judgment to 

appropriately tailor an efficient and effective audit 

approach to the customized system of ICFR of individual 

companies regardless of size or the methods and procedures 

management implements for evaluating their effectiveness. 

Commenters expressed concerns that the result of 

more prescriptive auditing standards will be to drive 

management to perform unnecessary work for the sole purpose 

of enabling their auditors to comply with the PCAOB's audit 

standards. 

Essentially the concern is that as drafted the 

auditing standard likely places management in the untenable 

position of having to decide to either pay the auditor to 

complete unnecessary testing documentation or do it 

themselves. 

As one example of the level of prescriptiveness in 

the proposed AS5, comment letters point out that there are a 

large number of musts and shoulds. This is significant 

because the PCAOB has defined via its rule 3101 on certain 

terms what must and should mean. Musts are mandatory and 

shoulds are presumptively mandatory performance requirements 

for auditors. 

Moreover, the PCAOB's Auditing Standard Number 3 

provides audit documentation requirements that when combined 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

with the musts and shoulds could have a significant impact on 

the level of audit effort. 

Auditors must explicitly comply with each 

performance and documentation requirement, so 

commenters expressed concern that not only can prescriptiveness 

lead to reluctance by auditors to exercise well-reasoned 

judgments but also PCAOB inspections would focus 

compliance with prescribed requirements rather than 

on achievement of the standard’s overall audit 

objectives. 

The second category of comments on alignment 

involves differences in defined terms between the 

Commission's proposed Management Guidance and the PCAOB's 

proposed guidance for auditors. 

For example, the proposals contain differences in 

the language describing what constitutes a material weakness, 

how individual controlled deficiencies should be aggregated 

when evaluating whether a material weakness exists and in the 

guidance describing circumstances ordinarily considered as 

strong indicators of a material weakness. 

In light of the comment letter feedback the staff 

believes that one area to strive toward is a consistent set 

of definitions to be used in defining those conditions in 

internal control that are disclosed to investors pursuant to 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

our rules. 

To address commenter concerns about confusion and 

misinterpretation among auditors, issuers and investors and 

to increase efficiency, the staff believes that the alignment 

concerns raised in the comment letters should be addressed. 

As a result the Commission staff proposes to work 

with the PCAOB staff to achieve a more principles-based 

approach to the proposed audit standards as follows. 

First, to identify and eliminate any unnecessarily 

prescriptive requirements where the overall principle or 

objective has been well stated. 

And, second, to harmonize the key terms and 

definitions in the Commission's Management Guidance and Rules 

and the PCAOB's definition in its two proposed auditing 

standards. 

Chairman Cox, the staffs of OCA and Corp Fin would 

be happy to discuss any qustions that you and the 

Commissioners might have on the staff's suggestions. 

CHAIRMAN COX: Well, I'd like to thank each of you, 

Conrad, John and Zoe-Vonna, for your job in laying out a 

landscape on this first topic. 

And, Zoe-Vonna, you mentioned that essentially we've 

got two issues to deal with in this area of coordinating our 

approaches. 

I'll also compliment our commenters for themselves 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

being so coordinated. I notice that about 70 percent of the 

commenters proposed that we do a better job in this area. So 

they were all coordinated in their message. And I also note 

that many of the commenters themselves submitted joint comment 

letters on the PCAOB standard and on Management Guidance. So 

at least the regulated community is showing a high level of 

coordination and I think the fact that the comments are 

coordinated will make it easier for us to take them into 

account at the SEC and the PCAOB. 

I'd like to get to the heart of this and ask first, 

why is it better for investors to have auditors using their 

professional judgment and why is it better for smaller 

companies? How will it make it a better process for them 

when they are complying with Section 404? 

MS. PALMROSE: Well, the reality is that 

professional standards which allow for the use of judgment in 

executing one's responsibilities represent the touchstone of 

any profession. Standards need to provide a floor, not a 

ceiling for auditor performance. 

And, as we struggled with the consequences of 

financial reporting complexity, it is important to resist the 

temptation to write prescriptive audit standards. 

Principles-based standards are the key to high quality time 

invariant audit standards. 

CHAIRMAN COX: On the second topic on definitions, I 
 1 think I can understand as a general matter why we don't want to 

2 confuse everyone, why we don’t want to have one definition in 

3 place in the PCAOB standard and use the same term with a 

4 different meaning as part of the same process in our Management 

5 Guidance. But can you give me an example of why this is

difficult? 

6 MS. PALMROSE: Why it's difficult to align them? 

7 CHAIRMAN COX: If it's such an obvious principle, 

8 how come we're not finished? 

9 MS. PALMROSE: Well, we have to confess and Carol 

10 can help me here a little bit, but we actually elicited 

11 questions on this very topic. And in part we knew that we 

12 weren't aligned in some ways and the intent was to solicit 

13 feedback on the issues where we differed. So, in some sense, 

14 this was intentional. 

15 Now, there also were nuances that we didn't 

16 appreciate the impact of, so there are slight differences in 

17 wording at times that we didn't appreciate the implication of 

18 and so it is very useful that we heard in regards to these. 

19 So some of this is that we knew we were going to 

20 get feedback and it would help us make decisions and some of 

21 it was a surprise and, thus, is a very important issue for 

22 us. 

23 And I think Jeff Steinhoff from the GAO sensitized 

24 us to the importance of this for everybody. In other words, 

25 it is important to have terminology that is converged and 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

consistent and harmonized across auditing in all sectors. 

And so we very much appreciate that for users across all 

markets. 

MS. STACEY: And I agree with Zoe-Vonna. I think it 

was very important that we received comments in this area 

rather than just spitting back the definitions from the 

original AS2, let's think through them again and have other 

people and commenters begin to focus more because they're very 

critical to scoping decisions and other decisions in the 

audit. So it was very important for people to comment on 

that. 

It also brought up the question as to whether we 

should have the definitions in our rules and the PCAOB's 

definitions should be obviously harmonized to whatever we 

decide to put in ours. So that's an open question also at 

that point which we think is very important. 

CHAIRMAN COX: And how do you think you're going to 

resolve that? 

MS. PALMROSE: Well, the staffs do plan to work 

together to get agreement on the definitions to make sure 

that we do agree on what the words will say. And then we're 

going to work through exactly how to accomplish the latter 

part of what Carol has suggested here. 

MS. STACEY: I think we will have the definitions, 

obviously, either in Management Guidance or if we believe 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

they need to be elevated to the rule level, we will propose 

that. So we have yet to work through that between ourselves 

and the PCAOB, but that is a focus area of ours. 

CHAIRMAN COX: All right. Commissioner Atkins. 

COMMISSIONER ATKINS: Thank you, Mr. Chairman. And 

thank you very much for calling this meeting to talk about 

this most important and vexing issue. 

And thank you very much to you all on the staff for 

all of your hard and dedicated work. I think you're doing a 

great job, so thank you very much for organizing this. 

In talking about AS5, which clearly I 

think is a significant improvement over AS2, there is 

widespread acknowledgement that AS2 didn't get us to where 

we need to be and now we have no choice but to get it right 

here the second time around. 

There still appears to be a concern that the new 

standard will force auditors to focus on issues that pose 

little risk to reliable financial reporting. We heard from GAO 

and others about how important it is to have a risk-based 

approach and also, as you were just saying, investors 

ultimately pay for all of wasted time not only of 

auditors but of management. 

What can we do to make sure that this standard, as 

well as other auditing standards, does not have the effect of 

wasting time and is really focused on a risk-based 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

type of approach? 

MS. PALMROSE: Perhaps I can start off and respond 

to that question and then others can join in if they want to 

add to it. 

First of all, I think it's really important and 

this is something that we are talking a lot about and it's 

coming out through the comments here this morning that 

judgment is very important and that prescriptiveness is not 

synonymous with rigorous judgments. In other words, the 

standards need to recognize and empower auditor judgment in 

ways that are objectives-based but without the structure around 

it that drives down into the details of unnecessary work. 

And I think it is also important to consider that 

as we look at auditing standards and make choices about 

auditing standards that affect the financial reporting and 

disclosure landscape that we don't lose sight of all the 

changes that have occurred since 2002 including in governance 

related to corporations and the role of management, boards and 

audit committees as well as governance of the profession. 

In other words, audit standards are very important 

but they are just one of the tools in the regulator's tool 

kit. So I think it is important to keep that background in 

mind, too, as we think about the audit standard itself. 

COMMISSIONER ATKINS: So you are saying they 

shouldn't be viewed in isolation. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

MS. PALMROSE: Exactly. 

COMMISSIONER ATKINS: It's part of an organic goal. 

MS. PALMROSE: Exactly. They're part of, yes, 

they're part of a broader array of regulatory activities 

here. 

COMMISSIONER ATKINS: Okay. Well, in this respect 

I just have one other question. Will your proposed work with 

the PCAOB on alignment address the concerns about 

the manner in which their standard allows for aggregation of 

unrelated accounts for the purposes of determining, for 

example, whether an account is significant and whether the 

combination of control deficiencies for the purposes of 

identifying significant deficiencies and material weaknesses 

are dealt with. 

MS. PALMROSE: Yes. Yes. That's one of the 

elements I alluded to in my remarks, one of the 

components that we will be considering. 

But perhaps one of the staff would like to join in 

and give a little bit more context on that. 

MR GAYNOR: We did include in our proposed 

Management Guidance some guidance on the aggregation of 

deficiencies. The notion of aggregation is something that's 

existed for some time in the financial statement audit. You 

know, when auditors encounter account balances that contain 

errors, they do have to consider those errors in the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

aggregate as well as individually. 

And so the same concept carries over to the 

internal control audit. Unfortunately, there is an added 

dimension of complexity because we're now -- we're in the 

control space as opposed to known errors. We're in what is the 

likelihood that there could be a material error. And those 

judgments clearly are more difficult, more complex for both 

management and auditors. And so it is clearly an important 

topic that we are studying and interested in working with the 

PCAOB on to ensure that management and the auditors have 

similar guidance in this regard. 

COMMISSIONER ATKINS: Well, this leads into what 

we'll talk about later with respect to materiality, but I 

think this is one very important thing where we need to get, 

you know, our management guidance aligned with their audit 

standard to make sure that there's no gap in the middle. 

Thanks. 

CHAIRMAN COX: Commissioner Campos. 

COMMISSIONER CAMPOS: Thank you. 

Let me add quickly my appreciation to the staff 

here at the SEC for all the efforts that have been put forth 

so far to bring us to this particular point and in particular 

the willingness to work with the PCAOB, their staff and, of 

course, the Board and the leadership there in terms of our 

two agencies working together. And I think to this point 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

being very committed jointly to get and to resolve a very 

challenging regulatory dilemma which is to essentially have 

investor protection with a reasonable and rational cost in 

particular for the small issuers. 

I believe that sometimes you need to just be very 

basic and general. And so I'm going to start at that 

particular level just in the event that there is 

something that's been missed or maybe our audience hasn't 

quite heard it yet. 

And that is that there seems to be from various 

questions a sense or an accusation that somehow the SEC and 

our staff with respect to 404 cares less about investors and 

cares more about reducing the cost of implementation of 

audits. 

Zoe-Vonna, how would you answer that concern? 

MS. PALMROSE: Not at all. Not at all. Would that 

be the strongest way I can say it? 

First of all, the staff is completely committed, 

strongly believes that investors in small companies are 

entitled to the same disclosures on ICFR as investors in 

large companies. 

And we look at all of our -- the comments and our 

assessment of changing management -- revising management 

guidance and the revisions to the audit standards through 

that lens. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

What we are really trying to do is make this a more 

effective audit process thinking in terms of an integrated 

audit which I think is an important element for both large 

and small companies alike. We never think in terms of 

efficiency without thinking about what is the impact on audit 

effectiveness. And, if it's positive, that's great. If it's 

neutral, okay. But there is never any thought about 

compromising audit effectiveness to obtain so-called 

efficiencies. 

In other words, efficiency is about unnecessary 

work that actually can diminish audit quality, not improve 

it. 

CONRAD HEWITT: I would like a footnote. As 

Zoe-Vonna has just said about the investor, protection of the 

investor, that excessive cost of an audit harms the investor's 

value in that company in the marketplace. Those costs can be 

used for other more important things of the company, such as 

customer satisfaction, product development and those types of 

things. So there has to be a good balance and that's what 

we're trying to approach here is a good balance for the 

investor. 

COMMISSIONER CAMPOS: I trust no one at any policy 

level has indicated to you that investor interests and 

investor protection is less important? 

MS. PALMROSE: No, not at all. In fact, that's what 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

we are constantly thinking about. And, as I said just to 

reinforce, we believe, we firmly believe that investors in 

all companies are entitled to these disclosures and that this 

is doable and that's what we are working to achieve. 

COMMISSIONER CAMPOS: I think Mike Gaynor put it to 

me another way when we were -- when he was briefing 

me, and he said that the goal of this process, I 

quote, "is to increase both the effectiveness of the audit 

and the efficiency in conducting the audit and if the only 

outcome of a proposed change to the standard is fewer 

disclosures to investors and less public reporting without 

gains in both the effectiveness and efficiency, then there is 

no reason to make a change." 

Is that a fair summarization of what we're trying 

to do? 

MS. PALMROSE: Well, let me speak for my staff. 

Oftentimes Mike is very eloquent. He also has a great wit, 

too. 

COMMISSIONER CAMPOS: I thought he was witty, too. 

MS. PALMROSE: I can't dispute that. But the answer 

is it's very well stated. 

COMMISSIONER CAMPOS: I'm trying to fit my subquestions where I can still say it's only been two questions. 

MS. PALMROSE: We're auditors here. 

COMMISSIONER CAMPOS: But are you using judgment? 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

It seems to me that the paradigm that 

we're struggling with is what our chairman alluded to a 

little while ago in his questioning. And that is in the 

overall harmonization of our guidance, you spoke 

essentially that it's principles versus prescriptive-ness or 

being prescriptive as the major difference. 

And what that leads you to is the situation in 

which, again, as a paradigm is it appropriate from a 

regulator's perspective to seek to give the auditor judgment, 

flexibility, the ability to use different aspects of evidence, 

and conclude that that will lead to better audits and 

better effectiveness or a better, effective audit versus a 

checklist in which the people who don't agree with that would 

say, "Well, you just can't trust in a given situation an 

auditor to get to the right conclusion or in this particular 

context." So you need to find some very specific rules to 

make sure you end up with a minimum of audit work. 

How do you square that in terms of that debate? 

MS. PALMROSE: Well, I think Jeff Steinhoff again 

alluded to this and set it up nicely in terms of the concern 

over form versus substance. And the problem is when you try 

to anticipate from Washington, D.C., what all the facts and 

circumstances will be for all the companies around this great 

world of ours, you just can't do it. 

You have to be able to allow auditors and 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

management to make judgments about the risks within their own 

organizations and the auditor to bring to the table evidence 

from that risk assessment, from management's process as well 

as from the financial statement audit in an integrated audit 

sense. And it's not possible to anticipate all of those 

facts and circumstances and prescribe responses to them. 

So that's why it is so important to have judgmentbased standards and that's what we've had. Auditing standards 

have always been judgment-based and they were scalable. We 

have had one set of standards for all companies regardless of 

size that were scalable because they establish the overarching principles and objectives behind the judgments 

without prescribing the methodology for accomplishing that. 

COMMISSIONER CAMPOS: Okay. One small push just to 

keep you, keep that great intellect going. What do you say 

to those who have said, "We have seen in these scandals, we 

have seen in the failures that whether it's on the part of 

management or whether it's on the part of auditors that that 

type of freedom in judgment doesn't produce results." 

MS. PALMROSE: Those were not a failure of the 

standards themselves. And I think this is an important 

element when I referred to the tools in the regulatory tool 

kit. 

Essentially, we have a process in place now with 

the PCAOB in which we can, the PCAOB can assess the role of 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

standards in any of those failures. But largely the analysis 

of those failures have been one of performance not standards. 

Now, it isn't that we can't learn lessons and 

improve. For example, I think the fraud standard that was 

promulgated it wasn't really in response to the failures but 

it did anticipate some of the issues that came out from those 

failures. But, again, it was judgment-based without 

prescribing a methodology. It identified factors to take 

into consideration in making your judgments as an auditor. 

So hopefully that provides a context for 

understanding that the response to those is not going to be 

one of a form solution that will only likely engender 

decisions that are not robust and productive. 

COMMISSIONER CAMPOS: I appreciate that answer and 

I just want to make the point that we should never take for 

granted that this dichotomy is totally accepted or totally 

understood. And I hope we do -- both us and the PCAOB -- do a 

good job of constantly expounding on why a judgment-based, 

top-risk-down approach produces the more effective audits. 

And I'm done. Thanks. 

CHAIRMAN COX: Thank you. Commissioner Nazareth? 

COMMISSIONER NAZARETH: Thank you very much. I'm 

very heartened by the conversation today because I think it 

really evidences that our goals are very significantly 

aligned between the SEC and the PCAOB. I mean our focus is 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

on investor protection and on integrity of internal controls. 

Our focus seems to be on a top-down risk-based approach to 

the audits. And certainly it's on effectiveness and 

efficiency of implementation of Section 404. 

So it seems to me that, listening to all this, what 

we're really talking about is where are the appropriate 

refinements in order to achieve those common goals. And, 

again, it's been a very constructive process as I think 

everyone can hear between the PCAOB and their staff and the 

SEC and our staff. 

I thought I'd just ask two questions. One, again 

under this alignment topic, we've talked about harmonization 

of key definitions. And harmonization is like mom and apple 

pie. Of course we want the definitions to be the same. But 

as I vote in favor of authorizing you to go forth and 

harmonize, I want to be sure I understand what exactly you're 

going to harmonize. 

So, for instance, when the staff talks about the 

definitions, are you in any way suggesting that you are going 

to recommend new definitions? Or are you talking about 

harmonizing the definitions consistent with what we proposed 

and the PCAOB proposed? 

MS. PALMROSE: Well, I think Carol can jump in here 

again. I think there are slight differences in some areas 

between our definitions that I suspect are not going to be 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

impediments at all. We have a slightly different one. 

Now, I mean I have to acknowledge that the comment 

letters do make -- there are some comment letters that make 

suggestions for more substantive changes in some definitions. 

And, in all honesty, we haven't made any decisions at all. 

We're still in the deliberation stage. I think it's 

reasonable to think it would be difficult to make major 

changes in some of the key definitions. 

COMMISSIONER NAZARETH: I wouldn't think without 

Commission approval you would be suggesting material 

changes to the definitions. 

MS. PALMROSE: I think that would be a necessity if 

it was to occur and especially since they do affect so many 

other areas. 

COMMISSIONER NAZARETH: Right. Particularly 

definitions like material weakness --

MS. PALMROSE: Oh, yes. Yes. 

COMMISSIONER NAZARETH: That would be the whole game. 

MS. PALMROSE: Yes. I think we just have a slight 

difference in that one between our two guidance and it's just 

a nuance and I suspect that's easily resolvable. 

COMMISSIONER NAZARETH: Right. That's what it 

looked like to me also. 

MR. WHITE: But there are comment letters that 

are suggesting quite significant changes in the definitions. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

 MS. PALMROSE: There are comment letters that suggest 

much more radical changes, and it would be inappropriate 

for me to say the staff has made conclusions. 

But it would be appropriate to say if we made a major change 

that it would require obviously Commission approval. 

COMMISSIONER NAZARETH: Right. Okay. Also, 

Chairman Olson indicated in his opening remarks that 

management's and the auditor's evaluations of internal 

control over financial reporting are complementary but 

different and for that reason requires an audit standard with 

more structure than is needed for management guidance. 

Does the staff believe that the approach should be 

identical or that there are reasons for some differences in 

the approach? 

MS. PALMROSE: Let me maybe have Mike Gaynor who --

the eloquent Mike Gaynor --

COMMISSIONER NAZARETH: Who is witty. 

MS. PALMROSE: The eloquent and witty Mike Gaynor --

COMMISSIONER NAZARETH: The pressure is on. 

MS. PALMROSE: Who has spent a good deal of time on 

management guidance talk a little bit about that issue. 

MR. GAYNOR: Well, I don't know what was more 

embarrassing having Commissioner Campos quote me or some of 

the other remarks. 

But in any event, in response to your question 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

about whether the staff believes that management's evaluation 

process and the auditor's approach should be identical, and 

the answer to that is no. We don't believe that the 

processes should necessarily be identical. 

We agree with the view that Chairman Olson 

articulated this morning, that management's knowledge of its 

business and its daily interaction with its internal control 

results in the auditor and management coming at their 

respective responsibilities to report on internal control 

from different places. 

Moreover, because the auditor is also performing an 

integrated audit, that is an audit of both the financial 

statements and an audit of internal control, the approach 

that the auditor takes will be significantly influenced by 

what's required to issue his or her opinion on the financial 

statements as well. 

However, having said that, the staff does believe 

that the manner and to what extent these differences require 

different approaches is a very important question and one 

on which we look forward to working with the PCAOB staff. 

A question that bears on our minds is this fundamental 

question of if the different or the need to scale internal 

control evaluations in the management space because of the 

different sizes and companies' different complexities, it 

seems like that same phenomenon -- size and complexity --
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

exists in the audit space as well. And so we need to sort of 

work through the extent to which those approaches need to be 

the same and reconcile them or at least help constituents 

understand, you know, why they're different and to what the 

implications of any differences are. 

COMMISSIONER NAZARETH: Thank you. 

CHAIRMAN COX: Commissioner Casey? 

COMMISSIONER CASEY: I also want to thank you for 

your comments particularly in response to Commissioner Campos 

in appreciating the traditional approach in auditing and 

taking -- the necessity, the importance of judgment for the 

auditor, flexibility of being able to exercise that judgment. 

And I think GAO also touched on that inasmuch as they've 

been, they've been taking a risk-based top-down approach for 

some time in assessing internal controls. So I thought that 

was extremely constructive to appreciate that. 

As a follow-on to the question that was just asked, 

inasmuch as our Management Guidance hopes to provide sort of 

workable guidance to issuers as well as acceptable frame 

works that are flexible to address particular characteristics 

of smaller companies in particular. As you work through some 

of the alignment issues with the PCAOB, in light of the 

Chairman's comment that they do have different functions or 

different purposes, how important will that be? I guess 

I'm asking will that be important to our achieving the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

benefits of Management Guidance if we are not able to 

leverage off of the benefits that we would anticipate coming 

from that flexibility? 

MS. PALMROSE: I would say it's very important and 

it's part of the motivation for doing this, in particular, 

looking deeply at the alignment question. 

But maybe Mike would add a few more comments on 

that, too. 

MR. GAYNOR: Yes, you know, we've talked a lot 

this morning about the alignment theme and the feedback that 

we got and I think Carol or Zoe-Vonna mentioned that we in fact 

solicited feedback on alignment differences. 

We knew when we were there, we were informed by 

some of the impact and the extent to which a lack of 

alignment issues would preclude management from achieving the 

improvements and efficiency and effectiveness that they 

desired. 

And, so, we're very mindful of that. We are 

working closely with the PCAOB to understand what it is in 

the auditing standard that is causing the dialogue between 

auditors and management to be of the nature that it is that 

it's driving these concerns and we will look very closely at 

what we can do to try to improve that. 

MS. PALMROSE: I just wanted to add, too. We do 

have some comment letters that are very helpful, too, in 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

terms of making suggestions. And we're in the process of 

analyzing those and hopefully we will be able to incorporate 

those, too. 

COMMISSIONER CASEY: Sort of as follow-on to some 

of the concerns with the prescriptiveness in the underlying 

standard, much of the criticism -- not "much" -- some of the 

criticism that was levied against AS2 because of its highly 

prescriptive and detailed approach was that it contributed to 

the PCAOB inspection process which sort of focused on 

technical compliance with the prescribed requirements rather 

than more looking at the standard's overall objective. 

I know that Chairman Olson mentioned this 

morning that it will be a key component and GAO has also made 

it clear that that will be important. 

Inasmuch as PCAOB, the inspection process will have 

to alter -- if we're successful in aligning both the 

Management Guidance and the Standard 2 infusing greater 

judgment and flexibility for the auditor, how will that 

inspection process have to change in terms of just mind set 

in examining and even as much as in our role which I know 

that John has spoken about our role in working with PCAOB and 

inspecting their inspections. 

I mean how do we have to change our mind set and 

expectations in terms of examination if we're to achieve the 

true benefits that we're talking about here? 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

MS. PALMROSE: Well, let me start off in responding 

and then others can add on. But I think it starts with, 

first of all, an education by the PCAOB standard-setting 

group for the inspection process. So, it's very key that 

there be alignment within the PCAOB about what they mean by 

the standard so that the inspectors understand what the key 

elements of it are and can then focus on the objectives 

rather than, you know, the minutia of the compliance aspect. 

I also think there's probably opportunities to 

think about how to approach an inspection as well as 

communicate the results so that it informs both auditor 

performance as well as standard setting. 

For example, there's ways of communicating best 

practices that the firms can learn from and there's also 

feedback into the standard setting process to refine if --

and, again, they have communication devices if people are 

misunderstanding or misinterpreting, there are ways that 

those can be addressed and they can be addressed in a timely 

fashion. 

So I think all of those are going to be important 

elements and they should work seamlessly, if we can get to 

that spot in terms of the standard-setting process and the 

implementation of it. And this will be one of the examples 

of it, too. 

MR. HEWITT: I just might add on this point that 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

the implementation of the standard will be very, very 

important assuming we have an excellent Standard AS5. 

The PCAOB will have to train their staff 

extensively into the new standard before they're out in the 

field inspecting the external auditing firms. And that 

behavior will have some effect on whether or not the standard 

is effectively implemented. 

Also, the external auditing firms will have to do 

the same. They will have to train, retrain their staff on 

this new standard which will be very important as to the 

implementation of the standard. 

And so I think we'll be looking at that aspect of 

it in our inspection process of the PCAOB. 

COMMISSIONER CASEY: Thank you very much. 

CHAIRMAN COX: Is there any further discussion the 

Commissioners would like to have on this first topic? 

(No response.) 

CHAIRMAN COX: If not, then to wrap up this portion 

of the discussion, I would like to summarize the staff's 

recommendation on alignment and ask the Commissioners to 

express their support or disagreement with this approach. 

Specifically on alignment, the SEC staff proposes 

to work with the PCAOB staff (1) to identify and eliminate 

any unnecessarily prescriptive requirements where the overall 

principle or objective has been well stated and (2) to 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

harmonize the key terms and definitions in the Commission's 

Management Guidance and Rules and the PCAOB's definitions in 

its two proposed auditing standards. 

Do the Commissioners support the staff's approach? 

COMMISSIONER ATKINS: Aye. 

COMMISSIONER CAMPOS: Yes. 

COMMISSIONER NAZARETH: Yes. 

COMMISSIONER CASEY: Yes. 

CHAIRMAN COX: Yes. 

And the recommendation is approved so let's move on 

to the staff's second recommendation on making AS5 scalable 

for smaller public companies. 

And I understand that Zoe-Vonna Palmrose is going to 

begin that presentation. 

MS. PALMROSE: Thank you. Let me just start us off. 

The next issue is, as the Chairman said, we would like to 

discuss relates to the section in the PCAOB's proposed audit 

standard entitled, "Scaling the Audit." 

Nancy Salisbury will briefly describe the concerns 

raised by the commenters and possible suggestions for 

improvements. Following Nancy's remarks, the staffs of OCA 

and CorpFin would be happy to discuss any questions that you 

and the Commissioners might have on the staff's suggestions. 

Nancy? 

MS. SALISBURY: Thank you. The PCAOB received a 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

number of comment letters in response to the section in AS5 

on scaling the audit that raised concerns with the staff that 

the guidance may not have been understood as intended. 

A number of the comments especially those from 

smaller companies or their representatives noted that it was 

still unclear how auditors could under the guidance tailor 

the nature, timing or extent of their procedures. 

In fact, some commenters raised concerns or 

questioned whether the documentation requirement in this 

section would actually add unnecessary work rather than 

reduce work. 

In our view, some of the issues raised by the 

comment letters can be dealt with by the PCAOB as they 

address some of the prescriptiveness issues of the proposed 

standard pursuant to the conversation we just completed. 

Additionally, we believe other promising ways to 

ensure the auditors appropriately tailor their audits to the 

unique facts and circumstances of smaller companies is to 

directly incorporate guidance throughout the various sections 

of the audit standard as applicable rather than including 

these comments only in this one particular section of the 

standard. 

Further, we think another approach could be to 

better illustrate how the auditor can maximize consideration 

of the work performed in support of the financial statement 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

audit in the audit of ICFR. 

Finally, many of the issues that smaller companies 

present may also exist in the audit of smaller locations of 

larger companies. We support having one auditing standard 

that is applicable to all companies regardless of size. So 

it seems appropriate to us that any scaling concepts 

ultimately outlined in the audit standard should be focused 

on the auditor's consideration of the facts and circumstances 

of each company rather than those concepts being applicable 

only to companies of a certain size or complexity. 

We believe that the PCAOB can improve the guidance 

on scaling the audit for smaller companies and the Commission 

staff proposes to work with the PCAOB staff on the following 

suggestions. First, extend the scaling concepts throughout 

AS5 to tailor the audit to the control systems of smaller 

companies rather than requiring smaller companies to conform 

their appropriately tailored control systems to an auditing 

standard. 

Second, ensure the appropriate integration of the 

financial statement audit to the auditor's consideration of 

the test necessary for the internal control audit. 

And then third, ensure the applicability of scaling 

concepts without any unnecessary conditions focusing on the 

facts and circumstances of each company. 

And, thank you, we'd be happy to take any of your 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

questions at this time. 

CHAIRMAN COX: Well, thank you, Nancy and Zoe-Vonna. 

Since the comments that we've received are 

obviously a focal point of the remaining work, let me just 

begin by asking what kind of comment did we get on this 

particular topic from smaller companies? 

MS. SALISBURY: The comments from the smaller 

companies were relatively consistent with the kind of 

comments we receive from all commenters. In general they were 

very supportive of the direction that the PCAOB was going. 

But a lot of them raised concerns that it was unclear exactly 

how the guidance in this section could -- would actually 

impact the testing or the work that auditors are going to 

perform as they complete their testing. 

CHAIRMAN COX: And then what's the answer to that 

question? 

MS. SALISBURY: Well, we think that the PCAOB could 

better illustrate for auditors by putting in throughout 

various sections of the standard that they could be putting 

in illustrative examples or contrast with how a larger 

company might do it that a smaller -- an auditor of a smaller 

company might see this, for example. You know, illustrations 

like that would help clarify for auditors of smaller 

companies exactly how the principles outlined in the scaling 

section could impact their audit. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

CHAIRMAN COX: Zoe-Vonna? 

MS. PALMROSE: I was just going to add we did that 

in Management Guidance and got positive feedback on that. So 

we thought it might be a useful approach within the auditing 

standard, too. 

CHAIRMAN COX: This leads us into another topic. 

Nancy, you mentioned extending this throughout the 

standard. What does the SEC staff mean when we talking about 

extending the scaling concept throughout the PCAOB standard? 

What exactly does that mean? 

MS. SALISBURY: Well, as Zoe-Vonna mentioned, in the 

Management Guidance, we tried to provide in places where we 

thought it was appropriate and beneficial, we tried to 

provide illustrative examples for specifically what smaller 

companies could anticipate or potentially how a smaller 

company approach might be different and we thought that it 

would be helpful if the PCAOB challenged their standard and 

looked for situations or areas where they could do the same 

to better illustrate the principles in the scaling section. 

CHAIRMAN COX: So the approach to extension is 

illustration and we would sprinkle those throughout the 

standard? 

MS. PALMROSE: Illustration is probably -- your 

vocabulary is so wonderful, you would probably get a little 

more precise term here --
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

CHAIRMAN COX: I think that was a backhanded way of 

saying I picked the wrong word; wasn't it? 

MS. PALMROSE: It would, it would provide some 

specificity around the context of that objective within a 

smaller company context. So it's not an example. It's not 

asking for examples per se, but to give a linkage of the 

objective or concept into the smaller company context and 

talk about the audit implications of it that way. 

CHAIRMAN COX: All right. Commissioner Atkins? 

COMMISSIONER ATKINS: Thank you, Mr. Chairman. 

I think this concept is very crucial. Just 

yesterday there was yet another bipartisan bill that was 

dropped in the House along this line with respect to smaller 

companies and we have gotten obviously many letters from 

members of Congress in this regard. So we have to get this 

right before we turn smaller companies over to this regime 

that we've seen come down in the last year. 

So I was curious, if you could give some 

examples of the areas in which the PCAOB standard could be --

these concepts of scalability could be integrated into that 

standard. 

MR. HEWITT: I'll just give you one example for 

small companies. They do operate in a quite different 

environment than a mid-size cap or a large cap company. I'm 

very familiar with small companies. I was on the board of 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

two or three of them. 

For example, in the standard it calls for you to 

look at the significant processes within the company as to 

its internal controls of those significant processes. In a 

smaller company, a significant process could be really the 

budgetary process which they monitor daily and the board does 

and the audit committee. In a larger company, you probably 

might not find that situation. So it's a different 

would be an example. 

COMMISSIONER ATKINS: Well, I think what you were 

talking about before with respect to integration of the audit 

is extremely important with smaller companies and as the Senate 

committee said back in the passage of Sarbanes-Oxley that 

already high-quality audits have internal control procedures 

worked into them. Unfortunately, that was one of the 

problems with the AS2 -- that it completely veered away from 

that and layered on something entirely new on top of it. 

MS. PALMROSE: Could I reinforce that and say that 

the staff really believes that that is a very important 

consideration. I mean it is for all companies, but it is 

especially so in the smaller company context and how the 

financial statement audit informs the risk assessment for the 

ICFR and vice versa. 

COMMISSIONER ATKINS: Right. 

MS. PALMROSE: It's just going to make both of them 
 1 better. 

2 COMMISSIONER ATKINS: Well, in fact, one company 

3 that I visited -- I've visited dozens of them over the last 

4 year or so -- is audited by a Big 4 firm and they are 

5 basically paying more to their -- for consultants and their 

6 Big 4 auditor than they were paying their CFO and all the 

7 people reporting to the CFO. So they are paying more to put 

8 together -- I mean more to audit their financials and 

9 therefore, for an audit than they were paying to put them 

10 together, which is a terrible situation. That company had no 

11 operating revenue. That's just an example of the problems that 

12 are out there. So, hopefully, we'll be able to fix it through 

13 this. With respect to the GAO testimony from Jeff Steinhoff 

14 before, he talked about that accountants should not be bound by 

15 a checklist and just being slaves to that type of thing. What 

16 steps can we take to ensure that they aren’t bound by 

17 particular checklists before they are able to apply scalability 

18 concepts but rather able to use their judgment? That sort of 

19 slops into the next thing you're going to talk about, but 

20 specifically, how can we ensure that they can use their 

21 judgments with respect to scalability across a wide range of

companies? 

22 MS. PALMROSE: I can start off and others can join 

23 in but I think the first step is reconsidering the musts and 

24 the shoulds within the standard. So that will help so 

25 challenging as Mark Olson said that the PCAOB staff is doing, 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

challenging those is going to be an important consideration 

because again remember that documentation sort of changes 

your focus from the substance to the form of it. And it 

should really instead cause you to think more rigorously and 

deeply, not simply do it to document that you have done it. 

So part of it is going to be challenging the 

prescriptiveness of the musts and shoulds. So that is going 

to be one important way. 

And the other is challenging sort of the overarching architecture of defining a methodology for an ICFR 

audit I think. And, so, that is probably worth thinking 

about in that the financial statement audit, the standards do 

not provide a defined methodology for everybody to use. They 

establish guidance and principles that others then decide how 

to implement their own methodologies. 

COMMISSIONER ATKINS: Okay. 

MS. STACEY: I also think it's important because 

the reality is that the firms use checklists. And so it's 

going to be important for us and for the PCAOB -- judgment is 

important. And it's just not enough just to go through 

the checklist and, “boom,” you’re done but 

definitely reinforce that you don’t necessarily 

have to abide by the checklist for everything 

and you can vary from that based on your judgment. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

So, you know, I agree that's going to be a concern going 

forward and it's going to continue to need reinforcement. 

COMMISSIONER ATKINS: And a lot of it comes down to 

training. I know a lot of the accounting firms sort of 

drafted people from the HR groups and tax and what not and 

threw them into this sort of environment to try to do these 

404 audits which, you know, is questionable as to the 

competency of that sort of thing. 

So, hopefully, with respect to both our Management 

Guidance and the Audit Standard 5 we'll be able to work these 

examples in and give better guidance I think. Thanks. 

CHAIRMAN COX: Commissioner Campos. 

COMMISSIONER CAMPOS: Thank you. Again, the words, 

scaling, scalability, it seems to me to be one of those 

concepts that seems to have a lot of different 

interpretations and I am hopeful that the staff will keep 

reinforcing these principles and what it means by that. 

For example, I think this entire Commission 

strongly supports the idea of a single standard under AS5 for 

companies of all sizes. That's been said in Nancy's 

comments. Nonetheless, there are those who say that scaling 

the audit means having a different standard for smaller 

companies. How do we answer that? 

MS. SALISBURY: To us scaling is not trying to have 

a different standard for different companies. It's more 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

about allowing an auditor to be able to recognize that there 

are different facts and circumstances at each particular 

company and that you aren't going to be able to use a one 

approach fits all when you are trying to evaluate the 

effectiveness of internal control. 

The manager of a smaller company is certainly going 

to have a very different knowledge of their financial 

reporting process based on their daily involvement with that 

company than the CFO of a Fortune 500 company. And so that 

can and should result in a different internal control 

structure at the smaller company. The audit standard needs 

to, in order to be appropriately scalable, needs to allow the 

auditor to recognize that there will be that difference and 

to allow them to perform their audit taking that difference 

into consideration. 

COMMISSIONER CAMPOS: And that is not creating a 

separate standard? 

MS. SALISBURY: That's not creating a separate 

standard. That's allowing an auditor to recognize what's 

there rather than forcing everybody to create a control 

system that works to an audit standard. 

MS. PALMROSE: I think a better way to look at it 

is it's an auditing tool that the auditor can use in trying 

to determine what to audit as opposed to a standard. 

COMMISSIONER CAMPOS: Well, again, these terms are 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

out there in the world and I think it's incumbent on us and the 

staff to be very clear about what we mean and to protect 

against misinterpretations of this term as well as our 

earlier discussion about judgment. 

Let me also note that many point out that most of 

the companies in the U.S. are under this definition of 

smaller companies. The vast preponderance of percentage of 

public companies are smaller companies that fit this. 

Therefore, many point out that most of the fraud and 

restatements that we see, and in particular many of the 

blatant frauds, stem from smaller companies. 

So that said, again, how do we answer that a scaled 

audit does not somehow allow that to occur? And is the 

answer that a scaled audit does not mean a less rigorous and 

effective audit? 

MS. PALMROSE: That's exactly right. Remember, the 

objectives of both are the same. So that's the key. The 

standard provides that you are getting to the same place for 

companies of all sizes. 

And I think it, again, this goes back to something 

that we talked about a little bit earlier, but here again the 

staff thinks it is very important to think in terms of an 

integrated audit. And that the financial statement audit 

actually can inform the control audit in a very productive 

fashion and vice versa. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

And some of these risks that you're assessing that 

you're talking about in terms of the fraudulent financial 

reporting risk do have root in terms of the control 

environment and those are things that we talk 

about in Management Guidance and that we put on emphasis on 

that auditors need to consider, too. 

Some of them are necessary, but not sufficient, 

conditions that's for sure, but all of those are an important 

element of the risk assessment process for companies of all 

sizes in an integrated audit context. 

COMMISSIONER CAMPOS: It seems to me that another 

way of saying much of what you're talking about is that sort 

of a non-thinking, busy work approach does not necessarily 

allow you to focus on risks and materiality and can be just 

as dangerous if it's too prescriptive. 

MS. PALMROSE: That's exactly right. And I think 

Jeff Steinhoff again used terms that are very salient here 

which include knowledge, expertise of the people making the 

judgments as well as professional skepticism, healthy 

skepticism. And all of those come from good -- make good 

judgments. They don't come from checklists. 

COMMISSIONER CAMPOS: And focus. Also, just one 

last point here on this matter, is it your view, the staff's 

view, that scaling should be focused not just on size but also 

the complexity and the particular characteristics of a 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

company? 

MS. PALMROSE: The answer is facts and circumstances 

would include both of those elements. So, again, complexity 

is a term that it's important to think of in the context we're 

talking about here. Some control systems are more complex 

than others and we are really talking about the complexity of 

the control system. 

And you can have a company that has complex 

elements to its control system and yet have simple 

controls in other areas. 

COMMISSIONER CAMPOS: And be small. 

MS. PALMROSE: And be small, yes. You can actually 

have large companies, too, that have complex control systems 

in some areas and simpler controls in others. So those are 

characteristics that are important to consider as factors 

that relate to the risks of financial misstatement in the 

context of those control elements. 

MS. STACEY: And I agree with Zoe-Vonna. I mean size 

is just one of the indicators of how you're scoping your audit. 

The Advisory Committee on Smaller Public Companies pointed out 

that, you know, smaller companies tend to have less complex 

systems. They tend to be simpler with financial reporting. 

But there are also some that we have seen that are much 

larger. They have large market caps but they have a very 

simple business model. And so for that instance, size really 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

doesn't matter because they are very similar to some of these 

smaller companies. So, while size is a very important 

indicator, there are others and complexity can be one of 

them. But there are also companies who are very simple 

except they have one very complex transaction and that 

doesn't necessarily make them complex. So it is one of the 

indicators, but there are several others. 

COMMISSIONER CAMPOS: Yes. Well, thank you very 

much. I appreciate all those answers. 

CHAIRMAN COX: Commissioner Nazareth. 

COMMISSIONER NAZARETH: Thank you. You have 

answered most of my questions. I really only have one. The 

staff is suggesting that, in your remarks, that there not be 

unnecessary conditions on the applicability of the scaling 

concepts. What did you mean by that term, "unnecessary 

conditions?" 

MS. SALISBURY: Well, it goes back to the size and 

complexity conditions that are currently built in. The 

proposed standard set up the section to be structured around 

considerations that could be given for companies that were 

smaller in size and less complex. And, as we've discussed 

throughout this discussion this morning, you know, you really 

have to take into consideration the full facts and 

circumstances of the company's situation rather than trying 

to limit it by, you know, purely their size or what you might 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

consider their complexities. 

As Carol said, you might have complex transactions 

in one area but the rest of your business model will be very 

simple. So we wanted to make sure that the standard provides 

flexibility, if the auditor has the ability to use those 

considerations and those principles in all appropriate 

situations. 

MS. STACEY: And there are also some commenters who 

commented that they thought that just documenting size and 

complexity requirements would complicate things and would 

cause a lot of additional work that was unnecessary. So 

there was also the documentation question that came into 

play. 

COMMISSIONER NAZARETH: Is what you're suggesting 

then that even within a company you can have different 

techniques being used based on whether or not, for instance, 

one division is involved in derivatives or some sort of 

complex business and other parts of the business are less 

esoteric. 

MS. STACEY: Absolutely. 

MS. PALMROSE: In other words, it's not a binary for 

a company. It's not a 0-1 on a company basis. So it really 

is trying to capture facts and circumstances and just using 

the term "complexity" to, you know, as a substitute in some 

sense for facts and circumstances in this context. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

COMMISSIONER NAZARETH: Thank you. 

CHAIRMAN COX: Commissioner Casey? 

COMMISSIONER CASEY: I just wanted to follow on to 

some of the questions which touched on the comments that we 

received particularly from small businesses. And I know that 

there was some question about the clarity associated with the 

scaling guidance and that in general I understand that the 

belief was that it was relevant but that there was some 

desire for additional guidance which the Chairman's comments 

touched on. 

Can you talk about what the comments said in terms 

of some of the attributes? Whether they felt the attributes 

that were identified in the guidance were sufficient? 

Whether there were additional topics that had to be included 

or that should be considered being included? Just a little 

bit of a flavor on the comments that we received. 

MS. SALISBURY: I'm trying to remember. I don't 

think we had very extensive comments on the attributes 

themselves. The comments were generally in favor of what the 

PCAOB had outlined -- I think it was six or seven. 

Brian, do you --

MR. CROTEAU: I think that's right. There were some 

comments around considering integration of the audit and how 

the financial statement audits integrated and whether that 

attribute should be considered as well. But I think to 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Nancy's point, the commenters for the most part were more 

concerned with how to apply the attributes. 

MS. STACEY: And I think it was also -- there were 

some comments around the complexity issue and the fact that, 

you know, what I pointed out before, if you have one 

transaction that's complex, does that just make you no longer 

able to apply a scalability concept. The auditors 

would have to look at it as if you're not 

really a small company and couldn't tailor to what the 

company actually has in their internal control system. 

So that was another area that was commented 

on was how does complexity impact scalability. And this is 

definitely something that we got a few comments on. 

CHAIRMAN COX: Thank you. Is there further 

discussion on this part of it? 

(No response.) 

CHAIRMAN COX: If not, I will summarize the staff's 

recommendation on scalability and ask the Commissioners to 

express agreement for or disagreement with this approach. 

Specifically, the SEC staff proposes to work with 

the PCAOB staff first to extend scaling concepts throughout 

AS5, to tailor the audit to the control systems of smaller 

companies rather than requiring smaller companies to conform 

their appropriately tailored control systems to the auditing 

standard. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Second, to ensure the appropriate integration of 

the financial statement audit in the auditor's consideration 

of the tests necessary for the internal control audit. 

And, third, to ensure the applicability of scaling 

concepts without unnecessary conditions, focusing on the 

facts and circumstances of each company. 

Do the Commissioners support the staff's approach? 

COMMISSIONER ATKINS: Aye. 

COMMISSIONER CAMPOS: Yes. 

COMMISSIONER NAZARETH: Yes. 

COMMISSIONER CASEY: Yes. 

CHAIRMAN COX: Yes. 

And that recommendation is agreed to. We will now 

go on to the third recommendation concerning the auditor's 

ability to exercise judgment. 

MS. PALMROSE: Thank you. The third issue we would 

like to address with the Commission today relates to the 

auditor's ability to exercise judgment as was just noted 

based on the circumstances of the individual audit engagement 

to determine the audit procedures and testing required to 

support the opinion on ICFR. 

Brian Croteau will briefly describe the concerns 

raised by the commenters and possible suggestions for 

improvement. And following Brian's remarks, the staff of OCA 

and Corp Fin will once again be happy to discuss any of your 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

questions. 

MR. CROTEAU: Thank you, Zoe-Vonna. 

There are two issues raised in the comment letters 

that we would like to discuss further with you today related 

to the auditor's ability to exercise judgment to determine 

the amount of testing to obtain sufficient audit evidence. 

First, numerous comment letters raised the concern 

that the proposed auditing standard is not clear as to how and 

to what extent the amount of testing can be meaningfully 

altered based upon the auditor's risk assessment. 

For example, a number of comment letters were 

concerned that the lack of clarity in this area, especially 

when combined with prescriptiveness throughout the proposed 

auditing standard may prevent auditors from taking full 

advantage of the risk-based approach in auditing internal 

control over financial reporting. 

In addition, there were mixed views from the 

comment process about whether the proposed auditing standard 

should permit rotational testing particularly in lower risk 

areas which the auditor has sufficient knowledge that the 

process and related controls are unchanged from the prior audit. 

Further, a number of comment letters raised 

questions about the impact of entity level controls and other 

monitoring and evaluation activities of management on the 

nature and extent of audit evidence. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

In order to address these issues, it would be 

helpful for the proposed auditing standard to clearly and 

directly describe how the auditor makes use of its own risk 

assessment and of the monitoring and evaluation activities 

conducted by company management to determine the amount of 

testing. 

The staff believes that the proposed auditing 

standard should indicate that decisions regarding 

sufficiency of the evidence should be based on the results of 

the auditor's risk assessment. This would include allowing 

the auditor to conclude for a given control, or a series of 

controls, that evidence obtained through the auditor's risk 

assessment activities, management's monitoring activities and 

evidence obtained through a walk-through procedure are 

appropriate in lower risk circumstances. 

The second area we would like to discuss involves 

significant deficiencies in the related auditor 

responsibilities. The proposed standard states that auditors 

are not required to search for control deficiencies that 

individually or in combination are less severe than material 

weaknesses. However, it does require auditors to evaluate 

whether control deficiencies are significant deficiencies and 

if so communicate them to the audit committee. 

We have heard feedback that this communication 

responsibility may be inappropriately affecting the level of 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

audit scoping. 

To address these concerns the staff believes that 

the auditing standard should be reconsidered to recognize new 

communication requirements related to these matters that have 

occurred under the Sarbanes-Oxley Act. 

For example, under the provisions of Section 302 of 

the Sarbanes-Oxley Act and the SEC's implementing rules, 

management's top officers must certify that they have 

communicated matters relating to significant deficiencies and 

material weaknesses to the audit committee. Therefore, we 

would like to explore with the PCAOB staff ways to provide 

for proactive auditor communication with the audit committee 

that builds upon rather than duplicates the existing 

management communication requirements, especially if the 

auditor communication requirement could inappropriately 

affect the level of audit scoping. 

The staff believes that these modifications might 

have potential to reduce misunderstandings about the scoping 

of the audit and positively affect the level and amount of 

testing without decreasing or limiting the totality of the 

information received by the audit committee about the 

condition of a company's internal controls. 

The Commission staff proposes to work with the 

PCAOB staff on the following three suggestions. First, to 

ensure that the auditor has latitude to establish the level 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

of evidence required based on the auditor's assessment of 

risk. 

And, second, to ensure that the auditor can make 

appropriate use of management's risk assessment and monitoring 

activities in determining the auditing procedures. 

And, third, to explore the relationship between the 

auditor's communications of significant deficiencies and 

management's responsibilities in this area. 

This concludes the remarks in this area and we are 

happy to answer any questions that you have. 

CHAIRMAN COX: Thank you very much. This is 

another area where I think we need to dive into it a little bit 

because it seems that everybody is in agreement -- we have 

raging agreement between the SEC and the PCAOB about the 

importance of auditors using their judgment. So why are we 

still focused in this area? 

MR. CROTEAU: I think the reason we're focused on 

this area is that the comment letters reflected that the 

standard, as proposed, may not be sufficiently clear about 

the latitude that the auditor has in making decisions 

about the extent of testing. 

And so what we would like to do is work with the 

PCAOB staff to help make sure that the standard does 

articulate this so auditors can actually exercise this --

CHAIRMAN COX: Is that another way of saying we 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

know what we're talking about but the people who are reading 

it don't seem to understand it? 

MR. CROTEAU: Well, I think what they would 

like is just clarity within the standard. I think 

even in the Board's release there was some description, 

but they would like to have some clarity in the 

standard to be sure that we are all talking about the 

same thing. 

CHAIRMAN COX: Does anybody else have any further 

thoughts on that one? 

MS. PALMROSE: I think it is important that we do 

decide that we all are talking about the same thing, too. 

There are going to be some areas in this related to this 

issue where the comment letters make clear that we are not 

all talking about the same thing. And so those are things 

that we will be sorting through, too, with the PCAOB. 

CHAIRMAN COX: All right. Just one other question. 

Can you lay out a bit more elaborately what you mean by the 

auditor's risk assessment and how that's going to impact the 

auditor's procedures and testing under the recommendation 

you're putting forward today? 

MR. CROTEAU: Sure. Yes. As you know, the proposed 

standard does indicate that as risk associated with the 

control being tested decreases, the level of evidence the 

auditor needs to obtain decreases. And as the risk associated 
 1 

 2 

3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

with the control being tested increases, the level of evidence 

the auditor needs to obtain increases. 

The staff thinks that additional principles-based 

guidance would be helpful to help auditors understand how risk 

meaningfully impacts their testing. And when I'm talking about the 

auditor's risk assessment, what I'm referring to are the considerations 

that the auditor makes around matters such as the nature and 

materiality of the misstatements the controls are intended to 

prevent or detect, susceptibility of misstatement, change in 

volume or nature of the transactions and the like. It’s those 

types of considerations that the auditors make with respect to 

their risk assessments that we want to be sure that auditors then 

understand how they can factor that into decision about the 

nature, timing, and extent of their work. 

In Management Guidance, we gave examples 

of what companies may do in lower risk areas 

in relying on their ongoing monitoring versus the 

direct testing we would expect in the higher risk areas. 

That is the sort of link that we’re expecting to 

talk through with the PCAOB staff. 

MR. HEWITT: I just might add, the risk 

assessment by the auditor is extremely important as to their 

scope of their audit. However, they must or should discuss 

their risk assessment with the audit committee so that the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

audit committee understands what the auditor considers as 

risk, high risk especially within the company. 

CHAIRMAN COX: Thank you for that. 

Brian, do you have anything else? 

MR. CROTEAU: No. 

CHAIRMAN COX: Okay. Commissioner Atkins? 

COMMISSIONER ATKINS: Thanks, Mr. Chairman. 

This again is obviously another very crucial aspect 

of the whole thing that needs to be addressed and 

particularly in my view with respect to significant 

deficiencies because that's one thing that I have heard over 

and over in my discussions and travels that seems to be 

useless wheel-spin. And I know that that is a significant 

change from AS2 to AS5 in that regard and we have sort of 

-- I know the PCAOB has tried to inject more judgment into 

the whole determination of what a significant deficiency is. 

I guess my question for you is how would your 

recommended approach help to direct the auditors' 

identification or their work more towards identification of 

material weaknesses than to significant deficiencies. And 

just by this very fact of this nomenclature that's new to 

this whole 404 regime, significant deficiency, we sort of 

come in a way full circle from the concept in AS2 

now to more judgment which is much more of the old reportable 

condition concept. Shouldn't we just do away with 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

significant deficiency and focus on having the 

accountants report reportable conditions to the board, to the 

board of directors, to the audit committee as they have been 

want to do for many, many years rather than having this, this 

sort of artificial determination that goes up to the national 

office and then back and there's all this incredible amount 

of work and added expense which adds to the -- it is in the 

pecuniary interests of the auditors perhaps but not perhaps 

the investors' interests. 

MS. STACEY: You're right, Commissioner Atkins, it 

does go back to the financial audit before internal 

control was added when the auditor had the responsibility to 

determine what should go to the audit committee, and the old 

audit standard on that or the interim audit standard called 

those reportable conditions. 

The auditors still had the ability in that standard 

to use their judgment as to what would go to the audit 

committee, so it wasn't necessarily every de facto reportable 

condition would go, but the auditor did have a judgment to 

play in that one. 

Now, what we think is probably important especially 

if significant deficiencies are potentially impacting the 

scoping of the audit is to just remove that totally from the 

auditor. Sarbanes-Oxley gave management the responsibility 

to communicate to the audit committee the significant 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

deficiencies. 

Now, the auditors have a very important role in 

that they need to understand what management has brought 

to the audit committee. We are trying to get them away from 

the mindset of looking at every deficiency and saying is it a 

significant deficiency that needs to be brought. But rather 

have them step back and look at the totality of the 

deficiencies that they have and say, "Which ones are 

important enough for me to discuss with the audit committee. 

I don't care if management reported them or not. I need to 

talk to the audit committee about them." 

Obviously, if they think management should have 

brought one to them and didn't, that is a different type of 

conversation to have with the audit committee. 

But we thought it was more important in stepping 

back and thinking about this, Sarbanes-Oxley obviously put 

the role on management to report significant deficiencies, so 

what role can the auditor play? The auditor really should be 

playing the role of, "Audit committee, these are the ones 

that concern us and we want to bring them to you." 

Irrespective of whether management called them a significant 

deficiency to begin with. 

COMMISSIONER ATKINS: Yes, I agree. I just think 

the artificial construct of it is really debilitating in this 

whole context. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

MR. WHITE: I think it is important to 

recognize that we are suggesting looking at AS5 in this 

respect in terms of the existing literature which I guess is 

often AU325 or somewhere like that, some technical place, 

that you've been referring to. 

We are not suggesting that that be changed. 

COMMISSIONER ATKINS: Right. 

MR. WHITE: That we should be staying with the 

system where if an auditor thinks there are important matters 

that ought to be brought before the audit committee that they 

will continue to do that. 

COMMISSIONER ATKINS: Right. 

MR. WHITE: SOX 302 doesn't replace that. 

COMMISSIONER ATKINS: Right. But I think it's 

this artificial identification of is this a “significant 

deficiency,” or not that creates an incredible amount 

of needless work I think. And so that’s what needs to 

be addressed in my opinion. So I'm glad you’re on the 

case on that. 

And with respect to the materiality concept that 

you were talking about, how can we incorporate materiality 

better into the scoping process? I mean because like you all 

were saying that's -- up front that's a very crucial step for 

the auditor to take in determining what sort of work from a 

risk-based perspective he's going to be doing. I'm just 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

curious if you had any particulars in that. 

MR. CROTEAU: I'll start and Zoe-Vonna may add. But 

certainly the auditors' risk assessments and their decisions 

in scoping are to be based on materiality and those are to 

impact the work throughout the entire process in the audit 

standard. And I think, again, emphasizing that in the 

standard is important which the PCAOB has done in the 

proposal. 

MS. PALMROSE: Let me just add that they've tried to 

provide some language to focus on what really matters here in 

terms of the determination of materiality. But we are also 

going to look at the comment letters in this regard to see if 

there is any suggestions for improvements in this area, too. 

It is a key driver here and materiality is what 

matters. And so it's important to get that guidance right. 

COMMISSIONER ATKINS: Right. As we discussed the 

other day, there's a big difference in a prospective versus a 

retrospective materiality determination, but I think better 

guidance in this area would be very helpful for everybody 

involved. Thanks. 

CHAIRMAN COX: Commissioner Campos. 

COMMISSIONER CAMPOS: Thank you. 

In theory, the idea of allowing auditors to vary 

the level of testing according to the risk assessments seems 

very logical and rational. That said, I am aware that there 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

is skepticism or concern in various quarters that when done 

in total this process of using reduced or at least the 

flexibility to have reduced testing will lead to gaps in 

testing with respect to individual controls or groups of 

controls. 

For example, we're suggesting that the audit be 

less prescriptive, allow for greater scalability, permit 

rotational testing in certain circumstances, be more 

principles-based in determining the competency and objective 

of others. 

Taken together, is it possible that all of these 

things will lead to a gap in a particularly important control 

or worse yet, lead to no testing? 

MR. CROTEAU: Let me start with that and maybe just 

to clarify starting with the comment on rotational testing 

and then thinking about the totality of it. 

We learned from the comment letter process that 

there are mixed views not only about whether rotational 

testing should be allowed but also what it exactly means. 

And the staff does suggest that the auditing standard provide 

latitude, as you've mentioned, for auditors to consider all 

information available to them to vary the nature, timing and 

extent of their testimony. Some view that as a form of 

rotation. 

Some also view rotation to be rotating out some 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

portions of ICFR in some years so that they are not testing 

some controls at all or considering those controls at all in a 

given year. The staff does not support incorporating 

rotational testing in the standard in that sense. 

The staff does believe that an audit opinion on an 

internal control over financial reporting should require the 

auditor to consider all aspects of ICFR each time an opinion 

is issued. 

We believe it might be confusing to investors to 

have an opinion where some controls were not looked at simply 

because they were rotated out that year. And so going back 

to some of the remarks in the introduction that I made, it is 

a matter of being able to have latitude to adjust the amount 

of work, and consider the auditor's risk assessment, 

management's monitoring activities and a walk-through, 

and considering whether in lower risk areas that may 

be enough testing. But we are not prescribing taking or 

suggesting that we talk to the PCAOB staff about taking 

controls completely off the table from consideration within a 

given year. 

And so I think just from a rotational perspective 

that's important to have that as a starting point for the 

discussion. 

In terms of your broader comment on the totality of 

all of these considerations, the auditor still needs to 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

obtain sufficient competent evidence and be able to issue an 

opinion that provides reasonable assurance. And so we are 

not asking the auditor to take things off the table that 

prevent them from doing that. 

Again, we are trying to provide the auditor with 

sufficient latitude to exercise professional judgment and 

really focus on the areas of higher risk as they believe 

appropriate. 

COMMISSIONER CAMPOS: Let's bore down a little bit. 

In a given year when internal controls are being reviewed by 

auditors, the high-risk controls I take it under our thinking, 

and this, of course, has to be discussed and worked out, but 

under our thinking, what would happen to high risk controls 

in a given audit? 

MR. CROTEAU: Higher risk controls would be subject 

to a greater extent of testing so presumably a larger sample 

size of the operation of that control from an operational 

perspective. All controls would be looked at from a design 

perspective. When I say all controls, I mean all controls 

important to the auditor's conclusion. So those controls 

that the auditor determined were necessary to provide 

reasonable assurance about whether the company’s controls 

sufficiently address the risk of a material 

misstatement. 

So, for the higher risk controls, auditors would 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

test more operations of the controls for operating 

effectiveness as compared to the work you might do on lower 

risk controls which would have a lower sample size or perhaps 

the auditor relying on a walk-through of the control. 

COMMISSIONER CAMPOS: Right. So a lot of the 

flexibility that you were considering and want to discuss 

with the PCAOB staff really comes to bear on lower risk 

controls. Isn't that a fair summary? 

MR. CROTEAU: Yes. I think that's fair. In 

the higher risk areas we would expect the auditor to do more 

work and continue to do that work in future years. It is 

what you do with the lower risk controls and how you can 

modify your work from year to year that we're talking 

about from that perspective. 

COMMISSIONER CAMPOS: Right. And, again, it seems 

to be very critical just to -- if I'm repetitive, it's 

because I just think it's so important -- to get to the end 

result of an auditor's assessment and attestation opinion, 

the auditor has to look and have enough evidence, as you 

said, right? 

MR. CROTEAU: Yes. 

COMMISSIONER CAMPOS: To test or to at least 

evaluate the workings of all of the controls. Is that 

correct? 

MR. CROTEAU: Yes, the auditor has to have sufficient 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

competent evidence to support their opinion, yes. 

COMMISSIONER CAMPOS: So when people say, "Well, 

gee, all of this is going to result in gaps or no testing," 

that isn't what we at least -- we being the staff and what 

you're suggesting -- that doesn't seem to be consistent. 

Does it? Because there is not a skipping, if you will, or 

letting a test not be looked at through rotational 

principles or anything? Is that right? 

MR. CROTEAU: Right. It's the idea of providing 

latitude to vary the nature, time, and extent of testing. 

MS. PALMROSE: Can I just add that this is a concept 

that is long-standing in the financial statement audit. So 

it is interesting that we are having so much dialogue around 

it in this context when these are sort of well accepted 

notions in the financial statement audit. 

And, again, it would help if we talked about 

it in the integrated audit context, too, and each 

informing the other and actually getting a better risk 

assessment and testing then based on an appropriate 

risk assessment for both. 

COMMISSIONER CAMPOS: Yes. And, again, this goes 

back to my repetitive theme that I think these are not 

concepts that are necessarily grasped by large groups of 

players in the system. I think it is incumbent on all of us 

to make sure we are very clear about what we mean and there 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

is an educational component here that I hope we take on. 

MS. PALMROSE: I suspect very few people who are 

discussing or a number of people who are discussing these 

never anticipated that they would be having these kinds of 

discussions. So we appreciate that. But it is important. 

It actually helps clarify one's thinking, you know, as part 

of the education process. We very much appreciate being able 

to do that. 

COMMISSIONER CAMPOS: Good. I'm almost done. 

Jeff Steinhoff made the point and I think I've 

heard it through other commentary today about professional 

skepticism being critical. Do we plan to stress that in any 

way or make sure that doesn't get lost in the wash? 

MS. PALMROSE: Let me say a few things about this 

because I feel very strongly. I was involved in the task 

force that helped draft SAS 99 which is the fraud standard. 

And it was something that we spent a great deal of time on 

because we thought it was absolutely essential. 

And one of the things you think about in terms of 

professional skepticism is the importance of recognizing 

disconfirming evidence. Not just confirming evidence. And 

so that standard recognized and built in considerations that 

we hoped would help with that mindset. 

Having said that, one of the things that Jeff 

alluded to but we haven't talked at all about is when it 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

comes to fraudulent financial reporting is the risk of 

management override in particular. 

In other words, you can have a gold-plated control 

system and you still have some risk of management override. 

It's sort of the elephant in the room or the Achilles's heal, 

however you want to describe it. 

So, again, I think I've said this maybe one too 

many times, but it is important to think about the integrated 

audit because the risk of management override gets considered 

from both the ICFR perspective as well as the financial 

statement perspective. 

COMMISSIONER CAMPOS: So somebody will see that 

elephant. 

MS. PALMROSE: Well, it's a very important one. 

It's a very important one to address. 

COMMISSIONER CAMPOS: Sure. 

MS. PALMROSE: And frankly the audit committee has 

an important responsibility in that regard, too. So it's 

something that in the post SOX environment I think a number 

of constituents are stepping up to the plate and recognizing 

the importance of it. 

COMMISSIONER CAMPOS: Thank you very much. 

CHAIRMAN COX: I think we can all agree that 

management override is the Achilles's heel on the elephant 

in the room. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Commissioner Nazareth. 

COMMISSIONER NAZARETH: Thank you. 

I just wanted to turn back for one moment to this 

issue of the term, "significant deficiency," in AS5. My 

understanding is that by using the term and the way it comes 

into the auditing standard it has had the perhaps unintended 

consequence of causing auditors to expand the scope of the 

audit. Because it's in there, the expectation is if they 

find deficiencies, now they have got to do enough work to 

figure out if they are significant deficiencies as the 

defined term goes and follow the process from there. 

And that that perhaps wasn't intended. 

On the other hand, I guess it is clearly important 

that management and audit committees are aware of 

significant deficiencies or reportable conditions or 

whatever we call them. And so it does seem to me to 

be important that in fine-tuning AS5 that we not do 

anything that has a chilling effect on the benefits that come 

from that kind of communication. 

So could you again, because I'm not sure I 

completely understood your answer, could you again describe 

how the current accounting literature works and what we would 

do to the current literature to ensure that we get both the 

benefits of, you know, not having the scope of these audits 

expand unnecessarily but at the same time having a robust 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

dialogue with audit committees on these important issues? 

MS. PALMROSE: Maybe I could start out and then 

Carol, do you want to jump in here and maybe elaborate? 

First of all, I think it is extremely important to 

recognize that the audit committee needs this information. 

And so there is no expectation to reduce the information set 

that the audit committee has or dialogue around the quality 

of that information set in terms of control deficiencies and 

the degree to which they are important or not. 

Another element of it is that it's important to 

have the dialogue around what's a material weakness and not 

get caught up in an artificial classification between 

significant deficiencies and material weaknesses. 

In other words, there is some comfort -- there is 

actually maybe personal concern that you can take comfort in 

you have got them classified as a significant deficiency 

rather than a material weakness because at least they have 

gone to the audit committee then. 

And it is really important to not allow that to 

happen because the material weaknesses are getting 

communicated to investors and we don't want those 

undermined by the notion that, well, as long as the audit 

committee has it that's what counts. 

So within that context it has caused us -- in some 

of the comment letters, there's not I don't think a large 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

number on this. I think it's a fairly small number, but it 

has caused us to sort of rethink this area. And that's what 

Carol was alluding to here in terms of the existing 

requirement outside of AS5 for communications on 

these. And the question is does it have to be within 

the context of AS5. 

We already have a standard, a different standard on 

communications with audit committees over a number of 

dimensions that don't now include the control communication 

within that standard. 

We also have another standard that has interim 

reviews that has a control communication to it, too. So what 

the staff is suggesting that maybe now is an opportune time 

to relook at the existing auditing literature, see where 

these communications are embedded in that literature, look at 

what's now changed post SOX in terms of the required 

communications with management and sync them up so that 

everybody is getting the information they need and also 

getting it in the form and substance of the way they need it 

and have the proper dialogue around it. So that's the idea. 

Now, whether there will be any changes or not, I 

don't know, but at least we want to have the dialogue. 

COMMISSIONER NAZARETH: Right. And I think that 

makes sense. I guess the other concern that some might raise 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

that we need to be conscious of is whether or not if through 

this process we end up having the auditors only communicate 

the information to management ensuring that there's no break 

between management and the audit committee in having that 

communication occur. I think that certainly some 

commentators will say, "Well, at least this way you knew that 

it was going to happen because the auditor was going to do 

it." 

So again we have to be conscious of not losing the 

quality of the communication. 

MS. PALMROSE: Exactly. In other words, it is not a 

retrenchment on anything that's occurring or that should 

occur, it is simply a rationalization of our rules and 

standards. 

MS. STACEY: Yes, I mean obviously when management 

is presenting the list of significant deficiencies to the 

audit committee, they have already talked to the auditor 

about those. So presumably if there is some disagreement or 

the auditor believes that there is something that may not be 

a significant deficiency but is well worth the audit 

committee knowing about, this would just open the lines of 

communication we think for the audit committee and the 

auditor to have a frank discussion over not just what's on 

management's list but what isn't. 

And so I think -- we think that this approach 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

eliminates that bright line test, is it a significant 

deficiency or not, eliminates the potential scuffles back and 

forth between management and the auditor over what is and is 

not on the list. Potentially eliminates the scoping issues 

but still leaves the auditor with the professional 

responsibility to discuss with the audit committee any 

deficiencies that concern them that they believe the audit 

committee should be aware of. 

MR. WHITE: I mean I think it's important to realize 

that you can have deficiencies that the management may not be 

as likely to identify. I mean the one that I think is most 

common is where management lacks the experience or knowledge 

or background in applying GAAP, for example. I mean they may 

not be as quick to pick that up and report that. And so 

there are certainly situations where we’re very 

much relying on the auditors to bring deficiencies, 

however we define them, to the attention of the audit 

committee. 

MS. PALMROSE: I don't want to prolong this, but I 

just wanted to maybe add one more useful thought and that is 

that we are also looking in the context of management 

guidance where we might be able to provide some more dialogue 

or structure in Management Guidance to backfill on any issues 

here that might arise that would address your concerns, too. 

So, we are also looking at it in that context. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

COMMISSIONER NAZARETH: Thank you. 

CHAIRMAN COX: Commissioner Casey. 

COMMISSIONER CASEY: I'd like to go back to some of 

the earlier comments regarding the sufficiency of walkthroughs in testing. I know there was a lot of commentary 

about when it might be appropriate to just conduct a walkthrough for testing the operating effectiveness of the 

internal controls. 

Similarly, there were also some comments that were 

raised regarding the ability to rely on others in walking 

through -- potentially, management I guess and others in the 

company to assist in those walk-throughs. Could you talk a 

little bit about the range of comments on that and what 

circumstances -- high-risk/low-risk circumstances where that 

sufficiency of the walk-through might apply? 

MR. CROTEAU: Some of this does get into the next 

topic, but I'll be glad to sort of tee-up part of it and then 

maybe we'll cover some of it as well as part of using the 

work of others. 

We did have a number of comment letters that raised 

concerns about the auditors’ ability to make use of 

management's risk assessment and monitoring activities 

including their self-assessments. And a lot of that had to 

do with the self-assessments including the review by someone 

supervisory in nature and concerns of the auditor 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

about that person's objectivity. 

What we are trying to accomplish is a discussion 

around how management's activities in that area can impact 

the auditor's work and again providing latitude for that work 

to be considered in a way that the auditor can adjust their 

own testing as a result of it. 

We do understand and appreciate that objectivity 

is, of course, important. As some commenters have 

described that work, there is often an element of 

internal audit involvement on a periodic basis 

in addition to management’s activities. 

It is a complex area. It requires auditors to 

think carefully about what management has done and how it 

might impact their work, and we would like to have more 

discussion with the PCAOB on that. 

COMMISSIONER CASEY: And I know there has been a 

lot of discussion about the rationalizing of the use of 

significant deficiency and enhancing the communication to the 

audit committee and the responsibilities that management has 

to report significant deficiencies under the law, so I 

appreciate that clarification of what our efforts would be in 

discussing this with the PCAOB and enhancing ways to ensure 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

that management does continue to fulfill their obligations. 

I wanted to ask about a couple of the other issues 

that were raised along -- some of the concerns associated 

with the definitions of materiality. 

I know that there were issues that were raised 

specifically to some of the strong indications of what a 

material weakness might be as well as including interim 

materiality. Could you speak a little bit about those 

comments? 

MS. PALMROSE: Yes. I'll start us off and one of 

the comments or one of the areas in which we did get comments 

and we realized in advance that we didn't quite sync up with 

the strong indicators that the PCAOB included in their 

guidance. 

And the reason was that we actually thought the one 

that we left out was an obvious material weakness, not a 

strong indicator. And, unfortunately, it was interpreted 

just the opposite. "Did you mean that it wasn't instead of 

it was?" 

So we are having dialogue around those and the 

importance of those within the guidance itself. So that's 

part of the dialogue that we would like to have. We 

appreciate that whatever guidance is there would need to be 

similar now that we obviously got that message that they do 

need to be similar. But we are revisiting the whole area in 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

terms of the necessity of them and what they say. And, 

again, the comment letters are helping us inform that. 

In terms of interim, there is -- this is an area in 

which there is a lot of I guess I would describe it as angst 

within both the financial statement audit as well as 

within the ICFR audit. 

And so we did receive a number of comments about 

including it or excluding it within the evaluation 

of potential material weaknesses. And we are considering 

those. The staff has not reached a conclusion on them. And 

in all honesty it is -- the staff thinks it is really 

important to think about the quality of financial reporting 

on both a quarterly and an annual basis. 

And, of course, none of the discussion is around 

controls over quarterly reporting. I mean those need to be 

in place. The problem here is that in the internal control 

space you are doing a hypothetical – if you don’t 

have an actual misstatement, you are trying to 

hypothesize, in other words, you have a hypothetical 

misstatement that you are trying then to analogize to what 

the impact would be on quarterly and annual reporting. And 

that is a hard thing to do. I mean it is hard to make that 

hypothetical as well as within the context of those two 

settings. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

 So we appreciate it, but we also appreciate the 

importance of internal controls for interim and annual 

financial reporting. And we have no conclusion on this. 

It is just an area that we have received comment on. 

The PCAOB solicited comment on it, got a number of comments 

and we will be talking about it. 

COMMISSIONER CASEY: Thank you. 

CHAIRMAN COX: Is there any further discussion on 

this point? 

(No response.) 

CHAIRMAN COX: If not, I will summarize the staff's 

recommendation on use of judgment and ask the Commissioners 

to express support or disagreement with this approach. 

Specifically on the use of judgment and testing and 

evaluation, the SEC staff proposes to work with the PCAOB 

staff, first, to ensure that the auditor has the latitude to 

establish the level of evidence required based upon the 

auditor's assessment of risk. 

Second, to ensure that the auditor can make 

appropriate use of management's risk assessment and 

monitoring activities in determining the audit procedures. 

And, third, to explore the relationship between the 

auditor's communications of significant deficiencies and 

management's responsibilities in this area. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

Do the Commissioners support the staff's approach? 

COMMISSIONER ATKINS: Aye. 

COMMISSIONER CAMPOS: Yes. 

COMMISSIONER NAZARETH: Yes. 

COMMISSIONER CASEY: Yes. 

CHAIRMAN COX: Yes. 

And the recommendation is agreed to. So now we 

will turn to the fourth and final of the staff's 

recommendations, this one concerning using the work of 

others. 

MS. PALMROSE: Thank you. Yes, that is our last 

topic. The PCAOB's proposed auditing standard which is a 

separate standard related to the use of the work of others. 

So Josh Jones will briefly describe the concerns raised by 

the commenters and possible suggestions for responding to them 

and then we'll be available for your questions. 

MR. JONES: Thanks, Zoe-Vonna. 

As background, the PCAOB's interim auditing 

standards cover the ability of the auditor to use the work of 

internal auditors for the purposes of the audited financial 

statements. While Audit Standard Number 2 allows auditors to 

use the work of internal auditors, other company personnel 

and third parties working under the direction of management 

in the audit of internal control, the PCAOB proposed a new 

audit standard, Considering and Using the Work of Others, in 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

order to provide a single framework for the auditor's use of 

the work of others in an integrated audit of internal control 

and the financial statements. 

The PCAOB's proposed standard provides guidance on 

the extent to which the auditor can use the work of others 

based on the competence and objectivity of the party who 

performed the work. The proposed standard also gives factors 

that the auditor should consider in making this 

determination. 

However, a majority of the accounting firms 

questioned the need for the PCAOB to replace rather than 

amend its existing auditing standard related to the use of 

the work of others. 

Letters from these firms indicate that the PCAOB's 

objective of increasing the auditor's use of the work of 

others can be achieved without a complete rewrite of the 

existing auditing standard. 

Further, numerous commenters suggested that the 

proposal's requirements for evaluating competence and 

objectivity are unnecessarily rigid and prescriptive and 

inconsistent with the PCAOB's stated goal of reducing 

auditor's work in low risk areas. 

Commenters also raised concerns regarding the 

restrictions on the auditor's use of management's monitoring 

activities because in their view it was unlikely that 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

management would ever be deemed objective in accordance with 

the factors outlined in the proposed auditing standard. 

These comments raised the possibility that auditors 

will not be able to consider to an appropriate extent the 

multitude of activities that a company's management 

undertakes to monitor and evaluate internal control over 

financial reporting. 

Based on our consideration of the comments received 

to the PCAOB's proposal, we identified several matters that 

we would like to explore with the PCAOB staff. 

One involves modifying the rule-based requirements 

related to assessing competence and objectivity to make them 

more principles-based with decisions made by auditors in 

accordance with their judgment about the individual's 

competence and objectivity. 

Further, clarifications may be possible to address 

the circumstances in which the auditor would be able to use 

management's monitoring activities. The Commission's 

proposed interpretive guidance enables management to use its 

own ongoing monitoring activities as evidence to support its 

assessment. 

If appropriately designed and operated, monitoring 

activities might also be a useful source of evidence for 

auditors and should not be excluded simply because by their 

very definition the individual performing the monitoring 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

activities is not independent of the underlying control 

activities. 

As a result of the concerns raised by the comment 

letters, we propose to work with the PCAOB staff on the 

following suggestions. 

One, to provide principles-based definitions of 

competence and objectivity that can inform the auditor's 

judgment of individuals on this basis, and two, to ensure that 

the auditor can use the work obtained from management's 

monitoring activities. 

Thank you. And this concludes the staff's remarks 

on this issue. We will be happy to answer any questions that 

you may have. 

CHAIRMAN COX: Thank you. I want to jump on one 

aspect of your presentation concerning the requirements for 

assessing competence and for assessing objectivity and our 

interest in making that whole approach more principles-based. 

Since most of the existing audit literature is 

aimed at audit personnel and since what we are talking about 

here is providing some guidance on what you do with 

management who are not audit personnel, is it something of a 

Procrustean bed to stretch that old audit literature to fit 

this circumstance? Is that why we need change in this area? 

MR. JONES: One of the reasons that the staff feels 

there needed to be changes is that the internal control over 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

financial reporting has fostered the ability of many 

people within the organization who don't exactly have an 

audit background or have an internal auditor-like background 

in their job requirements to perform activities that 

are or could be very relevant to the assessment of ICFR. 

And the staff is concerned that, since historically 

the auditors have been primarily focused on evaluating 

competence and objectivity as it relates to internal audit 

personnel, they might have trouble broadening their scope 

a little bit to consider individuals outside of that 

department and that fact may unduly influence their ability to 

utilize work that may actually be very helpful in 

conducting their assessment in their audit. 

CHAIRMAN COX: I appreciate that. Just one other 

question. Here again we've got agreement in principle I 

think between the SEC and the PCAOB. In fact, the PCAOB has 

gone so far as to develop a whole new standard focused on use 

of the work of others. We obviously both agree that this is 

very important. 

Why are you concerned still, why is our staff 

concerned that even under the proposed new audit standards, 

both AS5 and AS6, that auditors might not be able to use the 

work of management? 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

MS. PALMROSE: Let me start off and then maybe Josh 

would jump in. This is a place where the comment process was 

enormously informative. And a number of letters from the 

auditors themselves said that you, PCAOB, you don't need 

another standard. And this may actually undermine the intent 

here as written, as drafted. It would undermine the ability 

to use work of others and expand the universe of these others 

in the way intended by the PCAOB. 

So that's our concern is that it doesn't appear 

that the laudable intent here may have been executed in the 

way that we had hoped. 

CHAIRMAN COX: Is this another area where we know 

what we mean but we're confusing others when we say it? 

MS. PALMROSE: There is some elements of that here, 

but it is actually a little bit different problem, too. 

In expanding the requirements, the proposal is undermining the 

ability to then use the concepts. Motive and intent are a 

little bit obscure for me so I won’t speak to those. I’ll 

just speak to the result. And that is what we are 

trying to fix because everybody is trying to get to 

the same place here. And so the firms' comment letters 

in this regard were enormously helpful to us. 

CHAIRMAN COX: Thank you. 

MS. STACEY: Yes. And some of the comment letters 

went back to the number of factors that the auditor has to 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

consider when determining objectivity and independence or 

competence and objectivity. 

And they have a slight bias according to the 

commenters and I have to admit I think it is, it is slightly 

biased towards the internal audit staff. That's obviously 

who the auditor is used to relying on in the financial 

statement audit. And, as Josh said, opening that up to other 

folks in management is a little bit more difficult because 

you have to consider potentially other factors. 

And so I think the commenters thought that sort of 

looking back and determining whether those factors are too 

prescriptive or too biased towards internal audit would be 

helpful along those lines. And we do think that that would 

be helpful, to go back and take a fresh look at how they've 

structured this and whether the bias is there for internal 

audit or whether it's possible to open that up to other folks 

within management. 

MS. PALMROSE: And using the work of others, 

remember, is so that the auditor doesn't have to do 

it him or herself. And if you have to go do more 

work to assess the objectivity and competence and then 

document it than it would be to even to just do it 

yourself, it hasn't accomplished the goal. 

And there is also a prescriptive ordering here in 

terms of assessing competence and objectivity and then 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

relevant activities and the firms suggested that it would be 

more effective and efficient to reverse that ordering. 

But here again we get caught in the 

prescriptiveness where you have to do them one 

after the other, and that turns out probably not to be the 

most effective or efficient way based on feedback that we've 

had. 

So that's why we thought it was also important to 

reconsider the drafting in this area. 

CHAIRMAN COX: Well, that certainly makes sense 

particularly in the lowest risk areas. 

MR. HEWITT: I would like to add an example to 

that. Many years ago when I was a teller during my college 

days, one of fifteen tellers in a bank. We only had 

two internal auditors in that bank and on a surprise 

basis two internal auditors would come in and had 

each of us switch. I would take Susan down there and count 

her money and balance her cage at the end of the day and 

someone else would balance mine, and the two internal auditors 

would supervise the work of this. 

It could be interpreted under the standard 

today as proposed that the auditor, the external 

auditor would have to examine my personnel file to see if I 

was qualified, and could I count 1 plus 1 and this type of 

thing. And we don't need that type of thing in today's 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

standard or auditing world. So that is the type of thing 

that we want to avoid. From a practical viewpoint, 

the use of management in the internal control 

audits and testing probably is on a very seldom 

basis. 

Smaller companies will have to go outside and 

outsource and get a local CPA firm to come in and do the 

testing and that type of thing on a practical basis. 

CHAIRMAN COX: All right. Thank you. 

Commissioner Atkins. 

COMMISSIONER ATKINS: I thank you all. Again, I 

think this is, from what I've been able to discern out there, 

a big problem. Obviously, the commenters made some very good 

comments on it and it was addressed in AS5 and AS2 as 

proposed. 

And unfortunately this is where Audit Standard 2 

basically fed the fires I think of, again, the pecuniary 

interest of the various auditors in goosing their revenues in 

order to meet their -- whether it's individual or firm bogeys 

for revenue. So I think, you know, if we can address this 

before it gets loosed on smaller public companies, I think it 

would be better. 

The GAO did a study where of the 150 companies that 

they surveyed, 128 actually hired another accounting or 

consulting firm to help them on Section 404 and for the most 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

part, the accounting firms felt they couldn't use any of that 

work in their procedures. 

So I was wondering specifically what changes can be 

made to these proposed standards to help allow auditors 

when they deem it appropriate to rely on the work of others, 

including those who are not, as you were just saying, 

internal auditors? Do you have anything specific to focus 

on? 

MS. PALMROSE: Well, let me start off and say that 

we actually are taking very seriously the comments, you know, 

to reconsider the entire landscape here including whether the 

standard is necessary. And the firms provided some good 

feedback in terms of how to analyze that question and think 

about language in the existing standard that might satisfy 

the requirements here to expand the ability to use the work 

of others. So, it is -- it is really on the table for the 

dialogue here in terms of how to get the objective that 

everybody is trying to get to here. 

COMMISSIONER ATKINS: Well, I guess even more 

particularly with smaller public companies where if they have 

gone out and hired an outside consultant to help them on it, 

I guess one of the biggest tragedies I think from an 

investor's perspective, again, that company that I referred 

to earlier that paid more to outside consultants and its 

auditors than to put its 404 and financial statements 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

together. Basically when I posed the question directly 

to the outside auditors whether they had even looked 

at this nicely put together internal control framework and 

documentation of the company, they basically said in all 

candor, "No, we didn't believe that we could under Audit 

Standard 2." Now, that company poured huge amounts of 

money into that whole process and for the outside 

auditors to feel like they could not even look at it even 

from a scoping perspective I think is a complete outrage from 

the investor's perspective since this is coming out of the 

investors pocket. So, I was just curious, how can we 

remove any unique obstacles with respect to smaller 

public companies? 

MS. PALMROSE: Well, I actually think this question 

gets back to much of what we have been discussing here today 

in terms of all the other topics. Alignment is a really 

important one that also enters into the situation it sounds 

like that you encountered and described. 

Scaling the audit and the evidence, all three of 

those along with the use of work of others relate to that 

topic and if we can address the issues that we've talked 

about in each of these I think it will go a long way towards 

not having that situation arise under the revised standards. 

COMMISSIONER ATKINS: Well, good. That's what I 

was hoping you would say because we've been addressing these 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

four themes separately; but, just like anything 

else, the integration of 404 attestation into the financial 

audit I think is crucial. Part of the problem was that 

with AS2 and everything else it was taken off as a sort of a 

separate type of approach rather than an integrated approach. 

So, hopefully, you know, as we work with the PCAOB to try to 

get this back on track that we will keep that as our 

touchstone. Thank you very much. 

CHAIRMAN COX: Commissioner Campos. 

COMMISSIONER CAMPOS: Thank you. I admit I'm still 

thinking about where the heel is on an elephant. 

MS. PALMROSE: Well, I'm on -- I'm on the Procrust --

can't remember what that term was but I couldn't answer the 

question because I wasn't sure what --

COMMISSIONER CAMPOS: I'm just wondering whether an 

elephant has a heel that we can talk about. Anyway, whether 

it's Achilles's or otherwise. 

This has been a good discussion but I feel 

incompetent because I don't have a story to tell about my 

company or someplace where I was dealing with some 

of this stuff. 

I will try to get into one particular area. It 

seems to me that the key here is that it's a little bit back 

to the issue of trust and who can you rely on? 

So I'm wondering in terms of maybe it's 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

an internal control bias by the audit profession, maybe 

lawyers -- if lawyers were doing it, they would trust, quote, 

lawyers more than they would others. So maybe there is a 

professional bias here. 

But in terms of reliance on the work of others, 

what's the element that will break through in terms of 

figuring out what, when reliance is appropriate. I mean is 

there one or two touchstones here? 

MS. PALMROSE: Well, I actually have to start off by 

saying that it's really important to use the term, "use," 

rather than "reliance." So this is a difference with a 

distinction here where it's using the work of others and the 

auditor still has to have sufficient competent evidence to 

reach their own conclusions. 

And so it is not the same as relying. It is 

helping utilize that work in reaching that conclusion, but 

the auditor still has sufficient competent evidence. 

Now, this occurs again --

COMMISSIONER CAMPOS: You realize I'm not used to 

being lectured to like that --

MS. PALMROSE: Oh, I'm so sorry. 

COMMISSIONER CAMPOS: I'll accept it. 

MS. PALMROSE: Oh, I'm so sorry. 

COMMISSIONER CAMPOS: No, no. I can get used to it 

in a hurry. It's a good point in terms of the reliance. And 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

it's probably something that isn't broadly understood either. 

MS. PALMROSE: Well, I'm sensitive to it because I 

misused it two days ago and my wonderful staff corrected me, 

so it slips into your terminology and, you know, I found that 

I have to discipline myself here because they are very 

important distinctions. 

And it is also important to recognize that these 

have always occurred naturally again in the financial 

statement audit and in an integrated audit setting it would 

occur naturally, too. So in some sense it is not a unique 

feature either. It's just that in this setting --

COMMISSIONER CAMPOS: Okay. So when can the 

auditor use the work of others? 

MS. PALMROSE: Well, first of all, when it is 

appropriate. And so it is thinking about what is the context 

in which "appropriate" can take place. So it's going to 

depend upon the risk, it's going to depend upon the nature of 

the evidence that's needed which is obviously related to the 

risk also. And it's going to depend upon the characteristics 

in terms of the reliability of that activity and its 

relevance for the particular control testing being conducted. 

So, you know, the competence and objectivity are 

characteristics that are trying to improve the reliability of 

that information and, thus, its usefulness for the auditor. 

But, again, they are correlated with but not perfectly so. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

So it is thinking about what the first principle is here and 

what the auditor's task is at hand, And there will be some 

situations when it's not only not appropriate but obviously 

not also cost effective to do so. It's trying to identify 

those situations in which it can occur in a cost effective 

and relevant way. 

MR. JONES: And I might add something to that. 

Another focal point of the staff's recommendation is 

that the standard right now makes it hard to 

determine when you can rely on individuals --

because it lists a number of considerations that are 

very specific. 

And so one of the things that the staff is 

concerned about is that auditors may have a hard time 

understanding what kind of continuum there is in terms of 

what happens when you are dealing with management that 

might be, for example, mostly competent but maybe less 

objective, and how the auditor can best determine when 

to use evidence that they performed as part of the 

audit. 

And so one of the things that we're trying to work 

through with the PCAOB is how to best articulate those 

principles so that it becomes a little more clear to 

auditors how they can take the work of management 

of the company and apply that to their decisions 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

on what evidence they need to gather for the audit. 

COMMISSIONER CAMPOS: Yes, I think it's nice to 

know that we have general agreement. It's interesting to see 

that it's sort of elusive in terms of where you get 

it down, which is why obviously you've brought it up. And it's 

an element worth pursuing with the PCAOB staff. And I 

encourage that some consensus be drawn because I think 

it will continue to be one of those Achilles heels. 

It will continue to be a problem as time goes on. 

So I'm going to essentially end here, but I'm going 

to end with one observation. And I think that this area, 

again, speaks to what I view and I think the rest of the 

Commission views as the approach that is appropriate here 

with the PCAOB staff in this whole process. In this process, 

we are partners in trying to figure out how to implement 

404 as Congress wanted and in a way that's fair to 

investor protection and in a way that is also fair to issuers 

and their costs. Thank you. 

CHAIRMAN COX: Thank you. 

Commissioner Nazareth. 

COMMISSIONER NAZARETH: Thanks. 

Why did the audit firms think that a new audit 

standard wasn't needed and that simply modifying the existing 

audit standard would have been preferable? And do you have a 

view on at this point what is the preferable approach? 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

MR. JONES: Sure. I can take that one. Basically 

as I talked about briefly, the current guidance related to 

the auditor's considerations of using the work of others 

consists of the interim auditing standards which 

relates primarily to the auditor's consideration of the 

internal audit function in the audited financial statements 

and AS2 which relates to the audit of internal control. 

As we mentioned before, one of the PCAOB’s 

reasons for proposing the standard was to integrate the 

guidance between the two audits. 

The firms raised concerns that the current proposed 

standard may not necessarily provide the appropriate framework 

to guide the auditor's decisions and that it may actually 

create additional requirements that do not necessarily 

add to the overall quality of the audit. And, therefore, 

they believe that the Board could more effectively 

accomplish its objectives through minor modifications to the 

existing interim standards to explicitly allow for its 

consideration in the audit of internal control. 

In terms of our position, the staff, right 

now just wants to discuss the merits of the firms’ 

proposal. But what is really important is that our 

recommendations are primarily focused around the 

considerations that are contained in both the interim 

standards and the PCAOB's proposals. And so ultimately the 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

objectives we're trying to achieve can be accomplished through 

either way that the PCAOB determines is best to effectively 

communicate the audit standard. 

COMMISSIONER NAZARETH: Okay, thank you. 

CHAIRMAN COX: Thank you. 

Commissioner Casey? 

COMMISSIONER CASEY: Well, first of all, I want to 

again thank you for your response to all the questions that 

have been asked so far. It has been extremely helpful and as 

noted many of the different areas that we're talking about 

definitely apply to each other. And so inasmuch as we are 

seeking our greater principles-based approach, you get that 

elusiveness I think that Commissioner Campos talked about 

which does require more judgment, but I think it makes it 

more difficult to appreciate, you know, under what 

circumstances beyond certain factors -- facts and 

circumstances, as you know, where it would be appropriate to 

be able to rely on the work of -- or the use -- not "rely". 

Use the work of others. I apologize. 

But I want to go back to another point where I 

think that -- where I think that this will be important and 

Commissioner Atkins spoke to this. The GAO's work earlier 

back in April of 2006 to the Congress on Sarbanes-Oxley spoke 

about the particular kinds of considerations that you should 

think about in terms of the adverse costs for smaller 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

companies versus larger companies. 

And certainly giving consideration to the unique 

circumstances or characteristics of smaller companies which, 

because of resource limitations, adversely affect their 

ability in terms of achieving economies of scale, certainly 

segregation of duties and responsibilities leads to 

some of the circumstances that were alluded to where they 

are really forced to go out and hire additional personnel. 

And I think also it was interesting that 

the GAO also highlighted these unique circumstances, the 

smaller size of companies as also providing opportunities for 

more efficiently achieving effective internal controls 

because of management's day-to-day operational centralized 

management, oversight of the business, greater exposure and 

transparency within the senior levels of the company as well 

as their hands-on approach. 

And so inasmuch as we get to these kinds of issues 

where you do have these kinds of efficiencies that are 

potentially achievable and I think that our guidance is 

intended to try to foster, we would want to make sure in the 

appropriate circumstances, given objectivity and competence 

and the kinds of approaches that we take in determining when 

those factors are met, but you wouldn't want to lose 

those kinds of efficiencies inasmuch as the small 

company is able to benefit from them. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

So I do think it is important that even here on the 

work of others that if they are maximized -- if there are 

efficiencies that are unique to small business, to small 

public companies -- that we would want those efficiencies not 

to be lost and be leveraged in fact with the audit for ICFR. 

MS. PALMROSE: We agree. And actually, it's very 

important because, remember, a lot of the small companies 

aren't going to have internal audit departments. So 

it is very important that we get this right for that 

group of companies, too. 

COMMISSIONER CASEY: Thank you very much. 

CHAIRMAN COX: Thank you very much. 

Is there any further discussion on this fourth 

aspect? 

(No response.) 

CHAIRMAN COX: If not, I will summarize briefly the 

recommendation of the staff. 

Specifically, the SEC staff proposes to work with 

the PCAOB staff, first, to provide principles-based 

definitions of competence and objectivity that can inform the 

auditor's judgment of individuals on this basis. 

And, second, to ensure that the auditor can use the 

work obtained from management's monitoring activities. 

Do the Commissioners support the staff's approach? 

COMMISSIONER ATKINS: Aye. 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

 8 

 9 

 10 

 11 

 12 

 13 

 14 

 15 

 16 

 17 

 18 

 19 

 20 

 21 

 22 

 23 

 24 

 25 

COMMISSIONER CAMPOS: Yes. 

COMMISSIONER NAZARETH: Yes. 

COMMISSIONER CASEY: Yes. 

CHAIRMAN COX: Yes. 

And that recommendation is agreed to. 

That concludes the business on today's agenda. I 

want to take this opportunity once again to thank Chairman 

Mark Olson and the Public Company Accounting Oversight Board 

for their contributions to today's meeting and, of 

course, for their extensive work on these very subjects as 

well as Jeff Steinhoff and the Government Accountability 

Office for their extensive assistance in this effort. And 

special thanks to the professional staff here today, Carol, 

John, Conrad, Zoe-Vonna, Mike, Nancy, Brian and Josh and all of 

the staff in your divisions and across the agency. 

This is an exceptionally important work for the 

Securities and Exchange Commission and for the PCAOB. I am 

quite confident based on what you've told us today that our 

Number 1 priority is ensuring audit quality and that we are 

honed in on the importance of redirecting resources away from 

what is wasteful and duplicative and toward what really 

matters in ensuring the integrity of financial statements. 

So thank you very much for your effort and thanks 

very much to our Commissioners for the extraordinary amount 

of high-level involvement that we have had in this effort. I 
 1 

 2 

 3 

 4 

 5 

 6 

 7 

think it shows the country just how important the SEC 

believes that this is. I am confident we will stay on 

schedule and on track. 

If there is no further business, the meeting is 

adjourned. 

(The meeting was adjourned.) 

* * * * *