[Federal Register Volume 75, Number 186 (Monday, September 27, 2010)]
[Notices]
[Pages 59332-59410]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-23456]



[[Page 59331]]

-----------------------------------------------------------------------

Part II





Securities and Exchange Commission





-----------------------------------------------------------------------



Public Company Accounting Oversight Board; Notice of Filing of Proposed 
Rules on Auditing Standards Related to the Auditor's Assessment of and 
Response to Risk and Related Amendments to PCAOB Standards; Notice

Federal Register / Vol. 75 , No. 186 / Monday, September 27, 2010 / 
Notices

[[Page 59332]]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-62919; File No. PCAOB-2010-01]


Public Company Accounting Oversight Board; Notice of Filing of 
Proposed Rules on Auditing Standards Related to the Auditor's 
Assessment of and Response to Risk and Related Amendments to PCAOB 
Standards

September 15, 2010.
    Pursuant to Section 107(b) of the Sarbanes-Oxley Act of 2002 (the 
``Act''), notice is hereby given that on September 15, 2010, the Public 
Company Accounting Oversight Board (the ``Board'' or the ``PCAOB'') 
filed with the Securities and Exchange Commission (the ``Commission'') 
the proposed rules described in Items I and II below, which items have 
been prepared by the Board. The Commission is publishing this notice to 
solicit comments on the proposed rules from interested persons.

I. Board's Statement of the Terms of Substance of the Proposed Rules

    On August 5, 2010, the Board adopted the following eight auditing 
standards:

<bullet> Auditing Standard No. 8, Audit Risk
<bullet> Auditing Standard No. 9, Audit Planning
<bullet> Auditing Standard No. 10, Supervision of the Audit Engagement
<bullet> Auditing Standard No. 11, Consideration of Materiality in 
Planning and Performing an Audit
<bullet> Auditing Standard No. 12, Identifying and Assessing Risks of 
Material Misstatement
<bullet> Auditing Standard No. 13, The Auditor's Responses to the Risks 
of Material Misstatement
<bullet> Auditing Standard No. 14, Evaluating Audit Results
<bullet> Auditing Standard No. 15, Audit Evidence

(collectively referred to as the ``Risk Assessment Standards''); and 
amendment to the Board's interim auditing standards (collectively, 
``the proposed rules ''). The text of the Risk Assessment Standards and 
amendments to the Board's interim auditing standards are set out below.

Auditing Standard No. 8

Audit Risk

Introduction

    1. This standard discusses the auditor's consideration of audit 
risk in an audit of financial statements as part of an integrated audit 
\1\ or an audit of financial statements only.
---------------------------------------------------------------------------

    \1\ When the auditor is performing an integrated audit of 
financial statements and internal control over financial reporting, 
the requirements in Auditing Standard No. 5, An Audit of Internal 
Control Over Financial Reporting That Is Integrated with An Audit of 
Financial Statements, also apply. However, the risks of material 
misstatement of the financial statements are the same for both the 
audit of financial statements and the audit of internal control over 
financial reporting.
---------------------------------------------------------------------------

Objective

    2. The objective of the auditor is to conduct the audit of 
financial statements in a manner that reduces audit risk to an 
appropriately low level.

Audit Risk

    3. To form an appropriate basis for expressing an opinion on the 
financial statements, the auditor must plan and perform the audit to 
obtain reasonable assurance about whether the financial statements are 
free of material misstatement \2\ due to error or fraud. Reasonable 
assurance \3\ is obtained by reducing audit risk to an appropriately 
low level through applying due professional care, including obtaining 
sufficient appropriate audit evidence.
---------------------------------------------------------------------------

    \2\ Misstatement is defined in Appendix A of Auditing Standard 
No. 14, Evaluating Audit Results.
    \3\ See AU sec. 110, Responsibilities and Functions of the 
Independent Auditor, and paragraph .10 of AU sec. 230, Due 
Professional Care in the Performance of Work, for a further 
discussion of reasonable assurance.
---------------------------------------------------------------------------

    4. In an audit of financial statements, audit risk is the risk that 
the auditor expresses an inappropriate audit opinion when the financial 
statements are materially misstated, i.e., the financial statements are 
not presented fairly in conformity with the applicable financial 
reporting framework. Audit risk is a function of the risk of material 
misstatement and detection risk.
    Note: The auditor should look to the requirements of the Securities 
and Exchange Commission for the company under audit with respect to the 
accounting principles applicable to that company.
Risk of Material Misstatement
    5. The risk of material misstatement refers to the risk that the 
financial statements are materially misstated. Auditing Standard No. 
12, Identifying and Assessing Risks of Material Misstatement, indicates 
that the auditor should assess the risks of material misstatement at 
two levels: (1) At the financial statement level and (2) at the 
assertion \4\ level.\5\
---------------------------------------------------------------------------

    \4\ See Auditing Standard No. 15, Audit Evidence, for a 
description of financial statement assertions.
    \5\ Paragraph 59 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    6. Risks of material misstatement at the financial statement level 
relate pervasively to the financial statements as a whole and 
potentially affect many assertions. Risks of material misstatement at 
the financial statement level may be especially relevant to the 
auditor's consideration of the risk of material misstatement due to 
fraud. For example, an ineffective control environment, a lack of 
sufficient capital to continue operations, and declining conditions 
affecting the company's industry might create pressures or 
opportunities for management to manipulate the financial statements, 
leading to higher risk of material misstatement.
    7. Risk of material misstatement at the assertion level consists of 
the following components:
    a. Inherent risk, which refers to the susceptibility of an 
assertion to a misstatement, due to error or fraud, that could be 
material, individually or in combination with other misstatements, 
before consideration of any related controls.
    b. Control risk, which is the risk that a misstatement due to error 
or fraud that could occur in an assertion and that could be material, 
individually or in combination with other misstatements, will not be 
prevented or detected on a timely basis by the company's internal 
control. Control risk is a function of the effectiveness of the design 
and operation of internal control.
    8. Inherent risk and control risk are related to the company, its 
environment, and its internal control, and the auditor assesses those 
risks based on evidence he or she obtains. The auditor assesses 
inherent risk using information obtained from performing risk 
assessment procedures and considering the characteristics of the 
accounts and disclosures in the financial statements.\6\ The auditor 
assesses control risk using evidence obtained from tests of controls 
(if the auditor plans to rely on those controls to assess control risk 
at less than maximum) and from other sources.\7\
---------------------------------------------------------------------------

    \6\ Paragraph 59.a. of Auditing Standard No. 12.
    \7\ Paragraphs 32-34 of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement.
---------------------------------------------------------------------------

Detection Risk
    9. In an audit of financial statements, detection risk is the risk 
that the procedures performed by the auditor will not detect a 
misstatement that exists and that could be material, individually or in 
combination with other misstatements. Detection risk is affected by (1) 
the effectiveness of the

[[Page 59333]]

substantive procedures and (2) their application by the auditor, i.e., 
whether the procedures were performed with due professional care.
    10. The auditor uses the assessed risk of material misstatement to 
determine the appropriate level of detection risk for a financial 
statement assertion. The higher the risk of material misstatement, the 
lower the level of detection risk needs to be in order to reduce audit 
risk to an appropriately low level.
    11. The auditor reduces the level of detection risk through the 
nature, timing, and extent of the substantive procedures performed. As 
the appropriate level of detection risk decreases, the evidence from 
substantive procedures that the auditor should obtain increases.\8\
---------------------------------------------------------------------------

    \8\ Paragraph 37 of Auditing Standard No. 13.
---------------------------------------------------------------------------

Auditing Standard No. 9

Audit Planning

Introduction

    1. This standard establishes requirements regarding planning an 
audit.

Objective

    2. The objective of the auditor is to plan the audit so that the 
audit is conducted effectively.

Responsibility of the Engagement Partner for Planning

    3. The engagement partner \9\ is responsible for the engagement and 
its performance. Accordingly, the engagement partner is responsible for 
planning the audit and may seek assistance from appropriate engagement 
team members in fulfilling this responsibility. Engagement team members 
who assist the engagement partner with audit planning also should 
comply with the relevant requirements in this standard.
---------------------------------------------------------------------------

    \9\ Terms defined in Appendix A, Definitions, are set in 
boldface type the first time they appear.
---------------------------------------------------------------------------

Planning an Audit

    4. The auditor should properly plan the audit. This standard 
describes the auditor's responsibilities for properly planning the 
audit.\10\
---------------------------------------------------------------------------

    \10\ The term, ``auditor,'' as used in this standard, 
encompasses both the engagement partner and the engagement team 
members who assist the engagement partner in planning the audit.
---------------------------------------------------------------------------

    5. Planning the audit includes establishing the overall audit 
strategy for the engagement and developing an audit plan, which 
includes, in particular, planned risk assessment procedures and planned 
responses to the risks of material misstatement. Planning is not a 
discrete phase of an audit but, rather, a continual and iterative 
process that might begin shortly after (or in connection with) the 
completion of the previous audit and continues until the completion of 
the current audit.
Preliminary Engagement Activities
    6. The auditor should perform the following activities at the 
beginning of the audit:
    a. Perform procedures regarding the continuance of the client 
relationship and the specific audit engagement,\11\
---------------------------------------------------------------------------

    \11\ Paragraphs .14-.16 of QC sec. 20, System of Quality Control 
for a CPA Firm's Accounting and Auditing Practice. AU sec. 161, The 
Relationship of Generally Accepted Auditing Standards to Quality 
Control Standards, explains how the quality control standards relate 
to the conduct of audits.
---------------------------------------------------------------------------

    b. Determine compliance with independence and ethics requirements, 
and
    Note: The determination of compliance with independence and ethics 
requirements is not limited to preliminary engagement activities and 
should be reevaluated with changes in circumstances.
    c. Establish an understanding with the client regarding the 
services to be performed on the engagement.\12\
---------------------------------------------------------------------------

    \12\ AU sec. 310, Appointment of the Independent Auditor.
---------------------------------------------------------------------------

Planning Activities
    7. The nature and extent of planning activities that are necessary 
depend on the size and complexity of the company, the auditor's 
previous experience with the company, and changes in circumstances that 
occur during the audit. When developing the audit strategy and audit 
plan, as discussed in paragraphs 8-10, the auditor should evaluate 
whether the following matters are important to the company's financial 
statements and internal control over financial reporting and, if so, 
how they will affect the auditor's procedures:
    <bullet> Knowledge of the company's internal control over financial 
reporting obtained during other engagements performed by the auditor;
    <bullet> Matters affecting the industry in which the company 
operates, such as financial reporting practices, economic conditions, 
laws and regulations, and technological changes;
    <bullet> Matters relating to the company's business, including its 
organization, operating characteristics, and capital structure;
    <bullet> The extent of recent changes, if any, in the company, its 
operations, or its internal control over financial reporting;
    <bullet> The auditor's preliminary judgments about materiality,\13\ 
risk, and, in integrated audits, other factors relating to the 
determination of material weaknesses;
---------------------------------------------------------------------------

    \13\ Auditing Standard No. 11, Consideration of Materiality in 
Planning and Performing an Audit.
---------------------------------------------------------------------------

    <bullet> Control deficiencies previously communicated to the audit 
committee \14\ or management;
---------------------------------------------------------------------------

    \14\ If no audit committee exists, all references to the audit 
committee in this standard apply to the entire board of directors of 
the company. See 15 U.S.C. Sec. Sec.  78c(a)58 and 7201(a)(3).
---------------------------------------------------------------------------

    <bullet> Legal or regulatory matters of which the company is aware;
    <bullet> The type and extent of available evidence related to the 
effectiveness of the company's internal control over financial 
reporting;
    <bullet> Preliminary judgments about the effectiveness of internal 
control over financial reporting;
    <bullet> Public information about the company relevant to the 
evaluation of the likelihood of material financial statement 
misstatements and the effectiveness of the company's internal control 
over financial reporting;
    <bullet> Knowledge about risks related to the company evaluated as 
part of the auditor's client acceptance and retention evaluation; and
    <bullet> The relative complexity of the company's operations.
    Note: Many smaller companies have less complex operations. 
Additionally, some larger, complex companies may have less complex 
units or processes. Factors that might indicate less complex operations 
include: fewer business lines; less complex business processes and 
financial reporting systems; more centralized accounting functions; 
extensive involvement by senior management in the day-to-day activities 
of the business; and fewer levels of management, each with a wide span 
of control.
Audit Strategy
    8. The auditor should establish an overall audit strategy that sets 
the scope, timing, and direction of the audit and guides the 
development of the audit plan.
    9. In establishing the overall audit strategy, the auditor should 
take into account:
    a. The reporting objectives of the engagement and the nature of the 
communications required by PCAOB standards,\15\
---------------------------------------------------------------------------

    \15\ See, e.g., AU sec. 310 and AU sec. 380, Communication With 
Audit Committees. Also, various laws or regulations require other 
matters to be communicated. (See, e.g., Rule 2-07 of Regulation S-X, 
17 CFR 210.2-07; and Rule 10A-3 under the Securities Exchange Act of 
1934, 17 CFR 240.10A-3.) The requirements of this standard do not 
modify communications required by those other laws or regulations.

---------------------------------------------------------------------------

[[Page 59334]]

    b. The factors that are significant in directing the activities of 
the engagement team,\16\
---------------------------------------------------------------------------

    \16\ See, e.g., paragraph 6 of Auditing Standard No. 10, 
Supervision of the Audit Engagement.
---------------------------------------------------------------------------

    c. The results of preliminary engagement activities \17\ and the 
auditor's evaluation of the important matters in accordance with 
paragraph 7 of this standard, and
---------------------------------------------------------------------------

    \17\ Paragraph 6 of this standard.
---------------------------------------------------------------------------

    d. The nature, timing, and extent of resources necessary to perform 
the engagement.\18\
---------------------------------------------------------------------------

    \18\ See, e.g., paragraph .06 of AU sec. 230, Due Professional 
Care in the Performance of Work, paragraph 16 of this standard, and 
paragraph 5.a. of Auditing Standard No. 13, The Auditor's Responses 
to the Risks of Material Misstatement.
---------------------------------------------------------------------------

Audit Plan
    10. The auditor should develop and document an audit plan that 
includes a description of:
    a. The planned nature, timing, and extent of the risk assessment 
procedures; \19\
---------------------------------------------------------------------------

    \19\ Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement.
---------------------------------------------------------------------------

    b. The planned nature, timing, and extent of tests of controls and 
substantive procedures; \20\ and
---------------------------------------------------------------------------

    \20\ Auditing Standard No. 13 and Auditing Standard No. 5, An 
Audit of Internal Control Over Financial Reporting That Is 
Integrated with An Audit of Financial Statements.
---------------------------------------------------------------------------

    c. Other planned audit procedures required to be performed so that 
the engagement complies with PCAOB standards.
Multi-Location Engagements
    11. In an audit of the financial statements of a company with 
operations in multiple locations or business units,\21\ the auditor 
should determine the extent to which audit procedures should be 
performed at selected locations or business units to obtain sufficient 
appropriate evidence to obtain reasonable assurance about whether the 
consolidated financial statements are free of material misstatement. 
This includes determining the locations or business units at which to 
perform audit procedures, as well as the nature, timing, and extent of 
the procedures to be performed at those individual locations or 
business units. The auditor should assess the risks of material 
misstatement to the consolidated financial statements associated with 
the location or business unit and correlate the amount of audit 
attention devoted to the location or business unit with the degree of 
risk of material misstatement associated with that location or business 
unit.
---------------------------------------------------------------------------

    \21\ The term ``business units'' includes subsidiaries, 
divisions, branches, components, or investments.
---------------------------------------------------------------------------

    12. Factors that are relevant to the assessment of the risks of 
material misstatement associated with a particular location or business 
unit and the determination of the necessary audit procedures include:
    a. The nature and amount of assets, liabilities, and transactions 
executed at the location or business unit, including, e.g., significant 
transactions executed at the location or business unit that are outside 
the normal course of business for the company, or that otherwise appear 
to be unusual given the auditor's understanding of the company and its 
environment; \22\
---------------------------------------------------------------------------

    \22\ Paragraph .66 of AU sec. 316, Consideration of Fraud in a 
Financial Statement Audit.
---------------------------------------------------------------------------

    b. The materiality of the location or business unit; \23\
---------------------------------------------------------------------------

    \23\ Paragraph 10 of Auditing Standard No. 11 describes the 
consideration of materiality in planning and performing audit 
procedures at an individual location or business unit.
---------------------------------------------------------------------------

    c. The specific risks associated with the location or business unit 
that present a reasonable possibility\24\ of material misstatement to 
the company's consolidated financial statements;
---------------------------------------------------------------------------

    \24\ There is a reasonable possibility of an event, as used in 
this standard, when the likelihood of the event is either 
``reasonably possible'' or ``probable,'' as those terms are used in 
the FASB Accounting Standards Codification, Contingencies Topic, 
paragraph 450-20-25-1.
---------------------------------------------------------------------------

    d. Whether the risks of material misstatement associated with the 
location or business unit apply to other locations or business units 
such that, in combination, they present a reasonable possibility of 
material misstatement to the company's consolidated financial 
statements;
    e. The degree of centralization of records or information 
processing;
    f. The effectiveness of the control environment, particularly with 
respect to management's control over the exercise of authority 
delegated to others and its ability to effectively supervise activities 
at the location or business unit; and
    g. The frequency, timing, and scope of monitoring activities by the 
company or others at the location or business unit.
    Note: When performing an audit of internal control over financial 
reporting, refer to Appendix B, Special Topics, of Auditing Standard 
No. 5\25\ for considerations when a company has multiple locations or 
business units.
---------------------------------------------------------------------------

    \25\ Paragraphs B10-B16 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    13. In determining the locations or business units at which to 
perform audit procedures, the auditor may take into account relevant 
activities performed by internal audit, as described in AU sec. 322, 
The Auditor's Consideration of the Internal Audit Function in an Audit 
of Financial Statements, or others, as described in Auditing Standard 
No. 5. AU sec. 322 and Auditing Standard No. 5 establish requirements 
regarding using the work of internal audit and others, respectively.
    14. AU sec. 543, Part of Audit Performed by Other Independent 
Auditors, describes the auditor's responsibilities regarding using the 
work and reports of other independent auditors who audit the financial 
statements of one or more of the locations or business units that are 
included in the consolidated financial statements.\26\ In those 
situations, the auditor should perform the procedures in paragraphs 11-
13 of this standard to determine the locations or business units at 
which audit procedures should be performed.
---------------------------------------------------------------------------

    \26\ For integrated audits, see also paragraphs C8-C11 of 
Auditing Standard No. 5.
---------------------------------------------------------------------------

Changes During the Course of the Audit
    15. The auditor should modify the overall audit strategy and the 
audit plan as necessary if circumstances change significantly during 
the course of the audit, including changes due to a revised assessment 
of the risks of material misstatement or the discovery of a previously 
unidentified risk of material misstatement.
Persons With Specialized Skill or Knowledge
    16. The auditor should determine whether specialized skill or 
knowledge is needed to perform appropriate risk assessments, plan or 
perform audit procedures, or evaluate audit results.
    17. If a person with specialized skill or knowledge employed or 
engaged by the auditor participates in the audit, the auditor should 
have sufficient knowledge of the subject matter to be addressed by such 
a person to enable the auditor to:
    a. Communicate the objectives of that person's work;
    b. Determine whether that person's procedures meet the auditor's 
objectives; and
    c. Evaluate the results of that person's procedures as they relate 
to the nature, timing, and extent of other planned audit procedures and 
the effects on the auditor's report.

Additional Considerations in Initial Audits

    18. The auditor should undertake the following activities before 
starting an initial audit:

[[Page 59335]]

    a. Perform procedures regarding the acceptance of the client 
relationship and the specific audit engagement; and
    b. Communicate with the predecessor auditor in situations in which 
there has been a change of auditors in accordance with AU sec. 315, 
Communications Between Predecessor and Successor Auditors.
    19. The purpose and objective of planning the audit are the same 
for an initial audit or a recurring audit engagement. However, for an 
initial audit, the auditor should determine the additional planning 
activities necessary to establish an appropriate audit strategy and 
audit plan, including determining the audit procedures necessary to 
obtain sufficient appropriate audit evidence regarding the opening 
balances.\27\
---------------------------------------------------------------------------

    \27\ See also paragraph 3 of Auditing Standard No. 6, Evaluating 
Consistency of Financial Statements.
---------------------------------------------------------------------------

Appendix A--Definition

    A1. For purposes of this standard, the term listed below is defined 
as follows:
    A2. Engagement partner--The member of the engagement team with 
primary responsibility for the audit.

Auditing Standard No. 10

Supervision of the Audit Engagement

Introduction

    1. This standard establishes requirements regarding supervision of 
the audit engagement, including supervising the work of engagement team 
members.

Objective

    2. The objective of the auditor is to supervise the audit 
engagement, including supervising the work of engagement team members 
so that the work is performed as directed and supports the conclusions 
reached.

Responsibility of the Engagement Partner for Supervision

    3. The engagement partner \28\ is responsible for the engagement 
and its performance. Accordingly, the engagement partner is responsible 
for proper supervision of the work of engagement team members and for 
compliance with PCAOB standards, including standards regarding using 
the work of specialists,\29\ other auditors,\30\ internal auditors,\31\ 
and others who are involved in testing controls.\32\ Paragraphs 5-6 of 
this standard describe the nature and extent of supervisory activities 
necessary for proper supervision of engagement team members.\33\
---------------------------------------------------------------------------

    \28\ Terms defined in Appendix A, Definitions, are set in 
boldface type the first time they appear.
    \29\ AU sec. 336, Using the Work of a Specialist.
    \30\ AU sec. 543, Part of Audit Performed by Other Independent 
Auditors.
    \31\ AU sec. 322, The Auditor's Consideration of the Internal 
Audit Function in an Audit of Financial Statements.
    \32\ Paragraphs 16-19 of Auditing Standard No. 5, An Audit of 
Internal Control Over Financial Reporting That Is Integrated with An 
Audit of Financial Statements.
    \33\ See also paragraph .06 of AU sec. 230, Due Professional 
Care in the Performance of Work.
---------------------------------------------------------------------------

    4. The engagement partner may seek assistance from appropriate 
engagement team members in fulfilling his or her responsibilities 
pursuant to this standard. Engagement team members who assist the 
engagement partner with supervision of the work of other engagement 
team members also should comply with the requirements in this standard 
with respect to the supervisory responsibilities assigned to them.

Supervision of Engagement Team Members

    5. The engagement partner and, as applicable, other engagement team 
members performing supervisory activities, should:
    a. Inform engagement team members of their responsibilities,\34\ 
including:
---------------------------------------------------------------------------

    \34\ AU sec. 230.06 and paragraph 5 of Auditing Standard No. 13, 
The Auditor's Responses to the Risks of Material Misstatement, 
establish requirements regarding the appropriate assignment of 
engagement team members.
---------------------------------------------------------------------------

    (1) The objectives of the procedures that they are to perform;
    (2) The nature, timing, and extent of procedures they are to 
perform; and
    (3) Matters that could affect the procedures to be performed or the 
evaluation of the results of those procedures, including relevant 
aspects of the company, its environment, and its internal control over 
financial reporting,\35\ and possible accounting and auditing issues;
---------------------------------------------------------------------------

    \35\ Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement, describes the auditor's responsibilities 
for obtaining an understanding of the company, its environment, and 
its internal control over financial reporting.
---------------------------------------------------------------------------

    b. Direct engagement team members to bring significant accounting 
and auditing issues arising during the audit to the attention of the 
engagement partner or other engagement team members performing 
supervisory activities so they can evaluate those issues and determine 
that appropriate actions are taken in accordance with PCAOB standards; 
\36\
---------------------------------------------------------------------------

    \36\ See, e.g., paragraph 15 of Auditing Standard No. 9, Audit 
Planning, paragraph 74 of Auditing Standard No. 12, and paragraphs 
20-23 and 35-36 of Auditing Standard No. 14, Evaluating Audit 
Results.
---------------------------------------------------------------------------

    Note: In applying due professional care in accordance with AU sec. 
230, each engagement team member has a responsibility to bring to the 
attention of appropriate persons, disagreements or concerns the 
engagement team member might have with respect to accounting and 
auditing issues that he or she believes are of significance to the 
financial statements or the auditor's report regardless of how those 
disagreements or concerns may have arisen.
    c. Review the work of engagement team members to evaluate whether:
    (1) The work was performed and documented;
    (2) The objectives of the procedures were achieved; and
    (3) The results of the work support the conclusions reached.\37\
---------------------------------------------------------------------------

    \37\ Auditing Standard No. 14 describes the auditor's 
responsibilities for evaluating the results of the audit, and 
Auditing Standard No. 3, Audit Documentation, establishes 
requirements regarding audit documentation.
---------------------------------------------------------------------------

    6. To determine the extent of supervision necessary for engagement 
team members to perform their work as directed and form appropriate 
conclusions, the engagement partner and other engagement team members 
performing supervisory activities should take into account:
    a. The nature of the company, including its size and complexity; 
\38\
---------------------------------------------------------------------------

    \38\ Paragraph 10 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    b. The nature of the assigned work for each engagement team member, 
including:
    (1) The procedures to be performed, and
    (2) The controls or accounts and disclosures to be tested;
    c. The risks of material misstatement; and
    d. The knowledge, skill, and ability of each engagement team 
member.\39\
---------------------------------------------------------------------------

    \39\ See also paragraph 5.a. of Auditing Standard No. 13 and AU 
sec. 230.06.
---------------------------------------------------------------------------

    Note: In accordance with the requirements of paragraph 5 of 
Auditing Standard No. 13, The Auditor's Responses to the Risks of 
Material Misstatement, the extent of supervision of engagement team 
members should be commensurate with the risks of material 
misstatement.\40\
---------------------------------------------------------------------------

    \40\ Paragraph 5.b. of Auditing Standard No. 13 indicates that 
the extent of supervision of engagement team members is part of the 
auditor's overall responses to the risks of material misstatement.
---------------------------------------------------------------------------

Appendix A--Definition

    A1. For purposes of this standard, the term listed below is defined 
as follows:
    A2. Engagement partner--The member of the engagement team with 
primary responsibility for the audit.

[[Page 59336]]

Auditing Standard No. 11

Consideration of Materiality in Planning and Performing an Audit

Introduction

    1. This standard establishes requirements regarding the auditor's 
consideration of materiality in planning and performing an audit.\41\
---------------------------------------------------------------------------

    \41\ Auditing Standard No. 14 establishes requirements regarding 
the auditor's consideration of materiality in evaluating audit 
results.
---------------------------------------------------------------------------

Materiality in the Context of an Audit
    2. In interpreting the federal securities laws, the Supreme Court 
of the United States has held that a fact is material if there is ``a 
substantial likelihood that the * * * fact would have been viewed by 
the reasonable investor as having significantly altered the `total mix' 
of information made available.'' \42\ As the Supreme Court has noted, 
determinations of materiality require ``delicate assessments of the 
inferences a `reasonable shareholder' would draw from a given set of 
facts and the significance of those inferences to him * * *.'' \43\
---------------------------------------------------------------------------

    \42\ TSC Industries v. Northway, Inc., 426 U.S. 438, 449 (1976). 
See also Basic, Inc. v. Levinson, 485 U.S. 224 (1988).
    \43\ TSC Industries, 426 U.S. at 450.
---------------------------------------------------------------------------

    3. To obtain reasonable assurance about whether the financial 
statements are free of material misstatement, the auditor should plan 
and perform audit procedures to detect misstatements that, individually 
or in combination with other misstatements, would result in material 
misstatement of the financial statements. This includes being alert 
while planning and performing audit procedures for misstatements that 
could be material due to quantitative or qualitative factors. Also, the 
evaluation of uncorrected misstatements in accordance with Auditing 
Standard No. 14, Evaluating Audit Results, requires consideration of 
both qualitative and quantitative factors.\44\ However, it ordinarily 
is not practical to design audit procedures to detect misstatements 
that are material based solely on qualitative factors.
---------------------------------------------------------------------------

    \44\ Appendix B of Auditing Standard No. 14.
---------------------------------------------------------------------------

    4. For integrated audits, Auditing Standard No. 5, An Audit of 
Internal Control Over Financial Reporting That Is Integrated with An 
Audit of Financial Statements, states, ``In planning the audit of 
internal control over financial reporting, the auditor should use the 
same materiality considerations he or she would use in planning the 
audit of the company's annual financial statements.'' \45\
---------------------------------------------------------------------------

    \45\ Paragraph 20 of Auditing Standard No. 5.
---------------------------------------------------------------------------

Objective

    5. The objective of the auditor is to apply the concept of 
materiality appropriately in planning and performing audit procedures.

Considering Materiality in Planning and Performing an Audit

Establishing a Materiality Level for the Financial Statements as a 
Whole
    6. To plan the nature, timing, and extent of audit procedures, the 
auditor should establish a materiality level for the financial 
statements as a whole that is appropriate in light of the particular 
circumstances. This includes consideration of the company's earnings 
and other relevant factors. To determine the nature, timing, and extent 
of audit procedures, the materiality level for the financial statements 
as a whole needs to be expressed as a specified amount.
    Note: If financial statements for the audit period are not 
available, the auditor may establish an initial materiality level based 
on estimated or preliminary financial statement amounts. In those 
situations, the auditor should take into account the effects of known 
or expected changes in the company's financial statements, including 
significant transactions or adjustments that are expected to be 
reflected in the financial statements at the end of the period.
Establishing Materiality Levels for Particular Accounts or Disclosures
    7. The auditor should evaluate whether, in light of the particular 
circumstances, there are certain accounts or disclosures for which 
there is a substantial likelihood that misstatements of lesser amounts 
than the materiality level established for the financial statements as 
a whole would influence the judgment of a reasonable investor. If so, 
the auditor should establish separate materiality levels for those 
accounts or disclosures to plan the nature, timing, and extent of audit 
procedures for those accounts or disclosures.
    Note: Lesser amounts of misstatements could influence the judgment 
of a reasonable investor because of qualitative factors, e.g., because 
of the sensitivity of circumstances surrounding misstatements, such as 
conflicts of interest in related party transactions.
Determining Tolerable Misstatement
    8. The auditor should determine the amount or amounts of tolerable 
misstatement for purposes of assessing risks of material misstatement 
and planning and performing audit procedures at the account or 
disclosure level. The auditor should determine tolerable misstatement 
at an amount or amounts that reduce to an appropriately low level the 
probability that the total of uncorrected and undetected misstatements 
would result in material misstatement of the financial statements. 
Accordingly, tolerable misstatement should be less than the materiality 
level for the financial statements as a whole and, if applicable, the 
materiality level or levels for particular accounts or disclosures.
    9. In determining tolerable misstatement and planning and 
performing audit procedures, the auditor should take into account the 
nature, cause (if known), and amount of misstatements that were 
accumulated in audits of the financial statements of prior periods.
Considerations for Multi-Location Engagements
    10. For purposes of the audit of the consolidated financial 
statements of a company with multiple locations or business units, the 
auditor should determine tolerable misstatement for the individual 
locations or business units at an amount that reduces to an 
appropriately low level the probability that the total of uncorrected 
and undetected misstatements would result in material misstatement of 
the consolidated financial statements. Accordingly, tolerable 
misstatement at an individual location should be less than the 
materiality level for the financial statements as a whole.

Considerations as the Audit Progresses

    11. The auditor should reevaluate the established materiality level 
or levels and tolerable misstatement when, because of changes in the 
particular circumstances or additional information that comes to the 
auditor's attention, there is a substantial likelihood that 
misstatements of amounts that differ significantly from the materiality 
level or levels that were established initially would influence the 
judgment of a reasonable investor. Situations in which changes in 
circumstances or additional information that comes to the auditor's 
attention would require such reevaluation include:
    a. The materiality level or levels and tolerable misstatement were 
established initially based on estimated or preliminary financial 
statement amounts that differ significantly from actual amounts.
    b. Events or changes in conditions occurring after the materiality 
level or levels and tolerable misstatement were established initially 
are likely to affect

[[Page 59337]]

investors' perceptions about the company's financial position, results 
of operations, or cash flows.
    Note: Examples of such events or changes in conditions include (1) 
changes in laws, regulations, or the applicable financial reporting 
framework that affect investors' expectations about the measurement or 
disclosure of certain items and (2) significant new contractual 
arrangements that draw attention to a particular aspect of a company's 
business that is separately disclosed in the financial statements.
    12. If the auditor's reevaluation results in a lower amount for the 
materiality level or levels or tolerable misstatement than initially 
established by the auditor, the auditor should (1) evaluate the effect, 
if any, of the lower amount or amounts on his or her risk assessments 
and audit procedures and (2) modify the nature, timing, and extent of 
audit procedures as necessary to obtain sufficient appropriate audit 
evidence.
    Note: The reevaluation of the materiality level or levels and 
tolerable misstatement is also relevant to the auditor's evaluation of 
uncorrected misstatements in accordance with Auditing Standard No. 
14.\46\
---------------------------------------------------------------------------

    \46\ Paragraph 17 of Auditing Standard No. 14.
---------------------------------------------------------------------------

Auditing Standard No. 12

Identifying and Assessing Risks of Material Misstatement

Introduction

    1. This standard establishes requirements regarding the process of 
identifying and assessing risks of material misstatement \47\ of the 
financial statements.
---------------------------------------------------------------------------

    \47\ Paragraphs 5-8 of Auditing Standard No. 8, Audit Risk.
---------------------------------------------------------------------------

    2. Paragraphs 4-58 of this standard discuss the auditor's 
responsibilities for performing risk assessment procedures.\48\ 
Paragraphs 59-73 of this standard discuss identifying and assessing the 
risks of material misstatement using information obtained from 
performing risk assessment procedures.
---------------------------------------------------------------------------

    \48\ Terms defined in Appendix A, Definitions, are set in 
boldface type the first time they appear.
---------------------------------------------------------------------------

Objective

    3. The objective of the auditor is to identify and appropriately 
assess the risks of material misstatement, thereby providing a basis 
for designing and implementing responses to the risks of material 
misstatement.

Performing Risk Assessment Procedures

    4. The auditor should perform risk assessment procedures that are 
sufficient to provide a reasonable basis for identifying and assessing 
the risks of material misstatement, whether due to error or fraud,\49\ 
and designing further audit procedures.\50\
---------------------------------------------------------------------------

    \49\ AU sec. 316, Consideration of Fraud in a Financial 
Statement Audit, discusses fraud, its characteristics, and the types 
of misstatements due to fraud that are relevant to the audit, i.e., 
misstatements arising from fraudulent financial reporting and 
misstatements arising from asset misappropriation.
    \50\ Auditing Standard No. 15, Audit Evidence, describes further 
audit procedures as consisting of tests of controls and substantive 
procedures.
---------------------------------------------------------------------------

    5. Risks of material misstatement can arise from a variety of 
sources, including external factors, such as conditions in the 
company's industry and environment, and company-specific factors, such 
as the nature of the company, its activities, and internal control over 
financial reporting. For example, external or company-specific factors 
can affect the judgments involved in determining accounting estimates 
or create pressures to manipulate the financial statements to achieve 
certain financial targets. Also, risks of material misstatement may 
relate to, e.g., personnel who lack the necessary financial reporting 
competencies, information systems that fail to accurately capture 
business transactions, or financial reporting processes that are not 
adequately aligned with the requirements in the applicable financial 
reporting framework. Thus, the audit procedures that are necessary to 
identify and appropriately assess the risks of material misstatement 
include consideration of both external factors and company-specific 
factors. This standard discusses the following risk assessment 
procedures:
    a. Obtaining an understanding of the company and its environment 
(paragraphs 7-17);
    b. Obtaining an understanding of internal control over financial 
reporting (paragraphs 18-40);
    c. Considering information from the client acceptance and retention 
evaluation, audit planning activities, past audits, and other 
engagements performed for the company (paragraphs 41-45);
    d. Performing analytical procedures (paragraphs 46-48);
    e. Conducting a discussion among engagement team members regarding 
the risks of material misstatement (paragraphs 49-53); and
    f. Inquiring of the audit committee, management, and others within 
the company about the risks of material misstatement (paragraphs 54-
58).
    Note: This standard describes an approach to identifying and 
assessing risks of material misstatement that begins at the financial 
statement level and with the auditor's overall understanding of the 
company and its environment and works down to the significant accounts 
and disclosures and their relevant assertions.\51\
---------------------------------------------------------------------------

    \51\ Paragraph 11 of Auditing Standard No. 15 discusses 
financial statement assertions.
---------------------------------------------------------------------------

    6. In an integrated audit, the risks of material misstatement of 
the financial statements are the same for both the audit of internal 
control over financial reporting and the audit of financial statements. 
The auditor's risk assessment procedures should apply to both the audit 
of internal control over financial reporting and the audit of financial 
statements.

Obtaining an Understanding of the Company and Its Environment

    7. The auditor should obtain an understanding of the company and 
its environment (``understanding of the company'') to understand the 
events, conditions, and company activities that might reasonably be 
expected to have a significant effect on the risks of material 
misstatement. Obtaining an understanding of the company includes 
understanding:
    a. Relevant industry, regulatory, and other external factors;
    b. The nature of the company;
    c. The company's selection and application of accounting 
principles, including related disclosures;
    d. The company's objectives and strategies and those related 
business risks that might reasonably be expected to result in risks of 
material misstatement; and
    e. The company's measurement and analysis of its financial 
performance.
    8. In obtaining an understanding of the company, the auditor should 
evaluate whether significant changes in the company from prior periods, 
including changes in its internal control over financial reporting, 
affect the risks of material misstatement.
Industry, Regulatory, and Other External Factors
    9. Obtaining an understanding of relevant industry, regulatory, and 
other external factors encompasses industry factors, including the 
competitive environment and technological developments; the regulatory 
environment, including the applicable

[[Page 59338]]

financial reporting framework \52\ and the legal and political 
environment; \53\ and external factors, including general economic 
conditions.
---------------------------------------------------------------------------

    \52\ The auditor should look to the requirements of the 
Securities and Exchange Commission for the company under audit with 
respect to the accounting principles applicable to that company.
    \53\ AU sec. 317, Illegal Acts by Clients, discusses the 
auditor's consideration of laws and regulations relevant to the 
audit.
---------------------------------------------------------------------------

Nature of the Company
    10. Obtaining an understanding of the nature of the company 
includes understanding:
    <bullet> The company's organizational structure and management 
personnel;
    <bullet> The sources of funding of the company's operations and 
investment activities, including the company's capital structure, 
noncapital funding (e.g., subordinated debt or dependencies on supplier 
financing), and other debt instruments;
    <bullet> The company's significant investments, including equity 
method investments, joint ventures, and variable interest entities;
    <bullet> The company's operating characteristics, including its 
size and complexity;
    Note: The size and complexity of a company might affect the risks 
of misstatement and how the company addresses those risks.
    <bullet> The sources of the company's earnings, including the 
relative profitability of key products and services; and
    <bullet> Key supplier and customer relationships.
    Note: The auditor should take into account the information gathered 
while obtaining an understanding of the nature of the company when 
determining the existence of related parties in accordance with AU sec. 
334, Related Parties.
    11. As part of obtaining an understanding of the company as 
required by paragraph 7, the auditor should consider performing the 
following procedures and the extent to which the procedures should be 
performed:
    <bullet> Reading public information about the company relevant to 
the evaluation of the likelihood of material financial statement 
misstatements and, in an integrated audit, the effectiveness of the 
company's internal control over financial reporting, e.g., company-
issued press releases, company-prepared presentation materials for 
analysts or investor groups, and analyst reports;
    <bullet> Observing or reading transcripts of earnings calls and, to 
the extent publicly available, other meetings with investors or rating 
agencies;
    <bullet> Obtaining an understanding of compensation arrangements 
with senior management, including incentive compensation arrangements, 
changes or adjustments to those arrangements, and special bonuses; and
    <bullet> Obtaining information about trading activity in the 
company's securities and holdings in the company's securities by 
significant holders to identify potentially significant unusual 
developments (e.g., from Forms 3, 4, 5, 13D, and 13G).
Selection and Application of Accounting Principles, Including Related 
Disclosures
    12. As part of obtaining an understanding of the company's 
selection and application of accounting principles, including related 
disclosures, the auditor should evaluate whether the company's 
selection and application of accounting principles are appropriate for 
its business and consistent with the applicable financial reporting 
framework and accounting principles used in the relevant industry. 
Also, to identify and assess risks of material misstatement related to 
omitted, incomplete, or inaccurate disclosures, the auditor should 
develop expectations about the disclosures that are necessary for the 
company's financial statements to be presented fairly in conformity 
with the applicable financial reporting framework.
    13. The following matters, if present, are relevant to the 
necessary understanding of the company's selection and application of 
accounting principles, including related disclosures:
    <bullet> Significant changes in the company's accounting 
principles, financial reporting policies, or disclosures and the 
reasons for such changes;
    <bullet> The financial reporting competencies of personnel involved 
in selecting and applying significant new or complex accounting 
principles;
    <bullet> The accounts or disclosures for which judgment is used in 
the application of significant accounting principles, especially in 
determining management's estimates and assumptions;
    <bullet> The effect of significant accounting principles in 
controversial or emerging areas for which there is a lack of 
authoritative guidance or consensus;
    <bullet> The methods the company uses to account for significant 
and unusual transactions; and
    <bullet> Financial reporting standards and laws and regulations 
that are new to the company, including when and how the company will 
adopt such requirements.
Company Objectives, Strategies, and Related Business Risks
    14. The purpose of obtaining an understanding of the company's 
objectives, strategies, and related business risks is to identify 
business risks that could reasonably be expected to result in material 
misstatement of the financial statements.
    Note: Some relevant business risks might be identified through 
other risk assessment procedures, such as obtaining an understanding of 
the nature of the company and understanding industry, regulatory, and 
other external factors.
    15. The following are examples of situations in which business 
risks might result in material misstatement of the financial 
statements:
    <bullet> Industry developments (a potential related business risk 
might be, e.g., that the company does not have the personnel or 
expertise to deal with the changes in the industry.)
    <bullet> New products and services (a potential related business 
risk might be, e.g., that the new product or service will not be 
successful.)
    <bullet> Use of information technology (``IT'') (a potential 
related business risk might be, e.g., that systems and processes are 
incompatible.)
    <bullet> New accounting requirements (a potential related business 
risk might be, e.g., incomplete or improper implementation of a new 
accounting requirement.)
    <bullet> Expansion of the business (a potential related business 
risk might be, e.g., that the demand for the company's products or 
services has not been accurately estimated.)
    <bullet> The effects of implementing a strategy, particularly any 
effects that will lead to new accounting requirements (a potential 
related business risk might be, e.g., incomplete or improper 
implementation of the strategy.)
    <bullet> Current and prospective financing requirements (a 
potential related business risk might be, e.g., the loss of financing 
due to the company's inability to meet financing requirements.)
    <bullet> Regulatory requirements (a potential related business risk 
might be, e.g., that there is increased legal exposure.)
    Note: Business risks could affect risks of material misstatement at 
the financial statement level, which would affect many accounts and 
disclosures in the financial statements. For example, a company's loss 
of financing or declining conditions affecting the company's

[[Page 59339]]

industry could affect its ability to settle its obligations when due. 
This, in turn, could affect the risks of material misstatement related 
to, e.g., the classification of long-term liabilities or valuation of 
long-term assets, or it could result in substantial doubt about the 
company's ability to continue as a going concern. Other business risks 
could affect the risks of material misstatement for particular 
accounts, disclosures, or assertions. For example, an unsuccessful new 
product or service or failed business expansion might affect the risks 
of material misstatement related to the valuation of inventory and 
other related assets.
Company Performance Measures
    16. The purpose of obtaining an understanding of the company's 
performance measures is to identify performance measures, whether 
external or internal, that affect the risks of material misstatement.
    17. The following are examples of performance measures that might 
affect the risks of material misstatement:
    <bullet> Measures that form the basis for contractual commitments 
or incentive compensation arrangements;
    <bullet> Measures used by external parties, such as analysts and 
rating agencies, to review the company's performance; and
    <bullet> Measures the company uses to monitor its operations that 
highlight unexpected results or trends that prompt management to 
investigate their cause and take corrective action, including 
correction of misstatements.
    Note: The first two examples represent performance measures that 
can affect the risks of material misstatement by creating incentives or 
pressures for management of the company to manipulate certain accounts 
or disclosures to achieve certain performance targets (or conceal a 
failure to achieve those targets). The third example represents 
performance measures that management might use to monitor risks 
affecting the financial statements.
    Note: Smaller companies might have less formal processes to measure 
and review financial performance. In such cases, the auditor might 
identify relevant performance measures by considering the information 
that the company uses to manage the business.

Obtaining an Understanding of Internal Control Over Financial Reporting

    18. The auditor should obtain a sufficient understanding of each 
component \54\ of internal control over financial reporting 
(``understanding of internal control'') to (a) identify the types of 
potential misstatements, (b) assess the factors that affect the risks 
of material misstatement, and (c) design further audit procedures.
---------------------------------------------------------------------------

    \54\ Paragraphs 21-22 of this standard discuss components of 
internal control over financial reporting.
---------------------------------------------------------------------------

    19. The nature, timing, and extent of procedures that are necessary 
to obtain an understanding of internal control depend on the size and 
complexity of the company; \55\ the auditor's existing knowledge of the 
company's internal control over financial reporting; the nature of the 
company's controls, including the company's use of IT; the nature and 
extent of changes in systems and operations; and the nature of the 
company's documentation of its internal control over financial 
reporting.
---------------------------------------------------------------------------

    \55\ Paragraph 13 of Auditing Standard No. 5, An Audit of 
Internal Control Over Financial Reporting That is Integrated with An 
Audit of Financial Statements, states, ``The size and complexity of 
the company, its business processes, and business units, may affect 
the way in which the company achieves many of its control 
objectives. The size and complexity of the company also might affect 
the risks of misstatement and the controls necessary to address 
those risks.''
---------------------------------------------------------------------------

    Note: The auditor also might obtain an understanding of certain 
controls that are not part of internal control over financial 
reporting, e.g., controls over the completeness and accuracy of 
operating or other nonfinancial information used as audit evidence.\56\
---------------------------------------------------------------------------

    \56\ Paragraph 10 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    20. Obtaining an understanding of internal control includes 
evaluating the design of controls that are relevant to the audit and 
determining whether the controls have been implemented.
    Note: Procedures the auditor performs to obtain evidence about 
design effectiveness include inquiry of appropriate personnel, 
observation of the company's operations, and inspection of relevant 
documentation. Walkthroughs, as described in paragraphs 37-38, that 
include these procedures ordinarily are sufficient to evaluate design 
effectiveness.
    Note: Determining whether a control has been implemented means 
determining whether the control exists and whether the company is using 
it. The procedures to determine whether a control has been implemented 
may be performed in connection with the evaluation of its design. 
Procedures performed to determine whether a control has been 
implemented include inquiry of appropriate personnel, in combination 
with observation of the application of controls or inspection of 
documentation. Walkthroughs, as described in paragraphs 37-38, that 
include these procedures ordinarily are sufficient to determine whether 
a control has been implemented.
    21. Internal control over financial reporting can be described as 
consisting of the following components: \57\
---------------------------------------------------------------------------

    \57\ Different internal control frameworks use different terms 
and approaches to describe the components of internal control over 
financial reporting.
---------------------------------------------------------------------------

    <bullet> The control environment,
    <bullet> The company's risk assessment process,
    <bullet> Information and communication,
    <bullet> Control activities, and
    <bullet> Monitoring of controls.
    22. Management might use an internal control framework with 
components that differ from the components identified in the preceding 
paragraph when establishing and maintaining the company's internal 
control over financial reporting. In evaluating the design of controls 
and determining whether they have been implemented in an audit of 
financial statements only, the auditor may use the framework used by 
management or another suitable, recognized framework.\58\ For 
integrated audits, Auditing Standard No. 5, states, ``The auditor 
should use the same suitable, recognized control framework to perform 
his or her audit of internal control over financial reporting as 
management uses for its annual evaluation of the effectiveness of the 
company's internal control over financial reporting.'' \59\ If the 
auditor uses a suitable, recognized internal control framework with 
components that differ from those listed in the preceding paragraph, 
the auditor should adapt the requirements in paragraphs 23-36 of this 
standard to conform to the components in the framework used.
---------------------------------------------------------------------------

    \58\ See Securities Exchange Act Release No. 34-47986 (June 5, 
2003) for a description of the characteristics of a suitable, 
recognized framework.
    \59\ Paragraph 5 of Auditing Standard No. 5.
---------------------------------------------------------------------------

Control Environment
    23. The auditor should obtain an understanding of the company's 
control environment, including the policies and actions of management, 
the board, and the audit committee concerning the company's control 
environment.
    24. Obtaining an understanding of the control environment includes 
assessing:
    <bullet> Whether management's philosophy and operating style 
promote effective internal control over financial reporting;
    <bullet> Whether sound integrity and ethical values, particularly 
of top management, are developed and understood; and
    <bullet> Whether the board or audit committee understands and 
exercises oversight responsibility over financial reporting and 
internal control.
    Note: In an audit of financial statements only, this assessment may 
be based on the evidence obtained in

[[Page 59340]]

understanding the control environment, in accordance with paragraph 23, 
and the other relevant knowledge possessed by the auditor. In an 
integrated audit of financial statements and internal control over 
financial reporting, Auditing Standard No. 5 \60\ describes the 
auditor's responsibility for evaluating the control environment.
---------------------------------------------------------------------------

    \60\ Paragraph 25 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    25. If the auditor identifies a control deficiency \61\ in the 
company's control environment, the auditor should evaluate the extent 
to which this control deficiency is indicative of a fraud risk factor, 
as discussed in paragraphs 65-66 of this standard.
---------------------------------------------------------------------------

    \61\ Paragraph A3 of Auditing Standard No. 5.
---------------------------------------------------------------------------

The Company's Risk Assessment Process
    26. The auditor should obtain an understanding of management's 
process for:
    a. Identifying risks relevant to financial reporting objectives, 
including risks of material misstatement due to fraud (``fraud 
risks'');
    b. Assessing the likelihood and significance of misstatements 
resulting from those risks; and
    c. Deciding about actions to address those risks.
    27. Obtaining an understanding of the company's risk assessment 
process includes obtaining an understanding of the risks of material 
misstatement identified and assessed by management and the actions 
taken to address those risks.
Information and Communication
    28. Information System Relevant to Financial Reporting. The auditor 
should obtain an understanding of the information system, including the 
related business processes, relevant to financial reporting, including:
    a. The classes of transactions in the company's operations that are 
significant to the financial statements;
    b. The procedures, within both automated and manual systems, by 
which those transactions are initiated, authorized, processed, 
recorded, and reported;
    c. The related accounting records, supporting information, and 
specific accounts in the financial statements that are used to 
initiate, authorize, process, and record transactions;
    d. How the information system captures events and conditions, other 
than transactions,\62\ that are significant to the financial 
statements; and
---------------------------------------------------------------------------

    \62\ Examples of such events and conditions include depreciation 
and amortization and conditions affecting the recoverability of 
assets.
---------------------------------------------------------------------------

    e. The period-end financial reporting process.
    Note: Appendix B discusses additional considerations regarding 
manual and automated systems and controls.
    29. The auditor also should obtain an understanding of how IT 
affects the company's flow of transactions. (See Appendix B.)
    Note: The identification of risks and controls within IT is not a 
separate evaluation. Instead, it is an integral part of the approach 
used to identify significant accounts and disclosures and their 
relevant assertions and, when applicable, to select the controls to 
test, as well as to assess risk and allocate audit effort.
    30. A company's business processes are the activities designed to:
    a. Develop, purchase, produce, sell and distribute a company's 
products or services;
    b. Record information, including accounting and financial reporting 
information; and
    c. Ensure compliance with laws and regulations relevant to the 
financial statements.
    31. Obtaining an understanding of the company's business processes 
assists the auditor in obtaining an understanding of how transactions 
are initiated, authorized, processed, and recorded.
    32. A company's period-end financial reporting process, as referred 
to in paragraph 28.e., includes the following:
    <bullet> Procedures used to enter transaction totals into the 
general ledger;
    <bullet> Procedures related to the selection and application of 
accounting principles; \63\
---------------------------------------------------------------------------

    \63\ Paragraphs 12-13 of this standard.
---------------------------------------------------------------------------

    <bullet> Procedures used to initiate, authorize, record, and 
process journal entries in the general ledger;
    <bullet> Procedures used to record recurring and nonrecurring 
adjustments to the annual financial statements (and quarterly financial 
statements, if applicable); and
    <bullet> Procedures for preparing annual financial statements and 
related disclosures (and quarterly financial statements, if 
applicable).
    33. Communication. The auditor should obtain an understanding of 
how the company communicates financial reporting roles and 
responsibilities and significant matters relating to financial 
reporting to relevant company personnel and others, including:
    <bullet> Communications between management, the audit committee, 
and the board of directors; and
    <bullet> Communications to external parties, including regulatory 
authorities and shareholders.
Control Activities
    34. The auditor should obtain an understanding of control 
activities that is sufficient to assess the factors that affect the 
risks of material misstatement and to design further audit procedures, 
as described in paragraph 18 of this standard.\64\ As the auditor 
obtains an understanding of the other components of internal control 
over financial reporting, he or she is also likely to obtain knowledge 
about some control activities. The auditor should use his or her 
knowledge about the presence or absence of control activities obtained 
from the understanding of the other components of internal control over 
financial reporting in determining the extent to which it is necessary 
to devote additional attention to obtaining an understanding of control 
activities to assess the factors that affect the risks of material 
misstatement and to design further audit procedures.
---------------------------------------------------------------------------

    \64\ Also see paragraph B5 of Appendix B of this standard.
---------------------------------------------------------------------------

    Note: A broader understanding of control activities is needed for 
relevant assertions for which the auditor plans to rely on controls. 
Also, in the audit of internal control over financial reporting, the 
auditor's understanding of control activities encompasses a broader 
range of accounts and disclosures than what is normally obtained in a 
financial statement audit.
Monitoring of Controls
    35. The auditor should obtain an understanding of the major types 
of activities that the company uses to monitor the effectiveness of its 
internal control over financial reporting and how the company initiates 
corrective actions related to its controls.\65\
---------------------------------------------------------------------------

    \65\ In some companies, internal auditors or others performing 
an equivalent function contribute to the monitoring of controls. AU 
sec. 322, The Auditor's Consideration of the Internal Audit Function 
in an Audit of Financial Statements, establishes requirements 
regarding the auditor's consideration and use of the work of the 
internal audit function.
---------------------------------------------------------------------------

    36. An understanding of the company's monitoring activities 
includes understanding the source of the information used in the 
monitoring activities.
Performing Walkthroughs
    37. As discussed in paragraph 20, the auditor may perform 
walkthroughs as part of obtaining an understanding of internal control 
over financial reporting. For example, the auditor may perform 
walkthroughs in connection with understanding the flow of transactions

[[Page 59341]]

in the information system relevant to financial reporting, evaluating 
the design of controls relevant to the audit, and determining whether 
those controls have been implemented. In performing a walkthrough, the 
auditor follows a transaction from origination through the company's 
processes, including information systems, until it is reflected in the 
company's financial records, using the same documents and IT that 
company personnel use. Walkthrough procedures usually include a 
combination of inquiry, observation, inspection of relevant 
documentation, and re-performance of controls.
    Note: For integrated audits, Auditing Standard No. 5 establishes 
certain objectives that the auditor should achieve to further 
understand likely sources of potential misstatements and as part of 
selecting the controls to test. Auditing Standard No. 5 states that 
performing walkthroughs will frequently be the most effective way of 
achieving those objectives.\66\
---------------------------------------------------------------------------

    \66\ See paragraphs 34-38 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    38. In performing a walkthrough, at the points at which important 
processing procedures occur, the auditor questions the company's 
personnel about their understanding of what is required by the 
company's prescribed procedures and controls. These probing questions, 
combined with the other walkthrough procedures, allow the auditor to 
gain a sufficient understanding of the process and to be able to 
identify important points at which a necessary control is missing or 
not designed effectively. Additionally, probing questions that go 
beyond a narrow focus on the single transaction used as the basis for 
the walkthrough allow the auditor to gain an understanding of the 
different types of significant transactions handled by the process.
Relationship of Understanding of Internal Control to Tests of Controls
    39. The objective of obtaining an understanding of internal 
control, as discussed in paragraph 18 of this standard, is different 
from testing controls for the purpose of assessing control risk \67\ or 
for the purpose of expressing an opinion on internal control over 
financial reporting in the audit of internal control over financial 
reporting.\68\ The auditor may obtain an understanding of internal 
control concurrently with performing tests of controls if he or she 
obtains sufficient appropriate evidence to achieve the objectives of 
both procedures. Also, the auditor should take into account the 
evidence obtained from understanding internal control when assessing 
control risk and, in the audit of internal control over financial 
reporting, forming an opinion about the effectiveness of internal 
control over financial reporting.
---------------------------------------------------------------------------

    \67\ Paragraphs 16-35 of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement.
    \68\ Paragraph B1 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    40. Relationship of Understanding of Internal Control to Evaluating 
Entity-Level Controls in an Audit of Internal Control Over Financial 
Reporting. Auditing Standard No. 5 states, ``The auditor must test 
those entity-level controls that are important to the auditor's 
conclusion about whether the company has effective internal control 
over financial reporting.'' \69\ The procedures performed to obtain an 
understanding of certain components of internal control in accordance 
with this standard, e.g., the control environment, the company's risk 
assessment process, information and communication, and monitoring of 
controls, might provide evidence that is relevant to the auditor's 
evaluation of entity-level controls.\70\ The auditor should take into 
account the evidence obtained from understanding internal control when 
determining the nature, timing, and extent of procedures necessary to 
support the auditor's conclusions about the effectiveness of entity-
level controls in the audit of internal control over financial 
reporting.
---------------------------------------------------------------------------

    \69\ Paragraph 22 of Auditing Standard No. 5.
    \70\ The entity-level controls included in paragraph 24 of 
Auditing Standard No. 5 include controls related to the control 
environment; the company's risk assessment process; centralized 
processing and controls; controls over the period-end financial 
reporting process; and controls to monitor other controls.
---------------------------------------------------------------------------

Considering Information From the Client Acceptance and Retention 
Evaluation, Audit Planning Activities, Past Audits, and Other 
Engagements

    41. Client Acceptance and Retention and Audit Planning Activities. 
The auditor should evaluate whether information obtained from the 
client acceptance and retention evaluation process or audit planning 
activities is relevant to identifying risks of material misstatement. 
Risks of material misstatement identified during those activities 
should be assessed as discussed beginning in paragraph 59 of this 
standard.
    42. Past Audits. In subsequent years, the auditor should 
incorporate knowledge obtained during past audits into the auditor's 
process for identifying risks of material misstatement, including when 
identifying significant ongoing matters that affect the risks of 
material misstatement or determining how changes in the company or its 
environment affect the risks of material misstatement, as discussed in 
paragraph 8 of this standard.
    43. If the auditor plans to limit the nature, timing, or extent of 
his or her risk assessment procedures by relying on information from 
past audits, the auditor should evaluate whether the prior years' 
information remains relevant and reliable.
    44. Other Engagements. When the auditor has performed a review of 
interim financial information in accordance with AU sec. 722, Interim 
Financial Information, the auditor should evaluate whether information 
obtained during the review is relevant to identifying risks of material 
misstatement in the year-end audit.
    45. The auditor should obtain an understanding of the nature of the 
services that have been performed for the company by the auditor or 
affiliates of the firm \71\ and should take into account relevant 
information obtained from those engagements in identifying risks of 
material misstatement.\72\
---------------------------------------------------------------------------

    \71\ See PCAOB Rule 3501(a)(i), which defines ``affiliate of the 
accounting firm.''
    \72\ Paragraph 7 of Auditing Standard No. 9, Audit Planning.
---------------------------------------------------------------------------

Performing Analytical Procedures

    46. The auditor should perform analytical procedures that are 
designed to:
    a. Enhance the auditor's understanding of the client's business and 
the significant transactions and events that have occurred since the 
prior year end; and
    b. Identify areas that might represent specific risks relevant to 
the audit, including the existence of unusual transactions and events, 
and amounts, ratios, and trends that warrant investigation.
    47. In applying analytical procedures as risk assessment 
procedures, the auditor should perform analytical procedures relating 
to revenue with the objective of identifying unusual or unexpected 
relationships involving revenue accounts that might indicate a material 
misstatement, including material misstatement due to fraud. Also, when 
the auditor has performed a review of interim financial information in 
accordance with AU sec. 722, he or she should take into account the 
analytical procedures applied in that review when designing and 
applying analytical procedures as risk assessment procedures.
    48. When performing an analytical procedure, the auditor should use 
his or

[[Page 59342]]

her understanding of the company to develop expectations about 
plausible relationships among the data to be used in the procedure.\73\ 
When comparison of those expectations with relationships derived from 
recorded amounts yields unusual or unexpected results, the auditor 
should take into account those results in identifying the risks of 
material misstatement.
---------------------------------------------------------------------------

    \73\ Analytical procedures consist of evaluations of financial 
information made by a study of plausible relationships among both 
financial and nonfinancial data.
---------------------------------------------------------------------------

    Note: Analytical procedures performed as risk assessment procedures 
often use data that is preliminary or data that is aggregated at a high 
level, and, in those instances, such analytical procedures are not 
designed with the level of precision necessary for substantive 
analytical procedures.

Conducting a Discussion Among Engagement Team Members Regarding Risks 
of Material Misstatement

    49. The key engagement team members should discuss (1) the 
company's selection and application of accounting principles, including 
related disclosure requirements, and (2) the susceptibility of the 
company's financial statements to material misstatement due to error or 
fraud.
    Note: The key engagement team members should discuss the potential 
for material misstatement due to fraud either as part of the discussion 
regarding risks of material misstatement or in a separate 
discussion.\74\
---------------------------------------------------------------------------

    \74\ Paragraphs 52-53 of this standard.
---------------------------------------------------------------------------

    Note: As discussed in paragraph 67, the financial statements might 
be susceptible to misstatement through omission of required disclosures 
or presentation of inaccurate or incomplete disclosures.
    50. Key engagement team members include all engagement team members 
who have significant engagement responsibilities, including the 
engagement partner. The manner in which the discussion is conducted 
depends on the individuals involved and the circumstances of the 
engagement. For example, if the audit involves more than one location, 
there could be multiple discussions with team members in differing 
locations. The engagement partner or other key engagement team members 
should communicate the important matters from the discussion to 
engagement team members who are not involved in the discussion.
    Note: If the audit is performed entirely by the engagement partner, 
that engagement partner, having personally conducted the planning of 
the audit, is responsible for evaluating the susceptibility of the 
company's financial statements to material misstatement.
    51. Communication among the engagement team members about 
significant matters affecting the risks of material misstatement should 
continue throughout the audit, including when conditions change.\75\
---------------------------------------------------------------------------

    \75\ See also paragraph 29 of Auditing Standard No. 14, 
Evaluating Audit Results.
---------------------------------------------------------------------------

Discussion of the Potential for Material Misstatement Due to Fraud
    52. The discussion among the key engagement team members about the 
potential for material misstatement due to fraud should occur with an 
attitude that includes a questioning mind, and the key engagement team 
members should set aside any prior beliefs they might have that 
management is honest and has integrity. The discussion among the key 
engagement team members should include:
    <bullet> An exchange of ideas, or ``brainstorming,'' among the key 
engagement team members, including the engagement partner, about how 
and where they believe the company's financial statements might be 
susceptible to material misstatement due to fraud, how management could 
perpetrate and conceal fraudulent financial reporting, and how assets 
of the company could be misappropriated, including (a) the 
susceptibility of the financial statements to material misstatement 
through related party transactions and (b) how fraud might be 
perpetrated or concealed by omitting or presenting incomplete or 
inaccurate disclosures;
    <bullet> A consideration of the known external and internal factors 
affecting the company that might (a) create incentives or pressures for 
management and others to commit fraud, (b) provide the opportunity for 
fraud to be perpetrated, and (c) indicate a culture or environment that 
enables management to rationalize committing fraud;
    <bullet> A consideration of the risk of management override; and
    <bullet> A consideration of the potential audit responses to the 
susceptibility of the company's financial statements to material 
misstatement due to fraud.
    53. The auditor should emphasize the following matters to all 
engagement team members:
    <bullet> The need to maintain a questioning mind throughout the 
audit and to exercise professional skepticism in gathering and 
evaluating evidence, as described in AU sec. 316; \76\
---------------------------------------------------------------------------

    \76\ AU sec. 316.13.
---------------------------------------------------------------------------

    <bullet> The need to be alert for information or other conditions 
(such as those matters presented in Appendix C of Auditing Standard No. 
14) that might affect the assessment of fraud risks; and
    <bullet> If information or other conditions indicate that a 
material misstatement due to fraud might have occurred, the need to 
probe the issues, acquire additional evidence as necessary, and consult 
with other team members and, if appropriate, others in the firm 
including specialists.\77\
---------------------------------------------------------------------------

    \77\ Paragraphs 20-23 of Auditing Standard No. 14 establish 
further requirements for evaluating whether misstatements might be 
indicative of fraud and determining the necessary procedures to be 
performed in those situations.
---------------------------------------------------------------------------

Inquiring of the Audit Committee, Management, and Others Within the 
Company About the Risks of Material Misstatement

    54. The auditor should inquire of the audit committee, or 
equivalent (or its chair), management, the internal audit function, and 
others within the company who might reasonably be expected to have 
information that is important to the identification and assessment of 
risks of material misstatement.
    Note: The auditor's inquiries about risks of material misstatement 
should include inquiries regarding fraud risks.
    55. The auditor should use his or her knowledge of the company and 
its environment, as well as information from other risk assessment 
procedures, to determine the nature of the inquiries about risks of 
material misstatement.
Inquiries Regarding Fraud Risks
    56. The auditor's inquiries regarding fraud risks should include 
the following:
    a. Inquiries of management regarding:
    (1) Whether management has knowledge of fraud, alleged fraud, or 
suspected fraud affecting the company;
    (2) Management's process for identifying and responding to fraud 
risks in the company, including any specific fraud risks the company 
has identified or account balances or disclosures for which a fraud 
risk is likely to exist, and the nature, extent, and frequency of 
management's fraud risk assessment process;
    (3) Controls that the company has established to address fraud 
risks the company has identified, or that otherwise help to prevent and 
detect fraud, including how management monitors those controls;
    (4) For a company with multiple locations (a) the nature and extent 
of monitoring of operating locations or business segments and (b) 
whether there

[[Page 59343]]

are particular operating locations or business segments for which a 
fraud risk might be more likely to exist;
    (5) Whether and how management communicates to employees its views 
on business practices and ethical behavior;
    (6) Whether management has received tips or complaints regarding 
the company's financial reporting (including those received through the 
audit committee's internal whistleblower program, if such program 
exists) and, if so, management's responses to such tips and complaints; 
and
    (7) Whether management has reported to the audit committee on how 
the company's internal control serves to prevent and detect material 
misstatements due to fraud.
    b. Inquiries of the audit committee, or equivalent, or its chair 
regarding:
    (1) The audit committee's views about fraud risks in the company;
    (2) Whether the audit committee has knowledge of fraud, alleged 
fraud, or suspected fraud affecting the company;
    (3) Whether the audit committee is aware of tips or complaints 
regarding the company's financial reporting (including those received 
through the audit committee's internal whistleblower program, if such 
program exists) and, if so, the audit committee's responses to such 
tips and complaints; and
    (4) How the audit committee exercises oversight of the company's 
assessment of fraud risks and the establishment of controls to address 
fraud risks.
    c. If the company has an internal audit function, inquiries of 
appropriate internal audit personnel regarding:
    (1) The internal auditors' views about fraud risks in the company;
    (2) Whether the internal auditors have knowledge of fraud, alleged 
fraud, or suspected fraud affecting the company;
    (3) Whether internal auditors have performed procedures to identify 
or detect fraud during the year, and whether management has 
satisfactorily responded to the findings resulting from those 
procedures; and
    (4) Whether internal auditors are aware of instances of management 
override of controls and the nature and circumstances of such 
overrides.
    57. In addition to the inquiries outlined in the preceding 
paragraph, the auditor should inquire of others within the company 
about their views regarding fraud risks, including, in particular, 
whether they have knowledge of fraud, alleged fraud, or suspected 
fraud. The auditor should identify other individuals within the company 
to whom inquiries should be directed and determine the extent of such 
inquiries by considering whether others in the company might have 
additional knowledge about fraud, alleged fraud, or suspected fraud or 
might be able to corroborate fraud risks identified in discussions with 
management or the audit committee. Examples of other individuals within 
the company to whom inquiries might be directed include:
    <bullet> Employees with varying levels of authority within the 
company, including, e.g., company personnel with whom the auditor comes 
into contact during the course of the audit (a) in obtaining an 
understanding of internal control, (b) in observing inventory or 
performing cutoff procedures, or (c) in obtaining explanations for 
significant differences identified when performing analytical 
procedures;
    <bullet> Operating personnel not directly involved in the financial 
reporting process;
    <bullet> Employees involved in initiating, recording, or processing 
complex or unusual transactions, e.g., a sales transaction with 
multiple elements or a significant related party transaction; and
    <bullet> In-house legal counsel.
    58. When evaluating management's responses to inquiries about fraud 
risks and determining when it is necessary to corroborate management's 
responses, the auditor should take into account the fact that 
management is often in the best position to commit fraud. Also, the 
auditor should obtain evidence to address inconsistencies in responses 
to the inquiries.

Identifying and Assessing the Risks of Material Misstatement

    59. The auditor should identify and assess the risks of material 
misstatement at the financial statement level and the assertion level. 
In identifying and assessing risks of material misstatement, the 
auditor should:
    a. Identify risks of misstatement using information obtained from 
performing risk assessment procedures (as discussed in paragraphs 4-58) 
and considering the characteristics of the accounts and disclosures in 
the financial statements.
    Note: Factors relevant to identifying fraud risks are discussed in 
paragraphs 65-69 of this standard.
    b. Evaluate whether the identified risks relate pervasively to the 
financial statements as a whole and potentially affect many assertions.
    c. Evaluate the types of potential misstatements that could result 
from the identified risks and the accounts, disclosures, and assertions 
that could be affected.
    Note: In identifying and assessing risks at the assertion level, 
the auditor should evaluate how risks at the financial statement level 
could affect risks of misstatement at the assertion level.
    d. Assess the likelihood of misstatement, including the possibility 
of multiple misstatements, and the magnitude of potential misstatement 
to assess the possibility that the risk could result in material 
misstatement of the financial statements.
    Note: In assessing the likelihood and magnitude of potential 
misstatement, the auditor may take into account the planned degree of 
reliance on controls selected to test.\78\
---------------------------------------------------------------------------

    \78\ Paragraphs 16-35 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    e. Identify significant accounts and disclosures \79\ and their 
relevant assertions \80\ (paragraphs 60-64 of this standard).
---------------------------------------------------------------------------

    \79\ Paragraph A10 of Auditing Standard No. 5 states:
    An account or disclosure is a significant account or disclosure 
if there is a reasonable possibility that the account or disclosure 
could contain a misstatement that, individually or when aggregated 
with others, has a material effect on the financial statements, 
considering the risks of both overstatement and understatement. The 
determination of whether an account or disclosure is significant is 
based on inherent risk, without regard to the effect of controls.
    \80\ Paragraph A9 of Auditing Standard No. 5 states:
    A relevant assertion is a financial statement assertion that has 
a reasonable possibility of containing a misstatement or 
misstatements that would cause the financial statements to be 
materially misstated. The determination of whether an assertion is a 
relevant assertion is based on inherent risk, without regard to the 
effect of controls.
---------------------------------------------------------------------------

    Note: The determination of whether an account or disclosure is 
significant or whether an assertion is a relevant assertion is based on 
inherent risk, without regard to the effect of controls.
    f. Determine whether any of the identified and assessed risks of 
material misstatement are significant risks (paragraphs 70-71 of this 
standard).

Identifying Significant Accounts and Disclosures and Their Relevant 
Assertions

    60. To identify significant accounts and disclosures and their 
relevant assertions in accordance with paragraph 59.e., the auditor 
should evaluate the qualitative and quantitative risk factors related 
to the financial statement line items and disclosures. Risk factors 
relevant to the identification of significant accounts and disclosures 
and their relevant assertions include:
    <bullet> Size and composition of the account;
    <bullet> Susceptibility to misstatement due to error or fraud;

[[Page 59344]]

    <bullet> Volume of activity, complexity, and homogeneity of the 
individual transactions processed through the account or reflected in 
the disclosure;
    <bullet> Nature of the account or disclosure;
    <bullet> Accounting and reporting complexities associated with the 
account or disclosure;
    <bullet> Exposure to losses in the account;
    <bullet> Possibility of significant contingent liabilities arising 
from the activities reflected in the account or disclosure;
    <bullet> Existence of related party transactions in the account; 
and
    <bullet> Changes from the prior period in account and disclosure 
characteristics.
    61. As part of identifying significant accounts and disclosures and 
their relevant assertions, the auditor also should determine the likely 
sources of potential misstatements that would cause the financial 
statements to be materially misstated. The auditor might determine the 
likely sources of potential misstatements by asking himself or herself 
``what could go wrong?'' within a given significant account or 
disclosure.
    62. The risk factors that the auditor should evaluate in the 
identification of significant accounts and disclosures and their 
relevant assertions are the same in the audit of internal control over 
financial reporting as in the audit of the financial statements; 
accordingly, significant accounts and disclosures and their relevant 
assertions are the same for both audits.
    Note: In the financial statement audit, the auditor might perform 
substantive auditing procedures on financial statement accounts, 
disclosures, and assertions that are not determined to be significant 
accounts and disclosures and relevant assertions.\81\\\
---------------------------------------------------------------------------

    \81\ \\ The auditor might perform substantive auditing 
procedures because his or her assessment of the risk that undetected 
misstatement would cause the financial statements to be materially 
misstated is unacceptably high or as a means of introducing 
unpredictability in the procedures performed. See paragraphs 11, 14, 
and 25 of Auditing Standard No. 14, for further discussion about 
undetected misstatement. See paragraph 61 of Auditing Standard No. 5 
and paragraph 5.c. of Auditing Standard No. 13, for further 
discussion about the unpredictability of auditing procedures.
---------------------------------------------------------------------------

    63. The components of a potential significant account or disclosure 
might be subject to significantly differing risks.
    64. When a company has multiple locations or business units, the 
auditor should identify significant accounts and disclosures and their 
relevant assertions based on the consolidated financial statements.
Factors Relevant to Identifying Fraud Risks
    65. The auditor should evaluate whether the information gathered 
from the risk assessment procedures indicates that one or more fraud 
risk factors are present and should be taken into account in 
identifying and assessing fraud risks. Fraud risk factors are events or 
conditions that indicate (1) an incentive or pressure to perpetrate 
fraud, (2) an opportunity to carry out the fraud, or (3) an attitude or 
rationalization that justifies the fraudulent action. Fraud risk 
factors do not necessarily indicate the existence of fraud; however, 
they often are present in circumstances in which fraud exists. Examples 
of fraud risk factors related to fraudulent financial reporting and 
misappropriation of assets are listed in AU sec. 316.85. These 
illustrative risk factors are classified based on the three conditions 
discussed in this paragraph, which generally are present when fraud 
exists.
    Note: The factors listed in AU sec. 316.85 cover a broad range of 
situations and are only examples. Accordingly, the auditor might 
identify additional or different fraud risk factors.
    66. All three conditions discussed in the preceding paragraph are 
not required to be observed or evident to conclude that a fraud risk 
exists. The auditor might conclude that a fraud risk exists even when 
only one of these three conditions is present.
    67. Consideration of the Risk of Omitted, Incomplete, or Inaccurate 
Disclosures. The auditor's evaluation of fraud risk factors in 
accordance with paragraph 65 should include evaluation of how fraud 
could be perpetrated or concealed by presenting incomplete or 
inaccurate disclosures or by omitting disclosures that are necessary 
for the financial statements to be presented fairly in conformity with 
the applicable financial reporting framework.
    68. Presumption of Fraud Risk Involving Improper Revenue 
Recognition. The auditor should presume that there is a fraud risk 
involving improper revenue recognition and evaluate which types of 
revenue, revenue transactions, or assertions may give rise to such 
risks.
    69. Consideration of the Risk of Management Override of Controls. 
The auditor's identification of fraud risks should include the risk of 
management override of controls.
    Note: Controls over management override are important to effective 
internal control over financial reporting for all companies, and may be 
particularly important at smaller companies because of the increased 
involvement of senior management in performing controls and in the 
period-end financial reporting process. For smaller companies, the 
controls that address the risk of management override might be 
different from those at a larger company. For example, a smaller 
company might rely on more detailed oversight by the audit committee 
that focuses on the risk of management override.
Factors Relevant To Identifying Significant Risks
    70. To determine whether an identified and assessed risk is a 
significant risk, the auditor should evaluate whether the risk requires 
special audit consideration because of the nature of the risk or the 
likelihood and potential magnitude of misstatement related to the risk.
    Note: The determination of whether a risk of material misstatement 
is a significant risk is based on inherent risk, without regard to the 
effect of controls.
    71. Factors that should be evaluated in determining which risks are 
significant risks include:
    a. The effect of the quantitative and qualitative risk factors 
discussed in paragraph 60 on the likelihood and potential magnitude of 
misstatements;
    b. Whether the risk is a fraud risk;
    Note: A fraud risk is a significant risk.
    c. Whether the risk is related to recent significant economic, 
accounting, or other developments;
    d. The complexity of transactions;
    e. Whether the risk involves significant transactions with related 
parties;
    f. The degree of complexity or judgment in the recognition or 
measurement of financial information related to the risk, especially 
those measurements involving a wide range of measurement uncertainty; 
and
    g. Whether the risk involves significant transactions that are 
outside the normal course of business for the company or that otherwise 
appear to be unusual due to their timing, size, or nature.
Further Consideration of Controls
    72. When the auditor has determined that a significant risk, 
including a fraud risk, exists, the auditor should evaluate the design 
of the company's controls that are intended to address fraud risks and 
other significant risks and determine whether those controls have been 
implemented, if the auditor has not already done so when obtaining an 
understanding of internal control, as described in paragraphs 18-40 of 
this standard.\82\
---------------------------------------------------------------------------

    \82\ Auditing Standard No. 13 discusses the auditor's response 
to fraud risks and other significant risks.
---------------------------------------------------------------------------

    73. Controls that address fraud risks include (a) specific controls 
designed to

[[Page 59345]]

mitigate specific risks of fraud, e.g., controls to address risks of 
intentional misstatement of specific accounts and (b) controls designed 
to prevent, deter, and detect fraud, e.g., controls to promote a 
culture of honesty and ethical behavior.\83\\\ Such controls also 
include those that address the risk of management override of other 
controls.
---------------------------------------------------------------------------

    \83\ \\ AU sec. 316.88 and paragraph 14 of Auditing Standard No. 
5 present examples of controls that address fraud risks.
---------------------------------------------------------------------------

Revision of Risk Assessment

    74. The auditor's assessment of the risks of material misstatement, 
including fraud risks, should continue throughout the audit. When the 
auditor obtains audit evidence during the course of the audit that 
contradicts the audit evidence on which the auditor originally based 
his or her risk assessment, the auditor should revise the risk 
assessment and modify planned audit procedures or perform additional 
procedures in response to the revised risk assessments.\84\
---------------------------------------------------------------------------

    \84\ See also paragraph 46 of Auditing Standard No. 13.
---------------------------------------------------------------------------

APPENDIX A--Definitions

A1. For purposes of this standard, the terms listed below are defined 
as follows:
A2. Business risks--Risks that result from significant conditions, 
events, circumstances, actions, or inactions that could adversely 
affect a company's ability to achieve its objectives and execute its 
strategies. Business risks also might result from setting inappropriate 
objectives and strategies or from changes or complexity in the 
company's operations or management.
A3. Company's objectives and strategies--The overall plans for the 
company as established by management or the board of directors. 
Strategies are the approaches by which management intends to achieve 
its objectives.
A4. Risk assessment procedures--The procedures performed by the auditor 
to obtain information for identifying and assessing the risks of 
material misstatement in the financial statements whether due to error 
or fraud.

    Note: Risk assessment procedures by themselves do not provide 
sufficient appropriate evidence on which to base an audit opinion.

A5. Significant risk--A risk of material misstatement that requires 
special audit consideration.

APPENDIX B--Consideration of Manual and Automated Systems and Controls

B1. While obtaining an understanding of the company's information 
system related to financial reporting, the auditor should obtain an 
understanding of how the company uses information technology (``IT'') 
and how IT affects the financial statements.\85\ The auditor also 
should obtain an understanding of the extent of manual controls and 
automated controls used by the company, including the IT general 
controls that are important to the effective operation of the automated 
controls. That information should be taken into account in assessing 
the risks of material misstatement.\86\
---------------------------------------------------------------------------

    \85\ See also AU sec. 324, Service Organizations, if the company 
uses a service organization for services that are part of the 
company's internal control over financial reporting.
    \86\ See also paragraphs 16-17 of Auditing Standard No. 9, Audit 
Planning.
---------------------------------------------------------------------------

B2. Controls in a manual system might include procedures such as 
approvals and reviews of transactions, and reconciliations and follow-
up of reconciling items.
B3. Alternatively, a company might use automated procedures to 
initiate, record, process, and report transactions, in which case 
records in electronic format would replace paper documents. When IT is 
used to initiate, record, process, and report transactions, the IT 
systems and programs may include controls related to the relevant 
assertions of significant accounts and disclosures or may be critical 
to the effective functioning of manual controls that depend on IT.
B4. The auditor should obtain an understanding of specific risks to a 
company's internal control over financial reporting resulting from IT. 
Examples of such risks include:

    <bullet> Reliance on systems or programs that are inaccurately 
processing data, processing inaccurate data, or both;
    <bullet> Unauthorized access to data that might result in 
destruction of data or improper changes to data, including the 
recording of unauthorized or non-existent transactions or inaccurate 
recording of transactions (particular risks might arise when multiple 
users access a common database);
    <bullet> The possibility of IT personnel gaining access privileges 
beyond those necessary to perform their assigned duties, thereby 
breaking down segregation of duties;
    <bullet> Unauthorized changes to data in master files;
    <bullet> Unauthorized changes to systems or programs;
    <bullet> Failure to make necessary changes to systems or programs;
    <bullet> Inappropriate manual intervention; and
    <bullet> Potential loss of data or inability to access data as 
required.
B5. In obtaining an understanding of the company's control activities, 
the auditor should obtain an understanding of how the company has 
responded to risks arising from IT.
B6. When a company uses manual elements in internal control systems and 
the auditor plans to rely on, and therefore test, those manual 
controls, the auditor should design procedures to test the consistency 
in the application of those manual controls.

Auditing Standard No. 13

The Auditor's Responses to the Risks of Material Misstatement

Introduction

    1. This standard establishes requirements regarding designing and 
implementing appropriate responses to the risks of material 
misstatement.

Objective

    2. The objective of the auditor is to address the risks of material 
misstatement through appropriate overall audit responses and audit 
procedures.

Responding to the Risks of Material Misstatement

    3. To meet the objective in the preceding paragraph, the auditor 
must design and implement audit responses that address the risks of 
material misstatement that are identified and assessed in accordance 
with Auditing Standard No. 12, Identifying and Assessing Risks of 
Material Misstatement.
    4. This standard discusses the following types of audit responses:
    a. Responses that have an overall effect on how the audit is 
conducted (``overall responses''), as described in paragraphs 5-7; and
    b. Responses involving the nature, timing, and extent of the audit 
procedures to be performed, as described in paragraphs 8-46.

Overall Responses

    5. The auditor should design and implement overall responses to 
address the assessed risks of material misstatement as follows:

[[Page 59346]]

    a. Making appropriate assignments of significant engagement 
responsibilities. The knowledge, skill, and ability of engagement team 
members with significant engagement responsibilities should be 
commensurate with the assessed risks of material misstatement.\87\
---------------------------------------------------------------------------

    \87\ See also paragraph .06 of AU sec. 230, Due Professional 
Care in the Performance of Work.
---------------------------------------------------------------------------

    b. Providing the extent of supervision that is appropriate for the 
circumstances, including, in particular, the assessed risks of material 
misstatement. (See paragraphs 5-6 of Auditing Standard No. 10, 
Supervision of the Audit Engagement.)
    c. Incorporating elements of unpredictability in the selection of 
audit procedures to be performed. As part of the auditor's response to 
the assessed risks of material misstatement, including the assessed 
risks of material misstatement due to fraud (``fraud risks''), the 
auditor should incorporate an element of unpredictability in the 
selection of auditing procedures to be performed from year to year. 
Examples of ways to incorporate an element of unpredictability include:
    (1) Performing audit procedures related to accounts, disclosures, 
and assertions that would not otherwise be tested based on their amount 
or the auditor's assessment of risk;
    (2) Varying the timing of the audit procedures;
    (3) Selecting items for testing that have lower amounts or are 
otherwise outside customary selection parameters;
    (4) Performing audit procedures on an unannounced basis; and
    (5) In multi-location audits, varying the location or the nature, 
timing, and extent of audit procedures at related locations or business 
units from year to year.\88\
---------------------------------------------------------------------------

    \88\ For integrated audits, paragraphs 61 and B13 of Auditing 
Standard No. 5, An audit of Internal Control Over Financial 
Reporting That Is Integrated with An Audit of Financial Statements, 
establish requirements for introducing unpredictability in testing 
of controls from year to year and in multi-location audits.
---------------------------------------------------------------------------

    d. Evaluating the company's selection and application of 
significant accounting principles. The auditor should evaluate whether 
the company's selection and application of significant accounting 
principles, particularly those related to subjective measurements and 
complex transactions,\89\ are indicative of bias that could lead to 
material misstatement of the financial statements.
---------------------------------------------------------------------------

    \89\ Paragraphs 12-13 of Auditing Standard No. 12 discuss the 
auditor's responsibilities regarding obtaining an understanding of 
the company's selection and application of accounting principles. 
See also paragraphs .66-.67 of AU sec. 316, Consideration of Fraud 
in a Financial Statement Audit, and paragraphs .04 and .06 of AU 
sec. 411, The Meaning of Present Fairly in Conformity With Generally 
Accepted Accounting Principles.
---------------------------------------------------------------------------

    Note: Paragraph .11 of AU sec. 380, Communication With Audit 
Committees, discusses the auditor's judgments about the quality of a 
company's accounting principles.
    6. The auditor also should determine whether it is necessary to 
make pervasive changes to the nature, timing, or extent of audit 
procedures to adequately address the assessed risks of material 
misstatement. Examples of such pervasive changes include modifying the 
audit strategy to:
    a. Increase the substantive testing of the valuation of numerous 
significant accounts at year end because of significantly deteriorating 
market conditions, and
    b. Obtain more persuasive audit evidence from substantive 
procedures due to the identification of pervasive weaknesses in the 
company's control environment.
    7. Due professional care requires the auditor to exercise 
professional skepticism.\90\ Professional skepticism is an attitude 
that includes a questioning mind and a critical assessment of the 
appropriateness and sufficiency of audit evidence. The auditor's 
responses to the assessed risks of material misstatement, particularly 
fraud risks, should involve the application of professional skepticism 
in gathering and evaluating audit evidence.\91\ Examples of the 
application of professional skepticism in response to the assessed 
fraud risks are (a) modifying the planned audit procedures to obtain 
more reliable evidence regarding relevant assertions and (b) obtaining 
sufficient appropriate evidence to corroborate management's 
explanations or representations concerning important matters, such as 
through third-party confirmation, use of a specialist engaged or 
employed by the auditor, or examination of documentation from 
independent sources.
---------------------------------------------------------------------------

    \90\ AU secs. 230.07-.09.
    \91\ AU sec. 316.13.
---------------------------------------------------------------------------

Responses Involving the Nature, Timing, and Extent of Audit Procedures

    8. The auditor should design and perform audit procedures in a 
manner that addresses the assessed risks of material misstatement for 
each relevant assertion of each significant account and disclosure.
    9. In designing the audit procedures to be performed, the auditor 
should:
    a. Obtain more persuasive audit evidence the higher the auditor's 
assessment of risk;
    b. Take into account the types of potential misstatements that 
could result from the identified risks and the likelihood and magnitude 
of potential misstatement; \92\
---------------------------------------------------------------------------

    \92\ For example, potential misstatements regarding disclosures 
include omission of required disclosures or presentation of 
inaccurate or incomplete disclosures.
---------------------------------------------------------------------------

    c. In an integrated audit, design the testing of controls to 
accomplish the objectives of both audits simultaneously:
    (1) To obtain sufficient evidence to support the auditor's control 
risk \93\ assessments for purposes of the audit of financial 
statements; \94\ and
---------------------------------------------------------------------------

    \93\ See paragraph 7.b. of Auditing Standard No. 8, Audit Risk, 
for a definition of control risk.
    \94\ For purposes of this standard, the term ``audit of 
financial statements'' refers to the financial statement portion of 
the integrated audit and to the audit of financial statements only.
---------------------------------------------------------------------------

    (2) To obtain sufficient evidence to support the auditor's opinion 
on internal control over financial reporting as of year-end.
    Note: Auditing Standard No. 5 establishes requirements for tests of 
controls in the audit of internal control over financial reporting.
    10. The audit procedures performed in response to the assessed 
risks of material misstatement can be classified into two categories: 
(1) tests of controls and (2) substantive procedures.\95\ Paragraphs 
16-35 of this standard discuss tests of controls, and paragraphs 36-46 
discuss substantive procedures.
---------------------------------------------------------------------------

    \95\ Substantive procedures consist of (a) tests of details of 
accounts and disclosures and (b) substantive analytical procedures.
---------------------------------------------------------------------------

    Note: Paragraphs 16-17 of this standard discuss when tests of 
controls are necessary in a financial statement audit. Ordinarily, 
tests of controls are performed for relevant assertions for which the 
auditor chooses to rely on controls to modify his or her substantive 
procedures.
Responses to Significant Risks
    11. For significant risks, the auditor should perform substantive 
procedures, including tests of details, that are specifically 
responsive to the assessed risks.
    Note: Auditing Standard No. 12 discusses identification of 
significant risks \96\ and states that fraud risks are significant 
risks.
---------------------------------------------------------------------------

    \96\ See paragraph 71 of Auditing Standard No. 12 for factors 
that the auditor should evaluate in determining which risks are 
significant risks.
---------------------------------------------------------------------------

Responses to Fraud Risks
    12. The audit procedures that are necessary to address the assessed 
fraud risks depend upon the types of risks and the relevant assertions 
that might be affected.

[[Page 59347]]

    Note: If the auditor identifies deficiencies in controls that are 
intended to address assessed fraud risks, the auditor should take into 
account those deficiencies when designing his or her response to those 
fraud risks.
    Note: Auditing Standard No. 5 establishes requirements for 
addressing assessed fraud risks in the audit of internal control over 
financial reporting.\97\
---------------------------------------------------------------------------

    \97\ Paragraphs 14-15 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    13. Addressing Fraud Risks in the Audit of Financial Statements. In 
the audit of financial statements, the auditor should perform 
substantive procedures, including tests of details, that are 
specifically responsive to the assessed fraud risks. If the auditor 
selects certain controls intended to address the assessed fraud risks 
for testing in accordance with paragraphs 16-17 of this standard, the 
auditor should perform tests of those controls.
    14. The following are examples of ways in which planned audit 
procedures may be modified to address assessed fraud risks:
    a. Changing the nature of audit procedures to obtain evidence that 
is more reliable or to obtain additional corroborative information;
    b. Changing the timing of audit procedures to be closer to the end 
of the period or to the points during the period in which fraudulent 
transactions are more likely to occur; and
    c. Changing the extent of the procedures applied to obtain more 
evidence, e.g., by increasing sample sizes or applying computer-
assisted audit techniques to all of the items in an account.
    Note: AU secs. 316.54-.67 provide additional examples of responses 
to assessed fraud risks relating to fraudulent financial reporting 
(e.g., revenue recognition, inventory quantities, and management 
estimates) and misappropriation of assets in the audit of financial 
statements.
    15. Also, AU sec. 316 indicates that the auditor should perform 
audit procedures to specifically address the risk of management 
override of controls including:
    a. Examining journal entries and other adjustments for evidence of 
possible material misstatement due to fraud (AU secs. 316.58-.62);
    b. Reviewing accounting estimates for biases that could result in 
material misstatement due to fraud (AU secs. 316.63-.65); and
    c. Evaluating the business rationale for significant unusual 
transactions (AU secs. 316.66-.67).

Testing Controls

Testing Controls in an Audit of Financial Statements
    16. Controls to be Tested. If the auditor plans to assess control 
risk at less than the maximum by relying on controls,\98\ and the 
nature, timing, and extent of planned substantive procedures are based 
on that lower assessment, the auditor must obtain evidence that the 
controls selected for testing are designed effectively and operated 
effectively during the entire period of reliance.\99\ However, the 
auditor is not required to assess control risk at less than the maximum 
for all relevant assertions and, for a variety of reasons, the auditor 
may choose not to do so.
---------------------------------------------------------------------------

    \98\ Reliance on controls that is supported by sufficient and 
appropriate audit evidence allows the auditor to assess control risk 
at less than the maximum, which results in a lower assessed risk of 
material misstatement. In turn, this allows the auditor to modify 
the nature, timing, and extent of planned substantive procedures.
    \99\ Terms defined in Appendix A, Definitions, are set in 
boldface type the first time they appear.
---------------------------------------------------------------------------

    17. Also, tests of controls must be performed in the audit of 
financial statements for each relevant assertion for which substantive 
procedures alone cannot provide sufficient appropriate audit evidence 
and when necessary to support the auditor's reliance on the accuracy 
and completeness of financial information used in performing other 
audit procedures.\100\
---------------------------------------------------------------------------

    \100\ Paragraph 10 of Auditing Standard No. 15, Audit Evidence, 
and paragraph .16 of AU sec. 329, Substantive Analytical Procedures.
---------------------------------------------------------------------------

    Note: When a significant amount of information supporting one or 
more relevant assertions is electronically initiated, recorded, 
processed, or reported, it might be impossible to design effective 
substantive tests that, by themselves, would provide sufficient 
appropriate evidence regarding the assertions. For such assertions, 
significant audit evidence may be available only in electronic form. In 
such cases, the sufficiency and appropriateness of the audit evidence 
usually depend on the effectiveness of controls over their accuracy and 
completeness. Furthermore, the potential for improper initiation or 
alteration of information to occur and not be detected may be greater 
if information is initiated, recorded, processed, or reported only in 
electronic form and appropriate controls are not operating effectively.
    18. Evidence about the Effectiveness of Controls in the Audit of 
Financial Statements. In designing and performing tests of controls for 
the audit of financial statements, the evidence necessary to support 
the auditor's control risk assessment depends on the degree of reliance 
the auditor plans to place on the effectiveness of a control. The 
auditor should obtain more persuasive audit evidence from tests of 
controls the greater the reliance the auditor places on the 
effectiveness of a control. The auditor also should obtain more 
persuasive evidence about the effectiveness of controls for each 
relevant assertion for which the audit approach consists primarily of 
tests of controls, including situations in which substantive procedures 
alone cannot provide sufficient appropriate audit evidence.
Testing Design Effectiveness
    19. The auditor should test the design effectiveness of the 
controls selected for testing by determining whether the company's 
controls, if they are operated as prescribed by persons possessing the 
necessary authority and competence to perform the control effectively, 
satisfy the company's control objectives and can effectively prevent or 
detect error or fraud that could result in material misstatements in 
the financial statements.
    Note: A smaller, less complex company might achieve its control 
objectives in a different manner from a larger, more complex 
organization. For example, a smaller, less complex company might have 
fewer employees in the accounting function, limiting opportunities to 
segregate duties and leading the company to implement alternative 
controls to achieve its control objectives. In such circumstances, the 
auditor should evaluate whether those alternative controls are 
effective.
    20. Procedures the auditor performs to test design effectiveness 
include a mix of inquiry of appropriate personnel, observation of the 
company's operations, and inspection of relevant documentation. 
Walkthroughs that include these procedures ordinarily are sufficient to 
evaluate design effectiveness.\101\
---------------------------------------------------------------------------

    \101\ Paragraphs 37-38 of Auditing Standard No. 12 discuss 
performing a walkthrough.
---------------------------------------------------------------------------

Testing Operating Effectiveness
    21. The auditor should test the operating effectiveness of a 
control selected for testing by determining whether the control is 
operating as designed and whether the person performing the control 
possesses the necessary authority and competence to perform the control 
effectively.
    22. Procedures the auditor performs to test operating effectiveness 
include a

[[Page 59348]]

mix of inquiry of appropriate personnel, observation of the company's 
operations, inspection of relevant documentation, and re-performance of 
the control.
Obtaining Evidence From Tests of Controls
    23. The evidence provided by the auditor's tests of the 
effectiveness of controls depends upon the mix of the nature, timing, 
and extent of the auditor's procedures. Further, for an individual 
control, different combinations of the nature, timing, and extent of 
testing might provide sufficient evidence in relation to the degree of 
reliance in an audit of financial statements.
    Note: To obtain evidence about whether a control is effective, the 
control must be tested directly; the effectiveness of a control cannot 
be inferred from the absence of misstatements detected by substantive 
procedures.
Nature of Tests of Controls
    24. Some types of tests, by their nature, produce greater evidence 
of the effectiveness of controls than other tests. The following tests 
that the auditor might perform are presented in the order of the 
evidence that they ordinarily would produce, from least to most: 
inquiry, observation, inspection of relevant documentation, and re-
performance of a control.
    Note: Inquiry alone does not provide sufficient evidence to support 
a conclusion about the effectiveness of a control.
    25. The nature of the tests of controls that will provide 
appropriate evidence depends, to a large degree, on the nature of the 
control to be tested, including whether the operation of the control 
results in documentary evidence of its operation. Documentary evidence 
of the operation of some controls, such as management's philosophy and 
operating style, might not exist.
    Note: A smaller, less complex company or unit might have less 
formal documentation regarding the operation of its controls. In those 
situations, testing controls through inquiry combined with other 
procedures, such as observation of activities, inspection of less 
formal documentation, or re-performance of certain controls, might 
provide sufficient evidence about whether the control is effective.
Extent of Tests of Controls
    26. The more extensively a control is tested, the greater the 
evidence obtained from that test.
    27. Matters that could affect the necessary extent of testing of a 
control in relation to the degree of reliance on a control include the 
following:
    <bullet> The frequency of the performance of the control by the 
company during the audit period;
    <bullet> The length of time during the audit period that the 
auditor is relying on the operating effectiveness of the control;
    <bullet> The expected rate of deviation from a control;
    <bullet> The relevance and reliability of the audit evidence to be 
obtained regarding the operating effectiveness of the control;
    <bullet> The extent to which audit evidence is obtained from tests 
of other controls related to the assertion;
    <bullet> The nature of the control, including, in particular, 
whether it is a manual control or an automated control; and
    <bullet> For an automated control, the effectiveness of relevant 
information technology general controls.
    Note: AU sec. 350, Audit Sampling, establishes requirements 
regarding the use of sampling in tests of controls.
Timing of Tests of Controls
    28. The timing of tests of controls relates to when the evidence 
about the operating effectiveness of the controls is obtained and the 
period of time to which it applies. Paragraph 16 of this standard 
indicates that the auditor must obtain evidence that the controls 
selected for testing are designed effectively and operated effectively 
during the entire period of reliance.
    29. Using Audit Evidence Obtained during an Interim Period. When 
the auditor obtains evidence about the operating effectiveness of 
controls as of or through an interim date, he or she should determine 
what additional evidence is necessary concerning the operation of the 
controls for the remaining period of reliance.
    30. The additional evidence that is necessary to update the results 
of testing from an interim date through the remaining period of 
reliance depends on the following factors:
    <bullet> The possibility that there have been any significant 
changes in internal control over financial reporting subsequent to the 
interim date;
    Note: If there have been significant changes to the control since 
the interim date, the auditor should obtain evidence about the 
effectiveness of the new or modified control;
    <bullet> The inherent risk associated with the related account(s) 
or assertion(s);
    <bullet> The specific control tested prior to year end, including 
the nature of the control and the risk that the control is no longer 
effective during the remaining period, and the results of the tests of 
the control;
    <bullet> The planned degree of reliance on the control;
    <bullet> The sufficiency of the evidence of effectiveness obtained 
at an interim date; and
    <bullet> The length of the remaining period.
    31. Using Audit Evidence Obtained in Past Audits. For audits of 
financial statements, the auditor should obtain evidence during the 
current year audit about the design and operating effectiveness of 
controls upon which the auditor relies. When controls on which the 
auditor plans to rely have been tested in past audits and the auditor 
plans to use evidence about the effectiveness of those controls that 
was obtained in prior years, the auditor should take into account the 
following factors to determine the evidence needed during the current 
year audit to support the auditor's control risk assessments:
    <bullet> The nature and materiality of misstatements that the 
control is intended to prevent or detect;
    <bullet> The inherent risk associated with the related account(s) 
or assertion(s);
    <bullet> Whether there have been changes in the volume or nature of 
transactions that might adversely affect control design or operating 
effectiveness;
    <bullet> Whether the account has a history of errors;
    <bullet> The effectiveness of entity-level controls that the 
auditor has tested, especially controls that monitor other controls;
    <bullet> The nature of the controls and the frequency with which 
they operate;
    <bullet> The degree to which the control relies on the 
effectiveness of other controls (e.g., the control environment or 
information technology general controls);
    <bullet> The competence of the personnel who perform the control or 
monitor its performance and whether there have been changes in key 
personnel who perform the control or monitor its performance;
    <bullet> Whether the control relies on performance by an individual 
or is automated (i.e., an automated control would generally be expected 
to be lower risk if relevant information technology general controls 
are effective); \102\
---------------------------------------------------------------------------

    \102\ The auditor also may use a benchmarking strategy, when 
appropriate, for automated application controls in subsequent years' 
audits. Benchmarking is described further beginning at paragraph B28 
of Auditing Standard No. 5.
---------------------------------------------------------------------------

    <bullet> The complexity of the control and the significance of the 
judgments that must be made in connection with its operation;

[[Page 59349]]

    <bullet> The planned degree of reliance on the control;
    <bullet> The nature, timing, and extent of procedures performed in 
past audits;
    <bullet> The results of the previous years' testing of the control;
    <bullet> Whether there have been changes in the control or the 
process in which it operates since the previous audit; and
    <bullet> For integrated audits, the evidence regarding the 
effectiveness of the controls obtained during the audit of internal 
control.
Assessing Control Risk
    32. The auditor should assess control risk for relevant assertions 
by evaluating the evidence obtained from all sources, including the 
auditor's testing of controls for the audit of internal control and the 
audit of financial statements, misstatements detected during the 
financial statement audit, and any identified control deficiencies.
    33. Control risk should be assessed at the maximum level for 
relevant assertions (1) for which controls necessary to sufficiently 
address the assessed risk of material misstatement in those assertions 
are missing or ineffective or (2) when the auditor has not obtained 
sufficient appropriate evidence to support a control risk assessment 
below the maximum level.
    34. When deficiencies affecting the controls on which the auditor 
intends to rely are detected, the auditor should evaluate the severity 
of the deficiencies and the effect on the auditor's control risk 
assessments. If the auditor plans to rely on controls relating to an 
assertion but the controls that the auditor tests are ineffective 
because of control deficiencies, the auditor should:
    a. Perform tests of other controls related to the same assertion as 
the ineffective controls, or
    b. Revise the control risk assessment and modify the planned 
substantive procedures as necessary in light of the increased 
assessment of risk.
    Note: Auditing Standard No. 5 establishes requirements for 
evaluating the severity of a control deficiency and communicating 
identified control deficiencies to management and the audit committee 
in an integrated audit. AU sec. 325, Communications About Control 
Deficiencies in an Audit of Financial Statements, establishes 
requirements for communicating significant deficiencies and material 
weaknesses in an audit of financial statements only.
Testing Controls in an Audit of Internal Control
    35. Auditing Standard No. 5 states that the objective of the tests 
of controls in an audit of internal control is to obtain evidence about 
the effectiveness of controls to support the auditor's opinion on the 
company's internal control over financial reporting. The auditor's 
opinion relates to the effectiveness of the company's internal control 
over financial reporting as of a point in time and taken as a 
whole.\103\ Auditing Standard No. 5 establishes requirements regarding 
the selection of controls to be tested and the necessary nature, 
timing, and extent of tests of controls in an audit of internal control 
over financial reporting.
---------------------------------------------------------------------------

    \103\ Paragraph B1 of Auditing Standard No. 5.
---------------------------------------------------------------------------

Substantive Procedures

    36. The auditor should perform substantive procedures for each 
relevant assertion of each significant account and disclosure, 
regardless of the assessed level of control risk.
    37. As the assessed risk of material misstatement increases, the 
evidence from substantive procedures that the auditor should obtain 
also increases. The evidence provided by the auditor's substantive 
procedures depends upon the mix of the nature, timing, and extent of 
those procedures. Further, for an individual assertion, different 
combinations of the nature, timing, and extent of testing might provide 
sufficient appropriate evidence to respond to the assessed risk of 
material misstatement.
    38. Internal control over financial reporting has inherent 
limitations,\104\ which, in turn, can affect the evidence that is 
needed from substantive procedures. For example, more evidence from 
substantive procedures ordinarily is needed for relevant assertions 
that have a higher susceptibility to management override or to lapses 
in judgment or breakdowns resulting from human failures.\105\
---------------------------------------------------------------------------

    \104\ Paragraph A5 of Auditing Standard No. 5.
    \105\ See, e.g., paragraph .14 of AU sec. 328, Auditing Fair 
Value Measurements and Disclosures.
---------------------------------------------------------------------------

Nature of Substantive Procedures
    39. Substantive procedures generally provide persuasive evidence 
when they are designed and performed to obtain evidence that is 
relevant and reliable. Also, some types of substantive procedures, by 
their nature, produce more persuasive evidence than others. Inquiry 
alone does not provide sufficient appropriate evidence to support a 
conclusion about a relevant assertion.
    Note: Auditing Standard No. 15 discusses certain types of 
substantive procedures and the relevance and reliability of audit 
evidence.
    40. Taking into account the types of potential misstatements in the 
relevant assertions that could result from identified risks, as 
required by paragraph 9.b., can help the auditor determine the types 
and combination of substantive audit procedures that are necessary to 
detect material misstatements in the respective assertions.
    41. Substantive Procedures Related to the Period-end Financial 
Reporting Process. The auditor's substantive procedures must include 
the following audit procedures related to the period-end financial 
reporting process:
    a. Reconciling the financial statements with the underlying 
accounting records; and
    b. Examining material adjustments made during the course of 
preparing the financial statements.
    Note: AU secs. 316.58-.62 establish requirements for examining 
journal entries and other adjustments for evidence of possible material 
misstatement due to fraud.
Extent of Substantive Procedures
    42. The more extensively a substantive procedure is performed, the 
greater the evidence obtained from the procedure. The necessary extent 
of a substantive audit procedure depends on the materiality of the 
account or disclosure, the assessed risk of material misstatement, and 
the necessary degree of assurance from the procedure. However, 
increasing the extent of an audit procedure cannot adequately address 
an assessed risk of material misstatement unless the evidence to be 
obtained from the procedure is reliable and relevant.
Timing of Substantive Procedures
    43. Performing certain substantive procedures at interim dates may 
permit early consideration of matters affecting the year-end financial 
statements, e.g., testing material transactions involving higher risks 
of misstatement. However, performing substantive procedures at an 
interim date without performing procedures at a later date increases 
the risk that a material misstatement could exist in the year-end 
financial statements that would not be detected by the auditor. This 
risk increases as the period between the interim date and year end 
increases.
    44. In determining whether it is appropriate to perform substantive 
procedures at an interim date, the auditor should take into account the 
following:
    a. The assessed risk of material misstatement, including:

[[Page 59350]]

    (1) The auditor's assessment of control risk, as discussed in 
paragraphs 32-34;
    (2) The existence of conditions or circumstances, if any, that 
create incentives or pressures on management to misstate the financial 
statements between the interim test date and the end of the period 
covered by the financial statements;
    (3) The effects of known or expected changes in the company, its 
environment, or its internal control over financial reporting during 
the remaining period;
    b. The nature of the substantive procedures;
    c. The nature of the account or disclosure and relevant assertion; 
and
    d. The ability of the auditor to perform the necessary audit 
procedures to cover the remaining period.
    45. When substantive procedures are performed at an interim date, 
the auditor should cover the remaining period by performing substantive 
procedures, or substantive procedures combined with tests of controls, 
that provide a reasonable basis for extending the audit conclusions 
from the interim date to the period end. Such procedures should include 
(a) comparing relevant information about the account balance at the 
interim date with comparable information at the end of the period to 
identify amounts that appear unusual and investigating such amounts and 
(b) performing audit procedures to test the remaining period.
    46. If the auditor obtains evidence that contradicts the evidence 
on which the original risk assessments were based, including evidence 
of misstatements that he or she did not expect, the auditor should 
revise the related risk assessments and modify the planned nature, 
timing, or extent of substantive procedures covering the remaining 
period as necessary. Examples of such modifications include extending 
or repeating at the period end the procedures performed at the interim 
date.
Dual-Purpose Tests
    47. In some situations, the auditor might perform a substantive 
test of a transaction concurrently with a test of a control relevant to 
that transaction (a ``dual-purpose test''). In those situations, the 
auditor should design the dual-purpose test to achieve the objectives 
of both the test of the control and the substantive test. Also, when 
performing a dual-purpose test, the auditor should evaluate the results 
of the test in forming conclusions about both the assertion and the 
effectiveness of the control being tested.\106\
---------------------------------------------------------------------------

    \106\ Paragraph .44 of AU sec. 350 discusses applying audit 
sampling in dual-purpose tests.
---------------------------------------------------------------------------

APPENDIX A--Definitions

A1. For purposes of this standard, the terms listed below are defined 
as follows:
A2. Dual-purpose test--Substantive test of a transaction and a test of 
a control relevant to that transaction that are performed concurrently, 
e.g., a substantive test of sales transactions performed concurrently 
with a test of controls over those transactions.
A3. Period of reliance--The period being covered by the company's 
financial statements, or the portion of that period, for which the 
auditor plans to rely on controls in order to modify the nature, 
timing, and extent of planned substantive procedures.

Auditing Standard No. 14

Evaluating Audit Results

Introduction

    1. This standard establishes requirements regarding the auditor's 
evaluation of audit results and determination of whether he or she has 
obtained sufficient appropriate audit evidence.

Objective

    2. The objective of the auditor is to evaluate the results of the 
audit to determine whether the audit evidence obtained is sufficient 
and appropriate to support the opinion to be expressed in the auditor's 
report.

Evaluating the Results of the Audit of Financial Statements

    3. In forming an opinion on whether the financial statements are 
presented fairly, in all material respects, in conformity with the 
applicable financial reporting framework, the auditor should take into 
account all relevant audit evidence, regardless of whether it appears 
to corroborate or to contradict the assertions in the financial 
statements.
    4. In the audit of financial statements,\107\ the auditor's 
evaluation of audit results should include evaluation of the following:
---------------------------------------------------------------------------

    \107\ For purposes of this standard, the term ``audit of 
financial statements'' refers to the financial statement portion of 
the integrated audit and to the audit of financial statements only.
---------------------------------------------------------------------------

    a. The results of analytical procedures performed in the overall 
review of the financial statements (``overall review'');
    b. Misstatements accumulated during the audit, including, in 
particular, uncorrected misstatements; \108\
---------------------------------------------------------------------------

    \108\ Terms defined in Appendix A, Definitions, are set in 
boldface type the first time they appear.
---------------------------------------------------------------------------

    c. The qualitative aspects of the company's accounting practices;
    d. Conditions identified during the audit that relate to the 
assessment of the risk of material misstatement due to fraud (``fraud 
risk'');
    e. The presentation of the financial statements, including the 
disclosures; and
    f. The sufficiency and appropriateness of the audit evidence 
obtained.
Performing Analytical Procedures in the Overall Review
    5. In the overall review, the auditor should read the financial 
statements and disclosures and perform analytical procedures to (a) 
evaluate the auditor's conclusions formed regarding significant 
accounts and disclosures and (b) assist in forming an opinion on 
whether the financial statements as a whole are free of material 
misstatement.
    6. As part of the overall review, the auditor should evaluate 
whether:
    a. The evidence gathered in response to unusual or unexpected 
transactions, events, amounts, or relationships previously identified 
during the audit is sufficient; and
    b. Unusual or unexpected transactions, events, amounts, or 
relationships \109\ indicate risks of material misstatement that were 
not identified previously, including, in particular, fraud risks.
---------------------------------------------------------------------------

    \109\ Paragraphs 46-48 of Auditing Standard No. 12, Identifying 
and Assessing Risks of Material Misstatement and paragraph .03 of AU 
sec. 329, Substantive Analytical Procedures.
---------------------------------------------------------------------------

    Note: If the auditor discovers a previously unidentified risk of 
material misstatement or concludes that the evidence gathered is not 
adequate, he or she should modify his or her audit procedures or 
perform additional procedures as necessary in accordance with paragraph 
36 of this standard.
    7. The nature and extent of the analytical procedures performed 
during the overall review may be similar to the analytical procedures 
performed as risk assessment procedures. The auditor should perform 
analytical procedures relating to revenue through the end of the 
reporting period.\110\
---------------------------------------------------------------------------

    \110\ Paragraph 47 of Auditing Standard No. 12 contains a 
requirement to perform analytical procedures relating to revenue as 
part of the risk assessment procedures.
---------------------------------------------------------------------------

    8. The auditor should obtain corroboration for management's 
explanations regarding significant unusual or unexpected transactions,

[[Page 59351]]

events, amounts, or relationships. If management's responses to the 
auditor's inquiries appear to be implausible, inconsistent with other 
audit evidence, imprecise, or not at a sufficient level of detail to be 
useful, the auditor should perform procedures to address the matter.
    9. Evaluating Whether Analytical Procedures Indicate a Previously 
Unrecognized Fraud Risk. Whether an unusual or unexpected transaction, 
event, amount, or relationship indicates a fraud risk, as discussed in 
paragraph 6.b., depends on the relevant facts and circumstances, 
including the nature of the account or relationship among the data used 
in the analytical procedures. For example, certain unusual or 
unexpected transactions, events, amounts, or relationships could 
indicate a fraud risk if a component of the relationship involves 
accounts and disclosures that management has incentives or pressures to 
manipulate, e.g., significant unusual or unexpected relationships 
involving revenue and income.
Accumulating and Evaluating Identified Misstatements
    10. Accumulating Identified Misstatements. The auditor should 
accumulate misstatements identified during the audit, other than those 
that are clearly trivial.
    Note: ``Clearly trivial'' is not another expression for ``not 
material.'' Matters that are clearly trivial will be of a smaller order 
of magnitude than the materiality level established in accordance with 
Auditing Standard No. 11, Consideration of Materiality in Planning and 
Performing an Audit, and will be inconsequential, whether taken 
individually or in aggregate and whether judged by any criteria of 
size, nature, or circumstances. When there is any uncertainty about 
whether one or more items is clearly trivial, the matter is not 
considered trivial.
    11. The auditor may designate an amount below which misstatements 
are clearly trivial and do not need to be accumulated. In such cases, 
the amount should be set so that any misstatements below that amount 
would not be material to the financial statements, individually or in 
combination with other misstatements, considering the possibility of 
undetected misstatement.
    12. The auditor's accumulation of misstatements should include the 
auditor's best estimate of the total misstatement in the accounts and 
disclosures that he or she has tested, not just the amount of 
misstatements specifically identified. This includes misstatements 
related to accounting estimates, as determined in accordance with 
paragraph 13 of this standard, and projected misstatements from 
substantive procedures that involve audit sampling, as determined in 
accordance with AU sec. 350, Audit Sampling.\111\
---------------------------------------------------------------------------

    \111\ AU sec. 350.26.
---------------------------------------------------------------------------

    13. Misstatements Relating to Accounting Estimates. If the auditor 
concludes that the amount of an accounting estimate included in the 
financial statements is unreasonable or was not determined in 
conformity with the relevant requirements of the applicable financial 
reporting framework, he or she should treat the difference between that 
estimate and a reasonable estimate determined in conformity with the 
applicable accounting principles as a misstatement. If a range of 
reasonable estimates is supported by sufficient appropriate audit 
evidence and the recorded estimate is outside of the range of 
reasonable estimates, the auditor should treat the difference between 
the recorded accounting estimate and the closest reasonable estimate as 
a misstatement.
    Note: If an accounting estimate is determined in conformity with 
the relevant requirements of the applicable financial reporting 
framework and the amount of the estimate is reasonable, a difference 
between an estimated amount best supported by the audit evidence and 
the recorded amount of the accounting estimate ordinarily would not be 
considered to be a misstatement. Paragraph 27 discusses evaluating 
accounting estimates for bias.
    14. Considerations as the Audit Progresses. The auditor should 
determine whether the overall audit strategy and audit plan need to be 
modified if:
    a. The nature of accumulated misstatements and the circumstances of 
their occurrence indicate that other misstatements might exist that, in 
combination with accumulated misstatements, could be material; or
    b. The aggregate of misstatements accumulated during the audit 
approaches the materiality level or levels used in planning and 
performing the audit.\112\
---------------------------------------------------------------------------

    \112\ Auditing Standard No. 11.
---------------------------------------------------------------------------

    Note: When the aggregate of accumulated misstatements approaches 
the materiality level or levels used in planning and performing the 
audit, there likely will be greater than an appropriately low level of 
risk that possible undetected misstatements, when combined with the 
aggregate of misstatements accumulated during the audit that remain 
uncorrected, could be material to the financial statements. If the 
auditor's assessment of this risk is unacceptably high, he or she 
should perform additional audit procedures or determine that management 
has adjusted the financial statements so that the risk that the 
financial statements are materially misstated has been reduced to an 
appropriately low level.
    15. The auditor should communicate accumulated misstatements to 
management on a timely basis to provide management with an opportunity 
to correct them.
    16. If management has examined an account or a disclosure in 
response to misstatements detected by the auditor and has made 
corrections to the account or disclosure, the auditor should evaluate 
management's work to determine whether the corrections have been 
recorded properly and whether uncorrected misstatements remain.
    17. Evaluation of the Effect of Uncorrected Misstatements. The 
auditor should evaluate whether uncorrected misstatements are material, 
individually or in combination with other misstatements. In making this 
evaluation, the auditor should evaluate the misstatements in relation 
to the specific accounts and disclosures involved and to the financial 
statements as a whole, taking into account relevant quantitative and 
qualitative factors.\113\ (See Appendix B.)
---------------------------------------------------------------------------

    \113\ If the financial statements contain material 
misstatements, AU sec. 508, Reports on Audited Financial Statements, 
indicates that the auditor should issue a qualified or an adverse 
opinion on the financial statements. AU sec. 508.35 discusses 
situations in which the financial statements are materially affected 
by a departure from the applicable financial reporting framework.
---------------------------------------------------------------------------

    Note: In interpreting the federal securities laws, the Supreme 
Court of the United States has held that a fact is material if there is 
``a substantial likelihood that the * * * fact would have been viewed 
by the reasonable investor as having significantly altered the `total 
mix' of information made available.'' \114\ As the Supreme Court has 
noted, determinations of materiality require ``delicate assessments of 
the inferences a `reasonable shareholder' would draw from a given set 
of facts and the significance of those inferences to him * * *.'' \115\
---------------------------------------------------------------------------

    \114\ TSC Industries v. Northway, Inc., 426 U.S. 438, 449 
(1976). See also Basic, Inc. v. Levinson, 485 U.S. 224 (1988).
    \115\ TSC Industries, 426 U.S. at 450.
---------------------------------------------------------------------------

    Note: As a result of the interaction of quantitative and 
qualitative considerations in materiality judgments, uncorrected 
misstatements of relatively small amounts could have a material effect 
on the financial statements. For

[[Page 59352]]

example, an illegal payment of an otherwise immaterial amount could be 
material if there is a reasonable possibility \116\ that it could lead 
to a material contingent liability or a material loss of revenue.\117\ 
Also, a misstatement made intentionally could be material for 
qualitative reasons, even if relatively small in amount.
---------------------------------------------------------------------------

    \116\ There is a reasonable possibility of an event, as used in 
this standard, when the likelihood of the event is either 
``reasonably possible'' or ``probable,'' as those terms are used in 
the FASB Accounting Standards Codification, Contingencies Topic, 
paragraph 450-20-25-1.
    \117\ AU sec. 317, Illegal Acts by Clients.
---------------------------------------------------------------------------

    Note: If the reevaluation of the established materiality level or 
levels, as set forth in Auditing Standard No. 11,\118\ results in a 
lower amount for the materiality level or levels, the auditor should 
take into account that lower materiality level or levels in the 
evaluation of uncorrected misstatements.
---------------------------------------------------------------------------

    \118\ Paragraphs 11-12 of Auditing Standard No. 11.
---------------------------------------------------------------------------

    18. The auditor's evaluation of uncorrected misstatements, as 
described in paragraph 17 of this standard, should include evaluation 
of the effects of uncorrected misstatements detected in prior years and 
misstatements detected in the current year that relate to prior years.
    19. The auditor cannot assume that an instance of error or fraud is 
an isolated occurrence. Therefore, the auditor should evaluate the 
nature and effects of the individual misstatements accumulated during 
the audit on the assessed risks of material misstatement. This 
evaluation is important in determining whether the risk assessments 
remain appropriate, as discussed in paragraph 36 of this standard.
    20. Evaluating Whether Misstatements Might Be Indicative of Fraud. 
The auditor should evaluate whether identified misstatements \119\ 
might be indicative of fraud and, in turn, how they affect the 
auditor's evaluation of materiality and the related audit responses. As 
indicated in AU sec. 316, Consideration of Fraud in a Financial 
Statement Audit, fraud is an intentional act that results in material 
misstatement of the financial statements.\120\
---------------------------------------------------------------------------

    \119\ Misstatements include omission and presentation of 
inaccurate or incomplete disclosures.
    \120\ AU sec. 316.05.
---------------------------------------------------------------------------

    21. If the auditor believes that a misstatement is or might be 
intentional, and if the effect on the financial statements could be 
material or cannot be readily determined, the auditor should perform 
procedures to obtain additional audit evidence to determine whether 
fraud has occurred or is likely to have occurred and, if so, its effect 
on the financial statements and the auditor's report thereon.
    22. For misstatements that the auditor believes are or might be 
intentional, the auditor should evaluate the implications on the 
integrity of management or employees and the possible effect on other 
aspects of the audit. If the misstatement involves higher-level 
management, it might be indicative of a more pervasive problem, such as 
an issue with the integrity of management, even if the amount of the 
misstatement is small. In such circumstances, the auditor should 
reevaluate the assessment of fraud risk and the effect of that 
assessment on (a) the nature, timing, and extent of the necessary tests 
of accounts or disclosures and (b) the assessment of the effectiveness 
of controls. The auditor also should evaluate whether the circumstances 
or conditions indicate possible collusion involving employees, 
management, or external parties and, if so, the effect of the collusion 
on the reliability of evidence obtained.
    23. If the auditor becomes aware of information indicating that 
fraud or another illegal act has occurred or might have occurred, he or 
she also must determine his or her responsibilities under AU secs. 
316.79-.82A, AU sec. 317, and Section 10A of the Securities Exchange 
Act of 1934, 15 U.S.C. Sec.  78j-1.
Evaluating the Qualitative Aspects of the Company's Accounting 
Practices
    24. When evaluating whether the financial statements as a whole are 
free of material misstatement, the auditor should evaluate the 
qualitative aspects of the company's accounting practices, including 
potential bias in management's judgments about the amounts and 
disclosures in the financial statements.
    25. The following are examples of forms of management bias:
    a. The selective correction of misstatements brought to 
management's attention during the audit (e.g., correcting misstatements 
that have the effect of increasing reported earnings but not correcting 
misstatements that have the effect of decreasing reported earnings).
    Note: To evaluate the potential effect of selective correction of 
misstatements, the auditor should obtain an understanding of the 
reasons that management decided not to correct misstatements 
communicated by the auditor in accordance with paragraph 15.
    b. The identification by management of additional adjusting entries 
that offset misstatements accumulated by the auditor. If such adjusting 
entries are identified, the auditor should perform procedures to 
determine why the underlying misstatements were not identified 
previously and evaluate the implications on the integrity of management 
and the auditor's risk assessments, including fraud risk assessments. 
The auditor also should perform additional procedures as necessary to 
address the risk of further undetected misstatement.
    c. Bias in the selection and application of accounting 
principles.\121\
---------------------------------------------------------------------------

    \121\ Paragraph 5.d. of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement.
---------------------------------------------------------------------------

    d. Bias in accounting estimates.\122\
---------------------------------------------------------------------------

    \122\ Paragraph 27 of this standard.
---------------------------------------------------------------------------

    26. If the auditor identifies bias in management's judgments about 
the amounts and disclosures in the financial statements, the auditor 
should evaluate whether the effect of that bias, together with the 
effect of uncorrected misstatements, results in material misstatement 
of the financial statements. Also, the auditor should evaluate whether 
the auditor's risk assessments, including, in particular, the 
assessment of fraud risks, and the related audit responses remain 
appropriate.
    27. Evaluating Bias in Accounting Estimates. The auditor should 
evaluate whether the difference between estimates best supported by the 
audit evidence and estimates included in the financial statements, 
which are individually reasonable, indicate a possible bias on the part 
of the company's management. If each accounting estimate included in 
the financial statements was individually reasonable but the effect of 
the difference between each estimate and the estimate best supported by 
the audit evidence was to increase earnings or loss, the auditor should 
evaluate whether these circumstances indicate potential management bias 
in the estimates. Bias also can result from the cumulative effect of 
changes in multiple accounting estimates. If the estimates in the 
financial statements are grouped at one end of the range of reasonable 
estimates in the prior year and are grouped at the other end of the 
range of reasonable estimates in the current year, the auditor should 
evaluate whether management is using swings in estimates to achieve an 
expected or desired outcome, e.g., to offset higher or lower than 
expected earnings.

[[Page 59353]]

    Note: AU secs. 316.64-.65 establish requirements regarding 
performing a retrospective review of accounting estimates and 
evaluating the potential for fraud risks.
Evaluating Conditions Relating to the Assessment of Fraud Risks
    28. When evaluating the results of the audit, the auditor should 
evaluate whether the accumulated results of auditing procedures \123\ 
and other observations affect the assessment of the fraud risks made 
throughout the audit and whether the audit procedures need to be 
modified to respond to those risks. (See Appendix C.)
---------------------------------------------------------------------------

    \123\ Such auditing procedures include, but are not limited to, 
procedures in the overall review (paragraph 9 of this standard), the 
evaluation of identified misstatements (paragraphs 20-23 of this 
standard), and the evaluation of the qualitative aspects of the 
company's accounting practices (paragraphs 24-27 of this standard).
---------------------------------------------------------------------------

    29. As part of this evaluation, the engagement partner should 
determine whether there has been appropriate communication with the 
other engagement team members throughout the audit regarding 
information or conditions that are indicative of fraud risks.
    Note: To accomplish this communication, the engagement partner 
might arrange another discussion among the engagement team members 
about fraud risks. (See paragraphs 49-51 of Auditing Standard No. 12.)
Evaluating the Presentation of the Financial Statements, Including the 
Disclosures
    30. The auditor must evaluate whether the financial statements are 
presented fairly, in all material respects, in conformity with the 
applicable financial reporting framework.
    Note: AU sec. 411, The Meaning of Present Fairly in Conformity With 
Generally Accepted Accounting Principles, establishes requirements for 
evaluating the presentation of the financial statements. Auditing 
Standard No. 6, Evaluating Consistency of Financial Statements, 
establishes requirements regarding evaluating the consistency of the 
accounting principles used in financial statements.
    Note: The auditor should look to the requirements of the Securities 
and Exchange Commission for the company under audit with respect to the 
accounting principles applicable to that company.
    31. As part of the evaluation of the presentation of the financial 
statements, the auditor should evaluate whether the financial 
statements contain the information essential for a fair presentation of 
the financial statements in conformity with the applicable financial 
reporting framework. Evaluation of the information disclosed in the 
financial statements includes consideration of the form, arrangement, 
and content of the financial statements (including the accompanying 
notes), encompassing matters such as the terminology used, the amount 
of detail given, the classification of items in the statements, and the 
bases of amounts set forth.
    Note: According to AU sec. 508, if the financial statements, 
including the accompanying notes, fail to disclose information that is 
required by the applicable financial reporting framework, the auditor 
should express a qualified or adverse opinion and should provide the 
information in the report, if practicable, unless its omission from the 
report is recognized as appropriate by a specific auditing 
standard.\124\
---------------------------------------------------------------------------

    \124\ AU secs. 508.41-.44.
---------------------------------------------------------------------------

Evaluating the Sufficiency and Appropriateness of Audit Evidence
    32. Auditing Standard No. 8, Audit Risk, states:
    To form an appropriate basis for expressing an opinion on the 
financial statements, the auditor must plan and perform the audit to 
obtain reasonable assurance about whether the financial statements are 
free of material misstatement due to error or fraud. Reasonable 
assurance is obtained by reducing audit risk to an appropriately low 
level through applying due professional care, including obtaining 
sufficient appropriate audit evidence.\125\
---------------------------------------------------------------------------

    \125\ Paragraph 3 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    33. As part of evaluating audit results, the auditor must conclude 
on whether sufficient appropriate audit evidence has been obtained to 
support his or her opinion on the financial statements.
    34. Factors that are relevant to the conclusion on whether 
sufficient appropriate audit evidence has been obtained include the 
following:
    a. The significance of uncorrected misstatements and the likelihood 
of their having a material effect, individually or in combination, on 
the financial statements, considering the possibility of further 
undetected misstatement (paragraphs 14 and 17-19 of this standard).
    b. The results of audit procedures performed in the audit of 
financial statements, including whether the evidence obtained supports 
or contradicts management's assertions and whether such audit 
procedures identified specific instances of fraud (paragraphs 20-23 and 
28-29 of this standard).
    c. The auditor's risk assessments (paragraph 36 of this standard).
    d. The results of audit procedures performed in the audit of 
internal control over financial reporting, if the audit is an 
integrated audit.
    e. The appropriateness (i.e., the relevance and reliability) of the 
audit evidence obtained.\126\
---------------------------------------------------------------------------

    \126\ Paragraphs 7-9 of Auditing Standard No. 15, Audit 
Evidence, discuss the relevance and reliability of audit evidence.
---------------------------------------------------------------------------

    35. If the auditor has not obtained sufficient appropriate audit 
evidence about a relevant assertion or has substantial doubt about a 
relevant assertion, the auditor should perform procedures to obtain 
further audit evidence to address the matter. If the auditor is unable 
to obtain sufficient appropriate audit evidence to have a reasonable 
basis to conclude about whether the financial statements as a whole are 
free of material misstatement, AU sec. 508 indicates that the auditor 
should express a qualified opinion or a disclaimer of opinion.\127\
---------------------------------------------------------------------------

    \127\ AU sec. 508.22-.34 contains requirements regarding audit 
scope limitations.
---------------------------------------------------------------------------

    36. Evaluating the Appropriateness of Risk Assessments. As part of 
the evaluation of whether sufficient appropriate audit evidence has 
been obtained, the auditor should evaluate whether the assessments of 
the risks of material misstatement at the assertion level remain 
appropriate and whether the audit procedures need to be modified or 
additional procedures need to be performed as a result of any changes 
in the risk assessments. For example, the re-evaluation of the 
auditor's risk assessments could result in the identification of 
relevant assertions or significant risks that were not identified 
previously and for which the auditor should perform additional audit 
procedures.
    Note: Auditing Standard No. 12 establishes requirements on revising 
the auditor's risk assessment.\128\ Auditing Standard No. 13 discusses 
the auditor's responsibilities regarding the assessment of control risk 
and evaluation of control deficiencies in an audit of financial 
statements.\129\
---------------------------------------------------------------------------

    \128\ Paragraph 74 of Auditing Standard No. 12.
    \129\ Paragraphs 32-34 of Auditing Standard No. 13.
---------------------------------------------------------------------------

Evaluating the Results of the Audit of Internal Control Over Financial 
Reporting

    37. Auditing Standard No. 5, An Audit of Internal Control Over 
Financial Reporting That Is Integrated with An Audit of Financial 
Statements, indicates

[[Page 59354]]

that the auditor should form an opinion on the effectiveness of 
internal control over financial reporting by evaluating evidence 
obtained from all sources, including the auditor's testing of controls, 
misstatements detected during the financial statement audit, and any 
identified control deficiencies. Auditing Standard No. 5 describes the 
auditor's responsibilities regarding evaluating the results of the 
audit, including evaluating the identified control deficiencies.\130\
---------------------------------------------------------------------------

    \130\ Paragraphs 62-70 of Auditing Standard No. 5 discuss 
evaluating identified control deficiencies, and paragraphs 71-73 of 
Auditing Standard No. 5 discuss forming an opinion on the 
effectiveness of internal control over financial reporting.
---------------------------------------------------------------------------

APPENDIX A--Definitions

A1. For purposes of this standard, the terms listed below are defined 
as follows:
A2. Misstatement--A misstatement, if material individually or in 
combination with other misstatements, causes the financial statements 
not to be presented fairly in conformity with the applicable financial 
reporting framework.\131\ A misstatement may relate to a difference 
between the amount, classification, presentation, or disclosure of a 
reported financial statement item and the amount, classification, 
presentation, or disclosure that should be reported in conformity with 
the applicable financial reporting framework. Misstatements can arise 
from error (i.e., unintentional misstatement) or fraud.\132\
---------------------------------------------------------------------------

    \131\ The auditor should look to the requirements of the 
Securities and Exchange Commission for the company under audit with 
respect to the accounting principles applicable to that company.
    \132\ Paragraph .02 of AU sec. 316, Consideration of Fraud in a 
Financial Statement Audit.
---------------------------------------------------------------------------

A3. Uncorrected misstatements--Misstatements, other than those that are 
clearly trivial,\133\ that management has not corrected.
---------------------------------------------------------------------------

    \133\ Paragraph 10 of this standard states that, ``[t]he auditor 
should accumulate misstatements identified during the audit, other 
than those that are clearly trivial.''
---------------------------------------------------------------------------

APPENDIX B--Qualitative Factors Related to the Evaluation of the 
Materiality of Uncorrected Misstatements

B1. Paragraph 17 of this standard states: The auditor should evaluate 
whether uncorrected misstatements are material, individually or in 
combination with other misstatements. In making this evaluation, the 
auditor should evaluate the misstatements in relation to the specific 
accounts and disclosures involved and to the financial statements as a 
whole, taking into account relevant quantitative and qualitative 
factors.\134\
---------------------------------------------------------------------------

    \134\ If the financial statements contain material 
misstatements, AU sec. 508, Reports on Audited Financial Statements, 
indicates that the auditor should issue a qualified or an adverse 
opinion on the financial statements. AU sec. 508.35 discusses 
situations in which the financial statements are materially affected 
by a departure from the applicable financial reporting framework.
---------------------------------------------------------------------------

    Note: In interpreting the federal securities laws, the Supreme 
Court of the United States has held that a fact is material if there is 
``a substantial likelihood that the * * * fact would have been viewed 
by the reasonable investor as having significantly altered the `total 
mix' of information made available.'' \135\ As the Supreme Court has 
noted, determinations of materiality require ``delicate assessments of 
the inferences a `reasonable shareholder' would draw from a given set 
of facts and the significance of those inferences to him * * * '' \136\
---------------------------------------------------------------------------

    \135\ TSC Industries v. Northway, Inc., 426 U.S. 438, 449 
(1976). See also Basic, Inc. v. Levinson, 485 U.S. 224 (1988).
    \136\ TSC Industries, 426 U.S. at 450.
---------------------------------------------------------------------------

    Note: As a result of the interaction of quantitative and 
qualitative considerations in materiality judgments, uncorrected 
misstatements of relatively small amounts could have a material effect 
on the financial statements. For example, an illegal payment of an 
otherwise immaterial amount could be material if there is a reasonable 
possibility \137\ that it could lead to a material contingent liability 
or a material loss of revenue.\138\ Also, a misstatement made 
intentionally could be material for qualitative reasons, even if 
relatively small in amount.

    \137\ There is a reasonable possibility of an event, as used in 
this standard, when the likelihood of the event is either 
``reasonably possible'' or ``probable,'' as those terms are used in 
the FASB Accounting Standards Codification, Contingencies Topic, 
paragraph 450-20-25-1.
    \138\ AU sec. 317, Illegal Acts by Clients.

B2. Qualitative factors to consider in the auditor's evaluation of the 
materiality of uncorrected misstatements, if relevant, include the 
following:
    a. The potential effect of the misstatement on trends, especially 
trends in profitability.
    b. A misstatement that changes a loss into income or vice versa.
    c. The effect of the misstatement on segment information, for 
example, the significance of the matter to a particular segment 
important to the future profitability of the company, the pervasiveness 
of the matter on the segment information, and the impact of the matter 
on trends in segment information, all in relation to the financial 
statements taken as a whole.
    d. The potential effect of the misstatement on the company's 
compliance with loan covenants, other contractual agreements, and 
regulatory provisions.
    e. The existence of statutory or regulatory reporting requirements 
that affect materiality thresholds.
    f. A misstatement that has the effect of increasing management's 
compensation, for example, by satisfying the requirements for the award 
of bonuses or other forms of incentive compensation.
    g. The sensitivity of the circumstances surrounding the 
misstatement, for example, the implications of misstatements involving 
fraud and possible illegal acts, violations of contractual provisions, 
and conflicts of interest.
    h. The significance of the financial statement element affected by 
the misstatement, for example, a misstatement affecting recurring 
earnings as contrasted to one involving a non-recurring charge or 
credit, such as an extraordinary item.
    i. The effects of misclassifications, for example, 
misclassification between operating and non-operating income or 
recurring and non-recurring income items.
    j. The significance of the misstatement or disclosures relative to 
known user needs, for example:
    <bullet> The significance of earnings and earnings per share to 
public company investors.
    <bullet> The magnifying effects of a misstatement on the 
calculation of purchase price in a transfer of interests (buy/sell 
agreement).
    <bullet> The effect of misstatements of earnings when contrasted 
with expectations.
    k. The definitive character of the misstatement, for example, the 
precision of an error that is objectively determinable as contrasted 
with a misstatement that unavoidably involves a degree of subjectivity 
through estimation, allocation, or uncertainty.
    l. The motivation of management with respect to the misstatement, 
for example, (i) an indication of a possible pattern of bias by 
management when developing and accumulating accounting estimates or 
(ii) a misstatement precipitated by management's continued 
unwillingness to correct weaknesses in the financial reporting process.

[[Page 59355]]

    m. The existence of offsetting effects of individually significant 
but different misstatements.
    n. The likelihood that a misstatement that is currently immaterial 
may have a material effect in future periods because of a cumulative 
effect, for example, that builds over several periods.
    o. The cost of making the correction--it may not be cost-beneficial 
for the client to develop a system to calculate a basis to record the 
effect of an immaterial misstatement. On the other hand, if management 
appears to have developed a system to calculate an amount that 
represents an immaterial misstatement, it may reflect a motivation of 
management as noted in paragraph B2.l above.
    p. The risk that possible additional undetected misstatements would 
affect the auditor's evaluation.

APPENDIX C--Matters That Might Affect the Assessment of Fraud Risks

C1. If the following matters are identified during the audit, the 
auditor should take into account these matters in the evaluation of the 
assessment of fraud risks, as discussed in paragraph 28 of this 
standard:
    a. Discrepancies in the accounting records, including:
    (1) Transactions that are not recorded in a complete or timely 
manner or are improperly recorded as to amount, accounting period, 
classification, or company policy.
    (2) Unsupported or unauthorized balances or transactions.
    (3) Last-minute adjustments that significantly affect financial 
results.
    (4) Evidence of employees' access to systems and records that is 
inconsistent with the access that is necessary to perform their 
authorized duties.
    (5) Tips or complaints to the auditor about alleged fraud.
    b. Conflicting or missing evidence, including:
    (1) Missing documents.
    (2) Documents that appear to have been altered.\139\
---------------------------------------------------------------------------

    \139\ Paragraph 9 of Auditing Standard No. 15, Audit Evidence.
---------------------------------------------------------------------------

    (3) Unavailability of other than photocopied or electronically 
transmitted documents when documents in original form are expected to 
exist.
    (4) Significant unexplained items in reconciliations.
    (5) Inconsistent, vague, or implausible responses from management 
or employees arising from inquiries or analytical procedures.
    (6) Unusual discrepancies between the company's records and 
confirmation responses.
    (7) Missing inventory or physical assets of significant magnitude.
    (8) Unavailable or missing electronic evidence that is inconsistent 
with the company's record retention practices or policies.
    (9) Inability to produce evidence of key systems development and 
program change testing and implementation activities for current year 
system changes and deployments.
    (10) Unusual balance sheet changes or changes in trends or 
important financial statement ratios or relationships, e.g., 
receivables growing faster than revenues.
    (11) Large numbers of credit entries and other adjustments made to 
accounts receivable records.
    (12) Unexplained or inadequately explained differences between the 
accounts receivable subsidiary ledger and the general ledger control 
account, or between the customer statement and the accounts receivable 
subsidiary ledger.
    (13) Missing or nonexistent cancelled checks in circumstances in 
which cancelled checks are ordinarily returned to the company with the 
bank statement.
    (14) Fewer responses to confirmation requests than anticipated or a 
greater number of responses than anticipated.
    c. Problematic or unusual relationships between the auditor and 
management, including:
    (1) Denial of access to records, facilities, certain employees, 
customers, vendors, or others from whom audit evidence might be sought, 
including:\140\
---------------------------------------------------------------------------

    \140\ Denial of access to information might constitute a 
limitation on the scope of the audit that requires the auditor to 
qualify or disclaim an opinion. (See Auditing Standard No. 5, An 
Audit of Internal Control Over Financial Reporting That Is 
Integrated with An Audit of Financial Statements, and AU sec. 508, 
Reports on Audited Financial Statements.)
---------------------------------------------------------------------------

    a. Unwillingness to facilitate auditor access to key electronic 
files for testing through the use of computer-assisted audit 
techniques.
    b. Denial of access to key information technology operations staff 
and facilities, including security, operations, and systems 
development.
    (2) Undue time pressures imposed by management to resolve complex 
or contentious issues.
    (3) Management pressure on engagement team members, particularly in 
connection with the auditor's critical assessment of audit evidence or 
in the resolution of potential disagreements with management.
    (4) Unusual delays by management in providing requested 
information.
    (5) Management's unwillingness to add or revise disclosures in the 
financial statements to make them more complete and transparent.
    (6) Management's unwillingness to appropriately address significant 
deficiencies in internal control on a timely basis.
    d. Other matters, including:
    (1) Objections by management to the auditor meeting privately with 
the audit committee.
    (2) Accounting policies that appear inconsistent with industry 
practices that are widely recognized and prevalent.
    (3) Frequent changes in accounting estimates that do not appear to 
result from changing circumstances.
    (4) Tolerance of violations of the company's code of conduct.

Auditing Standard No. 15

Audit Evidence

Introduction

    1. This standard explains what constitutes audit evidence and 
establishes requirements regarding designing and performing audit 
procedures to obtain sufficient appropriate audit evidence.
    2. Audit evidence is all the information, whether obtained from 
audit procedures or other sources, that is used by the auditor in 
arriving at the conclusions on which the auditor's opinion is based. 
Audit evidence consists of both information that supports and 
corroborates management's assertions regarding the financial statements 
or internal control over financial reporting and information that 
contradicts such assertions.

Objective

    3. The objective of the auditor is to plan and perform the audit to 
obtain appropriate audit evidence that is sufficient to support the 
opinion expressed in the auditor's report.\141\
---------------------------------------------------------------------------

    \141\ Auditing Standard No. 14, Evaluating Audit Results, 
establishes requirements regarding evaluating whether sufficient 
appropriate evidence has been obtained. Auditing Standard No. 3, 
Audit Documentation, establishes requirements regarding documenting 
the procedures performed, evidence obtained, and conclusions reached 
in an audit.

---------------------------------------------------------------------------

[[Page 59356]]

Sufficient Appropriate Audit Evidence

    4. The auditor must plan and perform audit procedures to obtain 
sufficient appropriate audit evidence to provide a reasonable basis for 
his or her opinion.
    5. Sufficiency is the measure of the quantity of audit evidence. 
The quantity of audit evidence needed is affected by the following:
    <bullet> Risk of material misstatement (in the audit of financial 
statements) or the risk associated with the control (in the audit of 
internal control over financial reporting). As the risk increases, the 
amount of evidence that the auditor should obtain also increases. For 
example, ordinarily more evidence is needed to respond to significant 
risks.\142\
---------------------------------------------------------------------------

    \142\ Paragraph A5 of Auditing Standard No. 12, Identifying and 
Assessing Risks of Material Misstatement.
---------------------------------------------------------------------------

    <bullet> Quality of the audit evidence obtained. As the quality of 
the evidence increases, the need for additional corroborating evidence 
decreases. Obtaining more of the same type of audit evidence, however, 
cannot compensate for the poor quality of that evidence.
    6. Appropriateness is the measure of the quality of audit evidence, 
i.e., its relevance and reliability. To be appropriate, audit evidence 
must be both relevant and reliable in providing support for the 
conclusions on which the auditor's opinion is based.
Relevance and Reliability
    7. Relevance. The relevance of audit evidence refers to its 
relationship to the assertion or to the objective of the control being 
tested. The relevance of audit evidence depends on:
    a. The design of the audit procedure used to test the assertion or 
control, in particular whether it is designed to (1) test the assertion 
or control directly and (2) test for understatement or overstatement; 
and
    b. The timing of the audit procedure used to test the assertion or 
control.
    8. Reliability. The reliability of evidence depends on the nature 
and source of the evidence and the circumstances under which it is 
obtained. For example, in general:
    <bullet> Evidence obtained from a knowledgeable source that is 
independent of the company is more reliable than evidence obtained only 
from internal company sources.
    <bullet> The reliability of information generated internally by the 
company is increased when the company's controls over that information 
are effective.
    <bullet> Evidence obtained directly by the auditor is more reliable 
than evidence obtained indirectly.
    <bullet> Evidence provided by original documents is more reliable 
than evidence provided by photocopies or facsimiles, or documents that 
have been filmed, digitized, or otherwise converted into electronic 
form, the reliability of which depends on the controls over the 
conversion and maintenance of those documents.
    9. The auditor is not expected to be an expert in document 
authentication. However, if conditions indicate that a document may not 
be authentic or that the terms in a document have been modified but 
that the modifications have not been disclosed to the auditor, the 
auditor should modify the planned audit procedures or perform 
additional audit procedures to respond to those conditions and should 
evaluate the effect, if any, on the other aspects of the audit.
Using Information Produced by the Company
    10. When using information produced by the company as audit 
evidence, the auditor should evaluate whether the information is 
sufficient and appropriate for purposes of the audit by performing 
procedures to: \143\
---------------------------------------------------------------------------

    \143\ When using the work of a specialist engaged or employed by 
management, see AU sec. 336, Using the Work of a Specialist. When 
using information produced by a service organization or a service 
auditor's report as audit evidence, see AU sec. 324, Service 
Organizations, and for integrated audits, see Auditing Standard No. 
5, An Audit of Internal Control Over Financial Reporting That Is 
Integrated with An Audit of Financial Statements.
---------------------------------------------------------------------------

    <bullet> Test the accuracy and completeness of the information, or 
test the controls over the accuracy and completeness of that 
information; and
    <bullet> Evaluate whether the information is sufficiently precise 
and detailed for purposes of the audit.

Financial Statement Assertions

    11. In representing that the financial statements are presented 
fairly in conformity with the applicable financial reporting framework, 
management implicitly or explicitly makes assertions regarding the 
recognition, measurement, presentation, and disclosure of the various 
elements of financial statements and related disclosures. Those 
assertions can be classified into the following categories:
    <bullet> Existence or occurrence--Assets or liabilities of the 
company exist at a given date, and recorded transactions have occurred 
during a given period.
    <bullet> Completeness--All transactions and accounts that should be 
presented in the financial statements are so included.
    <bullet> Valuation or allocation--Asset, liability, equity, 
revenue, and expense components have been included in the financial 
statements at appropriate amounts.
    <bullet> Rights and obligations--The company holds or controls 
rights to the assets, and liabilities are obligations of the company at 
a given date.
    <bullet> Presentation and disclosure--The components of the 
financial statements are properly classified, described, and disclosed.
    12. The auditor may base his or her work on financial statement 
assertions that differ from those in this standard if the assertions 
are sufficient for the auditor to identify the types of potential 
misstatements and to respond appropriately to the risks of material 
misstatement in each significant account and disclosure that has a 
reasonable possibility \144\ of containing misstatements that would 
cause the financial statements to be materially misstated, individually 
or in combination with other misstatements.\145\
---------------------------------------------------------------------------

    \144\ There is a reasonable possibility of an event, as used in 
this standard, when the likelihood of the event is either 
``reasonably possible'' or ``probable,'' as those terms are used in 
the FASB Accounting Standards Codification, Contingencies Topic, 
paragraph 450-20-25-1.
    \145\ For an integrated audit, also see paragraph 28 of Auditing 
Standard No. 5.
---------------------------------------------------------------------------

Audit Procedures for Obtaining Audit Evidence

    13. Audit procedures can be classified into the following 
categories:
    a. Risk assessment procedures,\146\ and
---------------------------------------------------------------------------

    \146\ Auditing Standard No. 12.
---------------------------------------------------------------------------

    b. Further audit procedures,\147\ which consist of:
---------------------------------------------------------------------------

    \147\ Auditing Standard No. 13, The Auditor's Responses to the 
Risks of Material Misstatement.
---------------------------------------------------------------------------

    (1) Tests of controls, and
    (2) Substantive procedures, including tests of details and 
substantive analytical procedures.
    14. Paragraphs 15-21 of this standard describe specific audit 
procedures. The purpose of an audit procedure determines whether it is 
a risk assessment procedure, test of controls, or substantive 
procedure.
Inspection
    15. Inspection involves examining records or documents, whether 
internal or external, in paper form, electronic form, or other media, 
or physically examining an asset. Inspection of records and documents 
provides audit evidence of varying degrees of reliability, depending on 
their nature and source and, in the case of internal records and 
documents, on the effectiveness of the controls over their

[[Page 59357]]

production. An example of inspection used as a test of controls is 
inspection of records for evidence of authorization.
Observation
    16. Observation consists of looking at a process or procedure being 
performed by others, e.g., the auditor's observation of inventory 
counting by the company's personnel or the performance of control 
activities. Observation can provide audit evidence about the 
performance of a process or procedure, but the evidence is limited to 
the point in time at which the observation takes place and also is 
limited by the fact that the act of being observed may affect how the 
process or procedure is performed.\148\
---------------------------------------------------------------------------

    \148\ AU sec. 331, Inventories, establishes requirements 
regarding observation of the counting of inventory.
---------------------------------------------------------------------------

Inquiry
    17. Inquiry consists of seeking information from knowledgeable 
persons in financial or nonfinancial roles within the company or 
outside the company. Inquiry may be performed throughout the audit in 
addition to other audit procedures. Inquiries may range from formal 
written inquiries to informal oral inquiries. Evaluating responses to 
inquiries is an integral part of the inquiry process.\149\
---------------------------------------------------------------------------

    \149\ AU sec. 333, Management Representations, establishes 
requirements regarding written management representations, including 
confirmation of management responses to oral inquiries.
---------------------------------------------------------------------------

    Note: Inquiry of company personnel, by itself, does not provide 
sufficient audit evidence to reduce audit risk to an appropriately low 
level for a relevant assertion or to support a conclusion about the 
effectiveness of a control.
Confirmation
    18. A confirmation response represents a particular form of audit 
evidence obtained by the auditor from a third party in accordance with 
PCAOB standards.\150\
---------------------------------------------------------------------------

    \150\ AU sec. 330, The Confirmation Process.
---------------------------------------------------------------------------

Recalculation
    19. Recalculation consists of checking the mathematical accuracy of 
documents or records. Recalculation may be performed manually or 
electronically.
Reperformance
    20. Reperformance involves the independent execution of procedures 
or controls that were originally performed by company personnel.
Analytical Procedures
    21. Analytical procedures consist of evaluations of financial 
information made by a study of plausible relationships among both 
financial and nonfinancial data. Analytical procedures also encompass 
the investigation of significant differences from expected 
amounts.\151\
---------------------------------------------------------------------------

    \151\ AU sec. 329, Substantive Analytical Procedures, 
establishes requirements on performing analytical procedures as 
substantive procedures.
---------------------------------------------------------------------------

Selecting Items for Testing to Obtain Audit Evidence

    22. Designing substantive tests of details and tests of controls 
includes determining the means of selecting items for testing from 
among the items included in an account or the occurrences of a control. 
The auditor should determine the means of selecting items for testing 
to obtain evidence that, in combination with other relevant evidence, 
is sufficient to meet the objective of the audit procedure. The 
alternative means of selecting items for testing are:
    <bullet> Selecting all items;
    <bullet> Selecting specific items; and
    <bullet> Audit sampling.
    23. The particular means or combination of means of selecting items 
for testing that is appropriate depends on the nature of the audit 
procedure, the characteristics of the control or the items in the 
account being tested, and the evidence necessary to meet the objective 
of the audit procedure.
Selecting All Items
    24. Selecting all items (100 percent examination) refers to testing 
the entire population of items in an account or the entire population 
of occurrences of a control (or an entire stratum within one of those 
populations). The following are examples of situations in which 100 
percent examination might be applied:
    <bullet> The population constitutes a small number of large value 
items;
    <bullet> The audit procedure is designed to respond to a 
significant risk, and other means of selecting items for testing do not 
provide sufficient appropriate audit evidence; and
    <bullet> The audit procedure can be automated effectively and 
applied to the entire population.
Selecting Specific Items
    25. Selecting specific items refers to testing all of the items in 
a population that have a specified characteristic, such as:
    <bullet> Key items. The auditor may decide to select specific items 
within a population because they are important to accomplishing the 
objective of the audit procedure or exhibit some other characteristic, 
e.g., items that are suspicious, unusual, or particularly risk-prone or 
items that have a history of error.
    <bullet> All items over a certain amount. The auditor may decide to 
examine items whose recorded values exceed a certain amount to verify a 
large proportion of the total amount of the items included in an 
account.
    26. The auditor also might select specific items to obtain an 
understanding about matters such as the nature of the company or the 
nature of transactions.
    27. The application of audit procedures to items that are selected 
as described in paragraphs 25-26 of this standard does not constitute 
audit sampling, and the results of those audit procedures cannot be 
projected to the entire population.\152\
---------------------------------------------------------------------------

    \152\ If misstatements are identified in the selected items, see 
paragraphs 12-13 and paragraphs 17-19 of Auditing Standard No. 14.
---------------------------------------------------------------------------

Audit Sampling
    28. Audit sampling is the application of an audit procedure to less 
than 100 percent of the items within an account balance or class of 
transactions for the purpose of evaluating some characteristic of the 
balance or class.\153\
---------------------------------------------------------------------------

    \153\ AU sec. 350, Audit Sampling, establishes requirements 
regarding audit sampling.
---------------------------------------------------------------------------

Inconsistency in, or Doubts about the Reliability of, Audit Evidence

    29. If audit evidence obtained from one source is inconsistent with 
that obtained from another, or if the auditor has doubts about the 
reliability of information to be used as audit evidence, the auditor 
should perform the audit procedures necessary to resolve the matter and 
should determine the effect, if any, on other aspects of the audit.
Conforming Amendment to PCAOB Interim Quality Control Standards

Auditing Standards

    AU sec. 110, ``Responsibilities and Functions of the Independent 
Auditor''
    Statement on Auditing Standards (``SAS'') No. 1, ``Codification of 
Auditing Standards and Procedures'' section 110, ``Responsibilities and 
Functions of the Independent Auditor'' (AU sec. 110, ``Responsibilities 
and Functions of the Independent Auditor''), as amended, is amended as 
follows: Within footnote 1 to paragraph .02, the reference to section 
312, Audit Risk and Materiality in Conducting an Audit, is replaced 
with a reference to Auditing Standard No. 11, Consideration of 
Materiality in Planning and Performing an Audit.
    AU sec. 150, ``Generally Accepted Auditing Standards''

[[Page 59358]]

    SAS No. 95, ``Generally Accepted Auditing Standards'' (AU sec. 150, 
``Generally Accepted Auditing Standards''), as amended, is amended as 
follows:
    a. Within paragraph .02, in the third standard of field work, the 
word ``competent'' is replaced with the word ``appropriate.''
    b. Footnote 2 to paragraph .04 is deleted.
    AU sec. 210, ``Training and Proficiency of the Independent 
Auditor''
    SAS No. 1, ``Codification of Auditing Standards and Procedures'' 
section 210, ``Training and Proficiency of the Independent Auditor'' 
(AU sec. 210, ``Training and Proficiency of the Independent Auditor''), 
as amended, is amended as follows:
    The last sentence of paragraph .03 is replaced with: The engagement 
partner must exercise seasoned judgment in the varying degrees of his 
supervision and review of the work done and judgments exercised by his 
subordinates, who in turn must meet the responsibilities attaching to 
the varying gradations and functions of their work.
    AU sec. 230, ``Due Professional Care in the Performance of Work''
    SAS No. 1, ``Codification of Auditing Standards and Procedures'' 
section 230, ``Due Professional Care in the Performance of Work'' (AU 
sec. 230, ``Due Professional Care in the Performance of Work''), as 
amended, is amended as follows:
    a. The second and third sentences of paragraph .06 are replaced 
with: The engagement partner should know, at a minimum, the relevant 
professional accounting and auditing standards and should be 
knowledgeable about the client. The engagement partner is responsible 
for the assignment of tasks to, and supervision of, the members of the 
engagement team.\fn4\
    b. Footnote 3 to paragraph .06 is deleted.
    c. Within footnote 4 to paragraph .06, the phrase ``See section 
311.11'' is replaced with, ``See Auditing Standard No. 10, Supervision 
of the Audit Engagement.''
    d. Footnote 6 to paragraph .11 is deleted.
    e. In the first sentence of paragraph .11, the word ``competent'' 
is replaced with the word ``appropriate.''
    f. At the end of the fifth sentence of paragraph .12, the following 
parenthetical is added: ``(See paragraph 9 of Auditing Standard No. 15, 
Audit Evidence.)''
    AU sec. 310, ``Appointment of the Independent Auditor''
    SAS No. 1, ``Codification of Auditing Standards and Procedures'' 
section 310, ``Appointment of the Independent Auditor'' (AU sec. 310, 
``Appointment of the Independent Auditor''), as amended, is amended as 
follows:
    a. Within footnote ** to the title of the standard, the sentence 
``(See section 313.)'' is deleted.
    b. Paragraph .02 is replaced with: Audit planning is discussed in 
Auditing Standard No. 9, Audit Planning, and supervision of engagement 
team members is discussed in Auditing Standard No. 10, Supervision of 
the Audit Engagement.
    c. In paragraph .03, the sentence ``(See section 313)'' is deleted.
    d. Within footnote 3 to paragraph .06, the reference to Section 
312, Audit Risk and Materiality in Conducting an Audit, paragraph .04, 
is replaced with a reference to Paragraph A2 of Auditing Standard No. 
14, Evaluating Audit Results.
    AU sec. 311, ``Planning and Supervision''
    SAS No. 22, ``Planning and Supervision'' (AU sec. 311, ``Planning 
and Supervision''), as amended, is superseded.
    AU sec. 9311, ``Planning and Supervision: Auditing Interpretations 
of Section 311''
    AU sec. 9311, ``Planning and Supervision: Auditing Interpretations 
of Section 311'', as amended, is superseded.
    AU sec. 312, ``Audit Risk and Materiality in Conducting an Audit''
    SAS No. 47, ``Audit Risk and Materiality in Conducting an Audit'' 
(AU sec. 312, ``Audit Risk and Materiality in Conducting an Audit''), 
as amended, is superseded.
    AU sec. 9312, ``Audit Risk and Materiality in Conducting an Audit: 
Auditing Interpretations of Section 312''
    AU sec. 9312, ``Audit Risk and Materiality in Conducting an Audit: 
Auditing Interpretations of Section 312'' is superseded.
    AU sec. 313, ``Substantive Tests Prior to the Balance Sheet Date''
    SAS No. 45, ``Omnibus Statement on Auditing Standards--1983'' (AU 
sec. 313, ``Substantive Tests Prior to the Balance Sheet Date''), as 
amended, is superseded.
    AU sec. 315, ``Communications Between Predecessor and Successor 
Auditors''
    SAS No. 84, ``Communications Between Predecessor and Successor 
Auditors'' (AU sec. 315, ``Communications Between Predecessor and 
Successor Auditors''), as amended, is amended as follows:
    a. In the first sentence of paragraph .12, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. In the first sentence of paragraph .18, the word ``competent'' 
is replaced with the word ``appropriate.''
    AU sec. 316, ``Consideration of Fraud in a Financial Statement 
Audit''
    SAS No. 99, ``Consideration of Fraud in a Financial Statement 
Audit'' (AU sec. 316, ``Consideration of Fraud in a Financial Statement 
Audit''), as amended, is amended as follows:
    a. The second sentence of paragraph .01 is replaced with: This 
section establishes requirements and provides direction relevant to 
fulfilling that responsibility, as it relates to fraud, in an audit of 
financial statements.\fn2\
    b. In footnote 1 to paragraph .01, delete the following 
information: (see section 312, Audit Risk and Materiality in Conducting 
an Audit,'' and the closing parenthesis at the end of that sentence.
    c. Footnote 2 to paragraph .01 is replaced with: For purposes of 
this standard, the term ``audit of financial statements'' refers to the 
financial statement portion of the integrated audit and to the audit of 
financial statements only.
    d. The following paragraph .01A is added: Auditing Standard No. 12, 
Identifying and Assessing Risks of Material Misstatement, establishes 
requirements regarding the process of identifying and assessing risks 
of material misstatement of the financial statements. Auditing Standard 
No. 13, The Auditor's Responses to the Risks of Material Misstatement, 
establishes requirements regarding designing and implementing 
appropriate responses to the risks of material misstatement. Auditing 
Standard No. 14, Evaluating Audit Results, establishes requirements 
regarding the auditor's evaluation of audit results and determination 
of whether he or she has obtained sufficient appropriate audit 
evidence.
    e. In paragraph .02:
    <bullet> The third through the sixth bullet points are deleted.
    <bullet> The seventh bullet point is replaced with: Responding to 
fraud risks
    This section discusses certain responses to fraud risks involving 
the nature, timing, and extent of audit procedures, including:
    [cir] Responses to assessed fraud risks relating to fraudulent 
financial reporting and misappropriation of assets (see paragraphs .52 
through .56).
    [cir] Responses to specifically address the fraud risks arising 
from management override of internal controls (see paragraphs .57 
through .67).
    <bullet> The eighth bullet point is deleted.
    f. Paragraph .03 is deleted.
    g. Footnote 5 to paragraph .06 is replaced with: The auditor should 
look

[[Page 59359]]

to the requirements of the Securities and Exchange Commission for the 
company under audit with respect to accounting principles applicable to 
that company.
    h. In the third sentence of paragraph .13, the term ``the risk of 
material misstatement due to fraud'' is replaced with the term ``fraud 
risks.''
    i. Paragraphs .14 through .45 are deleted, along with the preceding 
heading, ``Discussion Among Engagement Personnel Regarding the Risks of 
Material Misstatement Due to Fraud.''
    j. Footnotes 8 through 19 related to paragraphs .14 through .45 are 
deleted.
    k. Paragraphs .46 through .50 are deleted. The heading preceding 
paragraph .46, ``Responding to the Results of the Assessment,'' is 
replaced with the heading ``Responding to Assessed Fraud Risks.''
    l. Paragraph .51 is deleted. The heading preceding paragraph .51, 
``Responses Involving the Nature, Timing, and Extent of Procedures to 
Be Performed to Address the Identified Risks,'' is replaced with the 
heading ``Responses Involving the Nature, Timing, and Extent of 
Procedures to Be Performed.''
    m. Paragraph .52 is replaced with: Paragraph 8 of Auditing Standard 
No. 13, The Auditor's Responses to the Risks of Material Misstatement, 
states that ``[t]he auditor should design and perform audit procedures 
in a manner that addresses the assessed risks of material misstatement 
due to error or fraud for each relevant assertion of each significant 
account and disclosure.'' Paragraph 12 of Auditing Standard No. 13 
states that ``the audit procedures that are necessary to address the 
assessed fraud risks depend upon the types of risks and the relevant 
assertions that might be affected.''
    Note: Paragraph 71.b. of Auditing Standard No. 12, Identifying and 
Assessing Risks of Material Misstatement, states that a fraud risk is a 
significant risk. Accordingly, the requirement for responding to 
significant risks also applies to fraud risks.
    n. In paragraph .53:
    <bullet> The first sentence is replaced with: The following are 
examples of responses to assessed fraud risks involving the nature, 
timing, and extent of audit procedures:
    <bullet> The fifth bullet point is replaced with: Interviewing 
personnel involved in activities in areas in which a fraud risk has 
been identified to obtain their insights about the risk and how 
controls address the risk. (See paragraph 54 of Auditing Standard No. 
12, Identifying and Assessing Risks of Material Misstatement)
    <bullet> In the sixth bullet point, the term ``risk of material 
misstatement due to fraud'' is replaced with the term ``fraud risk.''
    o. Footnote 20 to paragraph .53 is replaced with: AU sec. 329, 
Substantive Analytical Procedures, establishes requirements regarding 
performing analytical procedures as substantive tests.
    p. The heading preceding paragraph .54, ``Additional Examples of 
Responses to Identified Risks of Misstatements Arising From Fraudulent 
Financial Reporting,'' is replaced with the heading ``Additional 
Examples of Audit Procedures Performed to Respond to Assessed Fraud 
Risks Relating to Fraudulent Financial Reporting.''
    q. The first sentence in paragraph .54 is replaced with: The 
following are additional examples of audit procedures that might be 
performed in response to assessed fraud risks relating to fraudulent 
financial reporting:
    r. In paragraph .54:
    <bullet> In the last sentence of the first bullet point, the term 
``risk of material misstatement due to fraud'' is replaced with the 
term ``fraud risk.''
    <bullet> In the first sentence of the second bullet point, the term 
``risk of material misstatement due to fraud'' is replaced with the 
term ``fraud risk.''
    <bullet> In the first sentence of the third bullet point and the 
accompanying paragraph to the third bullet point, the term ``risk of 
material misstatement due to fraud'' is replaced with the term ``fraud 
risk.''
    s. Footnotes 21 and 22 to paragraph .54 are amended as follows:
    <bullet> The text of footnote 21 is replaced with ``AU sec. 330, 
The Confirmation Process, establishes requirements regarding the 
confirmation process in audits of financial statements.''
    <bullet> The text of footnote 22 is replaced with ``AU sec. 336, 
Using the Work of a Specialist, establishes requirements for an auditor 
who uses the work of a specialist in performing an audit of financial 
statements.''
    t. The heading preceding paragraph .55, ``Examples of Responses to 
Identified Risks of Misstatements Arising From Misappropriations of 
Assets,'' is replaced with the heading ``Examples of Audit Procedures 
Performed to Respond to Fraud Risks Relating to Misappropriations of 
Assets.''
    u. In the first sentence of paragraph .55, the term ``risk of 
material misstatement due to fraud'' is replaced with the term ``fraud 
risk.''
    v. In paragraph .56:
    <bullet> The first and second sentences are replaced with: The 
audit procedures performed in response to a fraud risk relating to 
misappropriation of assets usually will be directed toward certain 
account balances. Although some of the audit procedures noted in 
paragraphs .53 and .54 and in paragraphs 8 through 15 of Auditing 
Standard No. 13, The Auditor's Responses to the Risks of Material 
Misstatement, may apply in such circumstances, such as the procedures 
directed at inventory quantities, the scope of the work should be 
linked to the specific information about the misappropriation risk that 
has been identified.
    <bullet> In the third sentence, the words ``design and'' are added 
before the words ``operating effectiveness.''
    w. The heading preceding paragraph .57, ``Responses to Further 
Address the Risk of Management Override of Controls,'' is replaced with 
the heading ``Audit Procedures Performed to Specifically Address the 
Risk of Management Override of Controls.''
    x. The third sentence of paragraph .57 is replaced with: 
Accordingly, as part of the auditor's responses that address fraud 
risks, the procedures described in paragraphs .58 through .67 should be 
performed to specifically address the risk of management override of 
controls.
    y. Footnote 23 to paragraph .58 is replaced with: See paragraphs 28 
through 32 of Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement.
    z. In paragraph .61:
    <bullet> In the first sentence of the first bullet point, the term 
``the risk of material misstatement due to fraud'' is replaced with the 
term ``fraud risk.''
    <bullet> In the second bullet point, the last two sentences are 
replaced with the following: Effective controls over the preparation 
and posting of journal entries and adjustments may affect the extent of 
substantive testing necessary, provided that the auditor has tested the 
controls. However, even though controls might be implemented and 
operating effectively, the auditor's substantive procedures for testing 
journal entries and other adjustments should include the identification 
and substantive testing of specific items.
    <bullet> In item (f) of the fifth bullet point, the term ``risk of 
material misstatement due to fraud'' is replaced with the term ``fraud 
risk.''
    <bullet> The last sentence of the fifth bullet point is replaced 
with: In audits of entities that have multiple locations or business 
units, the auditor should determine whether to select journal entries 
from locations based on factors set forth in paragraphs 11 through 14 
of

[[Page 59360]]

Auditing Standard No. 9, Audit Planning.
    aa. The last sentence of paragraph .63 is replaced with: Paragraphs 
24 through 27 of Auditing Standard No. 14, Evaluating Audit Results, 
discuss the auditor's responsibilities for assessing bias in accounting 
estimates and the effect of bias on the financial statements.
    bb. Paragraphs .68 through .78 are deleted, along with the 
preceding heading ``Evaluating Audit Evidence.''
    cc. Footnotes 26 through 36 related to paragraphs .68 through .78 
are deleted.
    dd. In the first sentence of paragraph .80, the term ``risks of 
material misstatement due to fraud'' is replaced with the term ``fraud 
risks.''
    ee. The last sentence of paragraph .80 is replaced with: The 
auditor also should evaluate whether the absence of or deficiencies in 
controls that address fraud risks or otherwise help prevent, deter, and 
detect fraud (see paragraphs 72-73 of Auditing Standard No. 12, 
Identifying and Assessing Risks of Material Misstatement) represent 
significant deficiencies or material weaknesses that should be 
communicated to senior management and the audit committee.
    ff. The first sentence of paragraph .81 is replaced with: The 
auditor also should consider communicating other fraud risks, if any, 
identified by the auditor.
    gg. In paragraph .83:
    <bullet> The reference in the first bullet point to paragraphs .14 
through .17 is replaced with a reference to paragraphs 52 and 53 of 
Auditing Standard No. 12, Identifying and Assessing Risks of Material 
Misstatement.
    <bullet> The term ``risks of material misstatement due to fraud'' 
in the first sentence of the second bullet point is replaced with the 
term ``fraud risks.'' The reference in the second bullet point to 
paragraphs .19 through .34 is replaced with references to paragraph 47, 
paragraphs 56 through 58, and paragraphs 65 through 69 of Auditing 
Standard No. 12, Identifying and Assessing Risks of Material 
Misstatement.
    <bullet> The third bullet point is replaced with: The fraud risks 
that were identified at the financial statement and assertion levels 
(see paragraphs 59 through 69 of Auditing Standard No. 12, Identifying 
and Assessing Risks of Material Misstatement), and the linkage of those 
risks to the auditor's response (see paragraphs 5 through 15 of 
Auditing Standard No. 13, The Auditor's Responses to the Risks of 
Material Misstatement).
    <bullet> Within the fourth bullet point, the term ``risk of 
material misstatement due to fraud'' in the first sentence is replaced 
with the term ``fraud risk,'' and the reference to paragraph .41 is 
replaced with a reference to paragraph 68 of Auditing Standard No. 12, 
Identifying and Assessing Risks of Material Misstatement.
    <bullet> The fifth bullet point is replaced with: The results of 
the procedures performed to address the assessed fraud risks, including 
those procedures performed to further address the risk of management 
override of controls (See paragraph 15 of Auditing Standard No. 13, The 
Auditor's Responses to the Risks of Material Misstatements.)
    <bullet> The reference in the sixth bullet point to paragraphs .68 
through .73 is replaced with a reference to paragraphs 5 through 9 of 
Auditing Standard No. 14, Evaluating Audit Results.
    hh. Paragraph .84 and the heading preceding this paragraph, 
``Effective Date,'' are deleted.
    ii. The first sentence of paragraph .85 is replaced with: This 
appendix contains examples of risk factors discussed in paragraphs 65 
through 69 of Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement.
    AU sec. 317, ``Illegal Acts by Clients''
    SAS No. 54, ``Illegal Acts by Clients'' (AU sec. 317, ``Illegal 
Acts by Clients'') is amended as follows:
    a. The last sentence of paragraph .13 is replaced with: For 
example, an illegal payment of an otherwise immaterial amount could be 
material if there is a reasonable possibility that it could lead to a 
material contingent liability or a material loss of revenue.
    b. In paragraph .19, the word ``competent'' is replaced with the 
word ``appropriate.''
    AU sec. 319, ``Consideration of Internal Control in a Financial 
Statement Audit''
    SAS No. 55, ``Consideration of Internal Control in a Financial 
Statement Audit'' (AU sec. 319, ``Consideration of Internal Control in 
a Financial Statement Audit''), as amended, is superseded.
    AU sec. 322, ``The Auditor's Consideration of the Internal Audit 
Function in an Audit of Financial Statements''
    SAS No. 65, ``The Auditor's Consideration of the Internal Audit 
Function in an Audit of Financial Statements'' (AU sec. 322, ``The 
Auditor's Consideration of the Internal Audit Function in an Audit of 
Financial Statements''), as amended, is amended as follows:
    a. In the first sentence of paragraph .02, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. Footnote 3 to paragraph .04, is replaced with: Auditing Standard 
No. 12, Identifying and Assessing Risks of Material Misstatement, 
describes the procedures the auditor performs to obtain an 
understanding of internal control over financial reporting.
    c. In the first sentence of paragraph .18, the word ``competent'' 
is replaced with the word ``appropriate.''
    d. Within footnote 5 to paragraph .18, the reference to section 
326, Evidential Matter, paragraph .19c. is replaced with a reference to 
paragraph 8 of Auditing Standard No. 15, Audit Evidence.
    e. Within footnote 8 to paragraph .27, the reference to section 
311, Planning and Supervision, paragraphs .11 through .14 is replaced 
with a reference to Auditing Standard No. 10, Supervision of the Audit 
Engagement.
    AU sec. 324, ``Service Organizations''
    SAS No. 70, ``Service Organizations'' (AU sec. 324, ``Service 
Organizations''), as amended, is amended as follows:
    a. In the first sentence of paragraph .07, the reference to Section 
319, Consideration of Internal Control in a Financial Statement Audit, 
is replaced with a reference to Auditing Standard No. 12, Identifying 
and Assessing Risks of Material Misstatement.
    b. In the first sentence of paragraph .16, the reference to section 
319.90 through .99 is replaced with a reference to paragraph 18 and 
paragraphs 29 through 31 of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement.
    c. In the second sentence of paragraph .23, the reference to 
section 312, Audit Risk and Materiality in Conducting an Audit, is 
replaced with a reference to Auditing Standard No. 14, Evaluating Audit 
Results.
    AU sec. 326, ``Evidential Matter''
    SAS No. 31, ``Evidential Matter'' (AU sec. 326, ``Evidential 
Matter''), as amended, is superseded.
    AU sec. 9326, ``Evidential Matter: Auditing Interpretations of 
Section 326''
    AU sec. 9326, ``Evidential Matter: Auditing Interpretations of 
Section 326,'' as amended, is amended as follows:
    a. Paragraphs .01-.05 are deleted, along with the preceding heading 
``1. Evidential Matter for an Audit of Interim Financial Statements.''
    b. The reference in paragraph .10 to Section 326, Evidential 
Matter, paragraph .25, is replaced with a reference to Paragraph 35 of 
Auditing Standard No. 14, Evaluating Audit Results.
    c. In the first and second sentences of paragraph .10, the word 
``competent'' is replaced with the word ``appropriate.''

[[Page 59361]]

    d. In the second sentence of paragraph .12, the word ``competent'' 
is replaced with the word ``appropriate.''
    e. The last two sentences of paragraph .12 are deleted.
    f. In the first sentence of paragraph .13, the word ``competent'' 
is replaced with the word ``appropriate.''
    g. In paragraph .17, the word ``competent'' is replaced with the 
word ``appropriate.''
    h. In the second sentence of paragraph .21, the word ``competent'' 
is replaced with the word ``appropriate.''
    i. In the fourth sentence of paragraph .22, the word ``competent'' 
is replaced with the word ``appropriate.''
    j. In paragraph .23, the word ``competent'' is replaced with the 
word ``appropriate.''
    k. Paragraphs .24-.41 are deleted, along with the headings ``3. The 
Auditor's Consideration of the Completeness Assertion'' and ``4. 
Applying Auditing Procedures to Segment Disclosures in Financial 
Statements.''
    AU sec. 328, ``Auditing Fair Value Measurements and Disclosures''
    SAS No. 101, ``Auditing Fair Value Measurements and Disclosures'' 
(AU sec. 328, ``Auditing Fair Value Measurements and Disclosures''), as 
amended, is amended as follows:
    a. In the first sentence of paragraph .03, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. The phrase in paragraph .11 ``Section 319, Consideration of 
Internal Control in a Financial Statement Audit, as amended,'' is 
replaced with ``Auditing Standard No. 12, Identifying and Assessing 
Risks of Material Misstatement,''
    c. The reference in paragraph .14 to Section 319 is replaced with a 
reference to Paragraph A5, second note of Auditing Standard No. 5, An 
Audit of Internal Control Over Financial Reporting That Is Integrated 
with An Audit of Financial Statements.
    d. In the second sentence of paragraph .14, the reference ``(see 
section 316, Consideration of Fraud in a Financial Statement Audit'' is 
deleted.
    e. Within paragraph .25, in the second sentence of the second 
bullet point and in the first sentence in the third bullet point, the 
word ``competent'' is replaced with the word ``appropriate.''
    f. In the second sentence of paragraph .32, the word ``competent'' 
is replaced with the word ``appropriate.''
    g. In the first sentence of paragraph .42, the word ``competent'' 
is replaced with the word ``appropriate.''
    h. In footnote 8 to paragraph .43, the reference to section 431, 
Adequacy of Disclosure in Financial Statements, is replaced with a 
reference to ``paragraph 31 of Auditing Standard No. 14, Evaluating 
Audit Results.''
    i. In the second sentence of paragraph .44, the word ``competent'' 
is replaced with the word ``appropriate.''
    j. The reference in paragraph .47 to section 312, Audit Risk and 
Materiality in Conducting an Audit, paragraphs .36 through .41, is 
replaced with a reference to paragraphs 12 through 18 and 24 through 27 
of Auditing Standard No. 14, Evaluating Audit Results.
    AU sec. 329, ``Analytical Procedures''
    SAS No. 56, ``Analytical Procedures'' (AU sec. 329, ``Analytical 
Procedures''), as amended, is amended as follows:
    a. The title of the standard, ``Analytical Procedures,'' is 
replaced with the title, ``Substantive Analytical Procedures.''
    b. The text of paragraph .01 is replaced with: This section 
establishes requirements regarding the use of substantive analytical 
procedures in an audit.
    Note: Auditing Standard No. 12, Identifying and Assessing Risks of 
Material Misstatement, establishes requirements regarding performing 
analytical procedures as a risk assessment procedure in identifying and 
assessing risks of material misstatement.
    Note: Auditing Standard No. 14, Evaluating Audit Results, 
establishes requirements regarding performing analytical procedures as 
part of the overall review stage of the audit.
    c. The last sentence of paragraph .03 is deleted.
    d. The text of paragraph .04 is replaced with: Analytical 
procedures are used as a substantive test to obtain evidential matter 
about particular assertions related to account balances or classes of 
transactions. In some cases, analytical procedures can be more 
effective or efficient than tests of details for achieving particular 
substantive testing objectives.
    e. Paragraphs .06-.08 and the preceding heading, ``Analytical 
Procedures in Planning the Audit,'' are deleted.
    f. At the end of paragraph .09, the following new sentence is 
added: (See paragraph 11 of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement.)
    g. Within footnote 1 to paragraph .09, the reference to section 
326, Evidential Matter, is replaced with a reference to Auditing 
Standard No. 15, Audit Evidence.
    h. Footnote 2 to paragraph .20 is deleted.
    i. In paragraph .21:
    <bullet> In the fourth sentence, the word ``likely'' is deleted.
    <bullet> The reference to section 316, Consideration of Fraud in a 
Financial Statement Audit, is replaced with a reference to Auditing 
Standard No. 14, Evaluating Audit Results.
    j. Footnote 3 to paragraph .21 is deleted.
    k. Paragraph .23 and the preceding heading, ``Analytical Procedures 
Used in the Overall Review,'' and paragraph .24 and the preceding 
heading, ``Effective Date,'' are deleted.
    AU sec. 330, ``The Confirmation Process''
    SAS No. 67, ``The Confirmation Process'' (AU sec. 330, ``The 
Confirmation Process''), is amended as follows:
    a. The references in paragraph .02 to section 312, Audit Risk and 
Materiality in Conducting an Audit, and section 313, Substantive Tests 
Prior to the Balance-Sheet Date, are replaced with a reference to 
Auditing Standard No. 13, The Auditor's Responses to the Risks of 
Material Misstatement.
    b. The reference in paragraph .05 to Section 312 is replaced with a 
reference to Auditing Standard No. 8, Audit Risk.
    c. The second sentence of paragraph .06 is replaced with: See 
paragraph 8 of Auditing Standard No. 15, Audit Evidence, which 
discusses the reliability of audit evidence.
    d. In the first sentence of paragraph .11, the word ``competent'' 
is replaced with the word ``appropriate.''
    e. In the third sentence of paragraph .11, the reference to Section 
326 is replaced with a reference to Auditing Standard No. 15, Audit 
Evidence.
    f. In the first sentence of paragraph .24, the word ``competence'' 
is replaced with the word ``appropriateness.''
    g. In the last sentence of paragraph .27, the word ``competent'' is 
replaced with the word ``appropriate.''
    AU sec. 332, ``Auditing Derivative Instruments, Hedging Activities, 
and Investments in Securities''
    SAS No. 92, ``Auditing Derivative Instruments, Hedging Activities, 
and Investment in Securities'' (AU sec. 332, ``Auditing Derivative 
Instruments, Hedging Activities, and Investments in Securities''), as 
amended, is amended as follows:
    a. The reference in paragraph .01 to section 326, Evidential 
Matter, paragraphs .03-.08, is replaced with a reference to paragraphs 
11 and 12 of Auditing Standard No. 15, Audit Evidence.
    b. Paragraph .06 is replaced with: Auditing Standard No. 9, Audit 
Planning, discusses the auditor's responsibilities for consideration of 
the use of persons with specialized skill or knowledge. Auditing 
Standard No. 10,

[[Page 59362]]

Supervision of the Audit Engagement, discusses the auditor's 
responsibilities for supervision of specialists who are employed by the 
auditor. AU sec. 336, Using the Work of a Specialist, discusses the 
auditor's responsibilities for using the work of a specialist engaged 
by the auditor.
    c. The first and second sentences of paragraph .07 are deleted. The 
third sentence is replaced with:
    The auditor should design and perform audit procedures regarding 
relevant assertions of derivatives and investments in securities that 
are based on and that address the risks of material misstatement in 
those assertions.
    d. The reference in paragraph .09 to Section 319, Consideration of 
Internal Control in a Financial Statement Audit, is replaced with a 
reference to Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement.
    e. The fourth sentence of paragraph .11 is replaced with 
``Paragraphs 28 through 32 and B1 through B6 of Auditing Standard No. 
12, Identifying and Assessing Risks of Material Misstatement, discuss 
the information system, including related business processes, relevant 
to financial reporting.''
    f. In paragraph .15, the reference to section 319 is replaced with 
a reference to Auditing Standard No. 12, Identifying and Assessing 
Risks of Material Misstatement.
    g. The last sentence of paragraph .35 is replaced with: In 
addition, paragraphs 24 through 27 of Auditing Standard No. 14, 
Evaluating Audit Results, describe the auditor's responsibilities for 
assessing bias in accounting estimates.
    h. In paragraph .43, subparagraph a., the word ``competent'' is 
replaced with the word ``appropriate.''
    i. In paragraph .51, the last sentence is replaced with: (See 
paragraph 31 of Auditing Standard No. 14, Evaluating Audit Results.)
    j. In paragraph .57, subparagraph c., the word ``competent'' is 
replaced with the word ``appropriate.''
    AU sec. 333, ``Management Representations''
    SAS No. 85, ``Management Representations'' (AU sec. 333, 
``Management Representations''), as amended, is amended as follows:
    a. Footnote 4 to paragraph .06 is replaced with: Auditing Standard 
No. 14, Evaluating Audit Results, indicates that a misstatement can 
arise from error or fraud and also discusses the auditor's 
responsibilities for evaluating accumulated misstatements.
    b. Within footnote 6 to paragraph .06, the reference to Section 312 
is replaced with a reference to Paragraph 11 of Auditing Standard No. 
14, Evaluating Audit Results.
    c. Within footnote 7 to paragraph .06, the reference to section 
316, Consideration of Fraud in a Financial Statement Audit, paragraphs 
.38 through .40, is replaced with a reference to section 316, 
Consideration of Fraud in a Financial Statement Audit, paragraphs .79 
through .82.
    AU sec. 334, ``Related Parties''
    SAS No. 45, ``Related Parties'' (AU sec. 334 ``Related Parties''), 
is amended as follows:
    a. In the second sentence of paragraph .09, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. In the first sentence of paragraph .11, the word ``competent'' 
is replaced with the word ``appropriate.''
    c. In footnote 8 to paragraph .11, the reference to section 431, 
Adequacy of Disclosure in Financial Statements, is replaced with a 
reference to paragraph 31 of Auditing Standard No. 14, Evaluating Audit 
Results.
    AU sec. 9334, ``Related Parties: Auditing Interpretations of 
Section 334''
    AU sec. 9334, ``Related Parties: Auditing Interpretations of 
Section 334,'' is amended as follows: Within footnote 4 to paragraph 
.17, the reference to section 312, Audit Risk and Materiality in 
Conducting an Audit, is replaced with a reference to Auditing Standard 
No. 8, Audit Risk.
    AU sec. 336, ``Using the Work of a Specialist''
    SAS No. 73, ``Using the Work of a Specialist'' (AU sec. 336, 
``Using the Work of a Specialist''), is amended as follows:
    a. Footnote 1 to paragraph .01 is replaced with the following: 
Because income taxes and information technology are specialized areas 
of accounting and auditing, this section does not apply to situations 
in which an income tax specialist or information technology specialist 
participates in the audit. Auditing Standard No. 10, Supervision of the 
Audit Engagement, applies in those situations.
    b. Paragraph .05 is replaced with the following: This section does 
not apply to situations in which a specialist employed by the auditor's 
firm participates in the audit. Auditing Standard No. 10, Supervision 
of the Audit Engagement, applies in those situations.
    c. In the last sentence of paragraph .06, the word ``competent'' is 
replaced with the word ``appropriate.''
    d. In the first and last sentences of paragraph .13, the word 
``competent'' is replaced with the word ``appropriate.''
    AU sec. 9336, ``Using the Work of a Specialist: Auditing 
Interpretations of Section 336''
    AU sec. 9336, ``Using the Work of a Specialist: Auditing 
Interpretations of Section 336,'' is amended as follows:
    a. In the second sentence of paragraph .04, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. In paragraph .05, the word ``competent'' is replaced with the 
word ``appropriate.''
    c. In the second sentence of paragraph .11, the word ``competent'' 
is replaced with the word ``appropriate.''
    d. The penultimate sentence of paragraph .15, is replaced with: 
Paragraph 6 of Auditing Standard No. 15, Audit Evidence, states, ``[t]o 
be appropriate, audit evidence must be both relevant and reliable in 
providing support for the conclusions on which the auditor's opinion is 
based.''
    AU sec. 341, ``The Auditor's Consideration of an Entity's Ability 
to Continue as a Going Concern''
    SAS No. 59, ``The Auditor's Consideration of an Entity's Ability to 
Continue as Going Concern'' (AU sec. 341, ``The Auditor's Consideration 
of an Entity's Ability to Continue as a Going Concern''), as amended, 
is amended as follows: The reference in paragraph .02 to section 326, 
Evidential Matter, is replaced with a reference to Auditing Standard 
No. 15, Audit Evidence.
    AU sec. 342, ``Auditing Accounting Estimates''
    SAS No. 57, ``Auditing Accounting Estimates'' (AU sec. 342, 
``Auditing Accounting Estimates''), as amended, is amended as follows:
    a. In the first sentence of paragraph .01, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. In the first sentence of paragraph .07, the word ``competent'' 
is replaced with the word ``appropriate.''
    c. The text of footnote 3 to paragraph .07 is replaced with: See 
paragraph 31 of Auditing Standard No. 14, Evaluating Audit Results.
    d. The reference in paragraph .08 subparagraph b.1. to section 311, 
Planning and Supervision, is replaced with a reference to Auditing 
Standard No. 12, Identifying and Assessing Risks of Material 
Misstatement.
    e. Paragraph .14, is replaced with: Paragraphs 24 through 27 of 
Auditing Standard No. 14, Evaluating Audit Results, discuss the 
auditor's responsibilities for assessing bias and evaluating accounting 
estimates in relationship to the financial statements taken as a whole.
    AU sec. 9342, ``Auditing Accounting Estimates: Auditing 
Interpretations of Section 342''

[[Page 59363]]

    AU sec. 9342, ``Auditing Accounting Estimates: Auditing 
Interpretations of Section 342,'' is amended as follows: In the second 
sentence of paragraph .02, the word ``competent'' is replaced with the 
word ``appropriate.''
    AU sec. 350, ``Audit Sampling''
    SAS No. 39, ``Audit Sampling'' (AU sec. 350, ``Audit Sampling''), 
as amended, is amended as follows:
    a. Within footnote 2 to paragraph .02, the reference to section 
312, Audit Risk and Materiality in Conducting an Audit, is replaced 
with a reference to Auditing Standard No. 14, Evaluating Audit Results.
    b. The last sentence of paragraph .03 is replaced with: Either 
approach to audit sampling can provide sufficient evidential matter 
when applied properly. This section applies to both nonstatistical and 
statistical sampling.
    c. Paragraph .04 is deleted.
    d. In paragraph .06:
    <bullet> The first sentence is deleted.
    <bullet> In the last sentence, the word ``competence'' is replaced 
with the word ``appropriateness.''
    <bullet> The following note is added to the paragraph:
    Note: Auditing Standard No. 15, Audit Evidence, discusses the 
appropriateness of audit evidence, and Auditing Standard No. 14, 
Evaluating Audit Results, discusses the auditor's responsibilities for 
evaluating the sufficiency and appropriateness of audit evidence.
    e. Paragraph .08 is deleted.
    f. In paragraph .09:
    <bullet> The sentence in paragraph .09 referring to section 313, 
which is in parentheses, is deleted.
    <bullet> The following note is added to the paragraph:
    Note: Auditing Standard No. 8, Audit Risk, describes audit risk and 
its components in a financial statement audit--the risk of material 
misstatement (consisting of inherent risk and control risk) and 
detection risk.
    g. In paragraph .11:
    <bullet> The phrase ``(see section 311, Planning and Supervision)'' 
is deleted.
    <bullet> The sentence ``(See section 313.)'' is deleted.
    h. The second sentence of paragraph .15 is replaced with: See 
Auditing Standard No. 9, Audit Planning.
    i. In the first bullet in paragraph .16, the phrase ``(see section 
326, Evidential Matter)'' is deleted.
    j. In the second bullet of paragraph .16, the phrase ``Preliminary 
judgments about materiality levels'' is replaced with the phrase 
``Tolerable misstatement. (See paragraphs .18-18A.)''
    k. Paragraph .18 is replaced with: Evaluation in monetary terms of 
the results of a sample for a substantive test of details contributes 
directly to the auditor's purpose, since such an evaluation can be 
related to his or her judgment of the monetary amount of misstatements 
that would be material. When planning a sample for a substantive test 
of details, the auditor should consider how much monetary misstatement 
in the related account balance or class of transactions may exist, in 
combination with other misstatements, without causing the financial 
statements to be materially misstated. This maximum monetary 
misstatement for the account balance or class of transactions is called 
tolerable misstatement.
    l. Paragraph .18A is added: Paragraphs 8-9 of Auditing Standard No. 
11, Consideration of Materiality in Planning and Performing an Audit, 
describe the auditor's responsibilities for determining tolerable 
misstatement at the account or disclosure level. When the population to 
be sampled constitutes a portion of an account balance or transaction 
class, the auditor should determine tolerable misstatement for the 
population to be sampled for purposes of designing the sampling plan. 
Tolerable misstatement for the population to be sampled ordinarily 
should be less than tolerable misstatement for the account balance or 
transaction class to allow for the possibility that misstatement in the 
portion of the account or transaction class not subject to audit 
sampling, individually or in combination with other misstatements, 
would cause the financial statements to be materially misstated.
    m. Paragraph .20 is deleted.
    n. The first sentence of paragraph .21 is replaced with the 
following sentence: The sufficiency of tests of details for a 
particular account balance or class of transactions is related to the 
individual importance of the items examined as well as to the potential 
for material misstatement.
    o. Paragraph .23 is replaced with: To determine the number of items 
to be selected in a sample for a particular substantive test of 
details, the auditor should take into account tolerable misstatement 
for the population; the allowable risk of incorrect acceptance (based 
on the assessments of inherent risk, control risk, and the detection 
risk related to the substantive analytical procedures or other relevant 
substantive tests); and the characteristics of the population, 
including the expected size and frequency of misstatements.
    p. Paragraph .23A is added: Table 1 of the Appendix describes the 
effects of the factors discussed in the preceding paragraph on sample 
sizes in a statistical or nonstatistical sampling approach. When 
circumstances are similar, the effect on sample size of those factors 
should be similar regardless of whether a statistical or nonstatistical 
approach is used. Thus, when a nonstatistical sampling approach is 
applied properly, the resulting sample size ordinarily will be 
comparable to, or larger than, the sample size resulting from an 
efficient and effectively designed statistical sample.
    q. The last sentence of paragraph .25 is replaced with: The auditor 
also should evaluate whether the reasons for his or her inability to 
examine the items have (a) implications in relation to his or her risk 
assessments (including the assessment of fraud risk), (b) implications 
regarding the integrity of management or employees, and (c) possible 
effects on other aspects of the audit.
    r. Footnote 6 to paragraph .26 is replaced with: Paragraphs 10 
through 23 of Auditing Standard No. 14, Evaluating Audit Results, 
discuss the auditor's consideration of differences between the 
accounting records and the underlying facts and circumstances.
    s. Within footnote 7 to paragraph .32, the phrase ``(see section 
319.85)'' is deleted. In the first sentence of the footnote, the phrase 
``often plans'' is replaced with the phrase ``may plan.'' The last 
sentence of the footnote, which is in brackets, is deleted.
    t. The last sentence of paragraph .38 is replaced with: When 
circumstances are similar, the effect on sample size of those factors 
should be similar regardless of whether a statistical or nonstatistical 
approach is used. Thus, when a nonstatistical sampling approach is 
applied properly, the resulting sample size ordinarily will be 
comparable to, or larger than, the sample size resulting from an 
efficient and effectively designed statistical sample.
    u. The fifth sentence of paragraph .39 is replaced with: Paragraphs 
44 through 46 of Auditing Standard No. 13, The Auditor's Responses to 
the Risks of Material Misstatement, describe the auditor's 
responsibilities for performing procedures between the interim date of 
testing and period end.
    v. In paragraph .39, the last sentence, which is in brackets, is 
deleted.
    w. In paragraph .44:
    <bullet> The first sentence is replaced with: In some 
circumstances, the auditor may design a sample that will be used for 
dual purposes: as a test of control and as a substantive test.

[[Page 59364]]

    <bullet> The third sentence is replaced with: For example, an 
auditor designing a test of a control over entries in the voucher 
register may design a related substantive test at a risk level that is 
based on an expectation of reliance on the control.
    <bullet> The fifth sentence is replaced with: In evaluating such 
tests, deviations from the control that was tested and monetary 
misstatements should be evaluated separately using the risk levels 
applicable for the respective purposes.
    <bullet> The following Note is added to the paragraph:
    Note: Paragraph 47 of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement, provides additional 
discussion of the auditor's responsibilities for performing dual-
purpose tests.
    x. The reference in paragraph .45 to paragraph .04 is changed to a 
reference to paragraph .03.
    y. In item 2 of paragraph .48, the last sentence is deleted.
    z. Within footnote 1 to item 4 in paragraph .48, the sentence 
``(See section 313.)'' is deleted.
    aa. The sentence in item 6 of paragraph .48 ``(See section 313.)'' 
is deleted.
    AU sec. 9350, ``Audit Sampling: Auditing Interpretations of Section 
350''
    AU sec. 9350, ``Audit Sampling: Auditing Interpretations of Section 
350,'' is superseded.
    AU sec. 380, ``Communication With Audit Committees''
    SAS No. 61, ``Communication With Audit Committees'' (AU sec. 380, 
``Communication With Audit Committees''), as amended, is amended as 
follows:
    In footnote 5 to paragraph .10, the reference to section 
316A.38-.40 is replaced with a reference to AU secs. 316.79-.82; the 
reference to section 316A is replaced with a reference to section 316.
    AU sec. 411, ``The Meaning of Present Fairly in Conformity With 
Generally Accepted Accounting Principles''
    SAS No. 69, ``The Meaning of Present Fairly in Conformity With 
Generally Accepted Accounting Principles'' (AU sec. 411, ``The Meaning 
of Present Fairly in Conformity with Generally Accepted Accounting 
Principles''), as amended, is amended as follows:
    a. In paragraph .04, the reference in (c) to section 431 is 
replaced with a reference to paragraph 31 of Auditing Standard No. 14, 
Evaluating Audit Results; in (d), the reference to section 431 is 
replaced with a reference to paragraph 31 of Auditing Standard No. 14.
    b. The reference in footnote 1 to paragraph .04 to 312.10 is 
replaced with a reference to Auditing Standard No. 11, Consideration of 
Materiality in Planning and Performing an Audit.
    AU sec. 431, ``Adequacy of Disclosure in Financial Statements''
    SAS No. 32, ``Adequacy of Disclosure in Financial Statements'' (AU 
sec. 431, ``Adequacy of Disclosure in Financial Statements''), as 
amended, is superseded.
    AU sec. 508, ``Reports on Audited Financial Statements''
    SAS No. 58, ``Reports on Audited Financial Statements'' (AU sec. 
508, ``Reports on Audited Financial Statements''), as amended, is 
amended as follows:
    a. In paragraph 18C, the phrase ``and in AU sec. 431'' is deleted.
    b. In subparagraph .20.a., the word ``competent'' is replaced with 
the word ``appropriate.''
    c. In the second sentence of paragraph .22, the word ``competent'' 
is replaced with the word ``appropriate.''
    d. In the third sentence of paragraph .24, the word ``competent'' 
is replaced with the word ``appropriate.''
    e. In footnote 15 to paragraph .38, the first sentence is replaced 
with:
    In this context, practicable means that the information is 
reasonably obtainable from management's accounts and records and that 
providing the information in the report does not require the auditor to 
assume the position of a preparer of financial information.
    f. The references in paragraph .49 to section 312, Audit Risk and 
Materiality, and to section 342, Auditing Accounting Estimates, are 
replaced with a reference to paragraph 13 of Auditing Standard No. 14, 
Evaluating Audit Results.
    g. In the first sentence of paragraph .63, the word ``competent'' 
is replaced with the word ``appropriate.''
    h. In paragraph .66, the second sentence is replaced with:
    (See paragraph 31 of Auditing Standard No. 14, Evaluating Audit 
Results.)
    AU sec. 9508, ``Reports on Audited Financial Statements: Auditing 
Interpretations of Section 508''
    AU sec. 9508, ``Reports on Audited Financial Statements: Auditing 
Interpretations of Section 508,'' is amended as follows:
    In paragraph .02, the word ``competent'' is replaced with the word 
``appropriate.''
    AU sec. 530, ``Dating of the Independent Auditor's Report''
    SAS No. 1, ``Codification of Auditing Standards and Procedures,'' 
section 530, ``Dating of the Independent Auditor's Report'' (AU sec. 
530, ``Dating of the Independent Auditor's Report''), as amended, is 
amended as follows:
    a. In the first sentence of paragraph .01, the word ``competent'' 
is replaced with the word ``appropriate.''
    b. In the second note to paragraph .01, the word ``competent'' is 
replaced with the word ``appropriate.''
    c. In the first sentence of paragraph .05, the word ``competent'' 
is replaced with the word ``appropriate.''
    AU sec. 543, ``Part of Audit Performed by Other Independent 
Auditors''
    SAS No. 1, ``Codification of Auditing Standards and Procedures,'' 
section 543 ``Part of Audit Performed by Other Independent Auditors'' 
(AU sec. 543, ``Part of Audit Performed by Other Independent 
Auditors''), as amended, is amended as follows:
    a. The following note is added as the second note to paragraph .01:
    Note: For situations in which the auditor engages an accounting 
firm or individual accountants to participate in the audit engagement 
and AU sec. 543 does not apply, the auditor should supervise them in 
accordance with the requirements of Auditing Standard No. 10, 
Supervision of the Audit Engagement.
    b. Within paragraph .12:
    <bullet> Subparagraph b. is replaced with: A list of significant 
risks, the auditor's responses, and the results of the auditor's 
related procedures.
    <bullet> Subparagraph f. is replaced with: A schedule of 
accumulated misstatements, including a description of the nature and 
cause of each accumulated misstatement, and an evaluation of 
uncorrected misstatements, including the quantitative and qualitative 
factors the auditor considered to be relevant to the evaluation.
    AU sec. 9543, ``Part of Audit Performed by Other Independent 
Auditors: Auditing Interpretations of Section 543''
    AU sec. 9543, ``Part of Audit Performed by Other Independent 
Auditors: Auditing Interpretations of Section 543,'' as amended, is 
amended as follows:
    a. Paragraph .16 is replaced with: Interpretation--The principal 
auditor's response should ordinarily be made by the engagement partner. 
The engagement partner should take those steps that he or she considers 
reasonable under the circumstances to be informed of known matters 
pertinent to the other auditor's inquiry. For example, the engagement 
partner may inquire of engagement team members responsible for various 
aspects of the engagement or he or she may direct engagement team 
members to bring to his or her attention

[[Page 59365]]

any significant matters of which they become aware during the audit. 
The principal auditor is not required to perform any procedures 
directed toward identifying matters that would not affect his or her 
audit or his or her report.
    b. Footnote 4 to paragraph .16 is deleted.
    AU sec. 722, ``Interim Financial Information''
    SAS No. 100, ``Interim Financial Information'' (AU sec. 722, 
``Interim Financial Information''), as amended, is amended as follows:
    a. Within footnote 7 to paragraph .11, the first sentence is 
replaced with: Paragraphs 10 through 23 of Auditing Standard No. 14, 
Evaluating Audit Results, require the auditor to accumulate and 
evaluate the misstatements identified during the audit.
    b. The reference in paragraph .13 to section 319, Consideration of 
Internal Control in a Financial Statement Audit, is replaced with a 
reference to Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement.
    c. Within the last sentence of paragraph .16, the title of section 
329, ``Analytical Procedures,'' is replaced with the title 
``Substantive Analytical Procedures.''
    d. Footnote 20 to paragraph .26 is deleted.
    e. The reference in paragraph .56, subparagraph C5, to section 319 
is replaced with a reference to section 316.
    Auditing Standard No. 3, Audit Documentation
    Auditing Standard No. 3, Audit Documentation, as amended, is 
amended as follows:
    a. Within paragraph 3, subparagraph b. is replaced with: 
Supervisory personnel who review documentation prepared by other 
members of the engagement team.
    b. Paragraph 9A is added: Documentation of risk assessment 
procedures and responses to risks of misstatement should include (1) a 
summary of the identified risks of misstatement and the auditor's 
assessment of risks of material misstatement at the financial statement 
and assertion levels and (2) the auditor's responses to the risks of 
material misstatement, including linkage of the responses to those 
risks.
    c. Within paragraph 12:
    <bullet> Within subparagraph a.:, (1) a footnote reference 2A is 
added at the end of the first sentence: See paragraphs 12-13 of 
Auditing Standard No. 12, Identifying and Assessing Risks of Material 
Misstatement, and paragraphs .66-.67 of AU sec. 316, Consideration of 
Fraud in a Financial Statement Audit. and (2) the second sentence of 
subparagraph a. is deleted.
    <bullet> Subparagraph b. is replaced with: Results of auditing 
procedures that indicate a need for significant modification of planned 
auditing procedures, the existence of material misstatements (including 
omissions in the financial statements), and the existence of 
significant deficiencies or material weaknesses in internal control 
over financial reporting.
    <bullet> Subparagraph c. is replaced with: Accumulated 
misstatements and evaluation of uncorrected misstatements, including 
the quantitative and qualitative factors the auditor considered to be 
relevant to the evaluation.
    <bullet> Footnote 2B is added to subparagraph c.: See paragraphs 
10-23 of Auditing Standard No. 14, Evaluating Audit Results.
    <bullet> Subparagraph d. is replaced with: Disagreements among 
members of the engagement team or with others consulted on the 
engagement about final conclusions reached on significant accounting or 
auditing matters, including the basis for the final resolution of those 
disagreements. If an engagement team member disagrees with the final 
conclusions reached, he or she should document that disagreement.
    <bullet> Subparagraph f. is replaced with: Significant changes in 
the auditor's risk assessments, including risks that were not 
identified previously, and the modifications to audit procedures or 
additional audit procedures performed in response to those changes.
    <bullet> Footnote 2C is added to subparagraph f.: See paragraph 74 
of Auditing Standard No. 12, Identifying and Assessing Risks of 
Material Misstatement, and paragraph 36 of Auditing Standard No. 14, 
Evaluating Audit Results.
    <bullet> Subparagraph f-1. is added: Risks of material misstatement 
that are determined to be significant risks and the results of the 
auditing procedures performed in response to those risks.
    d. Within paragraph 19:
    <bullet> Subparagraph b. is replaced with: A list of significant 
risks, the auditor's responses, and the results of the auditor's 
related procedures.
    <bullet> Subparagraph f. is replaced with: A schedule of 
accumulated misstatements, including a description of the nature and 
cause of each accumulated misstatement, and an evaluation of 
uncorrected misstatements, including the quantitative and qualitative 
factors the auditor considered to be relevant to the evaluation.
    e. Paragraph 21 and the preceding heading, ``Effective Date,'' are 
deleted.
    Auditing Standard No. 4, Reporting on Whether a Previously Reported 
Material Weakness Continues to Exist
    Auditing Standard No. 4, Reporting on Whether a Previously Reported 
Material Weakness Continues to Exist, as amended, is amended as 
follows: In the first sentence of paragraph 18, the word ``competent'' 
is replaced with the word ``appropriate.''
    Auditing Standard No. 5, An Audit of Internal Control Over 
Financial Reporting That Is Integrated with An Audit of Financial 
Statements
    Auditing Standard No. 5, An Audit of Internal Control Over 
Financial Reporting That Is Integrated with An Audit of Financial 
Statements, is amended as follows:
    a. In the second sentence of paragraph 3, the word ``competent'' is 
replaced with the word ``appropriate.''
    b. In the first sentence of paragraph 9, the phrase ``any 
assistants'' is replaced with the phrase ``the engagement team 
members.''
    c. Within footnote 10 to paragraph 14, the reference to paragraphs 
.19-.42 of AU sec. 316, Consideration of Fraud in a Financial Statement 
Audit, is replaced with a reference to Auditing Standard No. 12, 
Identifying and Assessing Risks of Material Misstatement.
    d. The reference in paragraph 15 to AU sec. 316.44 and .45 is 
replaced with a reference to paragraphs 65-69 of Auditing Standard No. 
12, Identifying and Assessing Risks of Material Misstatement.
    e. Within footnote 11 to paragraph 20, the reference to AU sec. 
312, Audit Risk and Materiality in Conducting an Audit, is replaced 
with a reference to Auditing Standard No. 11, Consideration of 
Materiality in Planning and Performing an Audit.
    f. Within footnote 12 to paragraph 28, the reference to AU sec. 
326, Evidential Matter, is replaced with a reference to Auditing 
Standard No. 15, Audit Evidence.
    g. Within footnote 13 to the note to paragraph 31, the reference to 
AU sec. 312.39 is replaced with a reference to paragraph 14 of Auditing 
Standard No. 14, Evaluating Auditing Results. The reference to AU sec. 
316.50 is replaced with a reference to paragraph 5 of Auditing Standard 
No. 13, The Auditor's Responses to the Risks of Material Misstatement.
    h. The references in paragraph 36 to paragraphs .16-.20, .30-.32, 
and .77-.79 of AU sec. 319, Consideration of Internal Control in a 
Financial Statement Audit, are replaced with references to paragraph 29 
and

[[Page 59366]]

Appendix B of Auditing Standard No. 12, Identifying and Assessing Risks 
of Material Misstatement.
    i. In the first sentence of paragraph 51, the word ``competent'' is 
replaced with the word ``appropriate.''
    j. In the first sentence of paragraph 89, the word ``competent'' is 
replaced with the word ``appropriate.''
    k. Within the note to paragraph C6 in Appendix C, the word 
``competent'' is replaced with the word ``appropriate.''
    Auditing Standard No. 6, Evaluating Consistency of Financial 
Statements
    Auditing Standard No. 6, Evaluating Consistency of Financial 
Statements, is amended as follows:
    a. Footnote 3 to paragraph 4 is deleted.
    b. In paragraph 10, the reference to AU sec. 431, Adequacy of 
Disclosure in Financial Statements, is replaced with a reference to 
paragraph 31 of Auditing Standard No. 14, Evaluating Audit Results.
    Auditing Standard No. 7, Engagement Quality Review
    Auditing Standard No. 7, Engagement Quality Review, is amended as 
follows:
    a. Footnote 3 to paragraph 5 is replaced with: The term 
``engagement partner'' has the same meaning as the ``practitioner-in-
charge of an engagement'' in PCAOB interim quality control standard QC 
sec. 40, The Personnel Management Element of a Firm's System of Quality 
Control-Competencies Required by a Practitioner-in-Charge of an Attest 
Engagement. QC sec. 40 describes the competencies required of a 
practitioner-in-charge of an attest engagement.
    b. In paragraph 10, the note following subparagraph b. is replaced 
with: Note: A significant risk is a risk of material misstatement that 
requires special audit consideration.

Ethics Standards

    ET sec. 102, ``Integrity and Objectivity''
    ET sec. 102, ``Integrity and Objectivity,'' is amended as follows: 
Footnote 1 to paragraph .05 is replaced with: See paragraph 5.b. of 
Auditing Standard No. 10, Supervision of the Audit Engagement, and 
paragraph 12.d. of Auditing Standard No. 3, Audit Documentation.

II. Board's Statement of the Purpose of, and Statutory Basis for, the 
Proposed Rules

    In its filing with the Commission, the Board included statements 
concerning the purpose of, and basis for, the proposed rules and 
discussed any comments it received on the proposed rules. The text of 
these statements may be examined at the places specified in Item IV 
below. The Board has prepared summaries, set forth in sections A, B, 
and C below, of the most significant aspects of such statements.

A. Board's Statement of the Purpose of, and Statutory Basis for, the 
Proposed Rules

(a) Purpose
    Section 103(a) of the Act directs the Board, by rule, to establish, 
among other things, ``auditing and related attestation standards * * * 
to be used by registered public accounting firms in the preparation and 
issuance of audit reports, as required by th[e] Act or the rules of the 
Commission, or as may be necessary or appropriate in the public 
interest or for the protection of investors.'' As discussed more fully 
in Exhibit 3, the Board adopted eight auditing standards and related 
amendments that benefit investors by establishing requirements that 
enhance the effectiveness of the auditor's assessment of and response 
to the risks of material misstatement in an audit.
    In an audit performed in accordance with PCAOB standards, risk 
underlies the entire audit process, including the procedures that the 
auditor performs to support the opinion expressed in the auditor's 
report. Most of the Board's interim auditing standards relating to 
assessing and responding to risk in an audit of financial statements 
were developed in the 1980s.\154\ Those standards described in general 
terms the auditor's responsibilities for assessing and responding to 
risk. They directed auditors to vary the amount of audit attention 
related to particular financial statement accounts based on the risks 
presented by them. The standards also allowed the auditor to use tests 
of controls to reduce substantive testing.\155\
---------------------------------------------------------------------------

    \154\ Examples of those standards include AU sec. 312, Audit 
Risk and Materiality in Conducting an Audit, and AU sec. 319, 
Consideration of Internal Control in a Financial Statement Audit.
    \155\ AU sec. 319.
---------------------------------------------------------------------------

    A number of factors and events led the Board to reexamine those 
standards and seek to improve them. These included the widespread use 
of risk-based audit methodologies; recommendations to the profession on 
ways in which auditors could improve risk assessment; \156\ advice from 
the Board's Standing Advisory Group (``SAG''); \157\ adoption of 
Auditing Standard No. 5, An Audit of Internal Control Over Financial 
Reporting That Is Integrated with An Audit of Financial Statements; and 
observations from the Board's oversight activities.
---------------------------------------------------------------------------

    \156\ See, e.g., Public Oversight Board, Panel on Audit 
Effectiveness (``PAE''), Report and Recommendations (August 31, 
2000). For a summary of the PAE's recommendations related to risk 
assessment, see PCAOB Standing Advisory Group (``SAG'') Meeting 
Briefing Paper, ``Risk Assessment in Financial Statement Audits'' 
(February 16, 2005), Appendix A, available at: http://www.pcaobus.org/News_and_Events/Events/2005/02-16.aspx.
    \157\ Webcasts of SAG meetings are available on the Board's Web 
site at: http://www.pcaobus.org/News_and_Events/Webcasts.
---------------------------------------------------------------------------

    On October 21, 2008, the Board proposed a set of auditing standards 
to update the requirements for assessing and responding to risk in an 
audit (``the original proposed standards'').\158\ The original proposed 
standards were intended to improve the auditing standards and to 
benefit investors by establishing requirements that enhance the 
effectiveness of auditors' assessment of and response to risk through:
---------------------------------------------------------------------------

    \158\ PCAOB Release No. 2008-006, Proposed Auditing Standards 
Related to the Auditor's Assessment of and Response to Risk (October 
21, 2008).

<bullet> Performing procedures that provide a reasonable basis for 
identifying and assessing risks of material misstatement, whether due 
to error or fraud
<bullet> Tailoring the audit to respond appropriately to the risks of 
material misstatement
<bullet> Making a comprehensive evaluation of the evidence obtained 
during the audit to form the opinion(s) in the auditor's report

    The Board also sought to emphasize the auditor's responsibilities 
for consideration of fraud by incorporating requirements for 
identifying and responding to the risks of material misstatement due to 
fraud (``fraud risks'') and evaluating audit results from the existing 
PCAOB standard, AU sec. 316, Consideration of Fraud in a Financial 
Statement Audit.\159\ Incorporating these requirements makes clear that 
the auditor's responsibilities for assessing and responding to fraud 
risks are an integral part of the audit process rather than a separate, 
parallel process. It also benefits investors by prompting auditors to 
make a more thoughtful and thorough assessment of fraud risks and to 
develop appropriate audit responses.
---------------------------------------------------------------------------

    \159\ Paragraphs .14-.51 and paragraphs .68-.78 of AU sec. 316, 
Consideration of Fraud in a Financial Statement Audit.
---------------------------------------------------------------------------

    Improvements in the standards related to risk assessment also 
should enhance integration of the audit of financial statements with 
the audit of internal control over financial reporting (``audit of 
internal control'') by articulating a process for identifying and 
assessing risks of material misstatement that applies to both portions 
of the

[[Page 59367]]

integrated audit when the auditor is performing an integrated audit.
    The proposed rules also amend the Board's interim standards 
including superseding the following sections of PCAOB interim auditing 
standards:

<bullet> AU sec. 311, Planning and Supervision
<bullet> AU sec. 312, Audit Risk and Materiality in Conducting an Audit
<bullet> AU sec. 313, Substantive Tests Prior to the Balance Sheet Date
<bullet> AU sec. 319, Consideration of Internal Control in a Financial 
Statement Audit
<bullet> AU sec. 326, Evidential Matter
<bullet> AU sec. 431, Adequacy of Disclosure in Financial Statements

    Similarly, the auditing interpretations of AU secs. 311, 312, and 
350 have been incorporated into the risk assessment standards and thus 
are superseded. The auditing interpretations of AU sec. 326, except for 
Interpretation No. 2 (AU secs. 9326.06-.23), also are superseded.\160\
---------------------------------------------------------------------------

    \160\ Interpretation No. 2 relates in part to AU sec. 336 and AU 
sec. 337, Inquiry of a Client's Lawyer Concerning Litigation, 
Claims, and Assessments, and it will be evaluated in connection with 
standards-setting projects related to those standards.
---------------------------------------------------------------------------

(b) Statutory Basis
    The statutory basis for the proposed rules is Title I of the Act.

B. Board's Statement on Burden on Competition

    The Board does not believe that the proposed rule changes will 
result in any burden on competition that is not necessary or 
appropriate in furtherance of the purposes of the Act. The proposed 
rule changes would apply equally to all registered public accounting 
firms conducting audits in accordance with PCAOB standards.

C. Board's Statement on Comments on the Proposed Rules Received From 
Members, Participants or Others

    The Board released the proposed rules for public comment in PCAOB 
Release No. 2008-006 (October 21, 2008). The Board received 33 written 
comments. The Board considered these comments and made changes to the 
initial proposed rules. As a result, the Board again sought public 
comment in PCOAB Release No. 2009-007 (December 21, 2009). The Board 
received 23 written comment letters relating to its reproposal of the 
proposed rules. A copy of PCAOB Release Nos. 2008-006 and 2009-007 and 
the comment letters received in response to the PCAOB's request for 
comment in both releases are available on the PCAOB's Web site at 
http://www.pcaobus.org.
    The Board has carefully considered all comments it has received. In 
response to the written comments received on both the initial and 
reproposal of the proposed rules, the Board has clarified and modified 
certain aspects of the proposed rules, as discussed below.
Overview of the Risk Assessment Standards
    Many commenters on the original proposed standards were supportive 
of the Board's efforts to update its risk assessment requirements and 
offered numerous suggestions for changing the original proposed 
standards. After considering all of the comments received on those 
standards, the Board made numerous refinements to the original proposed 
standards. Because the standards address many fundamental aspects of 
the audit process and are expected to serve as a foundation for future 
standards-setting, the Board reproposed the standards for public 
comment on December 17, 2009 (``the reproposed standards'').\161\
---------------------------------------------------------------------------

    \161\ PCAOB Release No. 2009-007, Proposed Auditing Standards 
Related to the Auditor's Assessment of and Response to Risk 
(December 17, 2009).
---------------------------------------------------------------------------

    The Board received 23 comment letters on the reproposed 
standards.\162\ The Board discussed the comments received with the SAG 
on April 8, 2010.\163\ Most commenters were generally supportive of the 
reproposed standards and the improvements made to those standards. Many 
commenters also offered suggestions to improve the standards, which the 
Board has carefully analyzed.
---------------------------------------------------------------------------

    \162\ Comments on the original proposed standards and the 
reproposed standards are available on the Board's Web site at: 
http://www.pcaobus.org/Rules/Rulemaking/Pages/Docket026.aspx.
    \163\ A transcript of the portion of the meeting that related to 
the reproposed standards is available on the Board's Web site at: 
http://www.pcaobus.org/Rules/Rulemaking/Pages/Docket026.aspx.
---------------------------------------------------------------------------

    After consideration of the comments received, the Board has refined 
the standards to provide additional clarity. The Board has decided to 
adopt the following standards for assessing and responding to risk in 
an audit and the related amendments to PCAOB standards:

<bullet> Auditing Standard No. 8, Audit Risk
<bullet> Auditing Standard No. 9, Audit Planning
<bullet> Auditing Standard No. 10, Supervision of the Audit Engagement
<bullet> Auditing Standard No. 11, Consideration of Materiality in 
Planning and Performing an Audit
<bullet> Auditing Standard No. 12, Identifying and Assessing Risks of 
Material Misstatement
<bullet> Auditing Standard No. 13, The Auditor's Responses to the Risks 
of Material Misstatement
<bullet> Auditing Standard No. 14, Evaluating Audit Results
<bullet> Auditing Standard No. 15, Audit Evidence
1. Notable Areas of Change in the Standards
    The changes made to the reproposed standards reflect refinements 
rather than significant shifts in approach. This section describes the 
areas of change to the reproposed standards that are most notable, 
e.g., because they affect multiple standards or multiple sections of an 
individual standard. This Release discusses these and other changes in 
more detail.
a. Planning and Supervision Standards
    The reproposed standards included a standard covering both audit 
planning and supervision. Some commenters observed that audit planning 
and supervision should be covered in separate standards.
    Audit planning and supervision, although related in some respects, 
are distinct activities that should be presented in separate standards. 
Accordingly, the Board has divided the planning and supervision 
standard into separate standards for planning and for supervision. 
Presenting the requirements for planning and supervision in separate 
standards is a technical change that, by itself, does not affect the 
auditor's responsibilities for planning the audit or supervision of the 
work of engagement team members as described in the reproposed 
standards.
b. Requirements for Multi-Location Audits
    The reproposed standard on audit planning and supervision included 
requirements regarding establishing the scope of testing of individual 
locations in multi-location engagements. The reproposed standard on 
consideration of materiality in planning and performing an audit 
included requirements for determining materiality of individual 
locations in multi-location audits. Some commenters requested 
clarification on the Board's expectations regarding how to apply those 
requirements in audits in which part of the work is performed by other 
auditors, specifically, auditors of financial statements of individual 
locations or business units that are included in the consolidated 
financial statements.
    The multi-location requirements have been revised to take into 
account situations in which part of the work is

[[Page 59368]]

performed by other auditors.\164\ This release discusses those 
revisions in more detail and explains the Board's expectations 
regarding how to apply the respective requirements in situations 
involving other auditors.
---------------------------------------------------------------------------

    \164\ Paragraphs 11-14 of Auditing Standard No. 9, Audit 
Planning, and paragraph 10 of Auditing Standard No. 11, 
Consideration of Materiality in Planning and Performing an Audit.
---------------------------------------------------------------------------

    The reproposed standard on audit planning and supervision also 
included a statement, similar to a statement in Auditing Standard No. 
5, that ``The direction in paragraph 5 of Proposed Auditing Standard, 
The Auditor's Responses to the Risks of Material Misstatement, 
regarding incorporating an element of unpredictability in the auditing 
procedures means that the auditor should vary the nature, timing, and 
extent of audit procedures at locations or business units from year to 
year.'' Some commenters stated that the statement in the reproposed 
audit planning and supervision standard was unnecessarily prescriptive. 
After considering the comments received, the requirement regarding 
unpredictability was removed from the audit planning standard, and the 
discussion in Auditing Standard No. 13 regarding incorporating an 
element of unpredictability was expanded to include varying the testing 
in the selected locations.\165\ However, this does not change the 
requirements in Auditing Standard No. 5 regarding incorporating 
unpredictability in testing controls at individual locations in audits 
of internal control.\166\
---------------------------------------------------------------------------

    \165\ Paragraph 5 of Auditing Standard No. 13, The Auditor's 
Responses to the Risks of Material Misstatement.
    \166\ Paragraphs 61 and B13 of Auditing Standard No. 5.
---------------------------------------------------------------------------

c. Requirement for Performing Walkthroughs
    In the original proposed standards, the standard on identifying and 
assessing risks of material misstatement referred auditors to Auditing 
Standard No. 5 for a discussion of the performance of walkthroughs. 
Some commenters on the original proposed standards stated that the 
proposed standard should include a discussion of walkthroughs rather 
than referring to Auditing Standard No. 5. The reproposed standard on 
identifying and assessing risks of material misstatement included a 
discussion of the objectives for understanding likely sources of 
potential misstatements and of performing walkthroughs, which 
paralleled a discussion in Auditing Standard No. 5.\167\ Some 
commenters expressed concerns that those new requirements would lead to 
unnecessary walkthroughs, particularly in audits of financial 
statements only.
---------------------------------------------------------------------------

    \167\ Paragraph 34 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    The intention of including the discussion of walkthroughs was to 
describe how to perform walkthroughs, not to impose additional 
requirements regarding when to perform walkthroughs. The discussion has 
been revised to focus on how the auditor should perform walkthroughs, 
and the discussion of the objectives for understanding likely sources 
of potential misstatements has been removed.\168\ Consequently, the 
objectives in paragraph 34 of Auditing Standard No. 5 for understanding 
potential sources of likely misstatement will continue to apply only to 
integrated audits.
---------------------------------------------------------------------------

    \168\ Paragraphs 37-38 of Auditing Standard No. 12, Identifying 
and Assessing Risks of Material Misstatement.
---------------------------------------------------------------------------

d. Requirements Regarding Financial Statement Disclosures
    Because of the importance of disclosures to the fair presentation 
of financial statements and based on observations from the Board's 
oversight activities, the reproposed standards included additional 
requirements intended to increase the auditor's attention on the 
disclosures in the financial statements. For example, the reproposed 
standard on identifying and assessing risks of material misstatement 
included a new requirement related to developing an expectation about 
the necessary financial statement disclosures as part of obtaining an 
understanding of the company and its environment. Some commenters 
stated that the requirements should be clarified as applying to 
disclosures required by the applicable financial reporting framework. 
Also, the reproposed standard on evaluating audit results included 
expanded requirements for the auditor to evaluate whether the financial 
statements include the required disclosures. Some commenters stated 
that the standard should clarify that the requirements apply only to 
material disclosures.
    After analyzing the comments, those two requirements have been 
revised to clarify that they refer to the fair presentation of the 
financial statements in conformity with the applicable financial 
reporting framework.\169\
---------------------------------------------------------------------------

    \169\ Paragraph 13 of Auditing Standard No. 12 and paragraph 31 
of Auditing Standard No. 14, Evaluating Audit Results.
---------------------------------------------------------------------------

2. Discussion of Comments That Relate to Many of the Reproposed 
Standards
    The following paragraphs discuss matters raised by commenters that 
relate to many of the reproposed standards. Section II.C.13 of this 
release contains a discussion of other topics raised by commenters on 
matters other than the risk assessment standards or the related 
amendments.
a. Consideration of Fraud in the Audit
    Section I of the Board's adopting release discusses the Board's 
objectives regarding incorporating into its risk assessment standards 
the requirements for identifying and responding to risks of material 
misstatement due to fraud (``fraud risks'') and evaluating audit 
results from AU sec. 316, Consideration of Fraud in a Financial 
Statement Audit.\170\
---------------------------------------------------------------------------

    \170\ The risk assessment standards incorporate paragraphs 
.14-.51 and .68-.78 of AU sec. 316. Accordingly, those paragraphs 
are removed from AU sec. 316 by means of a related amendment.
---------------------------------------------------------------------------

    The number of comments received on this approach to incorporate the 
requirements from AU sec. 316 declined significantly from the original 
proposed standards.\171\ The views of commenters continue to be mixed. 
One commenter supported the approach, and two commenters expressed 
concerns about the approach.
---------------------------------------------------------------------------

    \171\ As discussed in Section I, the risk assessment standards 
were originally proposed on October 21, 2008. See PCAOB Release No. 
2008-006, Proposed Auditing Standards Related to the Auditor's 
Assessment of and Response to Risk.
---------------------------------------------------------------------------

    The risk assessment standards continue to include relevant 
requirements from AU sec. 316. The Board has observed from its 
oversight activities instances in which auditors have performed the 
procedures required in AU sec. 316 mechanically, without using the 
procedures to develop insights on fraud risk or to modify the audit 
plan to address that risk. The Board also has observed instances in 
which firms have failed to respond appropriately to identified fraud 
risks.
    These observations suggest that some auditors may improperly view 
the consideration of fraud as an isolated, mechanical process rather 
than an integral part of audits under PCAOB standards. Integrating the 
requirements from AU sec. 316 into the risk assessment standards 
emphasizes to auditors that assessing and responding to fraud risks is 
an integral part of an audit in accordance with PCAOB standards, rather 
than a separate consideration. Such integration also should prompt 
auditors to make a more thoughtful and thorough assessment of the risks 
affecting the financial

[[Page 59369]]

statements, including fraud risks, and to develop appropriate audit 
responses. Furthermore, AU sec. 316, as amended, will continue to 
provide relevant information on determining the necessary procedures 
for considering fraud in a financial statement audit. (See section 
II.C.11.F.(ii). of this release for more discussion about AU sec. 316.)
b. Organization and Style of Standards (Including the Use of Notes and 
Appendices)
    In response to comments on the original proposed standards, the 
Board presented the reproposed standards using an organization and 
style that is intended to be a template for future standards of the 
Board. The organization and style includes an objective for each 
standard, which provides additional context for understanding the 
requirements in the standard, and a separate appendix for definitions 
of terms used in each standard.
    Commenters generally supported the organization and style of the 
reproposed standards, and some commenters suggested that existing PCAOB 
standards be revised to implement this organization and style. As 
stated in the release accompanying the reproposed standards, the 
organization and style used in the reproposed standards draws from 
previously issued standards of the Board, e.g., Auditing Standard No. 
7, Engagement Quality Review. Also, the Board will apply this template 
in the course of its other standards-setting activities.
    Commenters expressed concerns about including requirements in 
appendices and notes to the standard. Consistent with standards 
previously issued by the Board, the notes and appendices in the risk 
assessment standards are integral parts of the standards and carry the 
same authoritative weight as the other portions of the standards.
c. Use of Terms
    PCAOB Rule 3101, Certain Terms Used in Auditing and Related 
Professional Practice Standards, sets forth the terminology that the 
Board uses to describe the degree of responsibility that the auditing 
and related professional practice standards impose on auditors. The 
original proposed standards used terms in the requirements in a manner 
that was consistent with Rule 3101.
    Some comments received on the original proposed standards suggested 
revisions to the terms used in the requirements or asked for 
clarification about certain terms or phrases, e.g., ``take into 
account.'' The reproposed standards reflected numerous revisions to the 
terms used in the standards, and the risk assessment standards reflect 
further refinements. For example, the standards use ``should consider'' 
only when referring to a requirement to consider performing an action 
or procedure, which is consistent with Rule 3101.
    As explained in the release accompanying the reproposed standards, 
the phrase ``take into account'' has been used previously in PCAOB 
standards in reference to information or matters that the auditor 
should think about or give attention to in performing an audit 
procedure or reaching a conclusion.\172\ Accordingly, the results of 
the auditor's thinking on the relevant matters should be reflected in 
the performance and documentation of the respective audit procedure 
performed or conclusion reached. The accompanying standards continue to 
use ``take into account'' in the same way.
---------------------------------------------------------------------------

    \172\ AU sec. 316.45 and paragraphs 14, 44, 59, and B 12 of 
Auditing Standard No. 5, An Audit of Internal Control Over Financial 
Reporting That Is Integrated with An Audit of Financial Statements.
---------------------------------------------------------------------------

    Some commenters asked about the meaning of certain terms, e.g., 
``assess,'' ``evaluate,'' or ``determine.'' Those commenters also 
stated that the Board should use those terms consistently throughout 
its standards. The Board has reviewed the use of each of those terms 
and has revised the standards as necessary to apply those terms more 
consistently. Subsequent sections of this release discuss specific 
revisions to the individual standards.
    One commenter expressed concerns about statements that involve the 
use of present tense in the reproposed standards. As with standards 
that the Board previously issued, the present tense is used in the risk 
assessment standards for statements that are factual or definitional, 
e.g., to provide additional explanation of a required auditing 
procedure.\173\ Subsequent sections of this release discuss specific 
instances of the use of present tense in the risk assessment standards.
---------------------------------------------------------------------------

    \173\ See, e.g., paragraph 21 of Auditing Standard No. 5 for an 
example of the use of the present tense for this purpose.
---------------------------------------------------------------------------

d. Requirements and the Application of Judgment
    Some commenters on the original proposed standards stated that the 
original proposed standards contained requirements that were ``too 
prescriptive,'' limiting the auditor's ability to ``use professional 
judgment or scale the audit,'' e.g., because of the number of 
requirements in the standards and because the standards did not 
explicitly refer to professional judgment in the requirements. In the 
release accompanying the reproposed standards, the Board discussed the 
importance of professional judgment in fulfilling the requirements of 
the standards. After examining each requirement, the Board revised 
certain provisions in the reproposed standards to streamline the 
presentation of those requirements.
    Although the Board received fewer comments on the reproposed 
standard related to this topic, two commenters continue to express 
concerns about whether the reproposed standards made adequate allowance 
for the auditor to use professional judgment in assessing and 
responding to risk in an audit.
    PCAOB standards recognize that the auditor uses judgment in 
planning and performing audit procedures and evaluating the evidence 
obtained from those procedures.\174\ As under other PCAOB standards, 
auditors need to exercise judgment in fulfilling the requirements of 
the risk assessment standards in the particular circumstances. Making 
references to judgment in selected portions of the standards, however, 
could be misinterpreted as indicating that judgment is required only in 
certain aspects of the audit. Instead of referring to judgment 
selectively, the risk assessment standards set forth principles for 
meeting the requirements of the standards and allow the auditor to 
determine the most appropriate way to comply with the requirements in 
the circumstances.
---------------------------------------------------------------------------

    \174\ See, e.g., paragraph .11 of AU sec. 230, Due Professional 
Care in the Performance of Work.
---------------------------------------------------------------------------

3. Auditing Standard No. 8--Audit Risk

a. Background
    Auditing Standard No. 8 discusses audit risk and the relationships 
among the various components of audit risk in an audit of financial 
statements. The standard applies to integrated audits and to audits of 
financial statements only.
b. Objective
    The reproposed standard stated that the objective of the auditor is 
to conduct the audit of financial statements in a manner that reduces 
audit risk to an appropriately low level. This objective provided 
important context for understanding how the concept of audit risk is 
applied in an audit.
    One commenter observed that the reproposed standards sometimes used 
the phrase, ``appropriately low level'' and occasionally used the 
phrase ``acceptably low level,'' and that

[[Page 59370]]

commenter suggested revising the standards to use ``acceptably low 
level'' in each instance. The Board continues to believe the term 
``appropriately low level'' is more suitable because it is aligned more 
closely with the degree of assurance described in the auditor's 
opinion, i.e., the auditor conducts the audit to reduce audit risk to 
an appropriately low level in order to express an opinion with 
reasonable assurance. In contrast, the term ``acceptably low'' is less 
clear and could be misinterpreted. The risk assessment standards have 
been revised to use the phrase ``appropriately low level,'' as 
applicable.
c. Due Professional Care and Sufficient Appropriate Audit Evidence
    The reproposed standard stated that, to form an appropriate basis 
for expressing an opinion on the financial statements, the auditor must 
plan and perform the audit to obtain reasonable assurance about whether 
the financial statements are free of material misstatement due to error 
or fraud. It also stated that reasonable assurance is obtained by 
reducing audit risk to an appropriately low level through applying due 
professional care, including obtaining sufficient appropriate audit 
evidence.\175\
---------------------------------------------------------------------------

    \175\ Paragraph 3 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    A commenter suggested that due professional care is a 
responsibility throughout the audit, similar to professional skepticism 
and judgment, and need not be repeated throughout the Board's 
standards. The Board agrees that due professional care is a 
responsibility throughout the audit. On the other hand, existing PCAOB 
standards state that due professional care allows the auditor to obtain 
reasonable assurance,\176\ and the statement in Auditing Standard No. 8 
acknowledges that principle.
---------------------------------------------------------------------------

    \176\ AU sec. 230.10.
---------------------------------------------------------------------------

d. Audit Risk and Risk of Material Misstatement
    Some commenters on the original proposed standard requested more 
explanation about risks at the overall financial statement level, e.g., 
by providing examples of such risks. The reproposed standard elaborated 
further on risks at the financial statement level.\177\
---------------------------------------------------------------------------

    \177\ Paragraph 6 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    Commenters on the reproposed standard asked for more explanation 
regarding how financial statement level risks can result in material 
misstatement of the financial statements. The examples of financial 
statement level risks in Auditing Standard No. 8 have been expanded to 
illustrate how those risks can result in material misstatement of the 
financial statements.\178\
---------------------------------------------------------------------------

    \178\ Ibid.
---------------------------------------------------------------------------

    Some individual commenters offered suggestions for refining or 
clarifying the discussion of the risk of material misstatement and its 
components. For example, one commenter suggested that the description 
of the risk of material misstatement should state that the risk exists 
``prior to the audit'' to more clearly indicate that it is the 
company's risk. The Board agrees that the risk of material misstatement 
exists irrespective of the audit, while the risk of not detecting 
material misstatement is the auditor's risk. However, the suggested 
phrase could be misinterpreted, e.g., as implying that the auditor need 
not consider the risk of misstatements occurring during the audit.
    The reproposed standard included a statement that inherent risk and 
control risk are the company's risks; they exist independently of the 
audit. One commenter suggested that the statement was not informative 
and suggested revising the standard to state that inherent risk and 
control risk are functions of the company's characteristics, but 
influence the auditor's actions. The Board agrees that more discussion 
of the auditor's consideration of inherent risk and control risk is 
appropriate. Thus, Auditing Standard No. 8 has been expanded to discuss 
the sources of evidence the auditor uses when assessing inherent risk 
and control risk.\179\ Also, the description of control risk in 
Auditing Standard No. 8 has been aligned with the discussion of 
internal control concepts in Auditing Standard No. 5.
---------------------------------------------------------------------------

    \179\ Paragraph 8 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    One commenter expressed a concern that descriptions of inherent 
risk, control risk, and detection risk that included the phrase ``that 
could be material, individually or in combination with other 
misstatements,'' may be misinterpreted by the auditor as a requirement 
to consider whether the combination of dissimilar risks will result in 
a material misstatement. The commenter suggested changing 
``combination'' to ``aggregate.'' However, the standard does not 
discuss the combination of risks but, rather, the risk of a 
misstatement that could be material, individually or in combination 
with other misstatements, which is consistent with the description of 
the auditor's evaluation of uncorrected misstatements in Auditing 
Standard No. 14, Evaluating Audit Results. Thus, the term 
``combination'' was retained as proposed.
e. Detection Risk
    The reproposed standard indicated that detection risk is reduced by 
performing substantive procedures. Some commenters stated that the 
discussion of detection risk should be modified to indicate that 
auditors can reduce detection risk through procedures other than 
substantive procedures (e.g., risk assessment procedures and tests of 
controls). A commenter also suggested changing the sentence in the 
standard to refer to ``audit procedures'' instead of ``substantive 
procedures.''
    The Board acknowledges that auditors might obtain evidence of 
misstatements through procedures other than substantive procedures. 
However, that does not diminish the auditor's responsibility to plan 
and perform substantive procedures for significant accounts and 
disclosures that are sufficient to provide reasonable assurance of 
detecting misstatements that would result in material misstatement of 
the financial statements. Changing ``substantive procedures'' to 
``audit procedures,'' as suggested by the commenter, is not consistent 
with AU sec. 319, Consideration of Internal Control in a Financial 
Statement Audit, and could be misunderstood by auditors, resulting in 
inadequate substantive procedures.\180\ To provide further 
clarification, Auditing Standard No. 8 has been revised to describe the 
role of risk assessment procedures and tests of controls in assessing 
the risk of material misstatement, which, in turn, affects the 
appropriate level of detection risk.\181\
---------------------------------------------------------------------------

    \180\ AU secs. 319.81-.82. AU sec. 319, along with AU sec. 311, 
Planning and Supervision, AU sec. 312, Audit Risk and Materiality in 
Conducting an Audit, AU sec. 313, Substantive Tests Prior to the 
Balance Sheet Date, AU sec. 326, Evidential Matter, and AU sec. 431, 
Adequacy of Disclosure in Financial Statements, are superseded by 
the risk assessment standards.
    \181\ Paragraphs 8-9 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    Some commenters expressed concerns that the reproposed standard did 
not adequately link the concepts of inherent risk and control risk to 
detection risk. They stated that a discussion on the relationship of 
these concepts is necessary for the auditor to determine the acceptable 
level of detection risk for the financial statement assertions, which, 
in turn, is used to determine the nature, timing, and extent of 
substantive procedures. The following discussion, which is adapted from 
AU sec. 319, was added to paragraph 10 of Auditing

[[Page 59371]]

Standard No. 8: ``The auditor uses the assessed risk of material 
misstatement to determine the appropriate level of detection risk for a 
financial statement assertion. The higher the risk of material 
misstatement, the lower the level of detection risk needs to be in 
order to reduce audit risk to an appropriately low level.'' \182\
---------------------------------------------------------------------------

    \182\ Paragraph 10 of Auditing Standard No. 8.
---------------------------------------------------------------------------

f. Integrated Audit Considerations
    Auditing Standard No. 8 applies both to audits of financial 
statements only and to the financial statement audit portion of 
integrated audits. Audit risk in the audit of financial statements 
relates to whether the auditor expresses an inappropriate audit opinion 
when the financial statements are materially misstated, while audit 
risk in an audit of internal control over financial reporting (``audit 
of internal control'') relates to whether the auditor expresses an 
inappropriate audit opinion when one or more material weaknesses exist. 
The two forms of audit risk are related, however, and Auditing Standard 
No. 12, Identifying and Assessing Risks of Material Misstatement, 
indicates that the risk assessment procedures apply to both the audit 
of financial statements and the audit of internal control.
    Some commenters suggested revisions to the first paragraph and the 
first footnote of the reproposed standard to clarify how the concepts 
of audit risk in this standard apply to audits of financial statements 
only and to integrated audits. The first paragraph has been revised to 
indicate that Auditing Standard No. 8 applies to either an audit of 
financial statements only or to an integrated audit. The first footnote 
also has been revised to clarify that, in integrated audits, the risks 
of material misstatement are the same for both the audit of financial 
statements and the audit of internal control.

4. Auditing Standard No. 9--Audit Planning

a. Background
    Auditing Standard No. 9 describes the auditor's responsibilities 
for planning an integrated audit or an audit of financial statements 
only.
b. Planning and Supervision
    The original proposed standard and the reproposed standard 
discussed both audit planning and supervision, similar to AU sec. 311. 
Some commenters observed that audit planning and supervision should be 
covered in separate standards.
    The Board agrees that audit planning and supervision of engagement 
team members are distinct activities that should be covered in separate 
standards. Accordingly, the Board has divided the requirements of the 
reproposed planning and supervision standard into separate standards. 
Dividing the requirements for planning and supervision into separate 
standards does not affect the auditor's responsibilities for planning 
the audit or supervising the work of engagement team members.
c. Responsibilities of the Engagement Partner
    AU sec. 311 stated, ``The auditor with final responsibility for the 
audit may delegate portions of the planning and supervision of the 
audit to other firm personnel.'' Auditing Standard No. 9 uses the term 
``engagement partner'' instead of ``auditor with final responsibility 
for the audit'' and states more directly that the engagement partner is 
responsible for properly planning the audit. The standard also allows 
the engagement partner to seek assistance from appropriate engagement 
team members in fulfilling his or her planning responsibilities. 
Because the requirements in Auditing Standard No. 9 apply to the 
engagement partner and engagement team members who assist the 
engagement partner in planning the audit, the standard uses the term 
``auditor,'' and a footnote was added to clarify that the requirements 
in the standard apply to the engagement partner and other engagement 
team members who participate in planning the audit.
d. Preliminary Engagement Activities
    The reproposed standard included a note in paragraph 6 stating that 
the decision regarding continuance of the client relationship and the 
determination of compliance with independence and ethics requirements 
were not limited to preliminary engagement activities and should be 
reevaluated with changes in circumstances. One commenter expressed 
concern that the note did not describe the changes in circumstances for 
which it would be appropriate for the auditor to reevaluate these 
decisions. The acceptance and continuance of the client relationship 
are discussed in QC sec. 20, System of Quality Control for a CPA Firm's 
Accounting and Auditing Practice. Other PCAOB standards discuss certain 
circumstances that warrant reevaluating the client relationship.\183\ 
Auditors also may reevaluate their engagement acceptance decision for 
other reasons. However, because auditors must comply with independence 
and ethics requirements throughout the audit, the note was moved in 
Auditing Standard No. 9 to modify paragraph 6.b. and revised to state 
that determination of compliance with independence and ethics 
requirements is not limited to preliminary engagement activities and 
should be reevaluated upon changes in circumstances.
---------------------------------------------------------------------------

    \183\ See, e.g., paragraphs .18-.21 of AU sec. 317, Illegal Acts 
by Clients.
---------------------------------------------------------------------------

e. Planning Activities
    The reproposed standard stated that, as part of establishing the 
audit strategy and audit plan, the auditor should evaluate whether 
certain matters specified in the standard are important to the 
company's financial statements and internal control over financial 
reporting (``internal control'') and, if so, how those matters would 
affect the auditor's procedures. The requirement in the reproposed 
standard was the same as in paragraph 9 of Auditing Standard No. 5, 
thus extending its application to an audit of financial statements.
    Evaluation of the matters listed in paragraph 7 of Auditing 
Standard No. 9 can lead auditors to develop more effective audit 
strategies and audit plans. For example, evaluation of those matters 
can highlight areas that might warrant additional attention during the 
auditor's risk assessment procedures, which, in turn, could affect the 
audit procedures performed in response to the risks of material 
misstatement. Also, evaluation of the internal control related matters 
can help the auditor develop an appropriate audit strategy, e.g., in 
determining accounts for which reliance on controls might be 
appropriate in the audit of financial statements.
    Some commenters suggested changes to the requirement, including 
deleting some of the matters discussed in the requirement, moving other 
matters elsewhere within the standard, or making specific revisions to 
the language of the standard. Also, some commenters suggested using 
``should consider'' instead of ``should evaluate.''
    The Board considered the suggested changes to the standard and 
determined that those changes would not substantially improve the 
standard. Also, it is important for the language in this requirement to 
be identical to the language in Auditing Standard No. 5 to emphasize 
that this required procedure is to be performed only once in an 
integrated audit, with the results of the procedure to be applied in 
planning both the financial statement audit and the audit of internal 
control. Also, reframing the requirement from ``should evaluate'' to 
``should consider'' would

[[Page 59372]]

weaken the requirement. Therefore, Auditing Standard No. 9 retains the 
wording from the reproposed standard.
f. Audit Strategy and Audit Plan
    Auditing Standard No. 9 requires the auditor to take into account 
certain matters when establishing the overall audit strategy, including 
the reporting objectives of the engagement and the nature of the 
communications required by PCAOB standards; the factors that are 
significant in directing the activities of the engagement team; the 
results of preliminary engagement activities and the auditor's 
evaluation of certain important matters; and the nature, timing, and 
extent of resources necessary to perform the engagement.\184\ These 
matters generally relate to information that auditors obtain through 
other required procedures. One commenter suggested that this 
requirement should discuss the need for specialists. Auditing Standard 
No. 9 was revised to include a reference to paragraph 16 regarding the 
requirement for the auditor to determine whether specialized skill or 
knowledge is needed to perform the engagement.
---------------------------------------------------------------------------

    \184\ Paragraph 9 of Auditing Standard No. 9.
---------------------------------------------------------------------------

    The reproposed standard required the auditor to develop and 
document an audit plan that includes the planned nature, timing, and 
extent of the risk assessment procedures. One commenter suggested that 
it was unnecessary to document the timing of the risk assessment 
procedures because risk assessment is an ongoing process that occurs 
throughout the execution of the audit. Auditing Standard No. 9 retains 
the requirement to document the timing of the risk assessment 
procedures. Identifying and appropriately assessing the risks of 
material misstatement provide a basis for designing and implementing 
responses to the risks of material misstatement, so the timing of the 
risk assessment procedures is important to determine the timing of 
other audit procedures.
    The reproposed standard also required the auditor to develop and 
document the planned nature, timing, and extent of tests of controls 
and substantive procedures. One commenter suggested that the 
requirement should specify that the audit plan include planned tests at 
the ``relevant assertion level.'' Auditing Standard No. 9 retains the 
requirement as reproposed. Audit procedures are not performed only at 
the assertion level, e.g., certain general audit procedures and tests 
of certain entity-level controls in the audit of internal control over 
financial reporting. Therefore, it is not appropriate to update the 
standard with the suggested language.
g. Requirements for Multi-Location Engagements
    Auditing Standard No. 9 establishes requirements that apply to 
audits of companies with operations in multiple locations or business 
units. Auditing Standard No. 9 requires the auditor to determine the 
extent to which audit procedures should be performed at selected 
locations or business units to obtain sufficient appropriate evidence 
to obtain reasonable assurance about whether the consolidated financial 
statements are free of material misstatement. This includes determining 
the locations or business units at which to perform audit procedures, 
as well as the nature, timing, and extent of the procedures to be 
performed at those individual locations or business units. The auditor 
is required to assess the risks of material misstatement to the 
consolidated financial statements associated with the location or 
business unit and correlate the amount of audit attention devoted to 
the location or business unit with the degree of risk of material 
misstatement associated with that location or business unit. Auditing 
Standard No. 9 also lists factors that are relevant to the assessment 
of the risks of material misstatement associated with a particular 
location or business unit and the determination of the necessary audit 
procedures. These requirements are risk-focused and aligned with the 
requirements in Auditing Standard No. 5.
    An example was added to one of the factors in Auditing Standard No. 
9 to highlight that the auditor's consideration of risks associated 
with a location or business unit includes whether significant unusual 
transactions are executed at that location or business unit, e.g., 
whether certain transactions were conducted at the location or business 
unit to achieve a particular accounting result. AU sec. 316 already 
requires the auditor to perform procedures regarding significant 
unusual transactions.
    The reproposed standard included a statement, similar to Auditing 
Standard No. 5, that ``The direction in paragraph 5 of Proposed 
Auditing Standard, The Auditor's Responses to the Risks of Material 
Misstatement, regarding incorporating an element of unpredictability in 
the auditing procedures means that the auditor should vary the nature, 
timing, and extent of audit procedures at locations or business units 
from year to year.'' Some commenters stated that the statement in the 
reproposed standard was unnecessarily prescriptive. After considering 
the comments received, the requirement regarding unpredictability was 
removed from the audit planning standard, and the requirements in 
Auditing Standard No. 13, The Auditor's Responses to the Risks of 
Material Misstatement, regarding incorporating an element of 
unpredictability were expanded to include discussion of varying the 
testing in the selected locations.\185\ However, this does not change 
the requirements in Auditing Standard No. 5 regarding incorporating 
unpredictability in testing controls at individual locations in audits 
of internal control.\186\
---------------------------------------------------------------------------

    \185\ Paragraph 5 of Auditing Standard No. 13.
    \186\ Paragraphs 61 and B13 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    The reproposed standard included a requirement for the auditor to 
determine the extent to which auditing procedures should be performed 
at selected locations or business units to obtain sufficient 
appropriate evidence to obtain reasonable assurance about whether the 
consolidated financial statements are free of material misstatements. 
One commenter was concerned that the use of the term ``consolidated 
financial statements'' is inconsistent with the terminology used 
elsewhere in the standards and that the financial statements of 
companies with multiple divisions might not meet the definition of 
consolidated. The use of ``consolidated financial statements'' is 
consistent with the term used in Auditing Standard No. 5. The use of 
the term ``consolidated'' applies to situations in which the company 
has multiple locations or business units. Auditing Standard No. 9 
retains the language as reproposed.
    Some commenters requested clarification on how the requirements are 
expected to be applied in audits in which part of the work is performed 
by other auditors of financial statements of individual locations or 
business units that are included in the consolidated financial 
statements. A paragraph was added to Auditing Standard No. 9 to clarify 
that the auditor should apply the requirements in paragraphs 11-13 to 
determine the locations or business units for testing when the auditor 
plans to use the work and reports of other independent auditors who 
have audited the financial statements of one or more of the locations 
or business units (including subsidiaries, divisions, branches, 
components, or investments) that are included in the consolidated 
financial statements. AU sec. 543, Part of Audit Performed by Other

[[Page 59373]]

Independent Auditors, describes the auditor's responsibilities when the 
auditor uses the work and reports of other independent auditors.\187\
---------------------------------------------------------------------------

    \187\ Paragraph 14 of Auditing Standard No. 9.
---------------------------------------------------------------------------

h. Persons With Specialized Skill or Knowledge
    Auditing Standard No. 9 indicates that the auditor should determine 
whether specialized skill or knowledge is needed to perform appropriate 
risk assessments, plan or perform audit procedures, or evaluate audit 
results. The responsibility has been extended from a similar 
requirement in AU sec. 311 regarding considering whether specialized 
information technology (``IT'') skill or knowledge is needed in an 
audit. The requirement was extended to specialized skill or knowledge 
in areas besides IT, e.g., valuation specialists, actuarial 
specialists, income tax specialists, and forensic specialists, because 
of the prevalent use of such individuals by auditors.
    The reproposed standard included a note that described the term 
``specialized skill or knowledge'' as persons engaged or employed by 
the auditor who have specialized skill or knowledge. Some commenters 
suggested that this note be removed because paragraph 17 included a 
similar description. The note was removed from Auditing Standard No. 9 
because it was unnecessary and redundant.
    One commenter suggested revising the standard to require the 
auditor to consider using a fraud specialist. The suggested requirement 
to consider using a fraud specialist was not added to Auditing Standard 
No. 9 because the requirement in the reproposed standard already covers 
fraud specialists, and the types of specialized skill or knowledge that 
might be needed on a particular audit depend on the particular 
circumstances and the skill and knowledge of the engagement team.
    Some commenters suggested that the requirements relating to the 
involvement of specialists be reframed as ``assisting'' the auditor. 
Such a formulation is too narrow to describe the range of involvement 
of specialists, which could include providing assistance to the auditor 
or actually performing audit procedures.
    Paragraph 17 of Auditing Standard No. 9 describes the required 
level of knowledge of the subject matter in terms of the general types 
of procedures that the auditor should be able to perform with regard to 
the person with specialized skill or knowledge. Paragraph 17, by 
itself, does not impose procedural requirements for working with 
persons with specialized skill or knowledge because those 
responsibilities already are described in either the supervision 
provisions of Auditing Standard No. 10, Supervision of the Audit 
Engagement, or AU sec. 336, Using the Work of a Specialist, as 
applicable.
5. Auditing Standard No. 10--Supervision of the Audit Engagement
a. Background
    Auditing Standard No. 10 sets forth requirements for supervising 
the audit engagement, including supervising the work of engagement team 
members.
    Auditing Standard No. 10 retains the basic requirements regarding 
supervision from AU sec. 311, with changes to align the requirements 
more closely with the other risk assessment standards. Auditing 
Standard No. 10 does not change the responsibilities for supervision 
from those in the supervision section of the reproposed standard on 
audit planning and supervision. However, the language in the standard 
has been revised in certain respects to describe more directly the 
supervisory responsibilities of the engagement partner and engagement 
team members who assist the engagement partner in supervision. As 
discussed later in this section, the Board has separate standards-
setting projects regarding specialists and principal auditors, which 
will likely result in changes to the auditor's responsibilities 
regarding the auditor's use of specialists and use of other auditors, 
and, in turn, may result in changes to Auditing Standard No. 10.
b. Planning and Supervision
    As discussed in section II.C.4.b., the original proposed standard 
and the reproposed standard included requirements for both audit 
planning and supervision, similar to AU sec. 311. Some commenters 
observed that audit planning and supervision should be covered in 
separate standards.
    The Board agrees that audit planning and supervision of engagement 
team members are distinct activities that should be covered in separate 
standards. Accordingly, the Board has divided the requirements of the 
planning and supervision standard into separate standards. Dividing the 
requirements for planning and supervision into separate standards does 
not affect the auditor's responsibilities for planning the audit or 
supervising the work of engagement team members.
c. Objective
    When the requirements for planning and supervision were divided 
into separate standards, the objective for supervision of the work of 
engagement team members was adapted from the elements of proper 
supervision in the reproposed standard. Auditing Standard No. 10 
states, ``The objective of the auditor is to supervise the audit 
engagement, including supervising the work of engagement team members 
so that the work is performed as directed and supports the conclusions 
reached.'' The revised objective does not alter the supervision 
responsibilities included in the original proposed standard or the 
reproposed standard.
d. Responsibilities of the Engagement Partner
    AU sec. 311 stated, ``The auditor with final responsibility for the 
audit may delegate portions of the planning and supervision of the 
audit to other firm personnel.'' Auditing Standard No. 10 uses the term 
``engagement partner'' instead of ``auditor with final responsibility 
for the audit.''
    Auditing Standard No. 10 states that the engagement partner is 
responsible for the engagement and its performance. Accordingly, the 
engagement partner is responsible for proper supervision of the work of 
engagement team members and for compliance with PCAOB standards, 
including standards regarding using the work of specialists,\188\ other 
auditors,\189\ internal auditors,\190\ and others who are involved in 
testing controls.\191\ As discussed previously, as the Board considers 
changes to the auditor's responsibilities regarding the auditor's use 
of specialists and use of other auditors, it also may consider changes 
to Auditing Standard No. 10.
---------------------------------------------------------------------------

    \188\ See Section II.C.5.f.
    \189\ Ibid.
    \190\ AU sec. 322, The Auditor's Consideration of the Internal 
Audit Function in an Audit of Financial Statements.
    \191\ Paragraphs 16-19 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    Auditing Standard No. 10 allows the engagement partner to seek 
assistance from appropriate engagement team members in fulfilling his 
or her responsibilities pursuant to the standard. Engagement team 
members who assist the engagement partner in supervision should comply 
with the relevant requirements of Auditing Standard No. 10. The 
requirements in PCAOB standards for assignment of responsibilities to 
engagement team members also apply to assignments that involve 
assisting the engagement

[[Page 59374]]

partner with his or her responsibilities pursuant to the standard.\192\
---------------------------------------------------------------------------

    \192\ See, e.g. AU sec. 230.06 and paragraph 5 of Auditing 
Standard No. 13, The Auditor's Responses to the Risks of Material 
Misstatement.
---------------------------------------------------------------------------

 e. Supervision of the Work of Engagement Team Members
    Previously adopted PCAOB standards use either the term ``engagement 
team members'' or the term ``assistants.'' Auditing Standard No. 10 
uses ``engagement team members,'' which is consistent with the other 
risk assessment standards. The Board is amending other PCAOB standards 
to conform to this terminology.
    Auditing Standard No. 10 describes the required supervisory 
activities that should be performed by the engagement partner and, as 
applicable, by other engagement team members with supervisory 
responsibilities.\193\ Those activities include informing engagement 
team members of their responsibilities and information relevant to 
those responsibilities, directing engagement team members to bring 
significant accounting and auditing issues arising during the audit to 
the attention of the engagement partner or other engagement team 
members performing supervisory activities, and reviewing the work of 
engagement team members as described in the standard.
---------------------------------------------------------------------------

    \193\ Paragraph 5 of Auditing Standard No. 10.
---------------------------------------------------------------------------

    Auditing Standard No. 10 describes the factors that should be taken 
into account in determining the necessary extent of supervision, i.e., 
the extent of supervision necessary so that the work of engagement team 
members is performed as directed and appropriate conclusions are formed 
based on the results of their work.\194\ Factors that affect the 
necessary extent of supervision include the risks of material 
misstatement, the nature of work assigned to the engagement team 
member, and the nature of the company, which includes the 
organizational structure of the company and its size and complexity. 
The extent of supervision of the work of an individual engagement team 
member increases or decreases, but cannot be eliminated, based on those 
factors. For example, the extent of supervision should be commensurate 
with the risks of material misstatement, which means, among other 
things, that the higher risk areas of the audit require more 
supervisory attention from the engagement partner.
---------------------------------------------------------------------------

    \194\ Paragraph 6 of Auditing Standard No. 10.
---------------------------------------------------------------------------

    One commenter suggested that the standard provide examples of 
``levels of supervision in relation to review,'' such as face-to-face 
review when reviewing higher risk areas. Auditing Standard No. 10 does 
not prescribe a particular method of review, so the engagement partner 
can determine the most effective way to comply with the requirements 
regarding the necessary nature of supervisory activities and necessary 
extent of supervision.
f. Persons with Specialized Skill or Knowledge and Other Auditors, 
Accounting Firms, and Individual Accountants
    Auditing Standard No. 10 states that the engagement partner is 
responsible for, among other things, compliance with PCAOB standards 
regarding using of the work of specialists and refers to AU sec. 336. 
AU sec. 336 applies to situations in which the auditor engages a 
specialist in an area other than accounting or auditing and uses the 
work of that specialist as audit evidence.\195\ Paragraphs 5-6 of 
Auditing Standard No. 10 describe the nature and extent of the 
supervisory activities necessary for proper supervision of a person 
with specialized skill or knowledge who participates in the audit and 
is either (a) employed by the auditor or (b) engaged by the auditor to 
provide services in a specialized area of accounting or auditing. AU 
sec. 336 has been amended to clarify when the auditor should look to 
the supervisory requirements in Auditing Standard No. 10 instead of AU 
sec. 336.
---------------------------------------------------------------------------

    \195\ AU sec. 336 also applies to situations in which the 
auditor uses the work of a specialist engaged or employed by 
management. The discussion in this section of the release focuses on 
the auditor's use of specialists who are employed or engaged by the 
auditor.
---------------------------------------------------------------------------

    AU sec. 543 describes the principal auditor's \196\ 
responsibilities for using the work and reports of other independent 
auditors who have audited the financial statements of one or more 
subsidiaries, divisions, branches, components, or investments included 
in the financial statements presented. The principal auditor should 
look to the requirements in AU sec. 543 \197\ in those situations. For 
situations in which the auditor engages an accounting firm or 
individual accountants to participate in the audit engagement and AU 
sec. 543 does not apply,\198\ the auditor should supervise them in 
accordance with the requirements of Auditing Standard No. 10. AU sec. 
543 has been amended to emphasize those points.
---------------------------------------------------------------------------

    \196\ AU sec. 543 uses the term ``principal auditor'' to refer 
to the auditor who issues the audit report on the financial 
statements presented.
    \197\ For integrated audits, see also paragraphs C8-C11 of 
Auditing Standard No. 5.
    \198\ Examples of situations that are not covered by AU sec. 543 
include loan staff arrangements.
---------------------------------------------------------------------------

    It should be noted, however, that the Board has separate standards-
setting projects regarding specialists and principal auditors, which 
will include comprehensive reviews of AU sec. 336 and AU sec. 543, 
respectively, in light of, among other things, observations from the 
Board's inspection activities. Those projects will likely result in 
changes to the auditor's responsibilities regarding the auditor's use 
of specialists and use of other auditors, and, in turn, may result in 
changes to Auditing Standard No. 10.
g. Differences of Opinion Within an Engagement Team
    The original proposed standard included a requirement, adapted from 
AU sec. 311.14, that the engagement partner and other engagement team 
members should make themselves aware of the procedures to be followed 
when differences of opinion concerning accounting and auditing issues 
exist among the engagement team members. Since the intention of 
including this provision was to require adequate documentation of 
disagreements, this paragraph was removed from the reproposed standard, 
and the documentation requirements from the original proposed standard 
were incorporated into an amendment to Auditing Standard No. 3, Audit 
Documentation.\199\ The documentation requirements regarding 
disagreements among members of the engagement team or with others 
consulted on the engagement about final conclusions reached on 
significant accounting or auditing matters include documenting the 
basis for the final resolution of those disagreements. If an engagement 
team member disagrees with the final conclusions reached, he or she 
should document that disagreement.
---------------------------------------------------------------------------

    \199\ Paragraph 12.d. of Auditing Standard No. 3.
---------------------------------------------------------------------------

    One commenter indicated concern that the requirement for the 
engagement partner and other engagement team members to be aware of how 
disagreements should be handled has been removed. The commenter 
indicated that disagreements are a sensitive area and that it is 
important that engagement team members are aware of how disagreements 
should be handled. In connection with the requirement to direct 
engagement team members to bring significant accounting and auditing 
issues to the attention of the engagement partner or other engagement 
team members performing supervisory activities, Auditing Standard No. 
10 also states that each engagement team member has a responsibility to 
bring to the attention of

[[Page 59375]]

appropriate persons, disagreements or concerns the engagement team 
member might have with respect to accounting and auditing issues that 
he or she believes are of significance to the financial statements or 
the auditor's report regardless of how those disagreements or concerns 
may have arisen.\200\
---------------------------------------------------------------------------

    \200\ Note to paragraph 5.b. of Auditing Standard No. 10.
---------------------------------------------------------------------------

6. Auditing Standard No. 11--Consideration of Materiality in Planning 
and Performing an Audit
a. Background
    Auditing Standard No. 11 discusses the auditor's responsibilities 
for applying the concept of materiality, as described by the courts in 
interpreting the federal securities laws, in planning the audit and 
determining the scope of the audit procedures. The standard applies to 
integrated audits and audits of financial statements only.
b. Materiality in the Context of an Audit
    Auditing Standard No. 11 discusses the concept of materiality that 
is applicable to audits performed in accordance with PCAOB standards, 
which is the articulation of materiality used by the courts in 
interpreting the federal securities laws.\201\ The Supreme Court of the 
United States has held that a fact is material if there is ``a 
substantial likelihood that the * * * fact would have been viewed by 
the reasonable investor as having significantly altered the `total mix' 
of information made available.'' \202\
---------------------------------------------------------------------------

    \201\ Paragraph 2 of Auditing Standard No. 11.
    \202\ See TSC Industries Northway, Inc., 426 U.S. 438, 449 
(1976). See also Basic, Inc. v. Levinson, 485 U.S. 224 (1988).
---------------------------------------------------------------------------

    Some commenters questioned the use of the court's articulation in 
the reproposed standard and suggested that this articulation might be 
difficult for auditors to apply. Also, some commenters asked whether 
the use of this articulation of materiality, in contrast to the 
quotation from a FASB Concept Statement\203\ used in AU sec. 312 was 
intended to result in a change in audit practice.
---------------------------------------------------------------------------

    \203\ Financial Accounting Standards Board Statement of 
Financial Accounting Concepts No. 2, Qualitative Characteristics of 
Accounting Information. FASB Concepts Statements are not included in 
FASB's Codification of Accounting Standards.
---------------------------------------------------------------------------

    Although the discussion of materiality in the accounting literature 
might help auditors understand how accounting standards-setters view 
materiality in the context of preparation and presentation of financial 
statements, the concept of materiality that is relevant for audits to 
which PCAOB standards apply is the concept used by the courts in 
interpreting the Federal securities laws. Because the auditor has a 
responsibility to plan and perform audit procedures to detect 
misstatements that, individually or in combination with other 
misstatements, would result in material misstatement of the financial 
statements, it is important for the auditor to plan and perform his or 
her audit procedures based on the applicable concept of materiality. 
Accordingly, Auditing Standard No. 11 uses the concept of materiality 
articulated by the courts.
    Because the courts' articulation of the concept of materiality is 
not new, using that articulation in Auditing Standard No. 11 is not 
intended to result in changes in practice for most auditors. Auditing 
Standard No. 11 emphasizes that an auditor's consideration of 
materiality should reflect matters that would affect the judgment of a 
reasonable investor.
c. Establishing a Materiality Level for the Financial Statements as a 
Whole
    Auditing Standard No. 11 requires the auditor to establish an 
appropriate materiality level for the financial statements as a 
whole.\204\ This materiality level should be established in light of 
the particular circumstances based on factors that could influence the 
judgment of a reasonable investor. The standard states that this 
requirement includes consideration of the company's earnings and other 
relevant factors. This statement is intended to emphasize that a 
company's net earnings are often an important factor in the total mix 
of information available to a reasonable investor, but Auditing 
Standard No. 11 does not require the use of earnings as the basis for 
the established materiality level in all cases. Other factors besides 
earnings might be more relevant depending on the particular 
circumstances, e.g., based on a company's industry or situations in 
which the company's earnings were near zero. Auditors are expected to 
consider the factors that would be relevant to the judgment of a 
reasonable investor.
---------------------------------------------------------------------------

    \204\ Paragraph 6 of Auditing Standard No. 11.
---------------------------------------------------------------------------

d. Qualitative Considerations
    The concept of materiality involves consideration of both 
quantitative and qualitative factors.\205\ Under Auditing Standard No. 
11, qualitative considerations can affect the auditor's establishment 
of materiality levels in the following ways:
---------------------------------------------------------------------------

    \205\ Paragraph 3 of Auditing Standard No. 11.
---------------------------------------------------------------------------

    <bullet> Establishing a materiality level for the financial 
statements as a whole that is appropriate in light of the particular 
circumstances. This involves matters such as consideration of the 
elements of the financial statements that are more important to a 
reasonable investor and the level of misstatements that would influence 
the judgment of a reasonable investor.
    <bullet> Establishing lower levels of materiality for certain 
accounts or disclosures when, in light of the particular circumstances, 
there are certain accounts or disclosures for which there is a 
substantial likelihood that misstatements of lesser amounts than the 
materiality level established for the financial statements as a whole 
would influence the judgment of a reasonable investor. The requirement 
in the standard \206\ is consistent with the principle of considering 
the judgment of a reasonable investor when establishing materiality 
levels because it recognizes that, in certain circumstances, 
misstatements in some accounts might have more significant consequences 
than in other accounts. The following are examples of such 
circumstances:
---------------------------------------------------------------------------

    \206\ Paragraph 7 of Auditing Standard No. 11.
---------------------------------------------------------------------------

    [cir] Laws, regulations, or the applicable financial reporting 
framework affect investors' expectations about the measurement or 
disclosure of certain items, e.g., related party transactions and 
compensation of senior management.
    [cir] Significant attention has been focused on a particular aspect 
of a company's business that is separately disclosed in the financial 
statements, e.g., a recent business acquisition.
    [cir] Certain disclosures are particularly important to investors 
in the industry in which the company operates.
    Auditing Standard No. 11 does not allow the auditor to establish a 
materiality level for an account or disclosure at an amount that 
exceeds the materiality level for the financial statements as a whole.
    The reproposed standard included a statement, adapted from AU sec. 
312, that ordinarily it is not practical to design audit procedures to 
detect misstatements that are material based solely on qualitative 
factors.\207\ One commenter suggested removing the word ``ordinarily'' 
from the statement because, in the commenter's view, it is not 
practical to design audit procedures to detect misstatements that are 
material based solely on qualitative factors. Auditing Standard No. 11 
retains the

[[Page 59376]]

statement as proposed. This statement reflects the principle that 
judgments about whether a particular misstatement is material involve 
consideration of the particular circumstances, including the nature of 
the misstatement and its effect on the financial statements. Also, if 
an auditor is aware of potential misstatements that would be material 
based on qualitative factors, he or she has a responsibility to design 
audit procedures to detect such misstatements.
---------------------------------------------------------------------------

    \207\ AU sec. 312.20.
---------------------------------------------------------------------------

e. Tolerable Misstatement
    The reproposed standard required the auditor to determine tolerable 
misstatement for purposes of assessing risks of material misstatement 
and planning and performing audit procedures at the account or 
disclosure level.\208\ Tolerable misstatement is a concept used in 
determining the scope of audit procedures. AU sec. 350, Audit Sampling, 
indicates that tolerable misstatement is the maximum amount of 
misstatement in an account or a class of transactions that may exist 
without causing the financial statements to be materially 
misstated.\209\ Tolerable misstatement is required to be set at an 
amount less than the materiality level for the financial statements as 
a whole and for particular accounts or disclosures, if lower 
materiality levels were established for particular accounts or 
disclosures.
---------------------------------------------------------------------------

    \208\ Paragraphs 8-9 of Auditing Standard No. 11.
    \209\ AU sec. 350.18.
---------------------------------------------------------------------------

    Some commenters suggested replacing the term ``tolerable 
misstatement'' in the reproposed standard with the term ``performance 
materiality,'' which is the term used in the International Standards on 
Auditing (``ISA'').
    The Board decided to retain the term ``tolerable misstatement'' in 
its standards. The concept of tolerable misstatement is already 
understood by auditors, and the Board is not seeking to change the 
concept as described in PCAOB standards. Because the term ``performance 
materiality'' uses the word ``materiality,'' it could be misunderstood, 
e.g., by nonauditors, as having a meaning other than that intended in 
the standard. The concept of materiality that applies to financial 
statements of companies that are audited in accordance with PCAOB 
standards is rooted in case law and reflects a reasonable investor's 
perspective. In contrast, tolerable misstatement is a concept used in 
audit scoping decisions at the account level, considering potential 
uncorrected and undetected misstatement.
    One commenter stated that the requirement to establish tolerable 
misstatement eliminated the need to establish a lower level of 
materiality for particular accounts or disclosures. However, the two 
concepts are designed for different purposes. The requirement to 
establish a lower materiality level is intended to address the need for 
a lower threshold when, in light of the particular circumstances, 
misstatements of lesser amounts have a substantial likelihood of 
influencing the judgment of a reasonable investor. As mentioned 
previously, tolerable misstatement is a concept used in audit scoping 
decisions at the account level, considering potential uncorrected and 
undetected misstatement.
    The reproposed standard also required the auditor to take into 
account the nature, cause (if known), and amount of misstatements that 
were accumulated in audits of financial statements of prior periods. 
One commenter suggested that the Board should clarify its intent 
regarding this requirement and provide additional guidance regarding 
its application. Tolerable misstatement is affected by the expected 
level of misstatement in the account or disclosure, and the nature, 
cause, and amount of misstatements from prior periods are relevant to 
developing expectations about the level of misstatement. Generally, as 
the expected level of misstatement increases, the amount of tolerable 
misstatement decreases.
f. Consideration of Materiality for Multi-location Engagements
    The reproposed standard included requirements for establishing 
materiality levels in multi-location engagements. The reproposed 
standard stated that when the auditor plans to perform procedures at 
selected locations or business units, the auditor should establish the 
materiality level for the individual locations or business units at an 
amount that reduces to an appropriately low level the probability that 
the total of uncorrected and undetected misstatements would result in 
material misstatement of the consolidated financial statements. The 
reproposed standard also stated that the materiality level for the 
selected locations or business units generally should be lower than the 
materiality level for the consolidated financial statements. Those 
requirements were an application of the fundamental principles to 
audits of consolidated financial statements of companies with multiple 
locations or business units.
    Some commenters suggested removing the word ``generally'' as it 
could be misinterpreted as permitting the use of the materiality level 
for the consolidated financial statements as a whole for planning and 
performing audit procedures at the individual location or business unit 
level. Other commenters questioned how the requirements would be 
applied when a principal auditor makes reference to the report of 
another auditor in the auditor's report on consolidated financial 
statements in accordance with AU sec. 543.
    After considering the comments, the Board has made certain 
clarifying revisions to the requirements for multi-location 
engagements.\210\ First, the language in the standard has been revised 
to use term ``tolerable misstatement'' for an individual location to 
more clearly distinguish that term from the materiality level for the 
financial statements as a whole. In addition, the requirements were 
revised to state that tolerable misstatement for a location or business 
unit should be less than the materiality level for the financial 
statements as a whole. The word ``generally'' was removed from the 
requirements to reduce the risk of misinterpretation of the provision. 
Also, the phrase ``to be used in performing audit procedures'' has been 
removed from the requirement to determine tolerable misstatement for 
the individual locations or business units to avoid a misinterpretation 
about the principal auditor's responsibilities for situations in which 
the principal auditor makes reference to the report of the other 
auditor in accordance with AU sec. 543. Auditing Standard No. 11 
requires the principal auditor to determine tolerable misstatement for 
the location or business unit audited by the other auditor, but the 
principal auditor is not expected to impose that determination of 
tolerable misstatement on the other auditor. Rather, tolerable 
misstatement for the location or business unit audited by the other 
auditor would be relevant to certain requirements under AU sec. 543 
\211\ and in determining an appropriate amount of tolerable 
misstatement for the remaining locations or business units included in 
the consolidated financial statements.
---------------------------------------------------------------------------

    \210\ Paragraph 10 of Auditing Standard No. 11.
    \211\ For example, AU sec. 543.10 states that the auditor should 
adopt measures to assure the coordination of the principal auditor's 
activities with those of the other auditor in order to achieve a 
proper review of matters affecting the consolidating or combining of 
accounts in the financial statements.

---------------------------------------------------------------------------

[[Page 59377]]

g. Reevaluating the Materiality Level and Tolerable Misstatement
    The reproposed standard stated that the established materiality 
level and tolerable misstatement should be reevaluated if changes in 
the particular circumstances or additional information comes to the 
auditor's attention that are likely to influence the judgment of a 
reasonable investor. In addition, the reproposed standard provided 
examples of situations that would require such reevaluation, and 
additional examples were discussed in the release accompanying the 
reproposed standards.
    Some commenters suggested that the examples in the release should 
be included in the reproposed standard. The examples in Auditing 
Standard No. 11 have been revised to clarify the types of situations 
that would require reevaluation of the established materiality level 
and tolerable misstatement.
    The reevaluation required by Auditing Standard No. 11 is important 
because if that reevaluation results in a lower materiality level or 
levels and tolerable misstatement than the auditor's initial 
determination, the standard states that the auditor should (1) evaluate 
the effect, if any, of the lower amount or amounts on his or her risk 
assessments and audit procedures and (2) modify the nature, timing, and 
extent of audit procedures as necessary to obtain sufficient 
appropriate audit evidence.\212\
---------------------------------------------------------------------------

    \212\ Paragraph 12 of Auditing Standard No. 11.
---------------------------------------------------------------------------

    Auditing Standard No. 11 does not allow the auditor to modify the 
established level or levels of materiality and tolerable misstatement 
solely because they are approximately equal to or are exceeded by the 
amount of uncorrected misstatements. Such a practice is inconsistent 
with the requirement to reevaluate the established materiality level or 
levels or tolerable misstatement if changes in the particular 
circumstances or additional information come to the auditor's attention 
that are likely to affect the judgments of a reasonable investor. 
Rather, Auditing Standard No. 14 establishes requirements for 
evaluating uncorrected misstatements \213\ and describes the auditor's 
responsibilities in situations in which uncorrected misstatements 
approach established materiality level or levels used in planning and 
performing an audit.\214\
---------------------------------------------------------------------------

    \213\ Paragraphs 17-23 of Auditing Standard No. 14.
    \214\ Paragraph 14.b. of Auditing Standard No. 14.
---------------------------------------------------------------------------

7. Auditing Standard No. 12--Identifying and Assessing Risks of 
Material Misstatement

a. Background
    Auditing Standard No. 12 describes the auditor's responsibilities 
for the process of identifying and assessing risks of material 
misstatement in an audit of financial statements only and in an 
integrated audit. This process includes (1) performing information-
gathering procedures, known as risk assessment procedures, and (2) 
identifying and assessing the risks of material misstatement using 
information obtained from the risk assessment procedures.
    As discussed in the release accompanying the reproposed standards, 
the requirements in this standard are intended to improve the auditor's 
risk assessments and ability to focus on areas of increased risk in 
audits of financial statements only and in integrated audits. The 
effectiveness of a risk-based audit depends on whether the auditor 
identifies the risks of material misstatement and has an appropriate 
basis for assessing those risks. Inappropriate identification or 
assessment of risks of material misstatements can lead to overlooking 
relevant risks to the financial statements, e.g., business conditions 
that affect asset quality or create pressures to manipulate the 
financial statements, or assessing risks too low without having an 
appropriate basis for the assessment. In turn, these situations can 
lead to misdirected or inadequate audit work.
    Auditing Standard No. 12 employs a top-down approach to risk 
assessment. Such an approach begins at the financial statement level 
and with the auditor's overall understanding of the company and its 
environment and works down to the significant accounts and disclosures 
and their relevant assertions. Also, the requirements for performing 
risk assessment procedures are designed to be scalable to companies of 
varying size and complexity.
    In an integrated audit, the risks of material misstatement affect 
both the audit of financial statements and the audit of internal 
control, so the risk assessment process described in Auditing Standard 
No. 12 is for a single process that applies to both the audit of 
financial statements and the audit of internal control. Auditing 
Standard No. 12 seeks to enhance the integration of the audit of 
financial statements with the audit of internal control by aligning 
these risk assessment standards with Auditing Standard No. 5. 
Accordingly, Auditing Standard No. 12 reflects certain foundational 
risk assessment principles from Auditing Standard No. 5 that also apply 
to audits of financial statements. On the other hand, the provisions of 
this standard also are designed to be tailored for audits of financial 
statements only, e.g., the requirements relating to the understanding 
of internal control over financial reporting.
b. Objective
    Some commenters recommended that the Board revise the objective in 
the reproposed standard to indicate that the auditor's identification 
and assessment of risks are through understanding of the company and 
its environment. The objective in Auditing Standard No. 12 was retained 
from the reproposed standard. The revision suggested by the commenters 
is too narrow because Auditing Standard No. 12 requires other risk 
assessment procedures beyond obtaining an understanding of the company 
and its environment.
c. Performing Risk Assessment Procedures
    The overarching requirement for risk assessment procedures in 
Auditing Standard No. 12 is that the auditor should perform risk 
assessment procedures that are sufficient to provide a reasonable basis 
for the identification and assessment of the risks of material 
misstatement, whether due to error or fraud, and to design further 
audit procedures.\215\ Auditing Standard No. 12 discusses the auditor's 
responsibilities for determining and performing the risk assessment 
procedures necessary to satisfy that overarching requirement.\216\
---------------------------------------------------------------------------

    \215\ Paragraph 4 of Auditing Standard No. 12. The phrase 
``design further audit procedures'' applies to substantive 
procedures and to tests of controls in the audit of financial 
statements and the audit of internal control over financial 
reporting.
    \216\ Paragraphs 5-58 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Risks of material misstatement may exist at the financial statement 
level or at the assertion level. Risks of material misstatement also 
can arise from a variety of sources, including external factors, such 
as conditions in the company's industry and environment, and company-
specific factors, such as the nature of the company, its activities, 
and internal control over financial reporting. Since the risks of 
material misstatement come from various sources, the auditor's risk 
assessment procedures need to encompass both external factors and 
company-specific factors. Auditing Standard No. 12 requires the 
following risk assessment procedures:

[[Page 59378]]

    <bullet> Obtaining an understanding of the company and its 
environment; \217\
---------------------------------------------------------------------------

    \217\ Paragraphs 7-17 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    <bullet> Obtaining an understanding of the company's internal 
control over financial reporting; \218\
---------------------------------------------------------------------------

    \218\ Paragraphs 18-40 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    <bullet> Considering information from the client acceptance and 
retention evaluation, audit planning activities, past audits, and other 
engagements performed for the company; \219\
---------------------------------------------------------------------------

    \219\ Paragraphs 41-45 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    <bullet> Performing analytical procedures; \220\
---------------------------------------------------------------------------

    \220\ Paragraphs 46-48 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    <bullet> Conducting a discussion among engagement team members 
regarding the risks of material misstatement; \221\ and
---------------------------------------------------------------------------

    \221\ Paragraphs 49-53 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    <bullet> Inquiring of the audit committee, management, and others 
within the company about the risks of material misstatement.\222\
---------------------------------------------------------------------------

    \222\ Paragraphs 54-58 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    The reproposed standard required the auditor to perform risk 
assessment procedures that are designed to help the auditor identify 
the areas of greater risk, appropriately assess those risks, and design 
and perform further audit procedures to address risks of material 
misstatements in the financial statements, whether due to error or 
fraud. One commenter suggested adding the phrase ``and to design 
further audit procedures focused on the areas of greatest risk'' to the 
end of the sentence in paragraph 4. The suggested language is not 
included in Auditing Standard No. 12 because that principle is already 
addressed in Auditing Standard No. 13.
    One commenter on the reproposed standard asked for more discussion 
of the connection between the components of audit risk and the risk 
assessment process. That discussion has been added to Auditing Standard 
No. 8.\223\
---------------------------------------------------------------------------

    \223\ Paragraphs 8-11 of Auditing Standard No. 8.
---------------------------------------------------------------------------

d. Obtaining an Understanding of the Company and Its Environment
    Like the reproposed standard, Auditing Standard No. 12 requires the 
auditor to obtain an understanding of the company and its environment 
to understand the events, conditions, and company activities that might 
reasonably be expected to have a significant effect on the risks of 
material misstatement (``obtaining an understanding of the 
company'').\224\ These requirements are an expansion of requirements 
that were in AU sec. 311 regarding obtaining knowledge of matters that 
relate to the nature of the entity's business, its organization, and 
its operating characteristics as part of audit planning.\225\ The 
expanded requirements are intended to focus the auditor on the degree 
of ``knowledge of the company'' that is necessary for a risk-based 
audit and to explain how knowledge of the company informs the auditor's 
identification and assessment of risk.
---------------------------------------------------------------------------

    \224\ Paragraph 7 of Auditing Standard No. 12.
    \225\ AU secs. 311.06-.09.
---------------------------------------------------------------------------

    Auditing Standard No. 12 requires that the understanding of the 
company and its environment include understanding the following:
    <bullet> Relevant industry, regulatory, and other external factors;
    <bullet> The nature of the company;
    <bullet> The company's selection and application of accounting 
principles, including related disclosures;
    <bullet> The company's objectives and strategies and those related 
business risks that might reasonably be expected to result in risks of 
material misstatement; and
    <bullet> The company's measurement and analysis of its financial 
performance.\226\
---------------------------------------------------------------------------

    \226\ Paragraph 7 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 requires the auditor to evaluate whether 
significant changes in the company from prior periods, including 
changes in its internal control over financial reporting, affect the 
risks of material misstatement.\227\ This requirement builds on the 
requirement in paragraph 7 of Auditing Standard No. 9 to evaluate 
whether, among other things, the extent of recent changes, if any, in 
the company, its operations, or its internal control over financial 
reporting is important to the company's financial statements and 
internal control over financial reporting and, if so, how those changes 
will affect the auditor's procedures. PCAOB standards have recognized 
that many risks of material misstatement arise due to changes in the 
company. For example, AU sec. 319 listed the following examples of 
circumstances that can result in risks or changes to existing risks: 
changes in operating environment; new personnel; new or revamped 
information systems; rapid growth; new technology; new business models, 
products, or activities; corporate restructurings; expanded foreign 
operations; and new accounting pronouncements.\228\
---------------------------------------------------------------------------

    \227\ Paragraph 8 of Auditing Standard No. 12.
    \228\ AU sec. 319.38.
---------------------------------------------------------------------------

    Paragraphs 9-17 of Auditing Standard No. 12 explain more fully the 
necessary understanding of the preceding aspects of the company and its 
environment, e.g., what it means to obtain an understanding of the 
nature of the company. The discussion of relevant industry, regulatory, 
and other external factors is adapted from AU sec. 311. The discussion 
of the nature of the company is also adapted from AU sec. 311 and has 
been updated to reflect certain changes in business practices since AU 
sec. 311 was originally issued (e.g., to encompass alternative 
investments and financing arrangements and to recognize the development 
of new business models).
    One commenter said that the requirement to obtain an understanding 
of the company and its environment should be revised because none of 
the aspects of the company and its environment listed in paragraph 7 is 
an event, condition, or company activity. However, the understanding of 
those aspects should lead the auditor to obtain an understanding of 
relevant events, conditions, and company activities. For example, 
obtaining an understanding of relevant industry, regulatory, and 
external factors helps an auditor understand the external conditions in 
which the company operates that represent risks of material 
misstatement at the financial statement level.
    The reproposed standard contained a note about how the size and 
complexity of the company can affect the risks of misstatement and the 
controls necessary to address those risks. This note was intended to be 
a reminder to auditors that both size and complexity affect risks. One 
commenter stated that complexity rather than size is likely to heighten 
risk. Auditing Standard No. 12 retains the note as reproposed.\229\ The 
size and complexity of the company can affect the risks of misstatement 
and the controls necessary to address those risks. Scaling the audit is 
most effective as a natural extension of the risk-based approach and 
applies to all audits, and the requirements in Auditing Standard No. 12 
are intended to be scalable to companies of varying size and 
complexity. Auditing Standard No. 12 contains certain notes regarding 
scaling the audit based on a company's size and complexity.
---------------------------------------------------------------------------

    \229\ First note to paragraph 10 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(i). Additional Procedures to Obtain an Understanding of the Company 
and its Environment
    The reproposed standard presented a list of procedures that the 
auditor should consider performing as part of obtaining an 
understanding of the company and its environment. These

[[Page 59379]]

procedures include reading public information about the company, 
observing or reading transcripts of earnings calls, obtaining an 
understanding of compensation arrangements with senior management, and 
obtaining information about significant unusual developments regarding 
trading activity in the company's securities. The auditor's decisions 
about whether to perform one or more of the additional procedures and 
the extent of those procedures depend on whether the matters addressed 
in those procedures are important to the company's internal control or 
financial statements and whether such procedures are necessary to meet 
the overall requirements for obtaining an understanding of the company 
and performing risk assessment procedures.
    Members of the Board's Standing Advisory Group (``SAG'') suggested 
that these matters could provide valuable information for identifying 
risks of material misstatement, e.g., to obtain information about 
business risks relevant to financial reporting or to identify 
incentives or pressures on management to manipulate financial 
results.\230\ Also, the Public Oversight Board, Panel on Audit 
Effectiveness, Report and Recommendations (``PAE Report''), recommended 
that auditors consider published analysts' reports and forecasts when 
gaining an understanding of the company's business and industry, 
assessing risks, and evaluating identified misstatements.\231\
---------------------------------------------------------------------------

    \230\ February 16, 2005. Webcasts of SAG meetings are available 
on the Board's Web site at: http://www.pcaobus.org/News_and_Events/Webcasts.
    \231\ Public Oversight Board, Panel on Audit Effectiveness, 
Report and Recommendations (August 31, 2000), p. 58.
---------------------------------------------------------------------------

    Commenters requested clarification of the Board's expectations 
regarding these procedures and expressed concern that the broad 
language used to describe some of the procedures might lead auditors to 
expend considerable efforts to decide and document whether to perform 
certain procedures. This requirement is not intended to require 
auditors to make a specific determination about each bit of data to 
which a procedure might be applied, e.g., to document each individual 
item of publicly available information to decide whether it should be 
reviewed.
    Instead, the intention is for auditors to consider whether and to 
what extent such procedures should be performed to achieve the 
objectives in paragraphs 4 and 7 of Auditing Standard No. 12. For 
example, observing the company's earnings calls and other meetings with 
investors are likely to provide important information about the 
measurement and review of the company's financial performance, 
particularly the performance measures monitored by investors and 
analysts. Likewise, an understanding of compensation arrangements with 
senior management often can provide important information about 
incentives or pressures on management to manipulate the financial 
statements.
    Auditing Standard No. 12 was revised to clarify that considering 
whether to perform the procedures listed in paragraph 11 also includes 
consideration of the extent of the procedures.
(ii). Selection and Application of Accounting Principles, Including 
Related Disclosures
    PCAOB standards require auditors to obtain an understanding of the 
accounting practices common to the industry and to evaluate the quality 
of a company's accounting principles as part of his or her response to 
fraud risks and in determining matters to be communicated to the audit 
committee.\232\ Auditing Standard No. 12 imposes a responsibility to 
obtain an understanding of the applicable financial reporting framework 
and to evaluate whether the company's selection and application of 
accounting principles are consistent with the applicable accounting 
framework and the accounting principles used in the relevant 
industry.\233\ Such procedures can provide important information for 
identifying relevant matters such as (1) accounts that are susceptible 
to misstatement, e.g., if an account balance is determined using 
accounting principles that are inconsistent with the applicable 
financial reporting framework or (2) more general conditions that 
affect risks of material misstatement, e.g., if the company's selection 
or application of accounting principles is more aggressive than 
prevailing practices in the relevant industry.
---------------------------------------------------------------------------

    \232\ See AU sec. 316 and AU sec. 380, Communication With Audit 
Committees.
    \233\ Paragraph 12 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    In connection with obtaining an understanding of the applicable 
financial reporting framework and evaluating the company's selection 
and application of accounting principles, including related 
disclosures, Auditing Standard No. 12 requires the auditor to develop 
expectations about the disclosures that are necessary for the company's 
financial statements to be presented fairly in conformity with the 
applicable financial reporting framework.\234\ The language in this 
requirement was revised to clarify that the auditor should develop an 
expectation about the disclosures as part of the risk assessment 
procedures and that the expectations should be based on the disclosures 
necessary for the fair presentation of the financial statements in 
conformity with the applicable financial reporting framework.
---------------------------------------------------------------------------

    \234\ Ibid.
---------------------------------------------------------------------------

    Auditing Standard No. 12 also presents a list of matters that, if 
present, are relevant to the necessary understanding of the company's 
selection and application of accounting principles.\235\ The amount of 
auditor attention devoted to an individual matter would depend on its 
importance in meeting the overall requirements for obtaining an 
understanding of the company and performing risk assessment 
procedures.\236\
---------------------------------------------------------------------------

    \235\ Paragraph 13 of Auditing Standard No. 12.
    \236\ Paragraphs 4 and 7 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iii). Company Objectives, Strategies, and Related Business Risks
    The reproposed standard required the auditor to obtain an 
understanding of the company's objectives, strategies, and related 
business risks in order to identify those business risks that could 
reasonably be expected to result in material misstatement of the 
financial statements. The PAE Report recommended that auditors be 
required to obtain an understanding of the company's business 
risks.\237\
---------------------------------------------------------------------------

    \237\ PAE Report, p. 20.
---------------------------------------------------------------------------

    Commenters on the reproposed standard requested additional 
discussion about business risks, including going concern risks, fraud 
risks, and how business risks can result in misstatements of the 
financial statements. Additional discussion has been added to Auditing 
Standard No. 8 and Auditing Standard No. 12.\238\
---------------------------------------------------------------------------

    \238\ Paragraph 6 of Auditing Standard No. 8 and the note to 
paragraph 15 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 discusses how business risks can lead to 
misstatements and provides examples of business risks that may result 
in a risk of material misstatement of the financial statements.\239\ 
However, the list of examples is meant to be illustrative rather than a 
checklist of factors to consider. Auditors would need to consider the 
business risks that are relevant to the particular company and 
industry. For example, in today's economic environment, business risks

[[Page 59380]]

might include financing risks (e.g., access to necessary financing) or 
product risks (e.g., investments in certain financial products).
---------------------------------------------------------------------------

    \239\ Paragraphs 5 and 14-15 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iv). The Company's Measurement and Analysis of its Financial 
Performance
    The risk assessment procedures in the reproposed standard included 
obtaining an understanding of the company's performance measures. The 
purpose of obtaining that understanding is to identify those 
performance measures, whether external or internal, that affect the 
risks of material misstatement. For example, understanding performance 
measures can help the auditor identify accounts or disclosures that 
might be susceptible to manipulation to achieve certain performance 
targets (or to conceal failures to achieve those targets) or to 
understand how management uses performance measures to monitor risks 
affecting the financial statements.
    Commenters requested clarification regarding the examples of 
performance measures. A note was added to Auditing Standard No. 12 to 
explain the significance of the individual examples.\240\
---------------------------------------------------------------------------

    \240\ Paragraph 17 of Auditing Standard No 12.
---------------------------------------------------------------------------

e. Obtaining an Understanding of Internal Control Over Financial 
Reporting
    Auditing Standard No. 12 describes the auditor's responsibilities 
for obtaining an understanding of internal control over financial 
reporting (``understanding of internal control''). Auditing Standard 
No. 12 requires the auditor to obtain a sufficient understanding of 
each component of internal control over financial reporting to (a) 
identify the types of potential misstatements, (b) assess the factors 
that affect the risks of material misstatement, and (c) design further 
audit procedures.\241\ These requirements are, in substance, equivalent 
to those in AU sec. 319, but the formulation in the proposed standard 
is aligned more clearly with Auditing Standard No. 5. Like the 
requirements in AU sec. 319, the requirements in Auditing Standard No. 
12 indicate that although the auditor's primary focus is on internal 
control over financial reporting, the auditor may obtain an 
understanding of controls related to operations or compliance 
objectives if they pertain to data that the auditor plans to use in 
applying auditing procedures.\242\
---------------------------------------------------------------------------

    \241\ Paragraph 18 of Auditing Standard No. 12.
    \242\ Paragraph 19 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 sets forth certain principles regarding 
the sufficiency of the auditor's understanding of internal control. The 
size and complexity of the company; the auditor's existing knowledge of 
the company's internal control; the nature of the company's internal 
controls, including the company's use of IT; the nature and extent of 
changes in systems and operations; and the nature of the company's 
documentation of its internal control over financial reporting affect 
the nature, timing, and extent of procedures necessary to obtain an 
understanding of internal control. For example, the auditor's 
procedures to obtain an understanding of internal control would be more 
extensive when the auditor plans to test controls more extensively 
(e.g., in an integrated audit), the company's internal control is more 
complex, or the company's controls have changed significantly.
    The reproposed standard stated that the auditor's understanding of 
internal control includes evaluating the design of controls and 
determining whether the controls are implemented. Commenters observed 
that the reproposed standard stated that walkthroughs that include the 
necessary procedures ordinarily are sufficient to evaluate design 
effectiveness, but the reproposed standard did not make a similar 
statement about the use of walkthroughs to determine whether controls 
have been implemented. Auditing Standard No. 12 has been revised to 
include a statement that walkthroughs that include the procedures 
described in the standard ordinarily are sufficient to determine 
whether a control has been implemented.\243\ Under Auditing Standard 
No. 12, as under AU sec. 319,\244\ the amount of audit attention 
devoted to design and operating effectiveness will vary based on the 
auditor's plan for testing controls. For example, if the auditor plans 
to test controls, more attention should be devoted to controls that the 
auditor plans to test.
---------------------------------------------------------------------------

    \243\ Paragraph 20 of Auditing Standard No. 12.
    \244\ AU sec. 319.58.
---------------------------------------------------------------------------

(i). Obtaining an Understanding of Individual Components of Internal 
Control Over Financial Reporting
    To describe the auditor's responsibilities for obtaining an 
understanding of internal control, it was necessary to describe the 
components of internal control over financial reporting. The components 
described in Auditing Standard No. 12 are similar to those in AU sec. 
319.\245\ Auditing Standard No. 12 also states that auditors may use 
other suitable, recognized frameworks \246\ in accordance with the 
provisions of the standard. If the auditor uses a suitable, recognized 
internal control framework with components that differ from those in 
the standard, the auditor should adapt the requirements in the standard 
for the components in the framework used.\247\
---------------------------------------------------------------------------

    \245\ Paragraph 21 of Auditing Standard No. 12.
    \246\ See Securities Exchange Act Release No. 34-47986 (June 5, 
2003) for a description of the characteristics of a suitable, 
recognized framework.
    \247\ Paragraph 22 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(ii). Control Environment
    Auditing Standard No. 12 requires the auditor to assess the 
following matters as part of obtaining an understanding of the control 
environment:
    <bullet> Whether management's philosophy and operating style 
promote effective internal control over financial reporting;
    <bullet> Whether sound integrity and ethical values, particularly 
of top management, are developed and understood; and
    <bullet> Whether the board or audit committee understands and 
exercises oversight responsibility over financial reporting and 
internal control.\248\
---------------------------------------------------------------------------

    \248\ Paragraph 24 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Although this requirement is aligned with a similar requirement in 
Auditing Standard No. 5 for evaluating the control environment, the 
auditor's process for assessing the control environment in an audit of 
financial statements only is not expected to be the same as that 
required when expressing an opinion on internal control over financial 
reporting. For audits of financial statements only, Auditing Standard 
No. 12 allows the auditor to base his or her assessment on evidence 
obtained as part of obtaining an understanding of the control 
environment and other relevant knowledge possessed by the auditor.\249\
---------------------------------------------------------------------------

    \249\ Ibid.
---------------------------------------------------------------------------

    Because of the importance of an effective control environment to 
address fraud risks, Auditing Standard No. 12 states that if the 
auditor identifies a control deficiency in the company's control 
environment, the auditor should evaluate the extent to which this 
control deficiency is indicative of a fraud risk factor.\250\
---------------------------------------------------------------------------

    \250\ Paragraph 25 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iii) The Company's Risk Assessment Process
    Auditing Standard No. 12 requires the auditor to obtain an 
understanding of management's risk assessment process for (a) 
identifying risks relevant to financial reporting objectives, including 
risks of material misstatement due to fraud, (b) assessing the 
likelihood and significance of misstatements resulting from those 
risks, and (c) deciding about

[[Page 59381]]

actions to address those risks.\251\ The standard also requires the 
auditor to obtain an understanding of the risks of material 
misstatement identified and assessed by management and the actions 
taken to address those risks.\252\ Compliance with these requirements 
will help make sure that the auditor's risk assessments are 
appropriately informed by management's risk assessments and the 
controls that management put in place to address the risks.
---------------------------------------------------------------------------

    \251\ Paragraph 26 of Auditing Standard No. 12.
    \252\ Paragraph 27 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iv) Information and Communication
    The reproposed standard required the auditor to obtain an 
understanding of the information system, including the related business 
processes, relevant to financial reporting. One commenter suggested 
removing the requirement to understand the company's business 
processes. The requirement was retained as reproposed.\253\ Obtaining 
an understanding of the company's business processes assists the 
auditor in obtaining an understanding of how transactions are 
initiated, authorized, processed, and recorded. Also, the requirement 
to understand business processes is a recommendation in the PAE 
Report.\254\ Auditing Standard No. 12 describes the necessary 
understanding of business processes to help auditors identify those 
business processes that are relevant to financial reporting.\255\
---------------------------------------------------------------------------

    \253\ Paragraph 28 of Auditing Standard No. 12.
    \254\ PAE Report, p. 15.
    \255\ Paragraphs 28-32 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 also contains requirements for 
understanding the period-end financial reporting process \256\ and 
describes important elements of that process.\257\ Because the period-
end financial reporting process is a common source of potential 
misstatements, it is important for the auditor to have an adequate 
understanding of the aspects of the period-end financial reporting 
process in all audits, including audits of financial statements only. 
Auditing Standard No. 12 requires the auditor only to obtain an 
understanding \258\ of the process, as compared to Auditing Standard 
No. 5, which requires the auditor also to evaluate that process in the 
audit of internal control.
---------------------------------------------------------------------------

    \256\ AU sec. 319.49 used the term ``financial reporting process 
used to prepare the entity's financial statements,'' but Auditing 
Standard No. 12 uses the same term as used in Auditing Standard No. 
5.
    \257\ Paragraphs 28 and 32 of Auditing Standard No. 12.
    \258\ Paragraph 20 of Auditing Standard No. 12 discusses 
procedures that the auditor performs to obtain an understanding of 
internal control.
---------------------------------------------------------------------------

    To appropriately highlight the importance of IT risks in 
determining the scope of the audit, the standard requires the auditor 
to obtain an understanding of how IT affects the company's flow of 
transactions. The standard also contains a note that states that the 
identification of risks and controls within IT is not a separate 
evaluation. Instead, it is an integral part of the approach used to 
identify significant accounts and disclosures and their relevant 
assertions and, when applicable, to select the controls to test, as 
well as to assess risk and allocate audit effort.
    Regarding the auditor's understanding of communication, one 
commenter suggested that the standard clarify that the auditor should 
understand how the company communicates financial reporting roles and 
responsibilities and significant matters relating to financial 
reporting. The requirement in Auditing Standard No. 12 has been revised 
to clarify that point.\259\
---------------------------------------------------------------------------

    \259\ Paragraph 33 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(v) Control Activities
    The reproposed standard required the auditor to obtain an 
understanding of control activities that is sufficient to assess the 
factors that affect the risks of material misstatement and to design 
further audit procedures. As under AU sec. 319, a more extensive 
understanding of control activities is needed in areas in which the 
auditor plans to test controls. Thus, for purposes of evaluating the 
effectiveness of internal control over financial reporting in an 
integrated audit, the auditor's understanding of control activities 
encompasses a broader range of accounts and disclosures than that which 
is normally obtained in an audit of financial statements only.
    Some commenters expressed concern that the language in the 
requirement could be misinterpreted as requiring the auditor to obtain 
an understanding of all controls, even in an audit of financial 
statements only in which the auditor does not plan to test controls. A 
few commenters suggested framing the requirement in terms of 
understanding control activities relevant to the audit.
    The Board did not intend to expand the auditor's responsibilities 
for obtaining an understanding of control activities beyond what is 
required in AU sec. 319. The discussion in Auditing Standard No. 12 on 
obtaining an understanding of control activities has been revised, 
primarily using language adapted from AU sec. 319, to clarify that the 
substance of the requirement has not changed.\260\
---------------------------------------------------------------------------

    \260\ AU sec. 319.42 and paragraph 34 of Auditing Standard No. 
12.
---------------------------------------------------------------------------

(vi). Performing Walkthroughs
    The original proposed standard referred auditors to Auditing 
Standard No. 5 for a discussion of the performance of walkthroughs. 
Some commenters on the original proposed standard stated that the 
standard should include a discussion of walkthroughs rather than 
referring to Auditing Standard No. 5. The reproposed standard included 
a discussion of performing walkthroughs as part of meeting certain 
specified objectives, which paralleled a requirement in Auditing 
Standard No. 5 \261\ regarding understanding likely sources of 
potential misstatements. Some commenters expressed concerns that the 
discussion would lead to unnecessary walkthroughs, particularly in 
audits of financial statements only.
---------------------------------------------------------------------------

    \261\ Paragraph 34 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    The intention of including the discussion of walkthroughs was to 
explain how to perform walkthroughs rather than to impose requirements 
regarding when walkthroughs should be performed. The standard has been 
revised to focus on how the auditor should perform walkthroughs, e.g., 
in connection with understanding the flow of transactions in the 
information system relevant to financial reporting, evaluating the 
design of controls relevant to the audit, and determining whether those 
controls have been implemented.\262\ The discussion of the objectives 
for understanding likely sources of potential misstatements has been 
removed from Auditing Standard No. 12, so those objectives would 
continue to apply only to integrated audits.
---------------------------------------------------------------------------

    \262\ Paragraph 37 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(vii). Relationship of Understanding of Internal Control to Tests of 
Controls
    Auditing Standard No. 12, like the reproposed standard, contains a 
discussion about the relationship between obtaining an understanding of 
controls and testing controls, including entity-level controls.\263\ 
The requirements in Auditing Standard No. 12 clarify that the objective 
of obtaining an understanding of internal control as a risk assessment 
procedure is different from testing controls for the purpose of 
assessing control risk \264\ or for the purpose of expressing an 
opinion on internal control over financial reporting

[[Page 59382]]

in the audit of internal control.\265\ The standard allows the auditor 
the flexibility of obtaining an understanding of internal control 
concurrently with performing tests of controls if he or she obtains 
sufficient appropriate evidence to achieve the objectives of both 
procedures.\266\
---------------------------------------------------------------------------

    \263\ Paragraph 39 of Auditing Standard No. 12.
    \264\ Paragraphs 16-31 of Auditing Standard No. 13.
    \265\ Paragraph B1 of Auditing Standard No. 5.
    \266\ Paragraph 39 of Auditing Standard No. 12.
---------------------------------------------------------------------------

f. Information Obtained from Past Audits and Other Engagements
(i). Information from Past Audits
    The reproposed standard included a requirement for the auditor to 
incorporate knowledge obtained during past audits into the auditor's 
process for identifying risks of material misstatement. One commenter 
asked for clarification of the meaning of the term ``incorporate.'' Two 
commenters stated that the most important issue is to determine whether 
information from past audits is still relevant.
    The term ``incorporate'' is not new and should be familiar to most 
auditors. For example, it has been used in AU sec. 316 regarding the 
requirement to incorporate an element of unpredictability in the audit 
in response to fraud risks. The requirement in the reproposed standard 
was similar to a requirement in Auditing Standard No. 5 to incorporate 
knowledge obtained during past audits in subsequent year audits of 
internal control.\267\ Accordingly the term has been retained in 
Auditing Standard No. 12.
---------------------------------------------------------------------------

    \267\ Paragraph 57 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    Auditing Standard No. 12 also states that if the auditor plans to 
limit the nature, timing, or extent of his or her risk assessment 
procedures by relying on information from past audits, the auditor 
should evaluate whether the prior-years' information remains relevant 
and reliable.\268\
---------------------------------------------------------------------------

    \268\ Paragraph 43 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(ii). Information from Other Engagements
    The reproposed standard included a requirement for the auditor to 
take into account relevant information obtained through other 
engagements performed by the auditor for the company.\269\ This 
requirement was intended to focus on the responsibility to take 
relevant information into account in identifying and assessing risks 
rather than to prescribe a particular method for obtaining that 
information.
---------------------------------------------------------------------------

    \269\ PCAOB Rule 1001, Definitions of Terms Employed in Rules, 
states that, when used in rules of the PCAOB, unless the context 
otherwise requires, ``[t]he term `auditor' means both public 
accounting firms registered with the Public Company Accounting 
Oversight Board and associated persons thereof.''
---------------------------------------------------------------------------

    Some commenters suggested that the requirement should be limited to 
consideration of other engagements performed by the engagement partner. 
The suggested change would weaken the standard. Limiting the 
consideration of information to engagements performed for the company 
by the engagement partner is too narrow because it omits other 
important information sources that are available to the engagement 
team. Also, limiting the consideration to engagements performed by the 
engagement partner is inconsistent with prior PCAOB standards. For 
example, AU sec. 311.04 stated that procedures the auditor may consider 
in planning an audit usually involve discussions with other firm 
personnel, and includes the following example ``Discussing matters that 
may affect the audit with firm personnel responsible for non-audit 
services to the entity.'' Also, paragraph 03 of AU sec. 9311, Planning 
and Supervision: Auditing Interpretations of Section 311, stated:

    The auditor should consider the nature of non-audit services 
that have been performed. He should assess whether the services 
involve matters that might be expected to affect the entity's 
financial statements or the performance of the audit, for example, 
tax planning or recommendations on a cost accounting system. If the 
auditor decides that the performance of the non-audit services or 
the information likely to have been gained from it may have 
implications for his audit, he should discuss the matter with 
personnel who rendered the services and consider how the expected 
conduct and scope of his audit may be affected. In some cases, the 
auditor may find it useful to review the pertinent portions of the 
work papers prepared for the non-audit engagement as an aid in 
determining the nature of the services rendered or the possible 
audit implications.

    Other commenters suggested that the requirement be revised to use 
more of the language from AU sec. 9311. The requirement in Auditing 
Standard No. 12 \270\ has been revised as follows:
---------------------------------------------------------------------------

    \270\ Paragraph 45 of Auditing Standard No. 12.

    The auditor should obtain an understanding of the nature of the 
services that have been performed for the company by the auditor or 
affiliates of the firm\271\ and should take into account relevant 
information obtained from those engagements in identifying risks of 
material misstatement.\272\
---------------------------------------------------------------------------

    \271\ See PCAOB Rule 3501(a)(i), which defines ``affiliate of 
the accounting firm.''
    \272\ Paragraph 7 of Auditing Standard No. 9.

    One commenter stated that audit firms will need to develop very 
costly reporting systems to enable them to convey relevant information 
about nonassurance engagements to audit engagement teams. Existing 
PCAOB and SEC rules already require firms to track and report nonaudit 
services provided to the company. Complying with these requirements 
would mean that the audit firms have a mechanism in place to track 
these services. For example, PCAOB Rules 3524 \273\ and 352 \274\ 
require the auditor to describe to the company's audit committee, among 
other things, the scope of and the potential effect on independence of 
other services provided by the firm. It is expected that the system 
used to capture, track, and monitor these services for compliance with 
these PCAOB independence rules would also be applicable to comply with 
the requirements of Auditing Standard No. 12.
---------------------------------------------------------------------------

    \273\ PCAOB Rule 3524, Audit Committee Pre-approval of Certain 
Tax Services.
    \274\ PCAOB Rule 3526, Communication With Audit Committees 
Concerning Independence.
---------------------------------------------------------------------------

g. Performing Analytical Procedures
    The reproposed standard retained requirements from AU sec. 329, 
Analytical Procedures, to perform analytical procedures during the 
planning phase of the audit.\275\ Such analytical procedures are, in 
essence, risk assessment procedures, so the respective requirements and 
direction have been incorporated into Auditing Standard No. 12.\276\ 
One commenter stated that it is unclear whether the PCAOB intends a 
change in practice regarding the execution of analytical procedures 
performed as risk assessment procedures, e.g., because the requirements 
in the reproposed standard discussed developing expectations and 
comparing them to recorded amounts. AU sec. 329, states that analytical 
procedures involve developing expectations and comparing those 
expectations to recorded amounts.\277\
---------------------------------------------------------------------------

    \275\ AU secs. 329.06-.08.
    \276\ Paragraphs 46-48 of Auditing Standard No. 12.
    \277\ AU sec. 329.05.
---------------------------------------------------------------------------

    Auditing Standard No. 12 states that analytical procedures 
performed as risk assessment procedures often use data that is 
preliminary or data that is aggregated at a high level and that in 
those instances such analytical procedures are not designed with the 
level of precision necessary for substantive analytical 
procedures.\278\ In those situations, the auditor's expectations in 
performing analytical procedures as risk assessment procedures do not 
require the same

[[Page 59383]]

degree of precision as substantive analytical procedures.
---------------------------------------------------------------------------

    \278\ Paragraph 48 of Auditing Standard No. 12.
---------------------------------------------------------------------------

h. Conducting a Discussion Among Engagement Team Members Regarding 
Risks of Material Misstatement
    Like the reproposed standard, Auditing Standard No. 12 includes a 
requirement that key engagement team members discuss (1) the company's 
selection and application of accounting principles, including related 
disclosure requirements and (2) the susceptibility of the company's 
financial statements to material misstatement due to error or 
fraud.\279\ The standard explains that key engagement team members 
include the engagement partner and all engagement team members who have 
significant engagement responsibilities.\280\ The term ``significant 
engagement responsibilities'' should be familiar to auditors because it 
is already used in AU sec. 316 regarding the appropriate assignment of 
engagement team members in the overall responses to fraud risks.
---------------------------------------------------------------------------

    \279\ Paragraph 49 of Auditing Standard No. 12.
    \280\ Paragraph 50 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    One commenter stated that the requirement for participation in the 
discussion among engagement team members on the reproposed standard 
should be revised to use the language in ISA 315, Identifying and 
Assessing the Risks of Material Misstatement through Understanding the 
Entity and its Environment, so that the engagement partner makes the 
determination of what needs to be reported to whom on a ``need to 
know'' basis.
    The language in Auditing Standard No. 12 was retained as 
reproposed. The Board believes that the discussion among engagement 
team members is an important part of the auditor's risk assessment 
procedures. Through its oversight activities, the Board has observed 
deficiencies relating to discussions among engagement team members 
regarding fraud risks, including instances in which key engagement team 
members did not participate.\281\
---------------------------------------------------------------------------

    \281\ PCAOB Release 2007-001, Observations on Auditors' 
Implementation of PCAOB Standards Relating to Auditors' 
Responsibilities with Respect to Fraud (January 22, 2007).
---------------------------------------------------------------------------

(i). Discussion of the Potential for Material Misstatement Due to Fraud
    A number of comments were received regarding the requirements for 
discussing the risks of material misstatement due to fraud.
    One commenter suggested that the standard should require the 
auditor to consider using a fraud specialist. The Board believes that 
this point is already covered by the requirement in Auditing Standard 
No. 9 to evaluate whether a person with specialized skill or knowledge 
is needed to assess risks.\282\
---------------------------------------------------------------------------

    \282\ Paragraphs 16-17 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    One commenter suggested that the requirement to discuss how the 
financial statements could be materially misstated through omitting or 
presenting incomplete disclosures also should include the possibility 
of presenting inaccurate disclosures. The requirement has been revised 
to include that topic.\283\Another commenter stated that the standard 
should provide more ``guidance'' about how fraud risks relate to 
disclosures. The manner in which management might intentionally omit 
disclosures or present inaccurate or incomplete disclosures to commit 
or conceal intentional misstatement of the financial statements 
necessarily depends on the circumstances, including the incentives or 
pressures and the opportunities to manipulate the financial statements. 
The discussion of fraud risks required by the standard should prompt 
engagement team members to consider ways in which omissions or 
inaccuracies in disclosures might be involved with fraudulent financial 
reporting.
---------------------------------------------------------------------------

    \283\ Paragraph 52 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Another commenter stated that the requirement for the auditor to 
emphasize certain matters regarding fraud to the engagement team 
members during the fraud risk discussion does not assign the 
responsibility to a specific person. The requirement focuses on the 
communication of important matters rather than on the person 
communicating the matters. Since the engagement partner has the overall 
responsibility for the audit engagement, the engagement partner is 
likely to be the most appropriate person to make the communications. 
However, Auditing Standard No. 12 allows the communications to be made 
by another engagement team member, when appropriate.
(ii) Communication Among Engagement Team Members
    Auditing Standard No. 12 states that communication among the 
engagement team members about significant matters affecting the risks 
of material misstatement should continue throughout the audit, 
including when conditions change. This requirement carries forward and 
builds upon a requirement in AU sec. 316.\284\
---------------------------------------------------------------------------

    \284\ AU sec. 316.18.
---------------------------------------------------------------------------

i. Inquiring of the Audit Committee, Management, and Others Within the 
Company About the Risks of Material Misstatement
    Like the reproposed standard, Auditing Standard No. 12 requires the 
auditor to make inquiries of the audit committee, or equivalent (or its 
chair), management, the internal audit function, and others within the 
company who might reasonably be expected to have information that is 
important to the identification and assessment of risks of material 
misstatement.\285\ The requirement to inquire of others who ``might 
reasonably be expected to have information'' is similar to a 
requirement in AU sec. 316 for making inquiries of others about the 
existence or suspicion of fraud, and it establishes a principle to 
guide the auditor in determining those other persons to whom the 
inquiries should be addressed.\286\
---------------------------------------------------------------------------

    \285\ Paragraph 54 of Auditing Standard No. 12.
    \286\ AU sec. 316.24.
---------------------------------------------------------------------------

(i). Inquiries Regarding Fraud Risks
    The reproposed standard also required the auditor to make inquiries 
of the audit committee (or its chair), management, the internal audit 
function, and others within the company about the risks of fraud. 
Commenters suggested that the requirements for identifying other 
individuals within the company to whom inquiries should be directed 
should include determining the extent of such inquiries. Auditing 
Standard No. 12 reflects the suggested revision to that requirement 
because inquiries of other individuals should be designed to obtain 
information relevant to identifying and assessing fraud risks.\287\
---------------------------------------------------------------------------

    \287\ Paragraph 57 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    The reproposed standard included a requirement to take into account 
the fact that management is often in the best position to commit fraud 
when evaluating management's responses to inquiries about fraud risks 
and determining when it is necessary to corroborate management's 
responses. One commenter stated that the requirement was unclear and 
the use of the term ``take into account'' did not seem consistent with 
the Board's explanation in the release accompanying the reproposed 
standards. This requirement has been revised to clarify the requirement 
and to use ``take into account'' in a manner that is consistent with 
the other PCAOB standards.\288\
---------------------------------------------------------------------------

    \288\ Paragraph 58 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Auditing Standard No. 12 requires that the auditor use his or her

[[Page 59384]]

knowledge of the company and its environment, as well as information 
from other risk assessment procedures, to determine the nature of the 
inquiries about risks of material misstatement. This requirement 
carries forward and builds upon a requirement in AU sec. 316.\289\
---------------------------------------------------------------------------

    \289\ AU sec. 316.24.
---------------------------------------------------------------------------

    Auditing Standard No. 12 includes an additional required inquiry of 
the internal auditor about whether he or she is aware of instances of 
management override of controls and the nature and circumstances of 
such overrides. Also, Auditing Standard No. 12 requires the auditor to 
make inquiries of management and the audit committee, or equivalent 
regarding tips or complaints about the company's financial 
reporting.\290\ These required inquiries were added in light of 
research indicating that many incidents of fraud are uncovered through 
tips.\291\ These inquiries can provide important evidence about fraud 
risks.
---------------------------------------------------------------------------

    \290\ Paragraph 56 of Auditing Standard No. 12.
    \291\ See, e.g., Association of Certified Fraud Examiners, 2008 
Report to the Nation on Occupational Fraud & Abuse (2008).
---------------------------------------------------------------------------

    Auditing Standard No. 12 requires the auditor, when evaluating 
management's responses to inquiries about fraud risks and determining 
when it is necessary to corroborate management's responses, to take 
into account the fact that management is often in the best position to 
commit fraud. The standard also requires the auditor to obtain evidence 
to address inconsistencies in responses to inquiries. This requirement 
carries forward and builds upon a requirement in AU sec. 316.\292\
---------------------------------------------------------------------------

    \292\ AU sec. 316.27.
---------------------------------------------------------------------------

j. Identifying and Assessing the Risks of Material Misstatement
    Auditing Standard No. 12 sets forth a process for identifying and 
assessing the risks of material misstatement using the information 
obtained from the risk assessment procedures and other relevant 
knowledge possessed by the auditor.\293\ This process involves:
---------------------------------------------------------------------------

    \293\ Under Auditing Standard No. 12, the auditor has a 
responsibility to perform risk assessment procedures that provide an 
appropriate basis for his or her risk assessment. Auditing Standard 
No. 12 does not include the provision in the prior interim standards 
that allowed the auditor to assess risk at the maximum solely for 
efficiency reasons. Rather, the auditor needs to have a sufficient 
understanding of the company and its environment, including its 
internal control, in order to determine the risks of material 
misstatement and, in turn, to design effective tests of controls and 
substantive procedures.
---------------------------------------------------------------------------

    <bullet> Identifying risks of misstatement using information 
obtained from risk assessment procedures and considering the 
characteristics of the accounts and disclosures in the financial 
statements.
    <bullet> Evaluating whether the identified risks relate pervasively 
to the financial statements as a whole and potentially affect many 
assertions.
    <bullet> Evaluating the types of potential misstatements that could 
result from the identified risks and the accounts, disclosures, and 
assertions that could be affected. This includes evaluating how risks 
at the financial statement level could affect risks at the assertion 
level.
    <bullet> Assessing the likelihood of misstatement, including the 
possibility of multiple misstatements, and the magnitude of potential 
misstatement to assess the possibility that the risk could result in 
material misstatement of the financial statements. In making this 
assessment, the auditor may take into account the planned degree of 
reliance on controls that the auditor plans to test, if the auditor 
performs tests of controls in accordance with PCAOB standards.
    <bullet> Identifying significant accounts and disclosures and their 
relevant assertions.
    <bullet> Determining whether any of the identified and assessed 
risks of material misstatement are significant risks.\294\
---------------------------------------------------------------------------

    \294\ Paragraph 59 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    One commenter suggested that the word ``material'' should be 
inserted before the word ``misstatement'' in paragraph 56.a. of the 
reproposed standard. No change was made to Auditing Standard No. 12 
because inserting the word ``material'' would inappropriately narrow 
the auditor's focus on only material risks too early in the process of 
identifying and assessing risks of misstatement, i.e., before assessing 
the likelihood and magnitude of potential misstatements related to the 
risks.
    Commenters suggested that the standard should clarify that the 
likelihood and magnitude of potential misstatements should be 
considered in determining which risks are significant risks. Auditing 
Standard No. 12 includes an additional requirement that states, ``To 
determine whether an identified and assessed risk is a significant 
risk, the auditor should evaluate whether the risk requires special 
audit consideration because of the nature of the risk or the likelihood 
and potential magnitude of misstatement related to the risk.'' \295\ 
Also, the list of factors that should be evaluated in determining which 
risks are significant risks was expanded to include ``the effect of the 
quantitative and qualitative risk factors discussed in paragraph 60 of 
the standard [on identifying significant accounts and disclosures and 
their relevant assertions] on the likelihood and potential magnitude of 
misstatements.'' \296\ Including this new factor highlights the 
relationship between the identification of significant accounts and 
disclosures and their relevant assertions and the identification of 
significant risks. Specifically, risk factors that form the basis for 
identifying significant accounts and disclosures and their relevant 
assertions also inform the identification of significant risks, and 
significant risks affect one or more relevant assertions of significant 
accounts or disclosures.
---------------------------------------------------------------------------

    \295\ Paragraph 70 of Auditing Standard No. 12.
    \296\ Paragraph 71 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    Another commenter on the reproposed standard suggested that the 
term ``likelihood'' be defined more in terms of reasonable possibility 
as that term is used in Auditing Standard No. 5. However, that change 
would be inconsistent with the requirement to assess the likelihood of 
misstatements, i.e., the possibility that the risk would result in 
misstatement of the financial statements.
    One commenter indicated that the requirement in the note to 
paragraph 59.c. of the reproposed standard ``inappropriately infers 
that the auditor should, and can, associate the risks at the financial 
statement level with particular assertions in order to assess risks at 
the assertion level.'' Auditing Standard No. 8 states that risks of 
material misstatement at the financial statement level have a pervasive 
effect on the financial statements as a whole and potentially affect 
many assertions, and the standard provides examples of how risks at the 
financial statement level can result in misstatements.\297\ It is 
important for the auditor to take into account risks of material 
misstatement at the financial statement level in order to evaluate 
types of misstatements that could occur.
---------------------------------------------------------------------------

    \297\ Paragraph 6 of Auditing Standard No. 8.
---------------------------------------------------------------------------

    Under PCAOB standards, significant accounts and disclosures and 
their relevant assertions are identified based upon their risk 
characteristics. Thus, the auditor needs to identify and assess the 
risks in order to identify the relevant assertions of significant 
accounts and disclosures in accordance with PCAOB standards. For 
example, Auditing Standard No. 5 requires the auditor to identify 
significant accounts and disclosures and their relevant assertions in 
integrated audits.\298\ Also, AU sec. 319 required the auditor to 
perform substantive procedures for the relevant assertions of 
significant accounts and

[[Page 59385]]

disclosures for all audits of financial statements, which implicitly 
required the auditor to identify those accounts, disclosures, and 
assertions.\299\ Auditing Standard No. 12 imposes a more explicit 
requirement on the auditor to identify significant accounts and 
disclosures and their relevant assertions in all audits.
---------------------------------------------------------------------------

    \298\ Paragraph 28 of Auditing Standard No. 5.
    \299\ Ibid.
---------------------------------------------------------------------------

(i). Factors Relevant To Identifying Fraud Risks
    Auditing Standard No. 12 requires that the auditor evaluate whether 
the information gathered from the risk assessment procedures indicates 
that one or more fraud risk factors are present and should be taken 
into account in identifying and assessing fraud risks.\300\ The 
reproposed standard included a paragraph that stated that the auditor 
should not assume that all of the fraud risk factors discussed in must 
be observed to conclude that a fraud risk exists. Commenters suggested 
that the language was not clear as to the action that auditors would 
need to take to ``not assume.'' The paragraph has been revised to 
clarify that all of the conditions are not required to be observed or 
evident to conclude that a fraud risk exists.\301\
---------------------------------------------------------------------------

    \300\ Paragraph 65 of Auditing Standard No. 12.
    \301\ Paragraph 66 of Auditing Standard No. 12.
---------------------------------------------------------------------------

    (ii). Consideration of the Risk of Omitted or Incomplete 
Disclosures
    The reproposed standard stated that the auditor's evaluation of 
fraud risk factors should include an evaluation of how fraud could be 
perpetrated or concealed by omitting required disclosures or by 
presenting incomplete disclosures. One commenter stated that the 
requirement should also include consideration of the possibility of 
presenting inaccurate disclosures. Other commenters stated that the 
requirement should be revised to refer to disclosures required by the 
applicable financial reporting framework. The requirement has been 
revised to encompass inaccurate disclosures and to refer to disclosures 
required for the fair presentation of the financial statements in 
conformity with the applicable financial reporting framework.\302\
---------------------------------------------------------------------------

    \302\ Paragraph 67 of Auditing Standard No. 12.
---------------------------------------------------------------------------

(iii). Presumption of Fraud Risk Involving Improper Revenue Recognition
    Like the reproposed standard, Auditing Standard No. 12 contains a 
requirement that the auditor should presume that there is a fraud risk 
involving improper revenue recognition and evaluate which types of 
revenue, revenue transactions, or assertions may give rise to such 
risks.\303\ One commenter recommended rewording this paragraph to state 
that while revenue recognition should be presumed to be a higher level 
of risk, there are exceptions. The requirement was retained as stated 
in the reproposed standard because a significant number of financial 
reporting frauds relate to revenue recognition.\304\
---------------------------------------------------------------------------

    \303\ Paragraph 68 of Auditing Standard No. 12.
    \304\ See, e.g., Committee of Sponsoring Organizations of the 
Treadway Commission, Fraudulent Financial Reporting: 1998-2007 (May 
2010).
---------------------------------------------------------------------------

k. Definition of Significant Risk
    The reproposed standard defined significant risk as a risk of 
material misstatement that requires special audit consideration. Some 
commenters stated that the definition of ``significant risk'' in the 
reproposed standard should be revised to indicate that significant 
risks are ``identified risks'' and that they are determined using the 
``auditor's judgment'' or risks that the auditor ``determines.'' Adding 
a reference to the auditor's determination or auditor's judgment is 
unnecessary because those points are inherent in the requirements for 
identifying significant risks, e.g., in the required evaluation of the 
likelihood and potential magnitude of misstatements related to the 
risk. Similarly, the reference to ``identified risks'' is unnecessary 
because it is already mentioned in the requirement for determining 
significant risks. Accordingly, the definition of significant risk 
included in the reproposed standard is retained.

8. Auditing Standard No. 13--The Auditor's Responses to the Risks of 
Material Misstatement

a. Background
    Auditing Standard No. 13 establishes requirements for responding to 
the risks of material misstatement, including responses regarding the 
general conduct of the audit and responses involving audit procedures. 
Auditing Standard No. 13 applies to integrated audits and audits of 
financial statements only.
b. Linking Assessed Risks and Auditor's Responses
    The reproposed standard included a requirement for the auditor to 
design and implement appropriate responses to the ``assessed risks of 
material misstatement'' to address comments received on the original 
proposed standard for improving the linkage between the auditor's 
responses and the identification and assessment of risks of material 
misstatement. Acknowledging the improvements in the reproposed 
standard, some commenters continued to suggest that the objective also 
should state that the auditor is to address the assessed risks of 
material misstatement.
    In the Board's view, obtaining sufficient appropriate evidence to 
support the auditor's opinion requires the auditor to adequately 
respond to the risks of material misstatement. Accordingly, the title 
and objective of the standard continue to refer to responding to the 
risks of material misstatement. However, the Board recognizes that the 
appropriate identification and assessment of the risks of material 
misstatement in accordance with Auditing Standard No. 12 enable the 
auditor to effectively respond to the risks of material misstatement. 
Auditing Standard No. 13 continues to impose on auditors an 
unconditional responsibility to design and implement responses that 
address the risks of material misstatement identified and assessed in 
accordance with Auditing Standard No. 12.\305\ As with the reproposed 
standard, noncompliance with the requirements in Auditing Standard No. 
12 that leads to a failure to identify or appropriately assess a risk 
of material misstatement also could result in a failure to 
appropriately respond to the risk of material misstatement in 
accordance with this standard.\306\
---------------------------------------------------------------------------

    \305\ Paragraph 3 of Auditing Standard No. 13.
    \306\ Failure to address a risk of material misstatement also 
might indicate a failure to comply with Auditing Standard No. 12.
---------------------------------------------------------------------------

c. Overall Responses to Risks
    The reproposed standard included a requirement for the auditor to 
respond to the risks of material misstatement through overall responses 
and responses involving the nature, timing, and extent of audit 
procedures. Overall responses relate to the general conduct of the 
audit, e.g., appropriately assigning and properly supervising 
engagement team members, incorporating an element of unpredictability 
into the audit, evaluating the company's selection and application of 
significant accounting principles, and making pervasive changes to the 
audit. Such responses are required by AU sec. 316 in response to fraud 
risks, but the reproposed standard extended the requirement to apply to 
risks of material misstatement due to error or fraud. These responses, 
by their nature, are appropriate for addressing risks of material 
misstatement due to error or fraud.
    Some commenters expressed concerns regarding the expansion of the 
requirement for incorporating an

[[Page 59386]]

element of unpredictability to apply to risks of material misstatement 
other than fraud risks.
    In the Board's view, although incorporating an element of 
unpredictability is intended primarily to address fraud risks, it also 
can enable the auditor to detect errors or control deficiencies that 
could otherwise remain undetected. In addition, the requirement to 
incorporate an element of unpredictability when testing controls 
already exists in Auditing Standard No. 5. Auditing Standard No. 13 
continues to indicate that the auditor should incorporate an element of 
unpredictability as part of the response to the risks of material 
misstatement, including fraud risks.\307\
---------------------------------------------------------------------------

    \307\ Paragraph 5.c. of Auditing Standard No. 13.
---------------------------------------------------------------------------

    One commenter requested clarification regarding the differences 
between the first and third examples used to illustrate ways to 
incorporate an element of unpredictability in paragraph 5.c. of the 
reproposed standard. The first example in Auditing Standard No. 13 is 
intended to illustrate that the auditor may decide to perform audit 
procedures for a particular account, disclosure, or assertion even 
though the auditor's risk assessment did not identify specific risks 
associated with those accounts.\308\ The third example is intended to 
illustrate that when sampling a particular financial statement amount, 
the auditor may consider selecting items with amounts lower than the 
threshold that the auditor had used in the past, or expanding the 
selection to other sections of the population that the auditor had not 
tested in the past.\309\
---------------------------------------------------------------------------

    \308\ Paragraph 5.c. (1) of Auditing Standard No. 13.
    \309\ Paragraph 5.c. (3) of Auditing Standard No. 13.
---------------------------------------------------------------------------

    The reproposed standard required the auditor to evaluate whether it 
is necessary to make pervasive changes to the audit to adequately 
address the assessed risks of material misstatement. The reproposed 
standard did not require that pervasive changes be made in every audit. 
Instead, it required the auditor to evaluate whether pervasive changes 
that affect many aspects of the audit are needed to address the 
assessed risks of material misstatement. Commenters questioned the use 
of the term ``pervasive'' in the requirement. Auditing Standard No. 13 
provides additional explanation of the types of circumstances in which 
pervasive changes might be necessary.\310\
---------------------------------------------------------------------------

    \310\ Paragraph 6 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    Existing PCAOB standards require the auditor to apply professional 
skepticism as part of due care,\311\ and Auditing Standard No. 13 
states that the auditor's response to fraud risks involves the 
application of professional skepticism in gathering and evaluating 
audit evidence.\312\ The requirement is intended to emphasize the 
importance of professional skepticism in responding to risks of 
material misstatement without limiting its application to the auditor's 
responses.
---------------------------------------------------------------------------

    \311\ AU secs. 230.07-.09.
    \312\ Paragraph 7 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    One commenter expressed concern that the reproposed standard did 
not explicitly require the auditor to implement overall responses to 
risks at the financial statement level. Such an explicit requirement 
would inappropriately limit the auditor's overall responses to risks at 
the financial statement level. Many of the overall responses also apply 
to risks at the assertion level, e.g., assigning more experienced 
personnel or applying a greater extent of supervision to accounts or 
disclosures with higher risk.
d. Responses Involving the Nature, Timing, and Extent of Audit 
Procedures
    The reproposed standard required the auditor to design and perform 
audit procedures in a manner that addresses the assessed risks of 
material misstatement for each relevant assertion of each significant 
account and disclosure. Auditing Standard No. 13 retained this 
requirement as reproposed. The requirement emphasizes that the auditor 
should focus on each relevant assertion of each significant account and 
disclosure and the risks of material misstatement associated with the 
relevant assertion when designing and performing audit procedures.
    The reproposed standard also included requirements for the auditor 
to design the testing of controls to accomplish the objectives of both 
the audit of financial statements and the audit of internal control in 
an integrated audit. This requirement is aligned with Auditing Standard 
No. 5. One commenter suggested that that the requirement be removed 
because it relates only to integrated audits. The requirement was 
retained as reproposed because Auditing Standard No. 13 applies to 
integrated audits as well as audits of financial statements only, and 
tests of controls are a necessary response in the audit of internal 
control.\313\
---------------------------------------------------------------------------

    \313\ Paragraph 9.c. of Auditing Standard No. 13.
---------------------------------------------------------------------------

e. Tests of Controls in an Audit of Internal Control
    Auditing Standard No. 13 includes requirements for performing tests 
of controls in the audit of financial statements.\314\
---------------------------------------------------------------------------

    \314\ Paragraphs 16-35 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    In an integrated audit, the tests of controls performed in the 
audit of internal control are part of the auditor's responses to the 
risks of material misstatement, as indicated in paragraph 9-10 of 
Auditing Standard No. 13.\315\ To help facilitate the integration of 
tests of controls in an integrated audit, the standard continues to use 
language similar to that of Auditing Standard No. 5 when describing 
analogous terms and concepts relating to the testing of controls.
---------------------------------------------------------------------------

    \315\ Paragraph 39 of Auditing Standard No. 5 states, ``The 
auditor should test those controls that are important to the 
auditor's conclusion about whether the company's controls 
sufficiently address the assessed risk of misstatement to each 
relevant assertion.''
---------------------------------------------------------------------------

f. Tests of Controls and Control Risk Assessment in the Audit of 
Financial Statements
(i). Requirements on When to Test Controls
    AU sec. 319 required auditors to obtain evidence about the design 
effectiveness and operating effectiveness of controls (a) when the 
auditor plans to rely on selected controls to reduce his or her 
substantive procedures and (b) in those limited circumstances in which 
the auditor cannot obtain sufficient appropriate evidence through 
substantive procedures alone.\316\ Thus, except in those limited 
circumstances, AU sec. 319 provided auditors with flexibility to decide 
when or whether to test controls.
---------------------------------------------------------------------------

    \316\ AU sec. 319.66.
---------------------------------------------------------------------------

    Auditing Standard No. 13 does not change the requirements in AU 
sec. 319 regarding when testing controls is necessary in audits of 
financial statements only.\317\ In those audits, auditors continue to 
have the same flexibility in deciding when or whether to test controls 
to reduce their substantive procedures.\318\ Auditing Standard No. 13 
includes additional statements that emphasize the flexibility that 
auditors have in making these decisions and provides additional 
examples, adapted from AU sec. 319.68, of situations in which auditors 
cannot obtain sufficient appropriate audit evidence through substantive 
procedures alone.\319\
---------------------------------------------------------------------------

    \317\ Certain clarifying revisions were made to the discussion 
of relying on controls to modify the auditor's substantive 
procedures, in response to comments on the reproposed standard. See 
footnote 12 to paragraph 16 of Auditing Standard No. 13.
    \318\ Paragraph 16 of Auditing Standard No. 13.
    \319\ Paragraph 17 of Auditing Standard No. 13.

---------------------------------------------------------------------------

[[Page 59387]]

(ii). Period of Reliance
    Auditing Standard No. 13 states that when the auditor relies on 
controls to assess control risk at less than the maximum, the auditor 
must obtain evidence that the controls selected for testing are 
designed effectively and operated effectively during the entire period 
of reliance.\320\ The concept of the period of reliance was introduced 
in Auditing Standard No. 5 and discussed further in the PCAOB staff 
guidance, Staff Views: An Audit of Internal Control Over Financial 
Reporting That Is Integrated with an Audit of Financial Statements--
Guidance for Auditors of Smaller Public Companies. Auditing Standard 
No. 13 provides a definition of ``period of reliance'' that parallels 
the language in paragraph B4 of Auditing Standard No. 5.\321\
---------------------------------------------------------------------------

    \320\ Paragraph 16 of Auditing Standard No. 13.
    \321\ Paragraph A.3 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(iii). Evidence About the Effectiveness of Controls
    Auditing Standard No. 13 describes the principle, adapted from AU 
sec. 319,\322\ that the evidence necessary to support the auditor's 
control risk assessment depends on the degree of reliance the auditor 
plans to place on the effectiveness of a control. In applying that 
principle, Auditing Standard No. 13 requires the auditor to obtain more 
persuasive audit evidence from tests of controls the greater the 
reliance the auditor places on the effectiveness of a control. In 
addition, Auditing Standard No. 13 requires the auditor to obtain more 
persuasive evidence about the effectiveness of controls for each 
relevant assertion for which the audit approach consists primarily of 
tests of controls, including situations in which substantive procedures 
alone cannot provide sufficient appropriate audit evidence.\323\
---------------------------------------------------------------------------

    \322\ AU sec. 319.90.
    \323\ Paragraph 18 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(iv). Testing Operating Effectiveness
    Auditing Standard No. 13 requires the auditor to determine, among 
other things, whether the person performing the control possesses the 
necessary authority and competence to perform the control 
effectively.\324\ This requirement is intended to call to the auditor's 
attention that whether he or she possesses the appropriate level of 
authority and the knowledge and skills necessary to perform the control 
function is essential to whether a person can effectively perform the 
control. Thus, the auditor is required to make such determination 
before he or she can conclude about the effectiveness of the control.
---------------------------------------------------------------------------

    \324\ Paragraph 21 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(v). Timing of Tests of Controls--Evidence Obtained During an Interim 
Period
    The reproposed standard stated that the auditor must obtain 
evidence about the effectiveness of controls selected for testing for 
the entire period of reliance. When the auditor tests controls during 
an interim period, additional evidence that is necessary concerning the 
operation of those controls for the remaining period of reliance 
depends on a series of factors listed in the reproposed standard, 
including, among other factors, the possibility of significant changes 
in internal control over financial reporting occurring subsequent to 
the interim date.
    One commenter suggested adding ``control environment'' to the list 
of factors that could affect the auditor's determination of what 
additional evidence is necessary. The control environment has an 
important, but indirect, effect on the likelihood that a misstatement 
will be prevented or detected on a timely basis. Also, unlike 
monitoring controls, the control environment is not designed to 
identify possible breakdowns in other controls. Accordingly, the 
control environment, by itself, does not reduce the amount of evidence 
needed concerning controls over specific relevant assertions for the 
remaining period. The control environment is not included in the list 
of factors in Auditing Standard No. 13.
    Another commenter suggested adding a requirement for the auditor to 
obtain, when applicable, audit evidence about subsequent changes to the 
controls tested during the interim period. A note has been added to 
Auditing Standard No. 13 requiring the auditor to obtain evidence about 
such subsequent changes, if significant.\325\
---------------------------------------------------------------------------

    \325\ Paragraph 30 of Auditing Standard No. 13.
---------------------------------------------------------------------------

(vi). Timing of Tests of Controls--Evidence from Past Audits
    Auditing Standard No. 13 states that the auditor should obtain 
evidence during the current year audit about the design and operating 
effectiveness of controls upon which the auditor relies.\326\ This 
requirement is based on the principle that auditors should support 
their control risk assessments each year with current evidence. 
However, when the auditor has tested the controls in the past and plans 
to rely on the same controls for the current year audit, the amount of 
evidence needed will vary based on the relevant factors listed in the 
standard.\327\ These additional factors generally relate to the degree 
of reliance on the control, the risk that the control will fail to 
operate as designed, and the nature and amount of evidence that the 
auditor has already obtained regarding the effectiveness of the 
controls. These requirements are consistent with Auditing Standard No. 
5. Also, the standard allows the auditor to use a benchmarking 
strategy, when appropriate, for automated application controls for 
subsequent years' audits, as do the provisions of Auditing Standard No. 
5. However, the standard does not permit testing controls once every 
third year because the standard requires evidence regarding the 
effectiveness of controls to be obtained each year.
---------------------------------------------------------------------------

    \326\ Paragraph 31 of Auditing Standard No. 13.
    \327\ Ibid.
---------------------------------------------------------------------------

    Some commenters expressed concern that the requirements in the 
reproposed standard for determining the amount of evidence needed in 
the current year could be interpreted as requiring the auditor to 
consider each factor listed for each of the controls that the auditor 
tested in the past, regardless of whether or not the auditor plans to 
rely on those controls for purposes of the current year audit. The 
requirement was intended to apply when the auditor tested the controls 
in the past audits and plans to rely on those controls and use evidence 
about the effectiveness of those controls obtained in prior years for 
purposes of the current year audit. That requirement is clarified in 
Auditing Standard No. 13.\328\
---------------------------------------------------------------------------

    \328\ Ibid.
---------------------------------------------------------------------------

(vii). Assessing Control Risk
    Auditing Standard No. 13 requires the auditor to assess control 
risk for relevant assertions.\329\ This requirement is not new. AU sec. 
319 established requirements for the auditor to assess control risk, 
and Auditing Standard No. 5 discusses control risk assessment in the 
financial statement audit portion of the integrated audit.\330\
---------------------------------------------------------------------------

    \329\ Paragraphs 32-34 of Auditing Standard No. 13.
    \330\ AU secs. 319.70, .83-.90 and paragraphs B4-B5 of Auditing 
Standards No. 5.
---------------------------------------------------------------------------

    Auditing Standard No. 13 requires the auditor to assess the control 
risk at the maximum level for relevant assertions when the controls 
necessary to sufficiently address the assessed risk of material 
misstatement in those assertions are missing or ineffective or when the 
auditor has not obtained sufficient appropriate evidence to support a 
control risk assessment below the maximum level.\331\
---------------------------------------------------------------------------

    \331\ Paragraph 33 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    One commenter expressed a concern that the reproposed standard 
seemed to

[[Page 59388]]

indicate that no reduction of the control risk assessment should occur 
based on understanding the design effectiveness of controls. The 
commenter suggested that a control that does not exist or is not 
designed effectively should have a different impact on the auditor's 
testing than a control that is designed effectively but not tested by 
the auditor.
    The risk assessment standards already address the points raised by 
the commenter regarding the effect of control deficiencies on the 
auditor's testing. Auditing Standard No. 12 requires the auditor to 
obtain an understanding of the design of the company's controls as part 
of his or her risk assessment procedures.\332\ If the auditor 
identifies design deficiencies in the company's controls, the auditor 
would take that into account in identifying and assessing the risks of 
material misstatement, and Auditing Standard No. 13 requires the 
auditor to implement responses to address those risks of material 
misstatement. When deficiencies are detected during the auditor's 
testing of controls that the auditor plans to rely on, Auditing 
Standard No. 13 requires the auditor to (1) perform tests of other 
controls related to the same assertion as the ineffective controls, or 
(2) revise the control risk assessment and modify the planned 
substantive procedures as necessary in light of the increased 
assessment of risk.\333\
---------------------------------------------------------------------------

    \332\ Paragraph 20 of Auditing Standard No. 12.
    \333\ Paragraph 34 of Auditing Standard No. 13.
---------------------------------------------------------------------------

    Another commenter suggested that the reproposed standard provide 
more direction about evaluating control deviations by adding a 
paragraph from Auditing Standard No. 5 regarding evaluating control 
deficiencies. The referenced paragraph does not apply specifically to 
assessing control risk in a financial statement audit, and Auditing 
Standard No. 13 requires the auditor to evaluate the evidence from all 
sources, including the results of test of controls, when assessing 
control risk for relevant assertions.\334\
---------------------------------------------------------------------------

    \334\ Paragraph 32 of Auditing Standard No. 13.
---------------------------------------------------------------------------

g. Substantive Procedures
    Auditing Standard No. 13 requires the auditor to perform 
substantive procedures for each relevant assertion of each significant 
account and disclosure, regardless of the assessed level of control 
risk.\335\ By definition, a relevant assertion of a significant account 
and disclosure has a reasonable possibility of containing a 
misstatement or misstatements that would cause the financial statements 
to be materially misstated.\336\ The requirement to obtain evidence 
from substantive procedures for each relevant assertion of each 
significant account and disclosure reflects the principle that the 
auditors need to implement appropriate responses to address the 
assessed risks of material misstatement.
---------------------------------------------------------------------------

    \335\ Paragraph 36 of Auditing Standard No. 13.
    \336\ Paragraph A9 of Auditing Standard No. 5.
---------------------------------------------------------------------------

    Existing PCAOB standards indicate that some risks of material 
misstatement might require more evidence from substantive procedures 
because of certain inherent limitations of internal control.\337\ For 
example, more evidence from substantive procedures ordinarily is needed 
for relevant assertions that have a higher susceptibility to management 
override or to lapses in judgment or breakdowns resulting from human 
failures. Observations from the Board's oversight activities have 
underscored the importance of this principle. Auditing Standard No. 13 
includes this principle because it is particularly relevant to the 
determination of the nature, timing, and extent of substantive 
procedures. It is also consistent with the principles regarding 
detection risk discussed in Auditing Standard No. 8.
---------------------------------------------------------------------------

    \337\ See, e.g., paragraph .14 of AU sec. 328, Auditing Fair 
Value Measurements and Disclosures.
---------------------------------------------------------------------------

h. Timing of Substantive Procedures
    The reproposed standard included a requirement for the auditor to 
take into account certain factors in determining whether it is 
appropriate to perform substantive procedures at an interim date. One 
commenter suggested that another point be added to the standard to 
require the auditor to review ``the internal control changes that have 
been made to date and the nature and extent of monitoring such changes 
by the client staff.'' Auditing Standard No. 13 requires the auditor to 
consider the effect of known or expected changes in the company, its 
environment, and its internal control over financial reporting during 
the remaining period on its risk assessments when determining whether 
to perform substantive procedures at an interim date.\338\ This 
additional requirement recognizes that both changes in controls and 
other changes to the company and its environment can affect the risks 
of material misstatement and, thus, the effectiveness of interim 
substantive procedures. For example, significant changes in industry or 
market conditions near year end could increase the risk of material 
misstatement regarding the valuation of assets at year end, which, in 
turn, would require significant audit attention during the remaining 
period.
---------------------------------------------------------------------------

    \338\ Paragraph 44.a.(3) of Auditing Standard No. 13.
---------------------------------------------------------------------------

    The reproposed standard stated that when an auditor performs 
substantive procedures as of an interim date, the auditor should 
perform substantive procedures, or substantive procedures combined with 
tests of controls, that provide a reasonable basis for extending the 
audit conclusions from the interim date to the period end. The 
reproposed standard also required that the auditor perform certain 
procedures that were adapted from AU sec. 313.
    Some commenters suggested that the Board remove the mandatory 
procedures in the reproposed standard, arguing that the procedures 
should be determined by the auditor based on professional judgment. 
Removing those requirements as suggested by the commenters would weaken 
PCAOB standards. Observations from the Board's oversight activities 
have included instances in which inadequate audit work was performed 
when extending the conclusion reached at the interim date to the end of 
the period covered by the financial statements. Therefore, retaining 
the mandatory procedures in this standard continues to be 
appropriate.\339\
---------------------------------------------------------------------------

    \339\ Paragraph 45 of Auditing Standard No. 13.
---------------------------------------------------------------------------

i. Substantive Procedures Responsive to Significant Risks
    Like the original proposed standard, the reproposed standard stated 
that the auditor should perform substantive procedures, including tests 
of details, that are specifically responsive to the significant risks. 
AU sec. 329 indicates that tests of details should be performed in 
response to significant risks.\340\
---------------------------------------------------------------------------

    \340\ AU sec. 329.09.
---------------------------------------------------------------------------

    One commenter continued to express concern about imposing a 
presumptively mandatory responsibility for auditors to perform tests of 
details in response to significant risks. Auditing Standard No. 13 
retains the requirement as reproposed.\341\ The nature and importance 
of significant risks warrant a high level of assurance from substantive 
procedures to adequately address the risk. Also, analytical procedures 
alone are not well suited to detecting certain types of misstatements 
related to significant risks, including, in particular, fraud risks. 
For example, when fraud risks are present, management might be able to 
override controls to allow adjustments that result in artificial 
changes to the financial statement relationships being analyzed,

[[Page 59389]]

causing the auditor to draw erroneous conclusions.
---------------------------------------------------------------------------

    \341\ Paragraph 11 of Auditing Standard No. 13.
---------------------------------------------------------------------------

j. Dual-purpose Test
    Auditing Standard No. 13 recognized that, in certain situations, 
the auditor might perform a substantive test of a transaction 
concurrently with a test of a control relevant to that transaction, 
i.e., a dual-purpose test. The auditor is required to design the dual-
purpose test to achieve the objectives of both the test of the control 
and the substantive test. In addition, the auditor is required to 
evaluate the results of the test in forming conclusions about both the 
assertion and the effectiveness of the control being tested.\342\ The 
standard refers the auditors to the relevant requirements in AU sec. 
350, Audit Sampling, for determining the proper sample size in a dual-
purpose test.
---------------------------------------------------------------------------

    \342\ Paragraph 47 of Auditing Standard No. 13.
---------------------------------------------------------------------------

9. Auditing Standard No. 14--Evaluating Audit Results

a. Background
    Auditing Standard No. 14 describes the auditor's responsibilities 
regarding the process of evaluating the results of the audit and 
determining whether sufficient appropriate audit evidence has been 
obtained in order to form the opinion to be expressed in the auditor's 
report. This standard consolidates into one auditing standard the 
requirements that were previously included in five separate auditing 
standards.\343\ The standard highlights matters that are important to 
the auditor's conclusions about the financial statements and the 
effectiveness of internal control.
---------------------------------------------------------------------------

    \343\ AU sec. 312, regarding evaluating audit results, including 
uncorrected misstatements; AU sec. 316, regarding fraud 
considerations that are relevant to evaluating audit results; AU 
sec. 329, regarding performing the overall review; AU sec. 326, 
regarding determining whether sufficient appropriate audit evidence 
has been obtained; and AU sec. 431, regarding the evaluation of 
disclosures.
---------------------------------------------------------------------------

b. Definition of Misstatement
    The reproposed standard defined the term ``misstatement'' as 
follows:

    A misstatement, if material individually or in combination with 
other misstatements, causes the financial statements not to be 
presented fairly in conformity with the applicable financial 
reporting framework.\344\ A misstatement may relate to a difference 
between the amount, classification, presentation, or disclosure of a 
reported financial statement item and the amount, classification, 
presentation, or disclosure that should be reported in conformity 
with the applicable financial reporting framework. Misstatements can 
arise from error (i.e., unintentional misstatement) or fraud.
---------------------------------------------------------------------------

    \344\ The auditor should look to the requirements of the 
Securities and Exchange Commission for the company under audit with 
respect to accounting principles applicable to that company.

    Some commenters indicated that the definition applied to ``material 
misstatement'' rather than ``misstatement'' and suggested revisions to 
the definition, e.g., moving the second sentence to the beginning of 
the definition.
    Auditing Standard No. 14 carries forward the definition of 
``misstatement'' as reproposed.\345\ This definition is not a 
definition of the term ``material misstatement.'' Rather, the 
definition emphasizes that misstatements prevent financial statements 
from being fairly presented in conformity with the applicable financial 
reporting framework, as discussed in AU sec. 411, The Meaning of 
Present Fairly in Conformity With Generally Accepted Accounting 
Principles. The phrase used in the definition, ``if material 
individually or in combination with other misstatements,'' is 
equivalent to the phrase ``In the absence of materiality 
considerations,'' which was used in the description of the term 
``misstatement'' in an auditing interpretation of AU sec. 312.\346\ The 
second sentence of the definition in Auditing Standard No. 14 describes 
the most common types of misstatements.\347\
---------------------------------------------------------------------------

    \345\ Paragraph A2 of Appendix A to Auditing Standard No. 14.
    \346\ Paragraph .02 of AU sec. 9312, Audit Risk and Materiality 
in Conducting an Audit: Auditing Interpretations of Section 312, 
which is superseded by the risk assessment standards, stated ``In 
the absence of materiality considerations, a misstatement causes the 
financial statements not to be in conformity with generally accepted 
accounting principles.''
    \347\ See also paragraph A2 of Auditing Standard No. 14.
---------------------------------------------------------------------------

c. Performing Analytical Procedures in the Overall Review
    Auditing Standard No. 14 adapted the requirements that were 
previously included in AU secs. 316 and 329 to read the financial 
statements and disclosures and perform analytical procedures in the 
overall review. The standard imposes on auditors a responsibility to 
read the financial statements and disclosures and perform analytical 
procedures to (a) evaluate the auditor's conclusions formed regarding 
significant accounts and disclosures and (b) assist in forming an 
opinion on whether the financial statements as a whole are free of 
material misstatement.\348\ In particular, Auditing Standard No. 14 
requires the auditor to evaluate whether (a) evidence gathered in 
response to unusual or unexpected transactions, events, amounts, or 
relationships previously identified during the audit is sufficient and 
(b) unusual or unexpected transactions, events, amounts, or 
relationships indicate risks of material misstatement that were not 
identified previously.\349\ Performing analytical procedures in the 
overall review assists the auditor in assessing the conclusions reached 
and in evaluating the overall financial statement presentation.
---------------------------------------------------------------------------

    \348\ Paragraph 5 of Auditing Standard No. 14.
    \349\ Paragraph 6 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 adapted a requirement, which previously 
existed in AU sec. 316, for the auditor to perform analytical 
procedures relating to revenue through the end of the period.\350\ 
These procedures are intended to identify unusual or unexpected 
relationships involving revenue accounts that might indicate a material 
misstatement, including a material misstatement due to fraud. 
Performing analytical procedures relating to revenue is important in 
light of the generally higher risk of financial statement fraud 
involving revenue accounts.
---------------------------------------------------------------------------

    \350\ Paragraph 7 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 requires the auditor to corroborate 
management's explanations regarding significant unusual or unexpected 
transactions, events, amounts, or relationships. The standard also 
states that if management's responses to the auditor's inquiries appear 
to be implausible, inconsistent with other audit evidence, imprecise, 
or not at a sufficient level of detail to be useful, the auditor should 
perform procedures to address the matter.\351\ Auditing Standard No. 
15, Audit Evidence, states that inquiry of company personnel, by 
itself, does not provide sufficient audit evidence to reduce audit risk 
to an appropriately low level.\352\ Therefore, obtaining corroboration 
of management's responses is important in obtaining sufficient 
appropriate audit evidence.
---------------------------------------------------------------------------

    \351\ Paragraph 8 of Auditing Standard No. 14.
    \352\ Paragraph 17 of Auditing Standard No. 15.
---------------------------------------------------------------------------

d. Clearly Trivial
    Auditing Standard No. 14 requires the auditor to accumulate 
misstatements identified during the audit, other than those that are 
clearly trivial.\353\ Like AU sec. 312, the standard allows the auditor 
to set a threshold for accumulating misstatements, provided that the 
threshold is set at a de minimis level that could not result in 
material misstatement of the financial statements, individually or in 
combination with other misstatements, after considering the possibility 
of

[[Page 59390]]

further undetected misstatement.\354\ The specific limitation on 
setting a threshold for accumulating misstatements is important to 
assure a proper evaluation of the effect of uncorrected misstatements 
on the financial statements.
---------------------------------------------------------------------------

    \353\ Paragraph 10 of Auditing Standard No. 14.
    \354\ Paragraph 11 of Auditing Standard No. 14.
---------------------------------------------------------------------------

e. Accumulating Misstatements
    The reproposed standard required the auditor to accumulate 
identified misstatements other than those that are clearly trivial. The 
reproposed standard also required the auditor to use his or her best 
estimate of the total misstatement in the accounts and disclosures that 
the auditor has tested, not just the amount of misstatements 
specifically identified. This includes misstatements related to 
accounting estimates and projected misstatements from substantive 
procedures that involve audit sampling.\355\
---------------------------------------------------------------------------

    \355\ Paragraphs 10-12 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Commenters suggested that the standard should use terms such as 
``known and likely misstatement'' or other terms to categorize the 
misstatements. Auditing Standard No. 14 uses the term ``identified 
misstatement'' to refer to misstatements that are identified during the 
audit and the term ``accumulated misstatements'' to refer to 
misstatements that are more than clearly trivial and, thus, should be 
accumulated by the auditor. Because Auditing Standard No. 14 requires 
the auditor to use his or her best estimate of the misstatements (which 
is how AU sec. 312 described ``likely misstatements''), it is not 
necessary to use the term ``known and likely misstatements.''
f. Correction of Misstatements
    Auditing Standard No. 14 requires that if management made 
corrections to accounts or disclosures in response to misstatements 
detected by the auditor, the auditor should evaluate management's work 
to determine whether the corrections have been recorded properly and to 
determine whether uncorrected misstatements remain.\356\ The standard 
imposes on auditors a responsibility to determine whether misstatements 
identified by the auditor and communicated to management are correctly 
recorded in the accounting records.
---------------------------------------------------------------------------

    \356\ Paragraph 16 of Auditing Standard No. 14.
---------------------------------------------------------------------------

g. Considerations When Accumulated Misstatements Approach the 
Materiality Level or Levels Used in Planning and Performing Audit 
Procedures
    Auditing Standard No. 14 requires the auditor to determine whether 
the overall strategy needs to be revised when the aggregate of 
misstatements accumulated during the audit approaches the materiality 
level or levels used in planning and performing the audit. When the 
aggregate of misstatements approaches the materiality level or levels 
used in planning and performing an audit, there likely will be greater 
than an appropriately low level of risk that possible undetected 
misstatements, combined with uncorrected misstatements accumulated 
during the audit, could be material to the financial statements. If the 
auditor assesses this risk to be unacceptably high, he or she should 
perform additional audit procedures or determine that management has 
adjusted the financial statements so that the risk that the financial 
statements are materially misstated has been reduced to an 
appropriately low level.\357\
---------------------------------------------------------------------------

    \357\ Paragraph 14 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard stated that when the aggregate of 
accumulated misstatements approaches the materiality used in planning 
and performing the audit, the auditor should perform additional 
procedures or determine that management has adjusted the financial 
statements so that the risk of material misstatement has been reduced 
to an appropriately low level. One commenter suggested that it is not 
clear what the additional procedures are and that more work is not 
always the answer. The additional procedures that are necessary depend 
upon, among other things, the procedures performed by the auditor to 
date and the nature of the misstatements that were detected.
h. Requirement to Reevaluate the Materiality Level
    Auditing Standard No. 11 includes a requirement to reevaluate the 
established materiality level or levels in certain circumstances. 
Auditing Standard No. 14 states that if the reevaluation of the 
materiality level or levels established in accordance with Auditing 
Standard No. 11 results in a lower amount for the materiality level or 
levels, the auditor should take into account that lower materiality 
level in the evaluation of uncorrected misstatements.\358\ The 
requirements are intended to prevent the auditor from incorrectly 
concluding that uncorrected misstatements are immaterial because he or 
she used outdated financial statement information. However, the 
standard does not allow the auditor to establish a higher level or 
levels of materiality when uncorrected misstatements exceed the 
initially established level or levels of materiality.
---------------------------------------------------------------------------

    \358\ Paragraph 17 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Reevaluating the established materiality level or levels prior to 
evaluating the effect of uncorrected misstatements will cause audit 
results to be evaluated based on the latest financial information.
i. Evaluating Uncorrected Misstatements
    The reproposed standard stated that the auditor should evaluate the 
uncorrected misstatements in relation to accounts and disclosures and 
to the financial statements as a whole, taking into account relevant 
quantitative and qualitative factors. The reproposed standard retained 
the provisions regarding qualitative factors that were included in an 
auditing interpretation to AU sec. 312,\359\ with some minor revisions 
to align the factors more closely to the terminology in the reproposed 
standard and to omit qualitative factors that apply only to nonissuers. 
A commenter indicated that the term ``profitability,'' which is 
included in the qualitative factors in Appendix B, is not defined, and 
the commenter suggested including examples of profitability in the 
reproposed standard. Although this term is not explicitly defined in 
Auditing Standard No. 14, it should be familiar to auditors because the 
related auditing interpretation was issued in 2000. Auditing Standard 
No. 14 carries forward the requirements and the related list of 
qualitative factors that are substantially the same as those in the 
auditing interpretation.\360\
---------------------------------------------------------------------------

    \359\ AU sec. 9312.15-17.
    \360\ AU sec. 9312 and paragraph 17 and Appendix B of Auditing 
Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 requires an evaluation of the effects of 
both uncorrected misstatements detected in prior years and 
misstatements detected in the current year that relate to prior 
years.\361\ The standard does not address how to evaluate the effects 
of prior period misstatements because that is an accounting and 
financial reporting matter. For example, the SEC staff has provided 
guidance in SEC Staff Accounting Bulletin (``SAB'') Topic 1.N, 
Considering the Effects of Prior Year Misstatements when Quantifying 
Misstatements in Current Year Financial Statements, on the effects of 
prior year misstatements when quantifying

[[Page 59391]]

misstatements in the current year financial statements. This SAB 
provides the SEC staff's views regarding evaluating the quantitative 
and qualitative factors regarding the materiality of uncorrected 
misstatements and evaluating the effects of prior year misstatements.
---------------------------------------------------------------------------

    \361\ Paragraph 18 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 states that the auditor cannot assume that 
an instance of error or fraud is an isolated occurrence and that the 
auditor should evaluate the nature and effects of the individual 
misstatements accumulated during the audit on the assessed risks of 
material misstatement.\362\ This procedure is important to inform the 
auditor's conclusions about whether the auditor's risk assessments 
remain appropriate and whether he or she has obtained sufficient 
appropriate evidence to support his or her opinion.
---------------------------------------------------------------------------

    \362\ Paragraph 19 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard included a requirement to evaluate the 
nature and effects of the individual misstatements accumulated during 
the audit on the assessed risks of material misstatement. A commenter 
suggested that this evaluation should be performed at the time the 
misstatement is identified. In the Board's view, it is not necessary to 
prescribe the timing for the evaluation of the nature and effects of 
misstatements on the risk assessments. However, performing this 
evaluation during the course of the audit could allow the auditor to 
make the necessary modifications to his or her planned audit procedures 
on a more timely basis.
    The reproposed standard required the auditor to evaluate whether 
identified misstatements might be indicative of fraud and, in turn, how 
they affect the auditor's evaluation of materiality and the related 
audit responses. This requirement is adapted from AU sec. 316.\363\ One 
commenter suggested that when there is an indicator of fraud, the 
requirement should make clear that clearly trivial misstatements may 
need to be evaluated to determine if they should be included in the 
accumulated misstatements. Like AU sec. 316, the requirement in the 
reproposed standard was phrased in terms of identified misstatements 
rather than accumulated misstatements because fraud of relatively small 
amounts can be material to the financial statements.
---------------------------------------------------------------------------

    \363\ AU sec. 316.75.
---------------------------------------------------------------------------

    Auditing Standard No. 14 retains the requirement as 
reproposed.\364\ If an auditor detects a misstatement, he or she should 
evaluate whether the misstatement is indicative of fraud when deciding 
whether a misstatement is clearly trivial and thus does not warrant 
being included with accumulated misstatements. Additionally, in 
situations in which the auditor believes that a misstatement is or 
might be intentional and the effect on the financial statements could 
be material or cannot be readily determined, Auditing Standard No. 14 
requires that the auditor perform procedures to obtain additional audit 
evidence to determine whether the fraud has occurred or is likely to 
have occurred. If the fraud has occurred or is likely to have occurred, 
the auditor is required to determine its effect on the financial 
statements and the auditor's report thereon.
---------------------------------------------------------------------------

    \364\ Paragraph 20 of Auditing Standard No. 14.
---------------------------------------------------------------------------

j. Communication of Accumulated Misstatements to Management
    The reproposed standard required the auditor to communicate 
accumulated misstatements to management on a timely basis to provide 
management with an opportunity to correct them. The reproposed standard 
also required the auditor to obtain an understanding of the reasons 
that management decided not to correct misstatements communicated by 
the auditor.
    Some commenters suggested that the standard should specifically 
require the auditor to request management to correct the misstatements.
    Auditing Standard No. 14 retains the requirement as 
reproposed.\365\ It is not necessary to specifically require the 
auditor to request that management correct the misstatements because 
management has its own legal responsibilities in relation to the 
preparation and maintenance of the company's books, records, and 
financial statements. Section 13(i) of the Securities and Exchange Act 
of 1934, 15 U.S.C. 78m(i), requires the financial statements filed with 
the SEC to reflect all material correcting adjustments identified by 
the auditor.
---------------------------------------------------------------------------

    \365\ Paragraphs 15 and 25 of Auditing Standard No. 14.
---------------------------------------------------------------------------

k. Communication of Illegal Acts
    Auditing Standard No. 14 requires the auditor to determine his or 
her responsibility under AU secs. 316.79-.82A, AU sec. 317, and Section 
10A of the Securities and Exchange Act of 1934, 15 U.S.C. 78j-1, if the 
auditor becomes aware of information indicating that fraud or another 
illegal act has occurred or might have occurred.\366\
---------------------------------------------------------------------------

    \366\ Paragraph 23 of Auditing Standard No. 14.
---------------------------------------------------------------------------

l. Evaluating the Qualitative Aspects of the Company's Accounting 
Practices
    Auditing Standard No. 14 requires the auditor to evaluate the 
qualitative aspects of the company's accounting practices, including 
potential bias in management's judgments regarding the amounts and 
disclosures in the financial statements.\367\
---------------------------------------------------------------------------

    \367\ Paragraph 24 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Auditing Standard No. 14 also states that if the auditor identifies 
bias in management's judgments about the amounts and disclosures in the 
financial statements, the auditor should evaluate whether the effect of 
that bias, together with the effect of uncorrected misstatements, 
results in material misstatement of the financial statements. Also, the 
standard states that the auditor should evaluate whether the auditor's 
risk assessments, including, in particular, the assessment of fraud 
risks, and the related audit responses remain appropriate.\368\
---------------------------------------------------------------------------

    \368\ Paragraph 26 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard included an example of management bias, 
which was based on observations from the Board's oversight activities. 
This example indicated that when management identifies adjusting 
entries that offset misstatements identified by the auditor, the 
auditor should perform procedures to determine why the underlying 
misstatement was not identified previously. The auditor also should 
evaluate the implications on the integrity of management, and the 
auditor's risk assessments, including fraud risk assessments, and 
perform additional procedures as necessary to address the risk of 
further undetected misstatements. A commenter suggested using the 
phrase ``identified misstatements other than those that are * * * 
clearly trivial'' instead of ``identified misstatements.'' The 
requirement has been revised to refer to misstatements accumulated by 
the auditor as required by paragraph 10 of Auditing Standard No. 
14.\369\
---------------------------------------------------------------------------

    \369\ Paragraph 25 of Auditing Standard No. 14.
---------------------------------------------------------------------------

m. Assessment of Fraud Risks
    The reproposed standard required the auditor to evaluate whether 
the accumulated results of auditing procedures and other observations 
affect the auditor's assessment of fraud risks made throughout the 
audit and whether the audit procedures need to be modified to respond 
to those risks.\370\ The reproposed standard included a reference to 
Appendix C, which listed matters that might affect the assessment of 
fraud risks. Appendix C stated that if

[[Page 59392]]

the matters listed in the appendix are identified during the audit, the 
auditor should determine whether the assessment of fraud risks remains 
appropriate or needs to be revised. This requirement was included 
because the evaluation provides additional insight regarding the fraud 
risks and the potential need to perform additional procedures to 
support the opinion to be expressed in the auditor's report.
---------------------------------------------------------------------------

    \370\ Paragraph 28 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    Some commenters indicated that the requirement in Appendix C seems 
to indicate that the auditor is required to determine if each item 
identified during the audit individually affects the assessment of 
fraud risks, which appears to be inconsistent with paragraph 28. Those 
commenters suggested revisions to the first sentence of Appendix C. 
After considering these comments, the first sentence of Appendix C has 
been revised to state that if the matters listed in the appendix are 
identified during the audit, the auditor should take into account these 
matters in the evaluation of the assessment of fraud risks, as 
discussed in paragraph 28.\371\
---------------------------------------------------------------------------

    \371\ Paragraph C1 of Appendix C to Auditing Standard No. 14.
---------------------------------------------------------------------------

    One commenter suggested including in Appendix C specific procedures 
that the auditor could perform to evaluate fraud risk, such as 
evaluating journal entries with round numbers or amounts slightly below 
a specified threshold. This type of procedure could be appropriate for 
selecting journal entries for testing, but it is different in nature 
from the matters listed in Appendix C.
    Auditing Standard No. 14 includes a requirement for the engagement 
partner to determine whether there has been appropriate communication 
with the other engagement team members throughout the audit regarding 
information or conditions that are indicative of fraud risks.\372\ This 
requirement is adapted from the existing PCAOB standards.\373\
---------------------------------------------------------------------------

    \372\ Paragraph 29 of Auditing Standard No. 14.
    \373\ AU sec. 316.18.
---------------------------------------------------------------------------

n. Evaluating Financial Statement Disclosures
    The reproposed standard included a requirement, adapted from AU 
sec. 431, for the auditor to evaluate whether the financial statements 
contain the required disclosures and, if the required disclosures are 
not included in the financial statements, to express a qualified or 
adverse opinion in accordance with AU sec. 508, Reports on Audited 
Financial Statements. The reproposed standard also stated that 
evaluation of disclosures includes consideration of the form, 
arrangement, and content of the financial statements (including the 
accompanying notes), encompassing matters such as the terminology used, 
the amount of detail given, the classification of items in the 
statements, and the bases of amounts set forth. These requirements were 
included in the reproposed standard because of the importance of 
disclosures to the fair presentation of financial statements.
    Some commenters stated that the requirements regarding evaluation 
of disclosures should be qualified based on materiality considerations. 
Auditing Standard No. 14 states that the auditor should evaluate 
whether the financial statements contain the information essential for 
a fair presentation of the financial statements in conformity with the 
applicable financial reporting framework, which is aligned with an 
analogous requirement in AU sec. 508.41.\374\ AU sec. 411 discusses the 
concept of materiality regarding the auditor's opinion that financial 
statements are presented fairly.\375\
---------------------------------------------------------------------------

    \374\ Paragraph 31 of Auditing Standard No. 14.
    \375\ AU sec. 411.04.
---------------------------------------------------------------------------

    Another commenter questioned whether the statement that 
``Evaluation of disclosures includes consideration of the form, 
arrangement, and content of the financial statements (including the 
accompanying notes), encompassing matters such as the terminology used, 
the amount of detail given, the classification of items in the 
statements, and the bases of amounts set forth'' is a requirement. The 
statement in the reproposed standard, which is retained in Auditing 
Standard No. 14, explains that the scope of the auditor's required 
evaluation of the information disclosed in the financial statements 
includes matters such as the form, arrangement, and content of the 
financial statements.\376\
---------------------------------------------------------------------------

    \376\ Paragraph 31 of Auditing Standard No. 14.
---------------------------------------------------------------------------

o. Evaluating the Sufficiency and Appropriateness of Audit Evidence
    The reproposed standard required the auditor to conclude whether 
sufficient appropriate audit evidence has been obtained to support his 
or her opinion on the financial statements. The reproposed standard 
also presented a list of factors that are relevant to the auditor's 
conclusion on whether sufficient appropriate audit evidence has been 
obtained. Consideration of the listed factors is essential to reaching 
an informed conclusion about whether sufficient appropriate audit 
evidence has been obtained. Accordingly, both the requirement and the 
list of factors contained in the reproposed standard have been 
retained.\377\
---------------------------------------------------------------------------

    \377\ Paragraphs 33-34 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    A commenter suggested that corrected adjustments also should be 
considered in concluding whether sufficient appropriate audit evidence 
has been obtained. Auditing Standard No. 14 already requires the 
auditor to evaluate the results of audit procedures in evaluating 
whether sufficient appropriate evidence has been obtained, and this 
would include misstatements identified by the auditor, regardless of 
whether they were corrected by management.\378\
---------------------------------------------------------------------------

    \378\ Paragraph 34 of Auditing Standard No. 14.
---------------------------------------------------------------------------

    The reproposed standard expanded the requirements regarding 
situations in which the auditor has not obtained sufficient appropriate 
audit evidence to include situations in which the auditor has 
substantial doubt about a relevant assertion. This additional provision 
was adapted from AU sec. 326. A commenter suggested that the 
requirement be revised to state that the auditor should attempt to 
obtain additional evidence if the auditor has not obtained sufficient 
appropriate evidence about a relevant assertion. The requirement has 
been retained as stated in the reproposed standard because it covers 
situations in which the evidence is inadequate and situations in which 
the auditor has concerns about whether an assertion is misstated.\379\
---------------------------------------------------------------------------

    \379\ Paragraph 35 of Auditing Standard No. 14.
---------------------------------------------------------------------------

p. Evaluating the Results of the Audit of Internal Control
    The reproposed standard included a section relating to evaluating 
audit results in the audit of internal control, which references 
Auditing Standard No. 5 for the requirements on evaluating the results 
of the audit of internal control.\380\ A commenter suggested removing 
this paragraph from the reproposed standard. Auditing Standard No. 14 
retains this paragraph, although it does not impose additional 
requirements. Including this paragraph emphasizes that, in integrated 
audits, the evaluation of audit results is an integrated process that 
affects both audits.
---------------------------------------------------------------------------

    \380\ Paragraph 37 of Auditing Standard No. 14.
---------------------------------------------------------------------------

10. Auditing Standard No. 15--Audit Evidence

a. Background
    Auditing Standard No. 15 explains what constitutes audit evidence, 
establishes requirements regarding designing and performing audit 
procedures to obtain sufficient

[[Page 59393]]

appropriate audit evidence to support the opinion in the auditor's 
report, and discusses methods for selecting items for testing.
b. Nature of Audit Evidence
    The reproposed standard stated that audit evidence is all the 
information, whether obtained from audit procedures or other sources, 
that is used by the auditor in arriving at the conclusions on which the 
auditor's opinion is based. Audit evidence consists of both information 
that supports and corroborates management's assertions regarding the 
financial statements or internal control over financial reporting and 
any information that contradicts such assertions.
    One commenter indicated that the meaning of the phrase ``and any 
information that contradicts such assertions'' was unclear. The 
commenter suggested that the Board clarify whether the requirement 
meant the auditor should look for such contradictory information, or if 
the requirement should apply only when such information comes to the 
auditor's attention.
    PCAOB standards require the auditor to plan and perform the audit 
to obtain sufficient appropriate evidence to support an opinion about 
whether the financial statements are free of material misstatement and, 
in the audit of internal control, whether material weaknesses 
exist.\381\ Thus, the auditor is required to perform the audit 
procedures necessary to test the accounts and controls, regardless of 
whether the results of those procedures support or contradict the 
assertions. The requirement in Auditing Standard No. 15 means that when 
contradictory evidence is obtained, the auditor should evaluate it when 
forming a conclusion on the financial statements and, in integrated 
audits, on internal control over financial reporting. To clarify the 
requirement, Auditing Standard No. 15 omits the word ``any.'' \382\
---------------------------------------------------------------------------

    \381\ Paragraph 3 of Auditing Standard No. 8 and paragraph 3 of 
Auditing Standard No. 5, respectively.
    \382\ Paragraph 2 of Auditing Standard No. 15.
---------------------------------------------------------------------------

c. Objective
    The objective in the reproposed standard acknowledged the auditor's 
responsibility to plan and perform the audit to obtain sufficient 
appropriate audit evidence to support the opinion expressed in the 
auditor's report. Commenters suggested revising the wording in 
paragraph 4 of the reproposed standard to be consistent with the 
objective in paragraph 3 of the reproposed standard. The requirement in 
paragraph 4 of Auditing Standard No. 15 has been revised to be 
consistent with the objective of the standard.
d. Sufficient Appropriate Audit Evidence
    The reproposed standard explained the meaning of the words 
``sufficient'' and ``appropriate'' as used in the phrase ``sufficient 
appropriate audit evidence.'' Commenters suggested that the Board 
provide formal definitions for terms like ``sufficiency'' and 
``appropriate'' so the terms can be easily located within the 
standards. Adding definitions is unnecessary because Auditing Standard 
No. 15 already describes the terms ``sufficiency'' and 
``appropriateness'' and explains the relevant characteristics of 
each.\383\
---------------------------------------------------------------------------

    \383\ Paragraphs 5-6 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    Commenters stated that the term ``persuasive'' was used in the 
reproposed standard, The Auditor's Responses to the Risks of Material 
Misstatement, and recommended that the Board clarify in the reproposed 
audit evidence standard the manner in which the persuasiveness of 
evidence affects the evaluation of audit evidence. The concept of 
``persuasiveness of evidence'' is discussed in Auditing Standard No. 
13.\384\
---------------------------------------------------------------------------

    \384\ Paragraph 39 of Auditing Standard No. 13.
---------------------------------------------------------------------------

e. Relevance and Reliability
    The reproposed standard contained a discussion about the relevance 
and reliability of audit evidence. The reproposed standard stated that 
the audit evidence must be both relevant and reliable to support the 
auditor's conclusions about the subject of the audit procedure. The 
reproposed standard stated that ``[e]vidence provided by original 
documents is more reliable than evidence provided by photocopies or 
facsimiles, or documents that have been filmed, digitized, or otherwise 
converted into electronic form, the reliability of which depends on the 
controls over the conversion and maintenance of those documents.''
    One commenter suggested that the standard be revised to indicate 
that electronic information, subject to proper controls, is in many 
ways more reliable than physical documentation. The language from the 
reproposed standard was retained in Auditing Standard No. 15.\385\ 
Although evidence sometimes is available only in electronic form and 
the reliability of electronic evidence depends on the controls over 
that information, an authentic original document generally is more 
reliable than an electronic form of that document.
---------------------------------------------------------------------------

    \385\ Paragraph 8 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    The reproposed standard stated that the relevance of audit evidence 
refers to its relationship to the assertion or to the objective of the 
control being tested. The relevance of audit evidence depends on (a) 
the design of the audit procedure used to test the assertion or 
control, and (b) the timing of the audit procedure used to test the 
assertion or control. One commenter recommended the description of the 
term ``relevance'' should be expanded to include the following 
statements:

    Relevance deals with the logical connection with, or bearing 
upon, the purpose of the audit procedure and, when appropriate, the 
assertion under consideration. The relevance of information to be 
used as audit evidence may be affected by the direction of testing.

    Auditing Standard No. 15 retains the description included in the 
reproposed standard because it is clearer than the suggested 
revision.\386\
---------------------------------------------------------------------------

    \386\ Paragraph 7 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    The reproposed standard indicated that ``[t]he auditor is not 
expected to be an expert in document authentication. However, if 
conditions indicate that a document may not be authentic or that the 
terms in a document have been modified but that the modifications have 
not been disclosed to the auditor, the auditor should modify the 
planned audit procedures or perform additional audit procedures to 
respond to those conditions and should evaluate the effect, if any, on 
the other aspects of the audit.''
    One commenter suggested that the requirement for the auditor to 
modify the planned audit procedures or perform additional audit 
procedures in response to concerns about the authenticity of documents 
should be linked to professional skepticism. The commenter also stated 
that many modifications are routine. The requirement was not meant to 
require the auditor to perform unlimited procedures but, rather, to 
perform the procedures necessary to address the issue in the 
circumstances. Auditing Standard No. 15 retains this requirement as 
reproposed.\387\Although professional skepticism is important in these 
situations, it is not the only factor that determines the procedures 
necessary to address the matter.
---------------------------------------------------------------------------

    \387\ Paragraph 9 of Auditing Standard No. 15.
---------------------------------------------------------------------------

f. Financial Statement Assertions
    In representing that the financial statements are presented fairly 
in conformity with the applicable financial reporting framework, 
management

[[Page 59394]]

implicitly or explicitly makes assertions regarding the recognition, 
measurement, presentation, and disclosure of the various elements of 
financial statements and related disclosures. Financial statement 
assertions are an important consideration for audits performed in 
accordance with PCAOB standards. For example, AU sec. 319 required 
auditors to perform substantive procedures for relevant assertions in 
audits of financial statements. Auditing Standard No. 5 requires 
auditors to obtain evidence about the design and operating 
effectiveness of controls over relevant assertions in audits of 
internal control.
    The reproposed standard retained the five categories of financial 
statement assertions in AU sec. 326 and Auditing Standard No. 5. Two 
commenters suggested that the Board use different descriptions for 
financial statement assertions. One commenter suggested using other 
standard-setters' descriptions of financial statement assertions. The 
other commenter suggested using a different description of assertions. 
Auditing Standard No. 15 retains the categories of assertions as 
reproposed.\388\ Like Auditing Standard No. 5,\389\Auditing Standard 
No. 15 allows auditors the flexibility to use categories of assertions 
that differ from the assertions listed in the standard under specified 
conditions.\390\
---------------------------------------------------------------------------

    \388\ Paragraph 11 of Auditing Standard No. 15.
    \389\ See the note to paragraph 28 of Auditing Standard No. 5.
    \390\ Paragraph 12 of Auditing Standard No. 15.
---------------------------------------------------------------------------

g. Inquiry
    The reproposed standard stated that inquiry of company personnel, 
by itself, does not provide sufficient audit evidence to reduce audit 
risk to an appropriately low level for a relevant assertion or to 
support a conclusion about the effectiveness of a control. One 
commenter suggested that the note to paragraph 17 of the reproposed 
standard be revised to include ``design and operating effectiveness of 
a control'' and that the auditor should perform audit procedures in 
addition to the use of inquiry to obtain sufficient appropriate audit 
evidence. Auditing Standard No. 15 retains the language from the 
reproposed standard. The phrase ``effectiveness of a control'' 
encompasses both design and operating effectiveness. It is not 
considered necessary to add that the auditor should perform additional 
procedures, since Auditing Standard No. 15 states that inquiry, by 
itself, does not provide sufficient audit evidence.\391\
---------------------------------------------------------------------------

    \391\ Paragraph 17 of Auditing Standard No. 15.
---------------------------------------------------------------------------

h. Confirmation
    The reproposed standard stated that a confirmation represents audit 
evidence obtained by the auditor as a direct response to the auditor 
from a third party. Some commenters suggested that the reproposed 
standard clarify that a confirmation be written. Auditing Standard No. 
15 has been revised to state that a confirmation response represents a 
particular form of audit evidence obtained by the auditor from a third 
party in accordance with PCAOB standards.\392\ The Board has a separate 
standards-setting project on confirmations that, among other things, 
will address the use of written confirmation or other alternative forms 
of confirmation.\393\
---------------------------------------------------------------------------

    \392\ Paragraph 18 of Auditing Standard No. 15.
    \393\ PCAOB Release No. 2010-003, Proposed Auditing Standard 
Related to Confirmation and Related Amendments to PCAOB Standards 
(July 13, 2010).
---------------------------------------------------------------------------

i. Analytical Procedures
    The reproposed standard described analytical procedures as an audit 
procedure for obtaining evidence. One commenter suggested adding 
``scanning'' as part of analytical procedures. Scanning is a means for 
selecting items for testing, not a separate audit procedure. The 
description of analytical procedures in Auditing Standard No. 15 is 
retained as reproposed.\394\
---------------------------------------------------------------------------

    \394\ Paragraph 21 of Auditing Standard No. 15.
---------------------------------------------------------------------------

j. Selecting Items for Testing To Obtain Audit Evidence
    Auditing Standard No. 15 contains a section on selecting items for 
testing that is adapted from an auditing interpretation of AU sec. 
350.\395\ The standard also states that the auditor should determine 
the means of selecting items for testing to obtain evidence that, in 
combination with other relevant evidence, is sufficient to meet the 
objective of the audit procedure.\396\
---------------------------------------------------------------------------

    \395\ AU sec. 9350, Audit Sampling: Auditing Interpretations of 
AU sec. 350.
    \396\ Paragraph 22 of Auditing Standard No. 15.
---------------------------------------------------------------------------

    The reproposed standard defined audit sampling as the application 
of an audit procedure to less than 100 percent of the occurrences of a 
control or items comprising an account for the purpose of evaluating 
some characteristic of the control or account. One commenter stated 
that the definition in the standard should be conformed to AU sec. 350. 
Auditing Standard No. 15 reflects revisions that align the standard 
with AU sec. 350.
k. Other Changes
    As noted in the reproposing release, certain topics that were 
included in AU sec. 326 were not carried forward to the reproposed 
standard and Auditing Standard No. 15. AU sec. 326 discussed the use of 
audit objectives, and an appendix to that standard illustrated how 
auditors might use assertions to develop audit objectives and 
substantive tests of inventory. Such a discussion is not necessary 
because the auditing standards do not require auditors to establish 
audit objectives to link assertions to substantive procedures. However, 
omission of this discussion would not preclude auditors from using 
audit objectives in designing their audit procedures.

11. Amendments to PCAOB Standards

a. Amendments to Auditing Standard No. 3
    In the release accompanying the original proposed standards, the 
Board sought comment on the need for specific documentation 
requirements regarding the risk assessment procedures. Responses from 
commenters were mixed. Some commenters supported adding specific 
documentation requirements, other commenters stated that the 
requirements in Auditing Standard No. 3, Audit Documentation, were 
adequate, and one commenter was ambivalent.
    After consideration of these comments and additional analysis, the 
amendments accompanying the reproposed standards included certain 
amendments to Auditing Standard No. 3 to (a) specify certain required 
documentation regarding the auditor's risk assessments and related 
responses, (b) align certain terms and provisions of Auditing Standard 
No. 3 with the risk assessment standards, and (c) incorporate the 
principles for documentation of disagreements among engagement team 
members. For example, the amendments indicated that the auditor's 
documentation should include the following:
    <bullet> A summary of the identified risks of misstatement and the 
auditor's assessment of risks of material misstatement at the financial 
statement and assertion levels; and
    <bullet> The auditor's responses to the risks of material 
misstatement, including linkage of the responses to those risks.
    Also, the requirements regarding documentation of significant 
findings or issues and related matters were expanded to require 
documentation regarding the significant risks identified and the 
results of the auditing procedures performed in response to those 
risks.
    A commenter indicated that the additional documentation requirement

[[Page 59395]]

will result in ``unnecessary linkage'' and ``a matrix-like mentality'' 
to the audit documentation. The documentation requirements are intended 
to enhance the auditor's ability to link identified and assessed risks 
to appropriate responses and could help reviewers understand the areas 
of greatest risk and the auditor's responses to those risks. In 
addition to these documentation requirements, the auditor would 
continue to be responsible for preparing documentation as required by 
other provisions of Auditing Standard No. 3, e.g., to demonstrate that 
the engagement complied with the standards of the PCAOB.\397\
---------------------------------------------------------------------------

    \397\ Paragraph 5.a. of Auditing Standard No. 3.
---------------------------------------------------------------------------

    Some commenters suggested placing the documentation requirements in 
the respective risk assessment standards rather than amending Auditing 
Standard No. 3. The risk assessment standards are foundational 
standards; therefore, the required documentation related to the risk 
assessment standards is included in Auditing Standard No. 3.\398\ 
Future decisions about the placement of new documentation requirements 
will be made during the course of the respective standards-setting 
projects.
---------------------------------------------------------------------------

    \398\ Paragraphs 9, 12, and 19 of Auditing Standard No. 3, as 
amended.
---------------------------------------------------------------------------

b. Amendments to Auditing Standard No. 4
    The amendment to Auditing Standard No. 4, Reporting on Whether a 
Previously Reported Material Weakness Continues To Exist, is limited to 
changing the word ``competent'' to ``appropriate'' when that word is 
used in reference to audit evidence.
c. Amendments to Auditing Standard No. 5
    The amendments to Auditing Standard No. 5 that accompanied the 
reproposed standards were limited to changing the phrase ``any 
assistants'' to ``the members of the engagement team,'' changing the 
word ``competent'' to ``appropriate'' when that word is used in 
reference to audit evidence, and updating references to auditing 
standards that are being superseded or amended. These amendments are 
retained as reproposed.
    One commenter suggested a series of additional amendments to 
Auditing Standard No. 5, which primarily involved removing certain 
paragraphs from Auditing Standard No. 5 that relate to risk assessment 
procedures or other requirements that are included in the risk 
assessment standards. The Board is not removing the requirements 
regarding risk assessment procedures from Auditing Standard No. 5 
because those requirements are important to understanding the other 
provisions of Auditing Standard No. 5 for performing an audit of 
internal control.
d. Amendments to Auditing Standard No. 6
    The amendments to Auditing Standard No. 6, Evaluating Consistency 
of Financial Statements, are limited to removing a footnote stating 
that the term ``error'' as used in Statement of Financial Accounting 
Standards No. 154, Accounting Changes and Error Corrections (``SFAS No. 
154''), is equivalent to ``misstatement'' as used in the auditing 
standards and updating a reference to a standard that is being 
superseded. This technical change is made because the footnote 
regarding misstatements in Auditing Standard No. 6 refers to SFAS No. 
154, whereas the definition of ``misstatement'' in Auditing Standard 
No. 14 on evaluating audit results is neutral regarding the financial 
reporting framework. However, this technical change does not alter the 
fact that an error under accounting standards generally accepted in the 
United States is a misstatement under Auditing Standard No. 14.
e. Amendments to Auditing Standard No. 7
    The amendments to Auditing Standard No. 7, Engagement Quality 
Review, update footnote 3 and the note to paragraph 10 to replace a 
reference to an interim standard that is superseded and to update the 
definitions of the terms ``engagement partner'' and ``significant 
risk'' to conform to the definitions in the risk assessment standards.
f. Amendments to Interim Auditing Standards
(i). Superseded Sections
    The risk assessment standards supersede the following sections of 
PCAOB interim auditing standards:

    <bullet> AU sec. 311, Planning and Supervision
    <bullet> AU sec. 312, Audit Risk and Materiality in Conducting an 
Audit
    <bullet> AU sec. 313, Substantive Tests Prior to the Balance Sheet 
Date
    <bullet> AU sec. 319, Consideration of Internal Control in a 
Financial Statement Audit
    <bullet> AU sec. 326, Evidential Matter
    <bullet> AU sec. 431, Adequacy of Disclosure in Financial 
Statements

    Similarly, the auditing interpretations of AU secs. 311, 312, and 
350 have been incorporated into the risk assessment standards and thus 
are superseded. The auditing interpretations of AU sec. 326, except for 
Interpretation No. 2 (AU secs. 9326.06-.23), also are superseded.\399\
---------------------------------------------------------------------------

    \399\ Interpretation No. 2 relates in part to AU sec. 336 and AU 
sec. 337, Inquiry of a Client's Lawyer Concerning Litigation, 
Claims, and Assessments, and it will be evaluated in connection with 
standards-setting projects related to those standards.
---------------------------------------------------------------------------

(ii). AU sec. 316, Consideration of Fraud in a Financial Statement 
Audit
    The relevant requirements regarding identifying and assessing fraud 
risks, principally AU secs. 316.14-.45; responding to fraud risks, 
principally AU secs. 316.46-.50; and evaluating audit results, 
principally AU secs. 316.68-.78, have been incorporated into Auditing 
Standard Nos. 12, 13, and 14, respectively. The remaining portions of 
AU sec. 316 describe important principles regarding the auditor's 
responsibility with respect to fraud and more detailed requirements 
regarding the auditor's responses to fraud risks. Topics covered in the 
remaining portions of AU sec. 316, as amended, include the following:
    <bullet> A description of fraud and its characteristics,
    <bullet> The importance of exercising professional skepticism,
    <bullet> Examples of fraud risk factors,
    <bullet> Examples of audit procedures performed to respond to fraud 
risks involving fraudulent financial reporting and misappropriation of 
assets, and
    <bullet> Requirements regarding procedures to further address the 
risk of material misstatement due to fraud involving management 
override of controls, including examining journal entries and other 
adjustments for evidence of possible material misstatement due to 
fraud; reviewing accounting estimates for biases that could result in 
material misstatement due to fraud; and evaluating the business 
rationale for significant unusual transactions.
(iii). AU sec. 329, Analytical Procedures
    The discussion in AU sec. 329 regarding analytical procedures 
performed during audit planning, principally AU secs. 329.03 and 
329.06-.08, is incorporated into Auditing Standard No. 12. Similarly, 
the requirements regarding analytical procedures in the overall review, 
principally AU secs. 329.23-.24, are incorporated into Auditing 
Standard No. 14. The remaining portion of AU sec. 329 relates to 
analytical procedures performed as substantive procedures. Therefore, 
AU sec. 329 is retitled, Substantive Analytical Procedures,

[[Page 59396]]

which more accurately reflects the content of the amended standard.
    A standard that focuses solely on substantive analytical procedures 
highlights more clearly the requirements that apply to analytical 
procedures performed for that purpose, including the higher degree of 
precision in substantive analytical procedures needed to provide the 
necessary level of assurance. The Board has observed instances in which 
auditors performed substantive procedures to test accounts without 
meeting the requirements in AU sec. 329 for substantive analytical 
procedures.\400\
---------------------------------------------------------------------------

    \400\ See, e.g., PCAOB Release 2007-010, Report on the PCAOB's 
2004, 2005, and 2006 Inspections of Domestic Triennially Inspected 
Firms (October 22, 2007).
---------------------------------------------------------------------------

(iv). AU sec. 336, Using the Work of a Specialist
    The text of footnote 1 to paragraph .01 and of paragraph .05 were 
amended to clarify that AU sec. 336 does not apply to situations in 
which persons who participate in the audit have specialized skills or 
knowledge in accounting or auditing (e.g., IT specialists and income 
tax specialists) and to specialists employed by the firm. Auditing 
Standard No. 10 applies to those situations. Those clarifications were 
previously included in the reproposed standard on audit planning and 
supervision.
(v). AU sec. 350, Audit Sampling
    The discussion in AU sec. 350 regarding audit risk and tolerable 
misstatement has been amended to align more closely with the 
terminology used in the risk assessment standards.
    The reproposed standards included amendments to AU secs. 350.23 and 
350.38, which explained more specifically the principles in the 
standard for determining sample sizes when nonstatistical sampling 
approaches are used. Some commenters expressed concern that the 
reproposed amendments would have required auditors who use 
nonstatistical sampling methods to compute sample sizes under both 
statistical and nonstatistical methods to demonstrate that the sample 
size under the nonstatistical method equaled or exceeded the sample 
size determined using a statistical method.
    Commenters suggested that the standard should state that it is not 
necessary to compute sample sizes using statistical methods. Including 
such a sentence in the standard might be misunderstood by auditors and 
weaken the requirement of the amended standard. The reproposed 
amendments do not require auditors to compute sample sizes using 
statistical methods in all instances to demonstrate compliance with the 
requirements. For example, the use of a nonstatistical sampling 
methodology that is adapted appropriately from a statistical sampling 
method also could demonstrate compliance. However, calculating a sample 
size that is not based on the relevant factors in AU sec. 350 is not in 
compliance with the standard. Accordingly, the amendments are retained 
as reproposed.
(vi). AU sec. 543, Part of Audit Performed by Other Independent 
Auditors, and Interpretations
    A note was added to paragraph .01 to clarify that Auditing Standard 
No. 10 applies to situations not covered by AU sec. 543 in which the 
auditor engages other accounting firms or other accountants to 
participate in the audit. Paragraph .12 was amended to align AU sec. 
543 with related amendments to Auditing Standard No. 3. Footnote 4 to 
paragraph .16 of AU sec. 9543, Part of Audit Performed by Other 
Independent Auditors: Auditing Interpretations of Section 543, is 
deleted because it refers to an interim standard that is being 
superseded.
(vii). Other Amendments to the Interim Auditing Standards
    For the following interim auditing standards, the amendments are 
limited to conforming terminology to the risk assessment standards and 
updating references to auditing standards that are being superseded or 
amended:

    <bullet> AU sec. 110, Responsibilities and Functions of the 
Independent Auditor
    <bullet> AU sec. 150, Generally Accepted Auditing Standards
    <bullet> AU sec. 210, Training and Proficiency of the Independent 
Auditor
    <bullet> AU sec. 230, Due Professional Care in the Performance of 
Work
    <bullet> AU sec. 310, Appointment of the Independent Auditor
    <bullet> AU sec. 315, Communications Between Predecessor and 
Successor Auditors
    <bullet> AU sec. 317, Illegal Acts by Clients
    <bullet> AU sec. 322, The Auditor's Consideration of the Internal 
Audit Function in an Audit of Financial Statements.
    <bullet> AU sec. 324, Service Organizations
    <bullet> AU sec. 328, Auditing Fair Value Measurements and 
Disclosures
    <bullet> AU sec. 330, The Confirmation Process
    <bullet> AU sec. 332, Auditing Derivative Instruments, Hedging 
Activities, and Investments in Securities
    <bullet> AU sec. 333, Management Representations
    <bullet> AU sec. 334, Related Parties, and AU sec. 9334, Related 
Parties: Auditing Interpretations of Section 334
    <bullet> AU sec. 9336, Using the Work of a Specialist: Auditing 
Interpretations of Section 336
    <bullet> AU sec. 341, The Auditor's Consideration of an Entity's 
Ability to Continue as a Going Concern
    <bullet> AU sec. 342, Auditing Accounting Estimates, and AU sec. 
9342, Auditing Accounting Estimates: Auditing Interpretations of 
Section 342
    <bullet> AU sec. 380, Communication With Audit Committees
    <bullet> AU sec. 411, The Meaning of Present Fairly in Conformity 
With Generally Accepted Accounting Principles
    <bullet> AU sec. 508, Reports on Audited Financial Statements, and 
AU sec. 9508, Reports on Audited Financial Statements: Auditing 
Interpretations of Section 508
    <bullet> AU sec. 530, Dating of the Independent Auditor's Report
    <bullet> AU sec. 722, Interim Financial Information
g. Amendments to Interim Ethics Standards
    In the interim ethics standards, ET sec. 102, Integrity and 
Objectivity, the amendments are limited to updating references to 
auditing standards that are being superseded or amended.

12. Effective Date

    In its reproposal of the proposed rules, the Board stated that it 
expects the standards would be effective for audits of fiscal years 
beginning on or after December 15, 2010, subject to approval by the 
Commission, and the Board requested comment on the proposed effective 
date. Several commenters stated that the Board should establish 
sufficient time for auditing firms to make changes to their 
methodologies and train their staff on the new risk assessment 
standards.
    After considering the comments received and the timing of the 
adoption of the standards, the Board has determined that the 
accompanying standards and related amendments will be effective, 
subject to Commission approval, for audits of fiscal periods beginning 
on or after December 15, 2010. In its determination, the Board 
considered that many auditors already employ risk-based audit 
methodologies, which should facilitate the methodology changes and 
training necessary to implement the standards by the effective date.

[[Page 59397]]

13. Other Topics Not Related to the Reproposed Standards

    The comment letters on the reproposed standards included certain 
comments that relate to standards-setting matters other than the 
reproposed standards. The following paragraphs discuss those comments.
a. Standards-setting Process
    Some commenters suggested changes to the Board's standards-setting 
process. These comments primarily relate to the extent to which the 
Board uses the standards of the IAASB and ASB in its standards-setting 
and the use of external task forces in drafting standards.
    In previous releases on its proposed risk assessment standards, the 
Board has stated that it has sought to eliminate unnecessary 
differences with the risk assessment standards and those of other 
standards-setters. However, because the Board's standards must be 
consistent with the Board's statutory mandate,\401\ differences will 
continue to exist between the Board's standards and the standards of 
the IAASB and ASB e.g., when the Board decides to retain an existing 
requirement in PCAOB standards that is not included in IAASB or ASB 
standards. Also, certain differences are often necessary for the 
Board's standards to be consistent with relevant provisions of the 
federal securities laws or other existing standards or rules of the 
Board. Also, the Board's standards-setting activities are informed by 
and developed to some degree, in response to observations from its 
oversight activities.
---------------------------------------------------------------------------

    \401\ E.g., Section 101 of the Sarbanes-Oxley Act of 2002 (the 
``Act''), 15 U.S.C. 7211.
---------------------------------------------------------------------------

    The Board has a number of means available to seek additional 
comments from external parties regarding its standards-setting 
activities, including meetings with its Standing Advisory Group 
(``SAG''), issuing concept releases or reproposing standards or rules, 
and conducting public roundtables. Although these are not the only 
means available to the Board, they have been used because they offer 
the Board the ability to obtain comments from a diverse group of 
interested parties through a public process.
    The Board continually endeavors to improve its processes, including 
its standards-setting process, and considers comments from the public 
as it does so. For example, the Board has undertaken certain steps to 
enhance the transparency of its standards-setting process, including 
maintaining on its Web site its standards-setting agenda and discussing 
the status of projects in public meetings with the SAG. This release 
has also been expanded to provide additional discussion of and 
explanation for the Board's conclusions regarding the risk assessment 
standards. Some commenters acknowledged the Board's efforts to increase 
the transparency of its process.
b. Other Standards-Setting Projects
    Commenters on the reproposed standards also recommended a number of 
additional standards-setting or standards-related projects for the 
Board. Examples of such projects included creating a codification of 
the Board's standards; creating a glossary of terms used in the Board's 
standards, issuing a concept release for the review of the Board's 
interim standards, developing a standard describing the overall 
objectives of the audit, similar to ISA 200, Overall Objectives of the 
Independent Auditor and the Conduct of an Audit in Accordance with 
International Standards on Auditing, and developing guidance related to 
how the Board would evaluate the reasonableness of judgments based on 
PCAOB auditing standards.
    The Board continually assesses its standards-setting and related 
projects based upon the need for improvements in standards or 
additional guidance in response to current developments, observations 
from the Board's oversight activities, comments received from the 
public, and other factors. As mentioned previously, the Board's 
standards-setting agenda is maintained on the Board's Web site. The 
Board is considering these comments as it assesses its agenda.
c. Comparison With and the Standards of the International Auditing and 
Assurance Standards Board the Auditing Standards Board of the American 
Institute of Certified Public Accountants
    Some commenters on the reproposed standards stated that the Board 
should provide more information about its requirements, including how 
the requirements are expected to affect audits. Commenters requested 
information about how the Board's standards compare to the standards of 
other standards-setters. Some commenters also requested more 
explanation for certain requirements in the Board's reproposed 
standards.
    In developing its original proposed standards, the Board took into 
account, among other things, the risk assessment standards of the 
International Auditing and Assurance Standards Board (``IAASB'') and 
the Auditing Standards Board of the American Institute of Certified 
Public Accountants (``ASB''). The release accompanying the reproposed 
standards included a comparison of the objectives and requirements of 
the reproposed standards to the analogous standards of the IAASB and 
ASB.
    Some commenters requested additional details about differences 
between the reproposed standards and the IAASB or ASB standards or 
clarifications regarding specific requirements in the reproposed 
standards for which the language was not identical to IAASB or ASB 
standards.
    In analyzing comments on the appendix to the reproposed standards 
that compared the reproposed standards to the analogous standards of 
the IAASB and ASB, the Board observed that a number of the explanations 
sought by commenters, e.g., the reasons for the differences in certain 
requirements were discussed elsewhere in the release accompanying the 
reproposed standards, e.g., in Appendix 9 to that release.
    The discussion below discusses certain differences between the 
objectives and requirements of the PCAOB standards and the analogous 
standards of the IAASB and ASB. When a difference between the Board's 
standards and the analogous standards of the IAASB and ASB is noted, 
the discussion contains a reference to the discussion of the Board's 
requirements in this release. This analysis may not represent the views 
of the IAASB or ASB regarding their standards.

Auditing Standard No. 8--Audit Risk

    Analogous discussions of the components of audit risk are included 
in the IAASB's International Standard on Auditing (``ISA'') 200, 
Overall Objectives of the Independent Auditor and the Conduct of an 
Audit in Accordance with International Standards on Auditing and the 
ASB's clarified Statement on Auditing Standards (``SAS''), Overall 
Objectives of the Independent Auditor and the Conduct of an Audit in 
Accordance with Generally Accepted Auditing Standards, respectively.
(i) Audit Risk and Reasonable Assurance
PCAOB
    Auditing Standard No. 8 states that to form an appropriate basis 
for expressing an opinion on the financial statements, the auditor must 
plan and perform the audit to obtain reasonable assurance about whether 
the financial statements are free of material misstatement due to error 
or fraud. Reasonable assurance is

[[Page 59398]]

obtained by reducing audit risk to an appropriately low level through 
applying due professional care, including obtaining sufficient 
appropriate audit evidence.\402\
---------------------------------------------------------------------------

    \402\ AU sec. 110, Responsibilities and Functions of the 
Independent Auditor, and AU sec. 230, Due Professional Care in the 
Performance of Work, provide further discussion of reasonable 
assurance.
---------------------------------------------------------------------------

    Auditing Standard No. 8 uses the phrase ``appropriately low level'' 
because the term ``appropriately'' is aligned more closely with the 
concept of reasonable assurance whereas ``acceptable level'' might be 
misunderstood as allowing auditors to vary the audit efforts based upon 
their personal tolerance for risk. This release contains additional 
discussion regarding the use of the phrase ``appropriately low level.'' 
\403\
---------------------------------------------------------------------------

    \403\ Section II.C.3.b.
---------------------------------------------------------------------------

    Auditing Standard No. 8 also clarifies that obtaining sufficient 
appropriate audit evidence is part of applying due professional care. 
This release provides additional discussion regarding due professional 
care and sufficient appropriate audit evidence.\404\
---------------------------------------------------------------------------

    \404\ Section II.C.3.c.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA states:

    To obtain reasonable assurance, the auditor shall obtain 
sufficient appropriate audit evidence to reduce audit risk to an 
acceptably low level and thereby enable the auditor to draw 
reasonable conclusions on which to base the auditor's opinion.

    The SAS includes a requirement similar to the ISA's requirement.
(ii) Detection Risk and Substantive Procedures
PCAOB
    Auditing Standard No. 8 states that as the appropriate level of 
detection risk decreases, the evidence from substantive procedures that 
the auditor should obtain increases. This requirement was adapted from 
AU sec. 319, Consideration of Internal Control in a Financial Statement 
Audit,\405\ and it parallels a requirement in Auditing Standard No. 13, 
The Auditor's Responses to the Risks of Material Misstatement.\406\ 
This release contains additional discussion regarding detection 
risk.\407\
---------------------------------------------------------------------------

    \405\ AU sec. 319 is superseded by the risk assessment 
standards.
    \406\ Paragraph 37 of Auditing Standard No. 13.
    \407\ Section II.C.3.e.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA and the SAS do not include an analogous requirement.

Auditing Standard No. 9--Audit Planning

    In this section, the analogous IAASB and ASB standards are, unless 
indicated otherwise, ISA 300, Planning an Audit of Financial 
Statements, and the clarified SAS, Planning an Audit, respectively.
(i). Planning an Audit
PCAOB
    Auditing Standard No. 9 contains a requirement to properly plan the 
audit. This requirement is consistent with the first standard of 
fieldwork in AU sec. 150, Generally Accepted Auditing Standards.
IAASB and ASB
    The ISA and the SAS do not include an analogous requirement, 
although planning the audit is referenced in the objectives of the 
standards.
(ii). Audit Strategy and Audit Plan
PCAOB
    Auditing Standard No. 9 requires the auditor to establish an 
overall audit strategy that sets the scope, timing, and direction of 
the audit and guides the development of the audit plan. When developing 
the audit strategy and audit plan, the standard requires the auditor to 
evaluate whether certain matters specified in the standard are 
important to the company's financial statements and internal control 
over financial reporting and, if so, how they will affect the auditor's 
procedures. As discussed in this release, these matters are adapted 
from Auditing Standard No. 5, An Audit of Internal Control Over 
Financial Reporting That Is Integrated with An Audit of Financial 
Statements, and are important for both the audit of financial 
statements and an audit of internal control over financial reporting 
(``audit of internal control'').\408\
---------------------------------------------------------------------------

    \408\ Section II.C.4.e.
---------------------------------------------------------------------------

    In establishing the overall audit strategy, Auditing Standard No. 9 
also requires the auditor to take into account certain matters, such as 
the reporting objectives and the factors that are significant in 
directing the activities of the engagement team, results of preliminary 
engagement activities and the auditor's evaluation of the important 
matters in accordance with paragraph 7, and the nature, timing, and 
extent of resources necessary to perform the engagement. This release 
discusses this requirement with more detail.\409\
---------------------------------------------------------------------------

    \409\ Section II.C.4.f.
---------------------------------------------------------------------------

    Auditing Standard No. 9 requires the auditor to develop and 
document an audit plan that includes a description of the planned 
nature, timing, and extent of risk assessment procedures; tests of 
controls, substantive procedures, and other audit procedures. The audit 
plan required by Auditing Standard No. 9 encompasses all of the audit 
procedures to be performed, i.e., it is not limited to procedures at 
the assertion level. This release contains additional discussion 
regarding developing the audit strategy and audit plan.\410\
---------------------------------------------------------------------------

    \410\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA and the SAS require the auditor to establish an overall 
audit strategy that sets the scope, timing, and direction of the audit 
and guides the development of the audit plan. Those standards do not 
have a requirement analogous to the Auditing Standard No. 9 requirement 
to evaluate specific matters in developing the audit strategy and audit 
plan.
    The ISA states:

    In establishing the overall audit strategy, the auditor shall:
    (a) Identify the characteristics of the engagement that define 
its scope;
    (b) Ascertain the reporting objectives of the engagement to plan 
the timing of the audit and the nature of the communications 
required;
    (c) Consider the factors that, in the auditor's professional 
judgment, are significant in directing the engagement team's 
efforts;
    (d) Consider the results of preliminary engagement activities 
and, where applicable, whether knowledge gained on other engagements 
performed by the engagement partner for the entity is relevant; and
    (e) Ascertain the nature, timing and extent of resources 
necessary to perform the engagement.

    The SAS includes a requirement similar to the ISA's requirement.
    Both the ISA and the SAS require the auditor to develop an audit 
plan that shall include a description of the nature, timing, and extent 
of planned further auditor procedures at the assertion level.
(iii). Multi-Location Engagements
PCAOB
    Auditing Standard No. 9 states that the auditor should determine 
the extent to which auditing procedures should be performed at selected 
locations or business units to obtain sufficient appropriate evidence 
to obtain reasonable assurance about whether the consolidated financial 
statements are free of material misstatement. This includes determining 
the locations or business units at which to perform audit procedures, 
as well as the nature, timing, and extent of the audit

[[Page 59399]]

procedures to be performed at those individual locations or business 
units. The auditor should assess the risks of material misstatement to 
the consolidated financial statements associated with the location or 
business unit and correlate the amount of audit attention devoted to 
the location or business unit with the degree of risk of material 
misstatement associated with that location or business unit. Auditing 
Standard No. 9 also provides a list of factors that are relevant to the 
assessment of the risks of material misstatement associated with a 
particular location or business unit and the determination of the 
necessary audit procedures.
    The provisions in Auditing Standard No. 9 are applicable to all 
multi-location audits. This release discusses the basis for the 
requirements and explains how the requirements should be applied in 
audits in which part of the work is performed by other auditors of 
financial statements of individual locations or business units that are 
included in the consolidated financial statements.\411\
---------------------------------------------------------------------------

    \411\ Section II.C.4.g.
---------------------------------------------------------------------------

IAASB and ASB
    ISA 600, Special Considerations--Audits of Group Financial 
Statements (Including the Work of Component Auditors), and the proposed 
SAS, Audits of Group Financial Statements (Including the Work of 
Component Auditors), apply to group audits. Under ISA 600, group audits 
are defined as the audit of group financial statements, which are 
financial statements that include the financial information of more 
than one component, and the component auditor is an auditor who, at the 
request of the group engagement team, performs work on financial 
information related to a component for the group audit.
    ISA 600 and the proposed SAS describe the scope of audit procedures 
to be performed at individual components, depending upon, among other 
things, whether the components are significant components as described 
in the respective standards.

Auditing Standard No. 10--Supervision of the Audit Engagement

    In this section, unless indicated otherwise, the analogous IAASB 
standards are ISA 300, Planning an Audit of Financial Statements, and 
ISA 220, Quality Control for an Audit of Financial Statements 
(collectively referred to in this section as ``the ISAs''); and the 
analogous ASB standards are the clarified SAS, Planning an Audit, and 
the proposed SAS, Quality Control for an Audit of Financial Statements 
(collectively referred to in this section as ``the SASs'').
(i). Supervision
PCAOB
    Auditing Standard No. 10 states that the engagement partner is 
responsible for supervising other engagement team members and may seek 
assistance from appropriate engagement team members. Auditing Standard 
No. 10 also requires the engagement partner, and engagement team 
members who assist the engagement partner in supervision, to properly 
supervise the members of the engagement team, describes the necessary 
elements of proper supervision, and describes the factors that affect 
the necessary extent of supervision. These requirements are adapted 
from AU sec. 311, Planning and Supervision.\412\ This release provides 
additional discussion regarding these requirements.\413\
---------------------------------------------------------------------------

    \412\ AU sec. 311 is superseded by Auditing Standard No. 9 and 
Auditing Standard No. 10.
    \413\ Section II.C.5.d.
---------------------------------------------------------------------------

    The requirements in the ISAs and the SASs do not describe the 
elements of supervision or factors that affect supervision.
IAASB and ASB
    The ISAs and the SASs require the auditor to plan the nature, 
timing, and extent of direction and supervision of engagement team 
members and review their work. The ISAs and SASs require the engagement 
partner to ``take responsibility for the direction, supervision and 
performance of the audit engagement in compliance with professional 
standards and applicable legal and regulatory requirements and for the 
auditor's report being appropriate in the circumstances.''
(ii). Supervision of Engagement Team Members
PCAOB
    Auditing Standard No. 10 requires the engagement partner and other 
engagement team members performing supervisory activities to: (a) 
Inform engagement team members of their responsibilities, including the 
objectives of the procedures that they are to perform; the nature, 
timing and extent of procedures they are to perform; and matters that 
could affect the procedures to be performed or the evaluation of the 
results of those procedures, (b) direct engagement team members to 
bring significant accounting and auditing issues arising during the 
audit to the attention of the engagement partner or other engagement 
team members performing supervising activities, and (c) review the work 
of engagement team members to evaluate whether the work was performed, 
the objectives of the procedures were achieved, and the results of the 
work support the conclusions. This release contains additional 
discussion regarding this requirement.\414\
---------------------------------------------------------------------------

    \414\ Section II.C.5.e.
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The engagement partner shall take responsibility for:
    (a) The direction, supervision and performance of the audit 
engagement in compliance with professional standards and applicable 
legal and regulatory and legal requirements; and
    (b) The auditor's report being appropriate in the circumstances.
    The engagement partner shall take responsibility for reviews 
being performed in accordance with the firm's review policies and 
procedures.
    On or before the date of the auditor's report, the engagement 
partner shall, through a review of the audit documentation and 
discussion with the engagement team, be satisfied that sufficient 
appropriate audit evidence has been obtained to support the 
conclusions reached and for the auditor's report to be issued.
    The auditor shall plan the nature, timing and extent of 
direction and supervision of engagement team members and the review 
of their work.
ASB
    The SAS includes requirements similar to the ISAs' requirements.
(iii). Extent of Supervision
PCAOB
    To determine the extent of supervision necessary for engagement 
team members to perform their work as directed and form appropriate 
conclusions, Auditing Standard No. 10 requires the engagement partner 
and other engagement team members performing supervisory activities to 
take into account the nature of company, the nature of the assigned 
work for each team member, the risks of material misstatement, and the 
knowledge, skill, and ability of each engagement team member. This 
release contains additional discussion regarding this requirement.\415\
---------------------------------------------------------------------------

    \415\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not have an analogous requirement for the 
auditor to determine the extent of supervision necessary for engagement 
team members.

[[Page 59400]]

Auditing Standard No. 11--Consideration of Materiality in Planning and 
Performing an Audit

    In this section, the analogous IAASB and ASB standards are ISA 320, 
Materiality in Planning and Performing an Audit, and the clarified SAS, 
Materiality in Planning and Performing an Audit, and the proposed SAS, 
Audits of Group Financial Statements (Including the Work of Component 
Auditors), respectively.
<bullet> Definition of Materiality
PCAOB
    Auditing Standard No. 11 requires the auditor to establish a 
materiality level for the financial statements as a whole that is 
appropriate in light of the particular circumstances, including 
consideration of the company's earnings and other relevant factors. The 
requirement in Auditing Standard No. 11 is based on the concept of 
materiality that is articulated by the courts in interpreting the 
federal securities laws. This release discusses the concept of 
materiality used in Auditing Standard No. 11.\416\
---------------------------------------------------------------------------

    \416\ Section II.C.6.b.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA states, ``When establishing the overall audit strategy, the 
auditor shall determine materiality for the financial statements as a 
whole.''
    The SAS has a requirement similar to the ISA's requirement.
<bullet> Materiality in the Context of an Audit
PCAOB
    Auditing Standard No. 11 requires the auditor to plan and perform 
audit procedures to detect misstatements that, individually or in 
combination with other misstatements, would result in material 
misstatement of the financial statements in order to obtain reasonable 
assurance about whether the financial statements are free of material 
misstatement. This release discusses the concept of materiality in the 
context of an audit.\417\
---------------------------------------------------------------------------

    \417\ Ibid.
---------------------------------------------------------------------------

IAASB
    ISA 200 states:
    In conducting an audit of financial statements, the overall 
objectives of the auditor are:
    a. To obtain reasonable assurance about whether the financial 
statements as a whole are free from material misstatement, whether due 
to fraud or error, thereby enabling the auditor to express an opinion 
on whether the financial statements are prepared, in all material 
respects, in accordance with an applicable financial reporting 
framework; and
    b. To report on the financial statements, and communicate as 
required by the ISAs, in accordance with the auditor's findings.
ASB
    The SAS includes an objective similar to the ISA's objective.
<bullet> Tolerable Misstatement and Performance Materiality
PCAOB
    Auditing Standard No. 11 requires the auditor to determine 
tolerable misstatement for purposes of assessing risks of material 
misstatement and planning and performing audit procedures at the 
account or disclosure level. Auditing Standard No. 11 uses the term 
``tolerable misstatement,'' which is also used in other PCAOB 
standards.\418\ This release discusses the use of the term ``tolerable 
misstatement'' in more detail.\419\
---------------------------------------------------------------------------

    \418\ Paragraph .18 of AU sec. 350, Audit Sampling.
    \419\ Section II.C.6.e.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA and SAS require the auditor to determine ``performance 
materiality'' for purposes of assessing the risks of material 
misstatement and determining the nature, timing, and extent of further 
audit procedures.
<bullet> Determining Tolerable Misstatement
PCAOB
    Auditing Standard No. 11 contains a requirement to take into 
account the nature, cause (if known), and amount of misstatements that 
were accumulated in audits of the financial statements of prior periods 
when determining tolerable misstatement and planning and performing 
audit procedures. This requirement is adapted from AU sec. 312, Audit 
Risk and Materiality in Conducting an Audit. This release contains 
further discussion regarding this requirement.\420\
---------------------------------------------------------------------------

    \420\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA and SAS do not have an analogous requirement.
<bullet> Multi-Location Determination of Tolerable Misstatement
PCAOB
    In multi-location engagements, Auditing Standard No. 11 requires 
the auditor to determine tolerable misstatement for the individual 
locations or business units at an amount that reduces to an 
appropriately low level the probability that the total of uncorrected 
and undetected misstatements would result in material misstatement of 
the consolidated financial statements. The standard also requires the 
tolerable misstatement at an individual location to be less than the 
established materiality level for the financial statements as a whole. 
This release provides further discussion regarding consideration of 
materiality for multi-location engagements.\421\
---------------------------------------------------------------------------

    \421\ Section II.C.6.f.
---------------------------------------------------------------------------

IAASB
    ISA 600 requires the group engagement team to determine, among 
other things, component materiality. The ISA states:

    Component materiality for those components where component 
auditors will perform an audit or a review for purposes of the group 
audit. To reduce to an appropriately low level the probability that 
the aggregate of uncorrected and undetected misstatements in the 
group financial statements exceeds materiality for the group 
financial statements as a whole, component materiality shall be 
lower than materiality for the group financial statements as a 
whole.
ASB
    Proposed SAS, Audits of Group Financial Statements (Including the 
Work of Component Auditors), requires the group engagement team to 
determine among other things, component materiality. The proposed SAS 
states:

    Component materiality for those components on which an audit or 
other specified audit procedures will be performed. To reduce the 
risk that the aggregate of detected and undetected misstatements in 
the group financial statements exceeds the materiality for the group 
financial statements as a whole, component materiality should be 
lower than the materiality for the group financial statements as a 
whole.
<bullet> Reevaluating Materiality and Tolerable Misstatement
PCAOB
    Auditing Standard No. 11 requires the auditor to reevaluate the 
established materiality level or levels and tolerable misstatement when 
there is a substantial likelihood that misstatements of amounts that 
differ significantly from the materiality level or levels that were 
established initially would influence the judgment of a reasonable 
investor. The requirement reflects the perspective of a reasonable 
investor, whereas the analogous requirements in the ISA and SAS reflect 
an auditor's perspective. This release contains additional discussion 
regarding materiality from

[[Page 59401]]

the perspective of a reasonable investor \422\ and the reevaluation of 
materiality.\423\
---------------------------------------------------------------------------

    \422\ Section II.C.6.b.
    \423\ Section II.C.6.g.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA and the SAS require the auditor to ``revise materiality for 
the financial statements as a whole (and, if applicable, the 
materiality level or levels for particular classes of transactions, 
account balances, or disclosures) in the event of becoming aware of 
information during the audit that would have caused the auditor to have 
determined a different amount (or amounts) initially.''

Auditing Standard No. 12--Identifying and Assessing Risks of Material 
Misstatement

    In this section, the analogous IAASB standards are ISA 315, 
Identifying and Assessing the Risks of Material Misstatement Through 
Understanding the Entity and Its Environment, and ISA 240, The 
Auditor's Responsibilities Relating to Fraud In An Audit of Financial 
Statements (collectively referred to in this section as ``the ISAs''). 
The analogous ASB standards are the clarified SAS, Understanding the 
Entity and its Environment and Assessing the Risks of Material 
Misstatements (Redrafted) and proposed SAS, Consideration of Fraud in a 
Financial Statement Audit (Redrafted) (collectively referred to in this 
section as ``the SASs'').\424\
---------------------------------------------------------------------------

    \424\ In June 2010, the ASB adopted as a final standard the SAS, 
Consideration of Fraud in a Financial Statement Audit (Redrafted). 
However, the ASB has not yet published this standard.
---------------------------------------------------------------------------

(i). Objective
PCAOB
    The objective of Auditing Standard No. 12 is to identify and 
appropriately assess the risks of material misstatement, thereby 
providing a basis for designing and implementing responses to the risks 
of material misstatement. Auditing Standard No. 12 requires the auditor 
to perform other risk assessment procedures in addition to obtaining an 
understanding of the company and its environment. This release contains 
additional discussion regarding the objective of the standard.\425\
---------------------------------------------------------------------------

    \425\ Section II.C.7.b.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state:

    The objective of the auditor is to identify and assess the risks 
of material misstatement, whether due to fraud or error, at the 
financial statement and assertion levels, through understanding the 
entity and its environment, including the entity's internal control, 
thereby providing a basis for designing and implementing responses 
to the assessed risks of material misstatement.

    The SASs include an objective similar to the ISAs' objective.
(ii). Performing Risk Assessment Procedures
PCAOB
    Auditing Standard No. 12 states that the auditor should perform 
risk assessment procedures that are sufficient to provide a reasonable 
basis for identifying and assessing the risks of material misstatement, 
whether due to error or fraud, and designing further audit procedures. 
The requirement establishes a principle for determining the sufficiency 
of the necessary risk assessment procedures, and it also links the risk 
assessment procedures to the design of the tests of controls and 
substantive procedures to be performed to respond to the risks. This 
release includes additional discussion regarding performing risk 
assessment procedures.\426\
---------------------------------------------------------------------------

    \426\ Section II.C.7.c.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state:

    The auditor shall perform risk assessment procedures to provide 
a basis for the identification and assessment of risks of material 
misstatement at the financial statement and assertion levels.

    The SASs include a requirement similar to the ISAs' requirement.
(iii). Obtaining an Understanding of the Company and Its Environment
PCAOB
    Auditing Standard No. 12 includes a requirement to evaluate, while 
obtaining an understanding of the company, whether significant changes 
in the company from prior periods, including changes in its internal 
control over financial reporting, affect the risks of material 
misstatement. This release includes additional discussion regarding 
obtaining an understanding of the company and its environment.\427\
---------------------------------------------------------------------------

    \427\ Section II.C.7.d.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include an analogous requirement.
(iv). Additional Procedures To Understand the Company
PCAOB
    Auditing Standard No. 12 requires the auditor to consider 
performing certain procedures as part of obtaining an understanding of 
the company as required by paragraph 7 of the standard. These 
procedures include reading public information about the company, 
observing or reading transcripts of earnings calls, obtaining an 
understanding of compensation arrangements with senior management, and 
obtaining information about trading activity in the company's 
securities and holdings in the company's securities by significant 
holders. This release includes additional discussion regarding this 
requirement.\428\
---------------------------------------------------------------------------

    \428\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include an analogous requirement.
(v). Selection and Application of Accounting Principles, Including 
Related Disclosures
PCAOB
    Auditing Standard No. 12 requires the auditor to develop 
expectations about the disclosures that are necessary for the company's 
financial statements to be presented fairly in conformity with the 
applicable financial reporting framework to identify and assess the 
risks of material misstatement related to omitted, incomplete, or 
inaccurate disclosures.\429\ The standard also requires engagement team 
members to discuss how fraud might be perpetrated or concealed by 
omitting or presenting incomplete or inaccurate disclosures.\430\ 
Additionally Auditing Standard No. 12 requires the auditor's evaluation 
of fraud risk factors to include how fraud could be perpetrated or 
concealed by presenting incomplete or inaccurate disclosures or by 
omitting disclosures that are necessary for the financial statements to 
be presented fairly in conformity with the applicable financial 
reporting framework.\431\ This release includes additional discussion 
regarding these requirements.\432\
---------------------------------------------------------------------------

    \429\ Paragraph 12 of Auditing Standard No. 12.
    \430\ Paragraph 52 of Auditing Standard No. 12.
    \431\ Paragraph 67 of Auditing Standard No. 12.
    \432\ Section II.C.7.d., h. and j. respectively.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do include analogous requirements regarding the 
disclosures that are necessary for the company's financial statements 
to be presented fairly in conformity with the applicable financial 
reporting framework.

[[Page 59402]]

(vi). Obtaining an Understanding of Internal Control Over Financial 
Reporting
PCAOB
    Auditing Standard No. 12 requires the auditor to obtain a 
sufficient understanding of each component of internal control over 
financial reporting to (a) identify the types of potential 
misstatements; (b) assess the factors that affect the risks of material 
misstatement; and (c) design further auditor procedures. This 
requirement relates to the sufficiency of the required understanding of 
internal control over financial reporting. This release contains 
additional discussion of this requirement.\433\
---------------------------------------------------------------------------

    \433\ Section II.C.7.e.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state:

    The auditor shall obtain an understanding of internal control 
relevant to the audit. Although most controls relevant to the audit 
are likely to relate to financial reporting, not all controls that 
relate to financial reporting are relevant to the audit. It is a 
matter of the auditor's professional judgment whether a control, 
individually or in combination with others, is relevant to the 
audit.

    The SASs include requirements similar to the ISAs' requirements.
(vii). Control Environment
PCAOB
    Auditing Standard No. 12 requires the auditor to assess the 
following matters as part of obtaining an understanding of the control 
environment:
    <bullet> Whether management's philosophy and operating style 
promote effective internal control over financial reporting;
    <bullet> Whether sound integrity and ethical values, particularly 
of top management, are developed and understood; and
    <bullet> Whether the board or audit committee understands and 
exercises oversight responsibility over financial reporting and 
internal control.
    This requirement is aligned with a similar requirement in Auditing 
Standard No. 5. This release includes additional discussion regarding 
this requirement.\434\
---------------------------------------------------------------------------

    \434\ Section II.C.7.e.(ii).
---------------------------------------------------------------------------

    Paragraph 25 of Auditing Standard No. 12 states that ``[i]f the 
auditor identifies a control deficiency in the company's control 
environment, the auditor should evaluate the extent to which this 
control deficiency is indicative of a fraud risk factor.'' This release 
includes additional discussion regarding the auditor's evaluation of an 
identified control deficiency in the control environment.\435\
---------------------------------------------------------------------------

    \435\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state:

    The auditor shall obtain an understanding of the control 
environment. As part of obtaining this understanding, the auditor 
shall evaluate whether:
    (a) Management, with the oversight of those charged with 
governance, has created and maintained a culture of honesty and 
ethical behavior; and
    (b) The strengths in the control environment elements 
collectively provide an appropriate foundation for the other 
components of internal control, and whether those other components 
are not undermined by deficiencies in the control environment.

    The SASs include requirements similar to the ISAs' requirements.
    The ISAs and SASs do not have a requirement analogous to paragraph 
25 of Auditing Standard No. 12.
(viii). The Company's Risk Assessment Process
PCAOB
    Auditing Standard No. 12 states that:

    The auditor should obtain an understanding of management's 
process for:
    (a) Identifying risks relevant to financial reporting 
objectives, including risks of material misstatement due to fraud 
(``fraud risks''),
    (b) Assessing the likelihood and significance of misstatements 
resulting from those risks, and
    (c) Deciding about actions to address those risks.

    The standard also states that obtaining an understanding of the 
company's risk assessment process includes obtaining an understanding 
of the risks of material misstatement identified and assessed by 
management and the actions taken to address those risks.
    Those requirements focus on the matters that are important to the 
auditor's understanding of the company's internal control and on the 
auditor's risk assessments. Although the auditor can be informed by the 
company's risk assessment process, the auditor is still required to 
perform risk assessment procedures that are sufficient for identifying 
and assessing the risks of material misstatement rather than relying on 
the company's process.
    This release includes additional discussion regarding the company's 
risk assessment process.\436\
---------------------------------------------------------------------------

    \436\ Section II.C.7.e.(iii).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state:

    The auditor shall obtain an understanding of whether the entity 
has a process for (a) Identifying business risks relevant to 
financial reporting objectives; (b) Estimating the significance of 
the risks; (c) Assessing the likelihood of their occurrence; and (d) 
Deciding about actions to address those risks.
    If the entity has established such a process (referred to 
hereafter as the ``entity's risk assessment process''), the auditor 
shall obtain an understanding of it, and the results thereof. If the 
auditor identifies risks of material misstatement that management 
failed to identify, the auditor shall evaluate whether there was an 
underlying risk of a kind that the auditor expects would have been 
identified by the entity's risk assessment process. If there is such 
a risk, the auditor shall obtain an understanding of why that 
process failed to identify it, and evaluate whether the process is 
appropriate to its circumstances or determine if there is a 
significant deficiency in internal control with regard to the 
entity's risk assessment process.
    If the entity has not established such a process or has an ad 
hoc process, the auditor shall discuss with management whether 
business risks relevant to financial reporting objectives have been 
identified and how they have been addressed. The auditor shall 
evaluate whether the absence of a documented risk assessment process 
is appropriate in the circumstances, or determine whether it 
represents a significant deficiency in internal control.

    The SASs include requirements similar to the ISAs' requirements.
(ix). Information and Communication
PCAOB
    Auditing Standard No. 12 requires the auditor to obtain an 
understanding of how IT affects the company's flow of transactions. The 
standard also states that the identification of risks and controls 
within IT is not a separate evaluation. Instead, it is an integral part 
of the approach used to identify significant accounts and disclosures 
and their relevant assertions and, when applicable, to select the 
controls to test, as well as to assess risk and allocate audit effort. 
This release contains additional discussion of this requirement.\437\
---------------------------------------------------------------------------

    \437\ Section II.C.7.e.(iv).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(x). Control Activities
PCAOB
    Auditing Standard No. 12 requires the auditor to obtain an 
understanding of control activities that is sufficient to assess the 
factors that affect the risks of material misstatement and to design 
further audit procedures. Auditing Standard No. 12 requires the auditor 
to use his or her knowledge about the presence or absence of control 
activities obtained from the understanding of the other components of 
internal control over financial reporting in determining

[[Page 59403]]

the extent to which it is necessary to devote additional attention to 
obtaining an understanding of control activities to assess the factors 
that affect the risks of material misstatement and to design further 
audit procedures. This release includes additional discussion of this 
requirement.\438\
---------------------------------------------------------------------------

    \438\ Section II.C.7.e.(v).
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The auditor shall obtain an understanding of control activities 
relevant to the audit, being those the auditor judges it necessary 
to understand in order to assess the risks of material misstatement 
at the assertion level and design further audit procedures 
responsive to assessed risks. An audit does not require an 
understanding of all the control activities related to each 
significant class of transactions, account balance, and disclosure 
in the financial statements or to every assertion relevant to them.
ASB
    The SASs state:

    The auditor should obtain an understanding of control activities 
relevant to the audit, which are those control activities the 
auditor judges it necessary to understand in order to assess the 
risks of material misstatement at the assertion level and design 
further audit procedures responsive to assessed risks. An audit does 
not require an understanding of all the control activities related 
to each significant class of transactions, account balance, and 
disclosure in the financial statements or to every assertion 
relevant to them. However, the auditor should obtain an 
understanding of the process of reconciling detailed records to the 
general ledger for material account balances.
(xi). Relationship of Understanding of Internal Control to Tests of 
Controls
PCAOB
    Auditing Standard No. 12 requires the auditor to take into account 
the evidence obtained from understanding internal control when 
assessing control risk and, in the audit of internal control, forming 
conclusions about the effectiveness of controls. Auditing Standard No. 
12 also requires the auditor to take into account the evidence obtained 
from understanding internal control when determining the nature, 
timing, and extent of procedures necessary to support the auditor's 
conclusions about the effectiveness of entity-level controls in the 
audit of internal control. This release includes additional discussion 
of these requirements.\439\
---------------------------------------------------------------------------

    \439\ Section II.C.7.e.(vii).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(xii). Considering Information From the Client Acceptance and Retention 
Evaluation, Audit Planning Activities, Past Audits, and Other 
Engagements
PCAOB
    Auditing Standard No. 12 requires the auditor to evaluate whether 
information obtained during a review of interim financial information 
in accordance with AU sec. 722, Interim Financial Information, is 
relevant to identifying risks of material misstatement in the year-end 
audit. The ISAs and SASs do not include an analogous requirement.
    Auditing Standard No. 12 also states that the auditor should obtain 
an understanding of the nature of the services that have been performed 
for the company by the auditor or affiliates of the firm \440\ and 
should take into account relevant information obtained from those 
engagements in identifying risks of material misstatement. The 
requirement in Auditing Standard No. 12 applies to services performed 
by the firm and affiliates of the firm and is not limited to services 
performed by the engagement partner. This release contains additional 
discussion regarding these requirements.\441\
---------------------------------------------------------------------------

    \440\ See PCAOB Rule 3501(a)(i), which defines ``affiliate of 
the accounting firm.''
    \441\ Section II.C.7.f.(ii).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state, ``[i]f the engagement partner has performed other 
engagements for the entity, the engagement partner shall consider 
whether information obtained is relevant to identifying risks of 
material misstatement.''
    The SASs include a requirement similar to the ISAs' requirement.
(xiii). Performing Analytical Procedures
PCAOB
    Auditing Standard No. 12 contains a series of requirements 
regarding performing analytical procedures as risk assessment 
procedures. These requirements were adapted from AU sec. 329, 
Analytical Procedures. Auditing Standard No. 12 requires the auditor 
to:
    <bullet> Perform analytical procedures that are designed to (a) 
enhance the auditor's understanding of the client's business and the 
significant transactions and events that have occurred since the prior 
year end; and (b) identify areas that might represent specific risks 
relevant to the audit, including the existence of unusual transactions 
and events, and amounts, ratios, and trends that warrant investigation.
    <bullet> Perform analytical procedures regarding revenue as risk 
assessment procedures with the objective of identifying unusual or 
unexpected relationships involving revenue accounts that might indicate 
a material misstatement, including material misstatement due to fraud.
    <bullet> Take into account analytical procedures performed in 
accordance with AU sec. 722 when designing and applying analytical 
procedures as risk assessment procedures. This requirement is unique to 
PCAOB standards.
    <bullet> Use his or her understanding of the company to develop 
expectations about plausible relationships among the data to be used in 
the procedure.\442\
---------------------------------------------------------------------------

    \442\ Analytical procedures consist of evaluations of financial 
information made by a study of plausible relationships among both 
financial and nonfinancial data.
---------------------------------------------------------------------------

    <bullet> Take into account unusual or unexpected differences from 
the auditor's expectations that are identified while performing 
analytical procedures as risk assessment procedures.
    This release contains additional discussion of these 
requirements.\443\
---------------------------------------------------------------------------

    \443\ Section II.C.7.g.
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The risk assessment procedures shall include * * * [a]nalytical 
procedures * * *
    The auditor shall evaluate whether unusual or unexpected 
relationships that have been identified in performing analytical 
procedures, including those related to revenue accounts, may 
indicate risks of material misstatement due to fraud.
ASB
    The SASs state:

    The risk assessment procedures should include * * * [a]nalytical 
procedures * * *
    Based on analytical procedures performed as part of risk 
assessment procedures and as part of substantive procedures, the 
auditor should evaluate whether unusual or unexpected relationships 
that have been identified indicate risks of material misstatements 
due to fraud. To the extent not already included, the analytical 
procedures and evaluation thereof should include procedures relating 
to revenue accounts.
(xiv). Communication Among Engagement Team Members
PCAOB
    Auditing Standard No. 12 requires that the communication among the 
engagement team members about significant matters affecting the risks 
of material misstatement should continue throughout the audit, 
including when

[[Page 59404]]

conditions change. This release contains additional discussion of this 
requirement.\444\
---------------------------------------------------------------------------

    \444\ Section II.C.7.h.(ii).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(xv). Discussion of the Potential for Material Misstatement Due to 
Fraud
PCAOB
    Auditing Standard No. 12 requires a discussion among the key 
engagement team members of specified matters regarding fraud, including 
how and where the company's financial statements might be susceptible 
to material misstatement due to fraud, known fraud risk factors, the 
risk of management override of controls, and possible responses to 
fraud risks.
    Auditing Standard No. 12 requires all key engagement team members 
to participate in the discussion. Auditing Standard No. 12 also states 
that key engagement team members include the engagement partner and 
other engagement team members with significant engagement 
responsibilities.
    Auditing Standard No. 12 also includes a requirement to emphasize 
certain matters to all engagement team members, including the need to 
maintain a questioning mind throughout the audit and to exercise 
professional skepticism in gathering and evaluating evidence, to be 
alert for information or other conditions that might affect the 
assessment of fraud risks, and actions to be taken if information or 
other conditions indicate that a material misstatement due to fraud 
might have occurred.
    This release includes additional discussion of these 
requirements.\445\
---------------------------------------------------------------------------

    \445\ Section II.C.7.h.
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The engagement partner and other key engagement team members 
shall discuss the susceptibility of the entity's financial 
statements to material misstatement, and the application of the 
applicable financial reporting framework to the entity's facts and 
circumstances. The engagement partner shall determine which matters 
are to be communicated to engagement team members not involved in 
the discussion.
    * * * This discussion shall place particular emphasis on how and 
where the entity's financial statements may be susceptible to 
material misstatement due to fraud, including how fraud might occur.
ASB
    The SASs have requirements similar to the ISAs' requirements. 
However, the SASs also include a requirement that the discussion 
regarding fraud include an exchange among engagement team members about 
how and where the entity's financial statements might be susceptible to 
material misstatement due to fraud, how management could perpetrate and 
conceal fraudulent financial reporting, and how assets of the entity 
could be misappropriated. The SASs also include a requirement to 
emphasize certain matters to all engagement team members, but those 
matters identified are less extensive than those required by PCAOB 
standards.
(xvi). Inquiring of the Audit Committee, Management, and Others Within 
the Company About the Risks of Material Misstatement
PCAOB
    Auditing Standard No. 12 requires the auditor to make specified 
inquiries of management and the audit committee regarding tips or 
complaints about the company's financial reporting. This release 
includes additional discussion of this requirement.\446\
---------------------------------------------------------------------------

    \446\ Section II.C.7.i.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs do not specify the nature of the required 
inquiries, except for certain inquiries regarding fraud, which are less 
extensive than those required by PCAOB standards.
(xvii). Nature of Inquiries
PCAOB
    Auditing Standard No. 12 requires the auditor to use his or her 
knowledge of the company and its environment, as well as information 
from other risk assessment procedures, to determine the nature of 
inquiries about risks of material misstatement. This release includes 
additional discussion of this requirement.\447\
---------------------------------------------------------------------------

    \447\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(xviii). Evaluating Management Responses to Inquiries
PCAOB
    Auditing Standard No. 12 requires the auditor to take into account 
the fact that management is often in the best position to commit fraud 
when evaluating management's responses to inquiries about fraud risks. 
Auditing Standard No. 12 also requires the auditor to obtain evidence 
to address inconsistencies in response to the inquiries. This release 
includes additional discussion of these requirements.\448\
---------------------------------------------------------------------------

    \448\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(xix). Identifying and Assessing the Risks of Material Misstatement
PCAOB
    Auditing Standard No. 12 requires the auditor to evaluate how risks 
at the financial statement level could affect risks of material 
misstatement at the assertion level. This release includes additional 
discussion of this requirement.\449\
---------------------------------------------------------------------------

    \449\ Section II.C.7.j.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the proposed SAS do not include an analogous 
requirement.
(xx). Identifying Significant Accounts and Disclosures and Their 
Relevant Assertions
PCAOB
    Auditing Standard No. 12 requires the auditor to identify 
significant accounts and disclosures and their relevant assertions in 
identifying and assessing risks of material misstatement. PCAOB 
standards require auditors to perform substantive procedures for 
relevant assertions of significant accounts and disclosures in the 
audit of financial statements and tests of controls over relevant 
assertions of significant accounts and disclosures in the audit of 
internal control. This release includes additional discussion regarding 
identifying significant accounts and disclosures and relevant 
assertions.\450\
---------------------------------------------------------------------------

    \450\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not have an analogous requirement.
(xxi). Significant Risks
PCAOB
    Auditing Standard No. 12 defines significant risk as a ``risk of 
material misstatement that requires special audit consideration.'' This 
definition is different from the ISAs' definition because it omits two 
qualifying phrases, ``an identified and assessed'' and ``in the 
auditor's judgment.'' This release includes additional discussion 
regarding the definition of significant risks.\451\
---------------------------------------------------------------------------

    \451\ Section II.C.7.k.

---------------------------------------------------------------------------

[[Page 59405]]

IAASB and ASB
    The ISAs and SASs define significant risk as ``an identified and 
assessed risk of material misstatement that, in the auditor's judgment, 
requires special audit consideration.''

Auditing Standard No. 13--The Auditor's Responses to the Risks of 
Material Misstatement

    In this section, the analogous IAASB standards are ISA 330, The 
Auditor's Responses to Assessed Risks, and ISA 240, The Auditor's 
Responsibilities Relating to Fraud in an Audit of Financial Statements 
(collectively referred to in this section as ``the ISAs''). The 
analogous ASB standards are the clarified SAS, Performing Audit 
Procedures in Response to Assessed Risks and Evaluating the Audit 
Evidence Obtained (Redrafted), and the proposed SAS, Consideration of 
Fraud in a Financial Statement Audit (Redrafted) (collectively referred 
to in this section as ``the SASs'').
(i). Objective
PCAOB
    The objective of the auditor in Auditing Standard No. 13 is ``to 
address the risks of material misstatement through appropriate overall 
audit responses and audit procedures.'' The objective in the proposed 
standard emphasizes the auditor's responsibility for responding to the 
risks of material misstatements. This release contains additional 
discussion regarding the objective of the standard.\452\
---------------------------------------------------------------------------

    \452\ Section II.C.8.b.
---------------------------------------------------------------------------

IAASB and ASB
    The objective in the ISAs and the SASs is to obtain sufficient 
appropriate audit evidence regarding the assessed risks of material 
misstatement, through designing and implementing appropriate responses 
to those risks.
(ii). Overall Responses to Risks
PCAOB
    Auditing Standard No. 13 requires the auditor to design and 
implement certain overall responses (e.g., making appropriate 
assignments of specific engagement responsibilities, providing an 
appropriate extent of supervision, incorporating elements of 
unpredictability in selecting auditing procedures, and evaluating the 
company's selection and application of significant accounting 
principles) to address risks of material misstatement. These responses 
are not limited to addressing risks at the financial statement level. 
They are also intended to address risks at the significant account or 
disclosure level due to the nature of these specific overall responses. 
This release contains additional discussion of this requirement.\453\
---------------------------------------------------------------------------

    \453\ Section II.C.8.c.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs include requirements to design and implement 
overall responses to address the assessed risks of material 
misstatement at the financial statement level and requirements for 
particular types of responses to the risks of material misstatement due 
to fraud at the financial statement level.
(iii). Determination of the Need for Pervasive Changes
PCAOB
    Auditing Standard No. 13 requires the auditor to determine whether 
it is necessary to make pervasive changes to the nature, timing, or 
extent of audit procedures to adequately address the assessed risk of 
material misstatement. Examples of such pervasive changes include 
modifying the audit strategy to increase the substantive testing of the 
valuation of numerous significant accounts at year end because of 
significantly deteriorating market conditions and to obtain more 
pervasive audit evidence from substantive procedures due to the 
identification of pervasive weaknesses in the company's control 
environment. This release includes detailed discussions regarding 
making pervasive changes as an overall response to risks of material 
misstatement.\454\
---------------------------------------------------------------------------

    \454\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(iv). Application of Professional Skepticism
PCAOB
    Auditing Standard No. 13 states that due professional care requires 
the auditor to exercise professional skepticism, requires that the 
auditor apply professional skepticism in gathering and evaluating audit 
evidence in response to risks of material misstatement, and provides 
examples of the appropriate application of professional skepticism. 
This release includes additional discussion regarding application of 
professional skepticism.\455\
---------------------------------------------------------------------------

    \455\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state

    * * * the auditor shall maintain an attitude of professional 
skepticism throughout the audit, recognizing the possibility that a 
material misstatement due to fraud could exist, notwithstanding the 
auditor's past experience of the honesty and integrity of the 
entity's management and those charged with governance.
    The SASs include a requirement similar to the ISAs' requirement.
(v). Evidence About the Effectiveness of Controls
PCAOB
    In discussing testing controls in an audit of financial statements, 
Auditing Standard No. 13 establishes the principle that the evidence 
necessary to support the auditor's control risk assessment depends on 
the degree of reliance the auditor plans to place on the effectiveness 
of a control. The greater the reliance on a control, the more 
persuasive evidence the auditor is required to obtain from the tests of 
controls.
    In addition, the standard requires the auditor to obtain more 
persuasive evidence about the effectiveness of controls for each 
relevant assertion for which the audit approach consists primarily of 
tests of controls. This release includes additional discussions of 
these requirements.\456\
---------------------------------------------------------------------------

    \456\ Section II.C.8.f.(iii).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs include a requirement for the auditor to 
obtain more persuasive audit evidence the greater the reliance he or 
she plans to place on the effectiveness of a control, but they do not 
have an analogous requirement regarding situations in which the audit 
approach consists primarily of tests of controls.
(vi). Testing the Operating Effectiveness of a Control
PCAOB
    Auditing Standard No. 13 requires the auditor to determine whether 
the control selected for testing is operating as designed and whether 
the person performing the control possesses the necessary authority and 
competence to perform the control effectively. The standard also 
discusses the procedures the auditor performs in testing operating 
effectiveness. To help facilitate the tests of controls in an 
integrated audit, the standard continues to use language similar to 
that of Auditing Standard No. 5 when describing analogous terms and 
concepts relating to the testing of

[[Page 59406]]

controls. This release includes additional discussion regarding this 
requirement.\457\
---------------------------------------------------------------------------

    \457\ Section II.C.8.f.(iv).
---------------------------------------------------------------------------

IAASB
    The ISAs do not include an analogous requirement to determine 
whether the person performing the control possesses the necessary 
authority and competence to perform the control effectively.
ASB
    The SASs state:

    In designing and performing tests of controls, the auditor 
should: a. perform other audit procedures in combination with 
inquiry to obtain audit evidence about the operating effectiveness 
of the controls, including * * * by whom or by what means they were 
applied, including, when applicable, whether the person performing 
the control possesses the necessary authority and competence to 
perform the control effectively.

(vii). Tests of Controls in an Integrated Audit
PCAOB
    Auditing Standard No. 13 requires the auditor to perform tests of 
controls in integrated audits to meet the objectives of both the audit 
of financial statements and the audit of internal control. This release 
includes additional discussion of this requirement.\458\
---------------------------------------------------------------------------

    \458\ Section II.C.8.d.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs do not include an analogous requirement.
(viii). Rotational Testing of Controls
PCAOB
    Auditing Standard No. 13 requires the auditor to obtain evidence 
during the current year audit about the design and operating 
effectiveness of controls upon which the auditor relies. This release 
includes additional discussion of this requirement.\459\
---------------------------------------------------------------------------

    \459\ Section II.C.8.f.(vi).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs include requirements that apply to the use of 
evidence about controls obtained in prior audits and allow rotational 
testing of controls under certain conditions set forth in those 
standards.
(ix). Assessing Control Risk
PCAOB
    Auditing Standard No. 13 requires the auditor to assess control 
risk for relevant assertions by evaluating the evidence from all 
sources, including the auditor's testing of controls for the audit of 
internal control and the audit of financial statements, misstatements 
detected during the financial statement audit, and any identified 
control deficiencies. The standard also requires that control risk be 
assessed at the maximum level for relevant assertions (1) for which 
controls necessary to sufficiently address the assessed risk of 
material misstatement in those assertions are missing or ineffective or 
(2) when the auditor has not obtained sufficient appropriate audit 
evidence to support a control risk assessment below the maximum level. 
This release includes additional discussion of these requirements.\460\
---------------------------------------------------------------------------

    \460\ Section II.C.8.f.(vii).
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs include requirements regarding evaluating the 
operating effectiveness of controls and identified control deviations, 
but those standards do not require a specific assessment of control 
risk.
(x). Substantive Procedures
PCAOB
    Auditing Standard No. 13 requires the auditor to perform 
substantive procedures for each relevant assertion of each significant 
account and disclosure, regardless of the assessed level of control 
risk. This requirement reflects the principle that the auditor needs to 
implement appropriate responses to address assessed risks of material 
misstatement. This release contains additional discussion of this 
requirement.\461\
---------------------------------------------------------------------------

    \461\ Section II.C.8.g.
---------------------------------------------------------------------------

IAASB
    The ISAs state, ``Irrespective of the assessed risks of material 
misstatement, the auditor shall design and perform substantive 
procedures for each material class of transactions, account balance, 
and disclosure.''
ASB
    The SASs state, ``Irrespective of the assessed risks of material 
misstatement, the auditor should design and perform substantive 
procedures for all relevant assertions related to each material class 
of transactions, account balance, and disclosure.''
    The requirements in the ISAs and the SASs focus on the accounts and 
disclosures that are material, regardless of whether they are 
associated with identified risks of material misstatement.
(xi). Consideration of Confirmations
PCAOB
    Auditing Standard No. 13 requires the auditor to perform 
substantive procedures for each relevant assertion of each significant 
account and disclosure. The standard also discusses how to determine 
the types and combination of substantive audit procedures necessary to 
detect material misstatements in relevant assertions.
    AU sec. 330, The Confirmation Process, establishes requirements 
regarding the use of confirmation procedures.\462\ The risk assessment 
standards discuss the auditor's responsibilities for designing and 
performing the substantive procedures necessary to address the risks of 
material misstatement.
---------------------------------------------------------------------------

    \462\ The Board has a separate standards-setting project on 
confirmations.
---------------------------------------------------------------------------

IAASB and ASB
    ISA 330 specifically requires the auditor to consider whether 
external confirmation procedures are to be performed as substantive 
audit procedures. The ASB has proposed to amend the SASs to require the 
auditor to consider whether external confirmation procedures are to be 
performed as substantive audit procedures and to require the use of 
external confirmation procedures for material accounts receivable.
(xii). Determining Whether To Perform Interim Substantive Procedures
PCAOB
    Auditing Standard No. 13 requires the auditor to take into account 
a series of factors when determining whether it is appropriate to 
perform substantive procedures at an interim date. This release 
includes provides additional discussion regarding timing of substantive 
procedures.\463\
---------------------------------------------------------------------------

    \463\ Section II.C.8.h.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs do not include an analogous requirement for 
the auditor to take into account the factors listed in Auditing 
Standard No. 13 when determining whether it is appropriate to perform 
substantive procedures at an interim date.
(xiii). Substantive Procedures Covering the Remaining Period
PCAOB
    Auditing Standard No. 13 states, ``When substantive procedures are 
performed at an interim date, the auditor should cover the remaining 
period by performing substantive

[[Page 59407]]

procedures, or substantive procedures combined with tests of controls, 
that provide a reasonable basis for extending the audit conclusions 
from the interim date to the period end.'' The standard contains a 
specific requirement to compare relevant information about the account 
balance at the interim date with comparable information at the end of 
the period to identify amounts that appear unusual. This release 
includes additional discussion of this requirement.\464\
---------------------------------------------------------------------------

    \464\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs include requirements to cover the period 
between the interim testing date and year end by performing substantive 
procedures, combined with tests of controls for the intervening period, 
or by performing further substantive procedures only if the auditor 
determines that doing so would be sufficient. The ISAs and SASs do not 
include an analogous requirement regarding the specific procedures to 
be performed.
(xiv). Response to Significant Risks
PCAOB
    Auditing Standard No. 13 requires the auditor to perform 
substantive procedures, including tests of details, that are 
specifically responsive to significant risks. This release contains 
additional discussion of this requirement.\465\
---------------------------------------------------------------------------

    \465\ Section II.C.8.i.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state:

    If the auditor has determined that an assessed risk of material 
misstatement at the assertion level is a significant risk, the 
auditor shall perform substantive procedures that are specifically 
responsive to that risk. When the approach to a significant risk 
consists only of substantive procedures, those procedures shall 
include tests of details.

    The SASs include requirements similar the ISAs' requirements.
(xv). Dual-purpose Tests
PCAOB
    Auditing Standard No. 13 states that, when dual-purpose tests are 
performed, the auditor should design the dual-purpose test to achieve 
the objectives of both the test of the control and the substantive 
test. Also, when performing a dual-purpose test, the auditor should 
evaluate the results of the test in forming conclusions about both the 
assertion and the effectiveness of the control being tested. This 
release contains additional discussion of this requirement.\466\
---------------------------------------------------------------------------

    \466\ Section II.C.8.j.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs do not include analogous requirements.

Auditing Standard No. 14--Evaluating Audit Results

    In this section, the analogous IAASB standards are ISA 450, 
Evaluation of Misstatements Identified During the Audit, ISA 330, The 
Auditor's Responses to Assessed Risks, ISA 520, Analytical Procedures, 
ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit 
of Financial Statements, ISA 540, Auditing Accounting Estimates 
Including Fair Value Accounting Estimates, and Related Disclosures, and 
ISA 700, Forming an Opinion and Reporting on Financial Statements 
(collectively referred to in this section as ``the ISAs''). The 
analogous ASB standards are clarified SAS Evaluation of Misstatements 
Identified During the Audit, Performing Audit Procedures in Response to 
Assessed Risks and Evaluating the Audit Evidence Obtained (Redrafted), 
Understanding the Entity and its Environment and Assessing the Risks of 
Material Misstatement (Redrafted), and proposed SAS Consideration of 
Fraud in a Financial Statement Audit (Redrafted), Analytical Procedures 
(Redrafted), and Forming an Opinion and Reporting on Financial 
Statements (collectively referred to in this section as ``the SASs'').
(i). Performing Analytical Procedures in the Overall Review
PCAOB
    In the overall review, Auditing Standard No. 14 contains specific 
requirements for the auditor to read the financial statements and 
disclosures and perform analytical procedures to (a) evaluate the 
auditor's conclusions formed regarding significant accounts and 
disclosures and (b) assist in forming an opinion on whether the 
financial statements as a whole are free of material misstatement. 
These requirements were adapted from existing requirements in PCAOB 
standards.\467\ The conclusions formed from the results of the overall 
review of the audit are intended to inform the auditor's conclusions 
regarding significant accounts and disclosures and the opinion on the 
financial statements. This release includes additional discussion of 
these requirements.\468\
---------------------------------------------------------------------------

    \467\ AU sec. 329.23.
    \468\ Section II.C.9.c.
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The auditor shall design and perform analytical procedures near 
the end of the audit that assist the auditor when forming an overall 
conclusion as to whether the financial statements are consistent 
with the auditor's understanding of the entity.
ASB
    The SASs state:

    The auditor should design and perform analytical procedures near 
the end of the audit that are intended to corroborate audit evidence 
obtained during the audit of financial statements to assist the 
auditor in drawing reasonable conclusions on which to base the 
auditor's opinion.
(ii). Evaluating Evidence From Analytical Procedures
PCAOB
    Auditing Standard No. 14 contains a requirement, which was adapted 
from an existing requirement in PCAOB standards,\469\ for the auditor, 
as part of the overall review to evaluate whether (a) the evidence 
gathered in response to unusual or unexpected transactions, events, 
amounts or relationships previously identified during the audit is 
sufficient and (b) unusual or unexpected transactions, events, amounts, 
or relationships indicate risks of material misstatement that were not 
identified previously, including, in particular, fraud risks. Auditing 
Standard No. 14 also specifically requires the auditor to evaluate 
whether the evidence gathered during the audit is sufficient as part of 
the overall review.
---------------------------------------------------------------------------

    \469\ AU sec. 329.23.
---------------------------------------------------------------------------

    Also, the requirements in Auditing Standard No. 14 relate to risks 
of material misstatement due to error or fraud, whereas the 
requirements in the ISAs and SASs are limited to fraud risks. This 
release includes additional discussion of these requirements in 
Auditing Standard No. 14.\470\
---------------------------------------------------------------------------

    \470\ Section II.C.9.c.
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The auditor shall evaluate whether analytical procedures that 
are performed near the end of the audit, when forming an overall 
conclusion as to whether the financial statements as a whole are 
consistent with the auditor's understanding of the entity and its 
environment, indicate a previously unrecognized risk of material 
misstatement due to fraud.
ASB
    The SASs state:

    The auditor should evaluate whether the accumulated results of 
auditing procedures,

[[Page 59408]]

including analytical procedures, that are performed during the 
audit, in the overall review stage, or in both stages, when forming 
an overall conclusion concerning whether the financial statements as 
a whole are consistent with the auditor's understanding of the 
entity and its environment, indicate a previously unrecognized risk 
of material misstatement due to fraud.
(iii). Analytical Procedures Regarding Revenue
PCAOB
    Auditing Standard No. 14 includes a requirement, adapted from an 
existing requirement in AU sec. 316, for the auditor to perform 
analytical procedures relating to revenue through the end of the 
period. These procedures are intended to identify unusual or unexpected 
relationships involving revenue accounts that might indicate a material 
misstatement, including material misstatement due to fraud. This 
release includes additional discussion of this requirement.\471\
---------------------------------------------------------------------------

    \471\ Ibid.
---------------------------------------------------------------------------

IAASB
    The ISAs state:

    The auditor shall evaluate whether unusual or unexpected 
relationships that have been identified in performing analytical 
procedures, including those related to revenue accounts, may 
indicate risks of material misstatement due to fraud.

    The ISAs do not specifically require the auditor to perform 
analytical procedures related to revenue through the end of the period.
ASB
    The SASs require the auditor to perform analytical procedures 
related to revenue.
(iv). Corroborating Management Explanations
PCAOB
    Auditing Standard No. 14 requires the auditor to corroborate 
management's explanations regarding significant unusual or unexpected 
transactions, events, amounts, or relationships. Auditing Standard No. 
14 also states that if management's responses to the auditor's 
inquiries appear to be implausible, inconsistent with other audit 
evidence, imprecise, or not at a sufficient level of detail to be 
useful, the auditor should perform procedures to address the matter. 
Unlike the ISAs, Auditing Standard No. 14 specifically requires the 
auditor to corroborate management's explanations regarding significant 
matters. This release includes additional discussion regarding 
corroborating management's explanations.\472\
---------------------------------------------------------------------------

    \472\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs require the auditor to investigate the 
identified fluctuations or relationships that are inconsistent with 
other relevant information or that differ from expected values by a 
significant amount by (a) inquiring of management and obtaining 
appropriate audit evidence relevant to management's responses and (b) 
performing other audit procedures as necessary in the circumstances. 
The ISAs and the SASs also include a requirement to investigate 
inconsistent responses to inquiries from management and those charged 
with governance.
(v). Communication of Accumulated Misstatements
PCAOB
    Auditing Standard No. 14 requires the auditor to communicate 
accumulated misstatements to management on a timely basis to provide 
management with an opportunity to correct them. Unlike the ISAs and the 
SASs, Auditing Standard No. 14 does not require the auditor to request 
management to correct the misstatements. Instead, PCAOB standards focus 
on communicating the misstatements to management, performing procedures 
to determine whether management corrected them, understanding the 
reasons why management might not have corrected the misstatements, and 
evaluating the effect of uncorrected misstatements on the financial 
statements and the audit. This release includes additional discussion 
of this requirement.\473\
---------------------------------------------------------------------------

    \473\ Section II.C.9.j.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs include requirements to communicate on a 
timely basis all misstatements accumulated during the audit to an 
appropriate level of management and to request that management correct 
those misstatements.
(vi). Correction of Misstatements
PCAOB
    Auditing Standard No. 14 requires that if management has made 
corrections to accounts or disclosures in response to misstatements 
detected by the auditor, the auditor should evaluate management's work 
to determine whether the corrections have been appropriately recorded 
and determine whether uncorrected misstatements remain. This release 
includes additional discussion of this requirement.\474\
---------------------------------------------------------------------------

    \474\ Section II.C.9.f.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs contain a requirement to perform additional 
audit procedures to determine whether misstatements remain, if at the 
auditor's request management has examined a class of transactions, 
account balance or disclosure and corrected misstatements that were 
detected.
    The ISAs do not require the auditor to evaluate whether the 
misstatements that were communicated by the auditor to management have 
been appropriately corrected by management.
(vii). Evaluating Misstatements--Effect on Risk Assessments
PCAOB
    Auditing Standard No. 14 contains a requirement to evaluate the 
nature and the effects of individual misstatements accumulated during 
the audit on the assessed risks of material misstatement in determining 
whether the risk assessments remain appropriate. This release includes 
additional discussion of this requirement.\475\
---------------------------------------------------------------------------

    \475\ Section II.C.9.i.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs do not include an analogous requirement.
(viii). Evaluating Whether Misstatements Might Be Indicative of Fraud
PCAOB
    Auditing Standard No. 14 requires the auditor to perform procedures 
to obtain additional audit evidence to determine whether fraud has 
occurred or is likely to have occurred, and, if so, its effect on the 
financial statements and the auditor's report if the auditor believes 
that a misstatement is or might be intentional, and if the effect on 
the financial statement cannot be readily determined. This release 
includes additional discussions of this requirement.\476\
---------------------------------------------------------------------------

    \476\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs require the auditor to evaluate the implications for the 
audit if the auditor confirms that or is unable to conclude whether 
financial statements are materially misstated as a result of fraud. The 
ISA does not explicitly require the auditor to perform audit procedures 
to obtain additional audit evidence to determine the effect of the 
misstatement on the financial statements.

[[Page 59409]]

    The SASs include a requirement similar to the ISAs' requirement.
(ix). Communications Regarding Fraud
PCAOB
    Auditing Standard No. 14 requires the auditor to determine his or 
her responsibility under AU secs. 316.79-.82A, AU sec. 317, Illegal 
Acts by Clients, and Section 10A of the Securities and Exchange Act of 
1934, 15 U.S.C. 78j-1, if the auditor becomes aware of information 
indicating that fraud or another illegal act has occurred or might have 
occurred. AU sec. 316 requires that whenever the auditor has determined 
that there is evidence that fraud may exist, the auditor should bring 
that matter to the attention of an appropriate level of 
management.\477\ This release includes additional discussion of this 
requirement.\478\
---------------------------------------------------------------------------

    \477\ AU sec. 316.79.
    \478\ Section II.C.9.k.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs state that if the auditor has identified a fraud or has 
obtained information that indicates that a fraud may exist, the auditor 
shall communicate these matters on a timely basis to the appropriate 
level of management.
    The SASs include a requirement similar to the ISAs' requirement.
(x). Evaluating the Qualitative Aspects of the Company's Accounting 
Practices
PCAOB
    Auditing Standard No. 14 states that if the auditor identifies bias 
in management's judgments about the amounts and disclosures in the 
financial statements, the auditor should evaluate whether the effect of 
that bias, together with the effect of uncorrected misstatements, 
results in material misstatement of the financial statements. The 
standard also contains a requirement for the auditor to evaluate 
whether the auditor's risk assessments, including the assessment of 
fraud risks, and the related responses remain appropriate. This release 
includes additional discussion of these requirements.\479\
---------------------------------------------------------------------------

    \479\ Section II.C.9.l.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and the SASs contain a requirement for the auditor to 
evaluate whether the financial statements are prepared, in all material 
respects, in accordance with the requirements of the applicable 
financial reporting framework. This evaluation shall include 
consideration of the qualitative aspects of the entity's accounting 
practices, including indicators of possible bias in management's 
judgments.
(xi). Management's Identification of Offsetting Adjusting Entries
PCAOB
    If management identifies adjusting entries that offset 
misstatements accumulated by the auditor, Auditing Standard No. 14 
requires the auditor to perform procedures to determine why the 
misstatements were not identified previously and to evaluate the 
implications on the integrity of management and the auditor's risk 
assessments, including fraud risk assessments. Auditing Standard No. 14 
also requires the auditor to perform additional procedures as necessary 
to address the risk of further undetected misstatements. This release 
includes additional discussion of these requirements.\480\
---------------------------------------------------------------------------

    \480\ Ibid.
---------------------------------------------------------------------------

IAASB and ASB
    The ISAs and SASs do not include analogous requirements.
(xii). Evaluating Conditions Relating to Assessment of Fraud Risks
PCAOB
    Auditing Standard No. 14 requires the engagement partner to 
determine whether there has been appropriate communication with other 
engagement team members throughout the audit regarding information or 
conditions that are indicative of fraud risks. This release includes 
additional discussion of this requirement.\481\
---------------------------------------------------------------------------

    \481\ Section II.C.9.m.
---------------------------------------------------------------------------

IAASB
    The ISAs require a discussion among the engagement team members and 
a determination by the engagement partner of matters to be communicated 
to those team members not involved in the discussion.
ASB
    The SASs contain a requirement for the engagement partner to 
ascertain that appropriate communication exists about the need for the 
discussion of fraud risks among team members throughout the audit.

Auditing Standard No. 15--Audit Evidence

    In this section, the analogous IAASB and ASB standards are ISA 500, 
Audit Evidence, and the clarified SAS, Audit Evidence (Redrafted), 
respectively.
(i). Objective and Overarching Requirement
PCAOB
    The objective of the auditor in Auditing Standard No. 15 is to plan 
and perform the audit to obtain appropriate audit evidence that is 
sufficient to support the opinion expressed in the auditor's report. 
The objective of the standard, together with the related requirement 
regarding audit evidence, articulates the linkage between the auditor's 
responsibility to obtain sufficient appropriate audit evidence and to 
support his or her opinion. This release includes additional discussion 
regarding the objective of the standard.\482\
---------------------------------------------------------------------------

    \482\ Section II.C.10.c.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA states:

    The objective of the auditor is to design and perform audit 
procedures in such a way as to enable the auditor to obtain 
sufficient appropriate audit evidence to be able to draw reasonable 
conclusions on which to base the auditor's opinion.

    The ISA also states:

    The auditor shall design and perform audit procedures that are 
appropriate in the circumstances for the purpose of obtaining 
sufficient appropriate audit evidence.

    The SAS includes an objective and a requirement similar to the 
ISA's objective and requirement.
(ii). Document Authentication
PCAOB
    Auditing Standard No. 15 states that the auditor is not expected to 
be an expert in document authentication. However, if conditions 
indicate that a document may not be authentic or that the terms in a 
document have been modified but that the modifications have not been 
disclosed to the auditor, the auditor is required to modify the planned 
audit procedures or perform additional audit procedures to respond to 
those conditions and to evaluate the effect, if any, on the other 
aspects of the audit. Auditing Standard No. 15 omits protective 
language, such as ``[u]nless the auditor has reason to believe the 
contrary, the auditor may accept records and document as genuine'' that 
would weaken the requirement. This release includes additional 
discussion regarding this requirement.\483\
---------------------------------------------------------------------------

    \483\ Section II.C.10.e.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA states:

    Unless the auditor has reason to believe the contrary, the 
auditor may accept records and

[[Page 59410]]

documents as genuine. If conditions identified during the audit 
cause the auditor to believe that a document may not be authentic or 
that terms in a document have been modified but not disclosed to the 
auditor, the auditor shall investigate further.

    The SAS includes a requirement similar to the ISA's requirement.
(iii). Selecting Items for Testing To Obtain Audit Evidence
PCAOB
    Auditing Standard No. 15 states that the auditor should determine 
the means of selecting items for testing to obtain evidence that, in 
combination with other relevant evidence, is sufficient to meet the 
objective of the audit procedure. This requirement links the selection 
of items for testing to the sufficiency of the audit evidence. This 
release includes additional discussion of this requirement.\484\
---------------------------------------------------------------------------

    \484\ Section II.C.10.j.
---------------------------------------------------------------------------

IAASB and ASB
    The ISA states:

    When designing tests of controls and tests of details, the 
auditor shall determine means of selecting items for testing that 
are effective in meeting the purpose of the audit procedure.

    The SAS includes a requirement similar to the ISA's requirement.

III. Date of Effectiveness of the Proposed Rules and Timing for 
Commission Action

    Pursuant to Section 19(b)(2)(A)(ii) of the Securities Exchange Act 
of 1934 (``Exchange Act''), and based on its determination that an 
extension of the period set forth in Section 19(b)(2)(A)(i) of the 
Exchange Act is appropriate in light of the number and complexity of 
the standards to allow additional time sufficient for notice and 
comment, and consideration of comments, the Commission has determined 
to extend to December 27, 2010 as the date by which the Commission 
should take action on the proposed rule.

IV. Solicitation of Comments

    Interested persons are invited to submit written data, views and 
arguments concerning the foregoing, including whether the proposed rule 
is consistent with the requirements of Title I of the Act. Comments may 
be submitted by any of the following methods:

Electronic Comments

    <bullet> Use the Commission's Internet comment form (http://www.sec.gov/rules/pcaob.shtml); or
    <bullet> Send an e-mail to <a href="/cdn-cgi/l/email-protection#0173746d642c626e6c6c646f7572417264622f666e77"><span class="__cf_email__" data-cfemail="4331362f266e202c2e2e262d3730033026206d242c35">[email protected]</span></a>. Please include 
File Number PCAOB-2010-01 on the subject line.

Paper Comments

    <bullet> Send paper comments in triplicate to Elizabeth M. Murphy, 
Secretary, Securities and Exchange Commission, 100 F Street, NE., 
Washington, DC 20549-1090.

All submissions should refer to File Number PCAOB-2010-01. This file 
number should be included on the subject line if e-mail is used. To 
help the Commission process and review your comments more efficiently, 
please use only one method. The Commission will post all comments on 
the Commission's Internet Web site (http://www.sec.gov/rules/pcaob/shtml). Copies of the submission, all subsequent amendments, all 
written statements with respect to the proposed rule that are filed 
with the Commission, and all written communications relating to the 
proposed rule between the Commission and any person, other than those 
that may be withheld from the public in accordance with the provisions 
of 5 U.S.C. 552, will be available for Web site viewing and printing in 
the Commission's Public Reference Room, on official business days 
between the hours of 10 a.m. and 3 p.m. Copies of such filing will also 
be available for inspection and copying at the principal office of the 
PCAOB. All comments received will be posted without change; we do not 
edit personal identifying information from submissions. You should 
submit only information that you wish to make available publicly. All 
submissions should refer to File No. PCAOB-2010-01 and should be 
submitted on or before October 18, 2010.

    By the Commission.
Elizabeth M. Murphy,
Secretary.
[FR Doc. 2010-23456 Filed 9-24-10; 8:45 am]
BILLING CODE 8010-01-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>