The Center for Audit Quality (CAQ or the Center), submitted comment letters to the SEC and PCAOB related to the internal control over financial reporting (ICFR) proposals for issuers and auditors, respectively. The Center supports the proposals, which encourage increased effectiveness and efficiency in implementing the provisions of Section 404 of the Sarbanes-Oxley Act of 2002 (the Act). We believe that these proposals will facilitate continued progress in upholding the investor protections that are so fundamental to the success of the Act and that any changes to the implementation of Section 404 should flow primarily from the desire to reinforce the significant benefits of Section 404 rather than a drive to cut costs.

Summary of CAQ's Comments to the PCAOB

The following is a summary of the CAQ's comments on the PCAOB's proposed changes to Auditing Standard No. 2 within their proposal An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements and Related Other Proposals (PCAOB Release No. 2006-007).

We expect that the PCAOB proposed changes to ICFR, along with the proposed guidance of the SEC, will result in a reduction of total Section 404 efforts due to various specific positive changes such as the ability of the auditor to:

• Determine audit coverage based upon risk, without any pre-established quantitative coverage requirements, relative to an issuer's operations;
  
  
• Adjust, under certain conditions, the nature, timing, and extent of testing of particular controls, based in part on cumulative experience gained in prior audits; and
  
  
• Increase the use of the work of others, if certain conditions are met.

We are supportive of the following aspects of the PCAOB's proposals and efforts:

• Increased emphasis and flexibility on the auditor's use of professional judgment;
  
  
• Application of a single model of auditor reporting on ICFR that is scalable to companies of varying size and complexity;
  
  
• Project to develop guidance and education for auditors of smaller public companies that is supported by many member firms of the CAQ; and
  
  
• Plan to require that auditors obtain evidence regarding the operating effectiveness of controls to determine whether the controls in place actually work as intended.

The CAQ made the following comments intended to improve the proposed standards to meet the overall goal of making implementation of Section 404 more effective and efficient:

Considering and Using the Work of Others in an Audit

We noted in the comment letter that the changes in the Board's proposal on ICFR, coupled with the existing interim auditing standard "The Auditor's Consideration of the Internal Audit Function in an Audit of Financial Statements" (AU Sec. 322), can achieve the Board's objective of effective and efficient implementation of Section 404. Accordingly, we did not support the Board's proposed standard that would supersede AU Sec. 322. We did however, suggest an alternative should the Board decide that a new standard on considering and using the work of others is necessary.

Consideration of Fraud and Company-Level Controls

We recommended that the ICFR standard should clearly articulate the notion that when an auditor assesses risk when planning the audit, the interaction between the assessed risks of fraud for certain assertions be addressed when scoping the audit of internal control.

We also recommended that the precision of company-level controls as it relates to the risk of fraud be reiterated earlier in the ICFR standard for better planning of the audit.

Considering the Effect of Company-Level Controls

We noted that the ICFR standard should acknowledge that in many circumstances company-level controls only indirectly relate to relevant assertions and do not operate in a manner that would be sufficient to address the risk of material misstatement to specific accounts and disclosures in the financial statements.

In addition, we requested the Board to provide examples that illustrate the linkage between company-level controls and relevant assertions and the benefit that could be derived from them in determining the nature, timing and extent of testing lower-level controls.

Multi-location Scoping Decisions

With respect to multi-location scoping decisions, we supported the deletion of "large portion" from the proposal. However, we recommended that the standard include guidance acknowledging that the responsibility for the opinion expressed in the auditor's report rests solely with the auditor and that the auditor should not lose sight of the need to obtain sufficient audit evidence to support the opinion.

Strong Indicators of Material Weaknesses

We noted that the PCAOB's description of strong indicators of material weaknesses in the ICFR proposal differs from the SEC's description and noted in the comment letter that we have recommended to the SEC that they conform their description to that of the PCAOB. Conforming the two documents will help reduce potential confusion, inconsistencies, and possible inefficiencies that may occur as a result of differing evaluations by management and auditors of the same control deficiency.

Documentation

We recommended that the Board reconsider the use of the words "should" and "must" throughout the ICFR standard to ensure that disproportionate auditor effort is not unnecessarily devoted to documenting consideration of items that ordinarily would not be incorporated into the auditor's overall methodology.

Precedent of Mandatory Efficiency Requirements

We indicated our concern about the precedent established with the inclusion in an auditing standard of presumptively mandatory performance requirements relating to efficiencies as we believe this is inconsistent with the nature of professional standards.

The CAQ comment letter to the PCAOB can be accessed by clicking on the following link: CAQ Comment Letter on PCAOB Release No. 2006-007.

Click on this link for additional information on the Board's proposal: View CAQ Summary of Proposed Internal Control Standard and Other Related Proposals.