A question of balance: assessing the final PCAOB auditing standard.

• Author: Sayther, Colleen
• Position: President'sPage - Public Company Accounting Oversight Board

As of this writing, the Public Company Accounting Oversight Board (PCAOB) had just issued its long-awaited final standard on the integrated audits of internal control over financial reporting and financial statements, as required under Section 404 of the Sarbanes-Oxley Act.

The standard is complex. It is both a good news and a bad news story.

On a positive note, the final standard places greater reliance on auditor judgment, allowing him or her to rely at least partially on the work of others. In this important change, the standard has become far less prescriptive than had been originally proposed. The auditor can now exercise his or her professional judgment and rely on the work of competent and objective personnel--and particularly on a competent and objective internal audit function. This is particularly true in the areas of general information technology controls and controls over the period-end financial reporting process.

[ILLUSTRATION OMITTED]

The new standard establishes a three-part test for determining the extent to which the auditor can rely on others' work. The auditor must first examine the nature of the controls and assess their significance. Secondly, he or she must look at both the competency and objectivity of the party assessing those controls, carefully evaluating both and calculating a combined score--one cannot offset the other. And thirdly, he or she must test some of the work performed by others to evaluate its quality and effectiveness.

The Sins of the Few

I am very pleased that the Board agreed to consider the significant experience and judgmental integrity of most auditors and allow them, in turn, to factor in the collected expertise and honesty of the vast bulk of financial managers and internal auditors. I continue to believe that the corruption and excesses that led to Sarbanes-Oxley remain the sins of the few, not the many. Would an Enron or a WorldCom scandal have been avoided had these companies been required to document internal controls? I doubt it.

However, the new standard is very clear: the auditor must obtain the "principal evidence" to support an assessment. This means that although the auditor can rely on the work of others to a larger extent than in the previous draft, he or she must perform enough audit work directly to obtain the "principal evidence" for an attestation. The net result, then, is that the new standard should enable the auditor to reduce the extent of original testing.

In the negative...