Friday, November 16, 2007

Internal Controls over Auditors

The Public Company Accounting Oversight Board (PCOAB) is seeking comments on its latest attempt to make sense out of audit rules when applied to smaller public companies.

Smaller operations have been groaning under the weight of audits of their internal controls. The Board finally came up with
Auditing Standard No. 5, An Audit of Internal Control over Financial Reporting. It replaces Auditing Standard No. 2, which was the PCOAB’s first attempt at implementing the provisions of Sarbanes-Oxley.

Just the names sound ominous - like cells in some remote gulag - which is where some small company executives fear they are headed if their internal controls over financial reports are not up to the same standards as larger companies.

Never fear, the PCAOB staff is here! Forget that the PCOAB made a promise to issue smaller company guidance over five years ago.

To facilitate the implementation of AS No. 5, last month the PCOAB issued staff guidance on auditing the internal controls over financial reporting in the small company situation. They are looking for
comments by December 17, 2007.

AS No. 5 is considered an improvement since it eliminates unnecessary procedures and focuses on the most important risks in a particular company. It also provides direction to auditors on scaling the audit based on the company’s size and complexity. Sort of like an internal control over the auditor!

The staff guidance goes even further, addressing a number of internal control issues that are particularly difficult and expensive for smaller companies to address. For example, segregation of duties is a big problem for smaller companies that typically operating with a skeletal administrative staff and require employees to wear many hats at once. What is fiscally conservative and prudent is regarded by auditors as sketchy practice.

It is “ditto” for information technology controls and management overrides. Even if a small company has enough heads for the redundancy and separation that audit standards require, they often do not have the documentation necessary to prove it. So the PCAOB guidelines cover appropriate documentation in the small company environment.

AS No. 5 and the accompanying guidelines may not be perfect but anything will be an improvement over the snail’s pace at which the PCAOB has handled the small company issue up to this point.

No comments: