The auditor must understand the entity's responsibilities before assessing whether its governance structure creates financial reporting risks. The Sarbanes-Oxley Act (SOX) establishes obligations for corporate reporting, executive accountability, and oversight of the external auditor.
For domestic operating issuers, the auditor evaluates ownership and governance structure in light of Securities and Exchange Commission (SEC) reporting requirements and listing rules. A nonissuer does not acquire issuer filing obligations merely because its financial statements receive an audit.
Internal control over financial reporting (ICFR) comprises processes providing reasonable assurance about reliable financial reporting and preparation of financial statements under the applicable framework. Management establishes and maintains these processes, even when accounting operations depend on outside service providers.
An integrated audit combines the financial statement audit with an audit of ICFR effectiveness under Public Company Accounting Oversight Board (PCAOB) standards. Management's assessment and the auditor's opinion remain separate responsibilities within the issuer's governance structure.
The responsibilities divide as follows:
The listed issuer's governance structure must provide the audit committee with authority to retain independent advisers and appropriate funding for its responsibilities.
Common mistakes
- Quarterly assessment confusion. A December 31 annual ICFR assessment does not replace the separate period-end evaluation of disclosure controls.
- Customer size shortcut. Treating 45% customer concentration as a related-party relationship skips the necessary facts about relationships and influence.
- Disclosure becomes appointment. The absence of a financial expert calls for the required explanation, not an assumed universal appointment mandate.
Bottom line
- Management certifies reports and assesses ICFR; the audit committee oversees the auditor and establishes complaint procedures.
- Auditor attestation applicability depends on issuer classification, exemptions, and transition provisions.
- Financial-expert disclosure requires identification or an explanation of absence, rather than a universal appointment mandate.
- Operations, ownership, governance, investments, financing, policies, objectives, and strategies must be connected to plausible reporting errors.
Exam shortcut
Identify the actor first: certifying officers, management, audit committee, or external auditor. Then identify the specific duty and any stated exemption. For an entity fact, complete the chain: business consequence, possible accounting error, affected assertion, and breadth of impact. In paired acquisition questions, hold the purchase and reporting facts constant. Find whether actual processing changed before deciding how much documentation needs revision. For technology, trace the output into the accounts.
The full lesson (about 4,434 words, 30 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.B2
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.