Search within this section
Select a section below and enter your search term, or to search all click Financial Reporting Manual
Favorited Content
4320 Auditor's report on ICFR [AS 2201, S-X 2-02(f)]
us SEC - Financial Reporting Manual
4320.1 AS 2201 requires an auditor to perform an audit of a company's ICFR that is integrated with an audit of the financial statements. A report on the audit of ICFR, which may be combined with or separate from the report on the financial statements, must include the following:
- A title that includes the word independent;
- A statement that management is responsible for maintaining effective internal control over financial reporting and for assessing the effectiveness of internal control over financial reporting;
- An identification of management's report on internal control;
- A statement that the auditor's responsibility is to express an opinion on the company's internal control over financial reporting based on his or her audit;
- A definition of internal control over financial reporting as stated in AS 2201, paragraph A5;
- A statement that the audit was conducted in accordance with the standards of the Public Company Accounting Oversight Board (United States);
- A statement that the standards of the Public Company Accounting Oversight Board require that the auditor plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects;
- A statement that an audit includes obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, testing and evaluating the design and operating effectiveness of internal controls based on the assessed risk and performing such other procedures as the auditor considered necessary in the circumstances;
- A statement that the auditor believes the audit provides a reasonable basis for his or her opinion;
- A paragraph stating that, because of inherent limitations, internal control over financial reporting may not prevent or detect misstatements and that projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate;
- The auditor's opinion on whether the company maintained, in all material respects, effective internal control over financial reporting as of the specified date, based on the control criteria;
- The manual or printed signature of the auditor's firm;
- The city and state (or city and country, in the case of non-U.S. auditors) from which the auditor's report has been issued; and
- The date of the audit report.
4320.2 In addition, S-X 2-02(f) requires the audit report on ICFR to identify the period covered by the report.
4320.3 If the audit report on ICFR is separate from the audit report on the financial statements, both reports must be dated the same. See paragraphs 87-88 of AS 2201 for sample Illustrative Reports on Internal Control Over Financial Reporting.
4320.4 AS 2201 requires the auditor to modify its report on ICFR if any one of the following five conditions exists:
- Elements of management's annual report on internal control are incomplete or improperly presented;
- There is a restriction on the scope of the engagement;
- The auditor decides to refer to the report of other auditors as the basis, in part, for the auditor's own report;
- There is other information contained in management's annual report on internal control over financial reporting; or
- Management's annual certification pursuant to SOX 302 is misstated. [AS 2201, paragraphs C1-C15]
The report modification may be in one of the following forms, depending on the condition:
- an explanatory paragraph;
- an adverse opinion; or
- a disclaimer of opinion.
4320.5 The auditor's report on ICFR should clearly state whether or not it is the auditor's opinion that a company maintained, in all material respects, effective ICFR at year end. It is not appropriate for the report to state that ICFR is effective with certain qualifications or exceptions. For example, language indicating that the company maintained effective ICFR, except for a certain weakness in a control, is not acceptable. Language indicating that the company maintained ICFR that are "sufficiently effective" or "adequate" is also not appropriate.
4320.6 The auditor must express an adverse opinion on the company's ICFR when one or more material weaknesses in ICFR exist, unless there is a restriction on the scope of the engagement. See Section 4320.12. An adverse opinion on ICFR must include:
a. The definition of a material weakness; and
b. A statement that a material weakness has been identified and an identification of the material weakness described in management's assessment.
4320.7 The auditor should determine the effect an adverse opinion on ICFR has on the auditor's opinion on the financial statements. Also, the auditor should disclose whether or not the adverse opinion on ICFR affected its audit opinion on the financial statements. [AS 2201, paragraph 92]
4320.8 A material weakness is a deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis. [S-X 1-02(a)(4); AS 2201, paragraph A7]
4320.9 A deficiency or combination of deficiencies is an indicator of a material weakness if the auditor determines that the deficiency or combination of deficiencies might prevent prudent officials in the conduct of their own affairs from concluding that they have reasonable assurance that transactions are recorded as necessary to permit the preparation of the financial statements in conformity with GAAP. [AS 2201, paragraph 70]
4320.10 AS 2201 lists four indicators of a material weakness in ICFR, which are:
- Identification of fraud, whether or not material, on the part of senior management;
- Restatement of previously issued financial statements to reflect the correction of a material misstatement;
- Identification by the auditor of a material misstatement of financial statements in the current period in circumstances that indicate that the misstatement would not have been detected by the company's internal control over financial reporting; and
- Ineffective oversight of the company's external financial reporting and internal control over financial reporting by the company's audit committee. [AS 2201, paragraph 69]
4320.11 If the material weakness was not included in management's assessment, the auditor's report on ICFR should be modified to state that a material weakness has been identified but not included in management's assessment. Also, the auditor's report should include a description of the material weakness, which should provide the users of the audit report with specific information about the nature of the material weakness and its actual and potential effect on the presentation of the company's financial statements issued during the existence of the weakness. If the material weakness was included in management's assessment but the auditor concludes that management's disclosure of the material weakness is not fairly presented in all material respects, the auditor's report should describe this conclusion as well as the information necessary to fairly describe the material weakness. [AS 2201, paragraph 91]
4320.12 Any report modification due to a scope limitation would result in a disclaimer of opinion on the audit of ICFR. Reports that result in a disclaimer of opinion are expected to be rare. [S-X 2-02(f)] Reports on audits of ICFR that disclaim an opinion due to a scope limitation should be discussed with CF-OCA in advance of filing. (Last updated: 9/30/2011)
4320.13 When disclaiming an opinion due to a scope limitation, the auditor must state that the scope of the audit was not sufficient to warrant the expression of an opinion. Also, the auditor's report on ICFR should provide the substantive reasons for the disclaimer in a separate paragraph. [AS 2201, paragraph C4]
4320.14 When the auditor plans to disclaim an opinion on the audit of ICFR due to a scope limitation and the limited procedures performed by the auditor cause the auditor to conclude that a material weakness existed, the auditor's report on ICFR should include the definition of a material weakness and a description of any material weakness identified, as described in 4320.6. [AS 2201, paragraph C5]
4320.15 If management discloses additional information in the report (e.g., its plans to implement new controls, corrective actions taken after the date of assessment, or a statement that management believes the cost of correcting a material weakness would exceed the benefits to be derived from implementing new controls), the auditor is required to modify its report regarding any additional information and disclaim an opinion on this information. [AS 2201, paragraphs C1 and C12-14]
4320.16 The auditor should inquire about and examine relevant documents for events which occurred subsequent to the date as of which ICFR is being audited but before the date of the auditor's report. Such subsequent events could include changes in internal controls or other factors. If the auditor obtains knowledge about subsequent events that materially and adversely affect the effectiveness of the company's ICFR as of the date specified in the assessment, the auditor should issue an adverse opinion on ICFR. If the auditor is unable to determine the effect of the subsequent event on the effectiveness of ICFR, the auditor should disclaim an opinion. [AS 2201, paragraphs 93-96]
4320.17 The auditor may obtain knowledge about subsequent events with respect to conditions that did not exist at the date specified in the assessment but arose subsequent to that date and before issuance of the auditor's report. If a subsequent event of this type has a material effect on the company's ICFR, the auditor should include an explanatory paragraph in its report on ICFR describing the event and its effects or directing the reader to the event and its effects as disclosed in management's report on ICFR. [AS 2201, paragraph 97]
4320.18 An audit report on ICFR may be based, in part, on the work of another auditor when another auditor has audited the financial statements and ICFR of a subsidiary, division, branch or component of a company. The principal auditor should determine whether or not it will make reference in its report on ICFR to the audit of ICFR performed by another auditor. The auditor's decision to make reference or not is based on factors analogous to those in AU 1205 when a principal auditor decides to make reference to the report of another auditor when reporting on a company's financial statements. As a result, the decision to make reference to another auditor's report on ICFR may differ from the decision to make reference to another auditor in the principal auditor's report on the financial statements. When the auditor decides to make reference to the report of the other auditor in its report on ICFR, the principal auditor's report on ICFR should refer to the report of the other auditor when describing the scope of the audit and expressing an opinion on ICFR. [AS 2201, paragraphs C8-C11]
4320.19 If the auditor makes reference to another auditor's report on ICFR, the separate report of the other auditor on ICFR must also be included in the filing. [S-X 2-05]
4320.20 AS 6115 establishes requirements and provides guidance that apply when an auditor is engaged to report on whether a previously reported material weakness in internal control over financial reporting continues to exist as of a date specified by management.
4320.21 The auditor's objective in an engagement to report on whether a previously reported material weakness continues to exist is to obtain reasonable assurance about whether the previously reported material weakness exists as of a date specified by management and to express an opinion thereon. The auditor's opinion relates to the existence of a specifically identified material weakness as of a specified date and does not relate to the effectiveness of the company's ICFR overall.
This is a work of the U.S. Government
Link copied
