PCAOB 4: Reporting on Whether a Previously Reported Material Weakness Continues to Exist1
EFFECTIVE DATE AND APPLICABILITY
| Effective Date | This standard currently is effective. |
| Applicability | Engagements designed specifically to test for the continuing presence of previously reported material weaknesses. |
DEFINITIONS OF TERMS
Control objective. Provides a specific target for the evaluation of the effectiveness of controls. When used in relation to controls over financial reporting, it states a criterion for evaluating whether an entity’s control procedures provide reasonable assurance that a misstatement to or omission in that assertion is prevented or detected by controls on a timely basis.
Stated control objective. The specific control objective identified by management that, if achieved, would result in a material weakness no longer existing.
OBJECTIVES OF PCAOB STANDARD 4
Public Company Accounting Oversight Board (PCAOB) Auditing Standard 4 sets forth the general requirements for an auditor who is engaged to report on whether a previously reported material weakness in internal control over financial reporting continues to exist.
FUNDAMENTAL REQUIREMENTS
Basic Requirement
An auditor may report on whether a previously reported material weakness continues to exist if the auditor has audited the company’s financial statements and internal control over financial reporting in accordance with PCAOB Standard 5 either during the entity’s most recent annual assessment or in the current year. This is a voluntary auditor engagement by the entity, since the PCAOB does not require an auditor to undertake an engagement specifically to report on whether a previously reported material weakness continues to exist.
The auditor’s objective in this engagement is to obtain reasonable assurance about and report on the continued existence of a previously reported material weakness. This opinion relates only to the specific material weakness in question as of a specified date. Thus, the auditor is not expressing an opinion on the effectiveness of an entity’s overall system of internal control over financial reporting.
To obtain a reasonable level of assurance, the auditor should obtain evidence about whether the specific controls designed for a stated control objective were designed correctly and operate effectively.
The auditor may only report on this topic if management agrees to the following five conditions:
The stated control objective provides a specific target against which to evaluate whether a material weakness continues to exist, so management and the auditor must be satisfied that the material weakness would no longer exist if the stated control objective were achieved. However, if management and the auditor cannot identify all of the stated control objectives affected by a material weakness, then the weakness is probably not suitable for this engagement; instead, it would be better to address the issue through the auditor’s annual audit of internal control over financial reporting under PCAOB Standard 5.
Framework for Evaluation
Management and the auditor must use both the same control criteria used for the company’s most recent annual assessment of internal control over financial reporting and the company’s stated control objectives to evaluate whether a material weakness continues to exist.
When auditing internal control over financial reporting, the auditor should test the design effectiveness of controls by determining whether the company’s controls, if they are operated as prescribed by those people possessing the authority and competence to perform the controls effectively, satisfy the company’s control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements in the financial statements.
Performing the Engagement
In this engagement, the auditor must obtain sufficient competent evidence about the design and operating effectiveness of specific controls to obtain a reasonable assurance that the company’s stated control objective is achieved. While doing so, the auditor must adhere to the engagement standards of the PCAOB, which involve:
The person performing the engagement must have adequate training and proficiency as an auditor. In matters related to the engagement, the auditor must maintain an independence in mental attitude, and exercise due professional care in performing the engagement and preparing the report. Further, the auditor must have a sufficient knowledge of the company and its internal control over financial reporting. An auditor who has audited the entity’s internal control over financial reporting in accordance with PCAOB Standard 5 for the entity’s most recent annual assessment should have sufficient knowledge in this area.
If the auditor is a successor auditor, then he or she must perform procedures to obtain a sufficient knowledge of the company’s business and its internal control over financial reporting to achieve the objective of the engagement. These procedures include:
- Compliance with paragraphs 22–27 of PCAOB Standard 5 regarding obtaining an understanding of internal control over financial reporting. The more pervasive the effects of the material weakness, the more extensive the understanding of internal control over financial reporting should be. The entity-level controls noted in paragraphs 22–27 include controls related to the:
- Control environment (i.e., management operating style, ethical values, and audit committee oversight)
- Management override
- Risk assessment process
- Centralized processing
- Monitoring of the results of operations
- Monitoring of other controls
- Period-end financial reporting process (i.e., procedures for transactions and journal entries, as well as record adjustments)
- Compliance with paragraphs 34–38 of PCAOB Standard 5 for those transactions directly affected by controls specifically identified by management as addressing the material weakness. The issues noted in paragraphs 34–38 include obtaining an understanding of the likely sources of misstatements, which can include process walk-throughs.
- Make inquiries of the predecessor auditor that address the basis for the predecessor auditor’s determination that a material weakness existed in the entity’s internal control over financial reporting and the predecessor auditor’s awareness of any information relating to the entity’s ability to successfully address the material weakness.
The successor auditor may not be able to obtain a sufficient basis for reporting on whether a previously reported material weakness continues to exist without performing a complete audit of internal control over financial reporting (as governed by PCAOB Standard 5).
Evaluating Whether a Material Weakness Still Exists
If the auditor finds that management cannot support its assertion with sufficient evidence, then he or she cannot complete the engagement.
The auditor should determine if management is using an appropriate date for its assertion. This date is based on the following factors:
- It can be as of any date that gives management time to obtain sufficient evidence to support its assertion.
- It may need to be after the completion of a period-end financial reporting process, depending on the nature of the material weakness.
- It is more flexibly determined for those controls that operate on a nearly continuous basis.
- It can only be dated near a period-end for those controls that operate during the period-end financial reporting process.
The auditor should obtain sufficient evidence to support his or her opinion regarding the continued existence of the material weakness. To this end, all controls necessary to achieve the stated control objective should be identified and evaluated. The controls should include those that have been modified or newly implemented, and may include existing controls that were originally deemed effective during the most recent annual assessment of internal control over financial reporting.
The auditor should test the operating effectiveness of a specified control by determining whether the specified control operated as designed, and whether the person performing the control possesses the authority and qualifications to perform it effectively.
The duration of controls testing should be adequate to determine whether the controls are operating effectively as of the date of management’s assertion. The duration of controls testing will extend with the level of risk, such that a daily transaction reconciliation can be tested quickly, while a control over management override may require considerably more time to test.
Using the Work of Others
The auditor should evaluate whether it is possible to use the work of others in the evaluation. Key factors in this determination are the competence and objectivity of the persons whose work the auditor plans to use, as well as the risk associated with the control. For high-risk controls, the auditor should be more inclined to perform his or her own work. Also, the auditor should perform any walkthroughs himself or herself because of the degree of judgment required in performing this work.
The work of others includes relevant work performed by internal auditors, company personnel (in addition to internal auditors), and third parties working under the direction of management or the audit committee that provide information about the effectiveness of internal control over financial reporting.
If the auditor decides to serve as the principal auditor and to use the work and reports of another auditor as a basis, in part, for his or her opinion, the principal auditor must not divide responsibility for the engagement with the other auditor. Thus, the principal auditor must not make reference to the other auditor in his or her report.
Scope Limitations
The auditor may only issue an opinion when there is no restriction on the scope of his or her work. If there is a scope limitation, then the auditor must either disclaim an opinion or withdraw from the engagement. A qualified opinion is not permitted.
The refusal of management to provide written representations is a scope limitation, and is discussed in the following section.
Management Representations
The auditor should obtain the following written representations from management:
- Acknowledge its responsibility for establishing and maintaining effective internal control over financial reporting;
- State that it has evaluated the effectiveness of the specified controls, using the specified control criteria and management’s stated control objective(s);
- State its assertion that the specified controls are effective in achieving the stated control objective(s) as of a specified date;
- State its assertion that the identified material weakness no longer exists as of the same specified date;
- State that it believes its assertions are supported by sufficient evidence;
- Describe any fraud resulting in a material misstatement to the company’s financial statements, and any other fraud that does not result in a misstatement in the company’s financial statements but involves senior management, management, or other employees who have a significant role in the company’s internal control over financial reporting, and that has occurred or come to management’s attention since the date of management’s most recent annual assessment of internal control over financial reporting.
- State whether there were, subsequent to the report date, any changes in internal control over financial reporting or other factors that might significantly affect the stated control objective(s) or indicate that the identified controls were not operating effectively as of, or subsequent to, the date specified in management’s assertion.
The written representations should be signed by those managers having overall responsibility for the company’s internal control over financial reporting, and who are responsible for the matters covered by the representations. The most applicable managers would ordinarily be the chief executive officer and the chief financial officer.
If management does not supply written representations, this is a scope limitation. Scope limitations were discussed in the preceding “Scope Limitations” section.
If management refuses to provide written representations, the auditor should evaluate the effects of this refusal on his or her reliance on other management representations, including any representations obtained as part of the audit of the company’s financial statements.
Management’s Report
Management must present a written report that will accompany the auditor’s report. The management report should include the following items:
- A statement of management’s responsibility for establishing and maintaining effective internal control over financial reporting for the company;
- A statement identifying the control criteria used by management to conduct the required annual assessment of the effectiveness of the company’s internal control over financial reporting;
- An identification of the material weakness that was identified as part of management’s annual assessment (which should be modified when only the auditor’s report on management’s annual assessment identified the material weakness);
- An identification of the control objective(s) addressed by the specified controls and a statement that the specified controls achieve the stated control objectives(s) as of a specified date; and
- A statement that the identified material weakness no longer exists as of the same specified date because the specified controls address the material weakness.
The auditor must evaluate management’s report. In particular, the auditor should evaluate the following issues:
- Whether management has properly stated its responsibility for establishing and maintaining effective internal control over financial reporting;
- Whether the control criteria used by management to conduct the evaluation is suitable;
- Whether the material weakness, stated control objectives, and specified controls have been properly described; and
- Whether management’s assertions, as of the date specified in management’s report, are free of material misstatement.
If the auditor evaluates management’s report and determines that it does not include the specified elements, the conditions for engagement performance have not been met.
The Auditor’s Report
The auditor’s report must include the following elements:
- A title that includes the word independent;
- A statement that the auditor has previously audited and reported on management’s annual assessment of internal control over financial reporting as of a specified date based on the control criteria, as well as a statement that the auditor’s report identified a material weakness;
- A description of the material weakness;
- An identification of management’s assertion that the identified material weakness in internal control over financial reporting no longer exists;
- An identification of the management report that includes management’s assertion, such as identifying the title of the report (if the report is titled);
- A statement that management is responsible for its assertion;
- An identification of the specific controls that management asserts address the material weakness;
- An identification of the company’s stated control objective that is achieved by these controls;
- A statement that the auditor’s responsibility is to express an opinion on whether the material weakness continues to exist as of the date of management’s assertion based on his or her auditing procedures;
- A statement that the engagement was conducted in accordance with the standards of the PCAOB (United States);
- A statement that the standards of the PCAOB require that the auditor plan and perform the engagement to obtain reasonable assurance about whether a previously reported material weakness continues to exist at the company;
- A statement that the engagement includes examining evidence supporting management’s assertion and performing such other procedures the auditor considered necessary in the circumstances, and that the auditor obtained an understanding of internal control over financial reporting as part of his or her previous audit of management’s annual assessment of internal control over financial reporting and updated that understanding as it specifically relates to changes in internal control over financial reporting associated with the material weakness;
- A statement that the auditor believes the auditing procedures provide a reasonable basis for his or her opinion;
- The auditor’s opinion on whether the identified material weakness exists (or no longer exists) as of the date of management’s assertion;
- A paragraph that includes the following statements:
- That the auditor was not engaged to and did not conduct an audit of internal control over financial reporting as of the date of management’s assertion, the objective of which would be the expression of an opinion on the effectiveness of internal control over financial reporting, and that the auditor does not express such an opinion, and
- That the auditor has not applied auditing procedures sufficient to reach conclusions about the effectiveness of any controls of the company as of any date after the date of management’s annual assessment of the company’s internal control over financial reporting, other than the controls specifically identified in the auditor’s report, and that the auditor does not express an opinion that any other controls operated effectively after the date of management’s annual assessment of the company’s internal control over financial reporting.
- A paragraph stating that, because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements and that projections of any evaluation of the effectiveness of specific controls or internal control over financial reporting overall to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate;
- The manual or printed signature of the auditor’s firm;
- The city and state (or city and country, in the case of non-US auditors) from which the auditor’s report has been issued; and
- The date of the auditor’s report.
The auditor should modify the standard report if any of the following conditions exist:
- Other material weaknesses that were reported previously by the company as part of its annual assessment of internal control are not addressed by the auditor’s opinion.
- A significant subsequent event has occurred since the date being reported on.
- Management’s report on whether a material weakness continues to exist includes additional information.
If the auditor reports on fewer than all of the entity’s previously reported material weaknesses, the auditor should include language in the paragraph stating that the auditor was not engaged to perform an audit of internal control over financial reporting. When referring to his or her previously issued report on management’s annual assessment, the auditor should either attach that report or include information about where it can be publicly obtained. Sample language follows:
Our report on management’s annual assessment of ABC Company’s internal control over financial reporting, dated [date of report], [attached or identify location of where the report is publicly available] identified additional material weaknesses other than the one identified in this report. We are not reporting on those other material weaknesses and, accordingly, express no opinion regarding whether those material weaknesses continue to exist after [date of management’s annual assessment].
If management’s report includes additional information beyond that itemized previously in the Management’s Report section, the auditor should disclaim an opinion on the additional information. Sample disclaimer language to include in the last paragraph of the report is:
We do not express an opinion or any other form of assurance on management’s statement referring to its plans to implement new controls by the end of the year.
If the auditor believes that management’s additional information contains material misstatements, he or she should discuss the issue with management. If the auditor then believes that there is still a material misstatement, he or she should notify management and the audit committee, in writing, of the auditor’s views concerning the information.
If the auditor determines that the previously reported material weakness continues to exist and the auditor reports on the results of the engagement, he or she must express an opinion that the material weakness exists as of the date specified by management.
If the auditor were engaged to report on whether two separate material weaknesses continue to exist and concluded that one no longer exists and one continues to exist, the auditor’s report could include either of the following:
If the auditor does not issue a report, he or she must still communicate, in writing, his or her conclusion that the material weakness continues to exist to the audit committee. Also, if the auditor identifies a new material weakness during the engagement, this new circumstance must also be communicated in writing to the audit committee.
Several examples of the auditor’s report are included in the “Illustrations” section.
Report Date
Management’s assertion that a material weakness no longer exists does not need to be made as of a period-end financial reporting date. Thus, the auditor’s report related to this issue does not have to be associated with the issuance of the entity’s financial statements; the report release date is the date when the auditor grants permission to use the auditor’s report.
Subsequent Events
A variety of factors may significantly affect the effectiveness of identified controls, or the achievement of the entity’s stated control objective might occur subsequent to the date of management’s assertion but before the date of the auditor’s report. Therefore, the auditor should inquire of management whether there was any such change or factors. In addition, the auditor should examine, during this subsequent period, the following items:
- Internal audit reports relevant to the stated control objective or identified controls issued during the subsequent period;
- Independent auditor reports (if other than the auditor’s) of significant deficiencies or material weaknesses relevant to the stated control objective or identified controls;
- Regulatory agency reports on the entity’s internal control over financial reporting relevant to the stated control objective or identified controls; and
- Information about the effectiveness of the company’s internal control over financial reporting relevant to the stated control objective or identified controls obtained as a result of other engagements.
If the auditor is unable to determine the effect of a subsequent event on the effectiveness of the identified controls or the achievement of the stated control objective, the auditor should disclaim an opinion.
Impact on Quarterly Disclosures
If the auditor concludes that a previously reported material weakness continues to exist, the auditor must consider that conclusion as part of his or her evaluation of management’s quarterly disclosures about internal control over financial reporting, as discussed further in PCAOB Standard 5.
TECHNIQUES FOR APPLICATION
The following table includes examples of control objectives and the assertions related to them:
| Control Objectives | Assertions |
| Recorded sales of product X initiated on the company’s website are real | Existence or occurrence |
| Product X warranty losses that are probable and can be reasonably estimated are recorded as of the company’s quarterly financial statement period-ends | Completeness |
| Interest rate swaps are recorded at fair value | Valuation or allocation |
| The company has legal title to recorded product X inventory in the company’s Alabama warehouse | Rights and obligations |
| Pending litigation that is reasonably possible to result in a material loss is disclosed in the quarterly and annual financial statements | Presentation and disclosure |
ILLUSTRATIONS
The following are illustrations of reports on whether a previously reported material weakness continues to exist. They are adapted from PCAOB Standard 4.
1 Practitioners should reference the additional guidance listed in the section “Other PCAOB Guidance” in this volume’s chapter PCAOB 1.