PCAOB AS 2201: Complete Guide to Auditing Internal Control Over Financial Reporting (ICFR)
How External Auditors Should Plan, Test, Evaluate, Document, and Report on Internal Controls Under PCAOB Auditing Standard 2201
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | PCAOB Auditing Standards | SOX 404 | COSO | 4 CPE Credits
Auditing internal control over financial reporting (ICFR) is one of the most demanding responsibilities facing external auditors of public companies.
An effective ICFR audit requires considerably more than reviewing a company's internal control documentation, examining policies, and testing whether employees completed approval procedures.
The auditor must understand how the organization identifies financial reporting risks, how management designs controls to address those risks, and whether those controls operate effectively.
The auditor must also evaluate whether identified control deficiencies, individually or in combination, represent material weaknesses.
PCAOB Auditing Standard 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, establishes the requirements for performing an integrated audit.
The standard requires a risk-based, top-down approach that begins with financial reporting risks and proceeds through entity-level controls, significant accounts and disclosures, relevant assertions, and the controls that address those risks.
The objective is not to test every control in the organization. It is to obtain reasonable assurance about whether material weaknesses in ICFR exist as of the date of management's assessment.
For external auditors, the challenge is selecting the right controls, performing appropriate tests, obtaining sufficient evidence, and reaching supportable conclusions.
Corporate Compliance Seminars (CCS) offers a focused, four-CPE-credit training event addressing these requirements.
1. What Is Internal Control Over Financial Reporting?
Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.
ICFR includes policies and procedures addressing the maintenance of records, authorization of transactions, and prevention or timely detection of unauthorized acquisition, use, or disposition of assets that could materially affect financial statements.
Management is responsible for establishing and maintaining effective ICFR.
The external auditor evaluates ICFR when engaged to perform an integrated audit.
The distinction is important.
Management owns the internal control framework.
The auditor independently evaluates the effectiveness of relevant controls.
The Audit Committee provides oversight of management's financial reporting responsibilities and the external audit.
2. What Does PCAOB AS 2201 Require?
AS 2201 establishes requirements for an audit of ICFR integrated with an audit of financial statements.
The auditor's objective is to express an opinion on the effectiveness of ICFR.
To support that opinion, the auditor must plan and perform the audit to obtain reasonable assurance about whether material weaknesses exist as of the specified assessment date.
A material weakness may exist even when the financial statements do not contain a material misstatement.
This is one of the most important concepts in AS 2201.
Two related audit opinions
In an integrated audit, the auditor evaluates:
Financial statements: Whether the financial statements are presented fairly, in all material respects, under the applicable financial reporting framework.
Internal control over financial reporting: Whether ICFR was effective as of the specified assessment date.
The audits are integrated because evidence obtained during one can inform the other.
However, the conclusions are distinct.
A company may have fairly presented financial statements while maintaining ineffective ICFR.
3. The Top-Down, Risk-Based Audit Approach
AS 2201 requires auditors to use a top-down approach when selecting controls for testing.
The approach begins with the financial statements and the overall risks to financial reporting.
The auditor then evaluates entity-level controls, identifies significant accounts and disclosures, determines relevant assertions, understands important business processes, and selects controls that sufficiently address the assessed risks.
The top-down process
Step 1: Identify financial statement-level risks.
Step 2: Evaluate relevant entity-level controls.
Step 3: Identify significant accounts and disclosures.
Step 4: Determine relevant financial statement assertions.
Step 5: Understand the flow of transactions through significant processes.
Step 6: Identify points where material misstatements could occur.
Step 7: Select controls that sufficiently address those risks.
Step 8: Test design and operating effectiveness.
This approach directs audit effort toward the controls that matter most.
It is not intended to be a mechanical checklist or a requirement to test every documented control.
Example
A company has $200 million in annual revenue.
The auditor identifies revenue recognition as an important financial reporting risk.
Rather than testing every control in the sales department, the auditor identifies the relevant assertions and determines where material misstatements could occur.
The auditor then selects controls addressing those risks.
These may include controls over contract approval, revenue recognition judgments, system interfaces, journal entries, and management review.
The specific controls selected depend on the company's processes and assessed risks.
4. Entity-Level Controls: The Foundation of ICFR
Entity-level controls influence the organization's overall financial reporting environment.
They may operate across multiple business processes, departments, and locations.
Examples include:
Board and Audit Committee oversight.
Management's commitment to ethical conduct.
Organizational structure and assignment of authority.
Financial reporting risk assessment.
Fraud risk assessment.
Management review of financial results.
Monitoring of internal control deficiencies.
Controls over management override.
Information technology governance.
Period-end financial reporting controls.
AS 2201 requires auditors to test entity-level controls important to their conclusion about ICFR effectiveness.
Why control precision matters
Some entity-level controls have an indirect effect on financial reporting.
Others monitor the effectiveness of more detailed controls.
Certain controls may operate at a level of precision sufficient to prevent or detect material misstatements.
For example, a CEO's general review of quarterly financial performance may help identify unusual business trends.
However, that review may not be sufficiently precise to detect a material misstatement in a particular account.
By contrast, a detailed management review of a significant accounting estimate may address a specific financial reporting risk if appropriately designed and performed.
Auditors must evaluate what each entity-level control actually accomplishes, not merely the seniority of the person performing it.
5. COSO's Five Components and 17 Principles
The COSO Internal Control–Integrated Framework is widely used by management and auditors to evaluate ICFR.
The framework includes five integrated components and 17 principles.
COSO component | Principles | ICFR audit considerations |
Control Environment | 1–5 | Integrity, oversight, authority, competence, accountability |
Risk Assessment | 6–9 | Objectives, financial reporting risks, fraud, significant changes |
Control Activities | 10–12 | Controls, technology, policies and procedures |
Information and Communication | 13–15 | Reliable information, internal communication, external communication |
Monitoring Activities | 16–17 | Ongoing evaluations, deficiency reporting, remediation |
Auditors should evaluate the relevant principles and controls based on the risks affecting financial reporting.
A company may have extensive written policies but still maintain ineffective ICFR if management does not enforce them.
Similarly, a control may be well designed but ineffective because it is performed inconsistently.
The auditor must obtain evidence supporting the conclusion.
6. Identifying Significant Accounts and Relevant Assertions
One of the most important planning judgments involves identifying significant accounts and disclosures.
AS 2201 requires auditors to evaluate quantitative and qualitative risk factors.
These may include:
Account size and composition.
Susceptibility to misstatement.
Transaction volume and complexity.
Exposure to losses.
Nature of the account.
Accounting and reporting complexity.
Changes in account characteristics.
Related-party transactions.
The auditor must then identify relevant assertions.
Common financial statement assertions
Assertion | Illustrative audit concern |
Existence or occurrence | Recorded transactions or assets may not exist |
Completeness | Transactions or liabilities may be omitted |
Valuation or allocation | Balances may be measured incorrectly |
Rights and obligations | Assets or liabilities may not belong to the entity |
Presentation and disclosure | Financial information may be classified or disclosed incorrectly |
The auditor should select controls that address the risks associated with relevant assertions.
An account may be significant even when its recorded balance is relatively small, particularly if qualitative risks are important.
7. Understanding Business Processes and Walkthroughs
Auditors must understand how significant transactions originate, are authorized, are processed, and are recorded in the financial statements.
Walkthroughs are an important method for developing this understanding.
A walkthrough generally traces a transaction through the relevant process, using inquiry, observation, inspection, and potentially reperformance.
Example: Procure-to-pay walkthrough
The auditor may trace a purchase from the initial requisition through vendor approval, purchase order issuance, receipt of goods, invoice processing, payment authorization, and general ledger posting.
The walkthrough should help identify points where material misstatements could occur and the controls management has established.
Important questions
Who initiates transactions?
Who authorizes them?
Which systems process the information?
What reconciliations are performed?
Where can unauthorized transactions enter the process?
How are errors identified and corrected?
Can management override established procedures?
Walkthroughs help the auditor understand process design.
However, performing a walkthrough does not automatically establish that controls operated effectively throughout the audit period.
8. Testing the Design Effectiveness of Controls
Design effectiveness concerns whether a control, if operated as prescribed by personnel possessing the necessary authority and competence, is capable of achieving its control objective.
The auditor should evaluate whether the control adequately addresses the identified risk.
Example: Journal entry approval
Risk: Unauthorized journal entries could materially misstate financial statements.
Control: Journal entries exceeding a specified threshold require independent approval before posting.
The auditor should evaluate whether the approval requirement appropriately addresses the risk.
Questions include:
Does the threshold capture potentially material entries?
Are all relevant journal entries subject to the control?
Is the reviewer independent of the preparer?
Does the reviewer possess appropriate competence?
Can privileged users bypass the approval process?
If the control is poorly designed, testing its operation will not establish that it effectively addresses the risk.
9. Testing Operating Effectiveness
Operating effectiveness addresses whether the control operated as designed during the relevant period.
The auditor must obtain sufficient appropriate evidence.
Common testing procedures include inquiry, observation, inspection, and reperformance.
Inquiry alone is not sufficient to establish operating effectiveness.
Example: Monthly account reconciliation
Suppose management requires monthly reconciliation of significant balance sheet accounts.
The auditor should determine:
Was the reconciliation prepared?
Was it prepared timely?
Was the underlying information reliable?
Did a qualified individual review it?
Were reconciling differences investigated?
Were necessary adjustments recorded?
Did the control operate consistently during the period?
The auditor's testing should reflect the risk associated with the control.
Controls addressing higher risks generally require more persuasive evidence.
10. Management Review Controls: A Major Audit Challenge
Management review controls are common in public companies.
Examples include:
Monthly financial statement reviews.
Budget-to-actual comparisons.
Revenue and gross margin analyses.
Reviews of accounting estimates.
Reviews of significant reconciliations.
Monitoring of unusual transactions.
However, these controls can be difficult to audit because the review may involve subjective judgments.
The precision problem
Management may state: "The CFO reviews the monthly financial statements."
That description does not explain how the review prevents or detects material misstatements.
The auditor should determine:
What information does the CFO review?
What expectations are used?
What thresholds trigger investigation?
How are unusual items identified?
What evidence demonstrates follow-up?
How does the reviewer determine whether explanations are reasonable?
A signature or electronic approval may demonstrate that someone acknowledged a report.
It does not necessarily establish that the review was sufficiently precise to address the relevant financial reporting risks.
11. Information Produced by the Entity
Many controls depend on reports generated by the company's information systems.
Examples include:
Accounts receivable aging reports.
Inventory valuation reports.
Journal entry exception reports.
Budget-to-actual comparisons.
Sales transaction reports.
Access rights reports.
Before relying on a control that uses company-generated information, the auditor must address the accuracy and completeness of that information as appropriate.
Example
A controller reviews an accounts receivable aging report to identify overdue balances.
However, the report excludes certain customer accounts because of an incorrect system filter.
The review may be ineffective even if the controller carefully examines every line presented.
The reliability of a management review control depends partly on the reliability of the information used in performing it.
Auditors should coordinate relevant testing with PCAOB AS 1105 and applicable information technology audit procedures.
12. Information Technology General Controls
Financial reporting processes increasingly depend on automated systems.
IT general controls may support the reliability of applications and automated controls.
Relevant areas include:
User access management.
Privileged access.
Program change management.
Computer operations.
System interfaces.
Data integrity.
Management of relevant third-party service providers.
The auditor should identify IT risks that could affect ICFR and determine which IT controls require testing.
Not every cybersecurity control is relevant to the ICFR audit.
The focus should remain on technology risks that could affect the reliability of financial reporting.
13. Fraud Risk and Management Override
Management override is a particularly important risk in financial reporting.
Senior executives may possess authority to bypass established controls.
Potential examples include:
Unauthorized journal entries.
Manipulation of accounting estimates.
Improper revenue recognition.
Concealment of liabilities.
Undisclosed related-party transactions.
Improper adjustments to financial results.
The auditor should evaluate relevant controls addressing management override and consider the implications of fraud risks under applicable PCAOB standards.
Example
A company requires independent approval of manual journal entries.
However, the CFO has system privileges allowing journal entries to be posted without approval.
The auditor should determine whether the system access creates a control deficiency and whether other controls adequately address the risk.
Management override risks cannot be dismissed merely because senior management has signed a Code of Conduct.
14. Evaluating Control Deficiencies
AS 2201 requires the auditor to evaluate identified control deficiencies.
The severity of a deficiency depends on the likelihood and potential magnitude of a misstatement that the control may fail to prevent or detect.
The auditor must consider deficiencies individually and in combination.
Control deficiency
A deficiency in the design or operation of internal control.
Significant deficiency
A deficiency less severe than a material weakness but important enough to merit attention by those responsible for oversight of financial reporting.
Material weakness
A deficiency, or combination of deficiencies, that creates a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.
Important principle
The severity of a deficiency does not depend solely on whether an actual misstatement occurred.
A material weakness can exist even if the financial statements are fairly presented.
This is particularly important when auditors identify deficiencies in controls over significant estimates, journal entries, or financial reporting.
15. Indicators of Material Weaknesses
AS 2201 identifies several indicators of material weaknesses.
These include:
Fraud by senior management, whether or not material.
Restatement of previously issued financial statements to correct a material misstatement.
Identification by the auditor of a current-period material misstatement that the company's ICFR would not have detected.
Ineffective Audit Committee oversight of external financial reporting and ICFR.
These indicators require careful evaluation.
The auditor should consider all relevant facts and circumstances when determining the effect on the ICFR opinion.
The existence of compensating controls may also affect the evaluation, provided those controls operate at sufficient precision.
16. Evaluating Compensating Controls
A compensating control may mitigate the risk created by another deficient control.
However, not every review or monitoring activity qualifies as an effective compensating control.
Example
A company lacks segregation of duties in accounts payable.
Management states that the CFO reviews monthly expense totals.
Does this compensate for the deficiency?
Not necessarily.
The review may be too broad to identify unauthorized vendor payments.
The auditor must evaluate whether the compensating control operates at a level of precision sufficient to prevent or detect a potentially material misstatement.
A general management review should not automatically be accepted as a compensating control.
17. Audit Committee Oversight and ICFR
The Audit Committee plays an important role in overseeing financial reporting and the external audit.
Auditors should evaluate relevant aspects of Audit Committee oversight as part of the company's control environment.
Potential concerns include:
Failure to receive significant financial reporting information.
Inadequate oversight of material accounting judgments.
Failure to address significant control deficiencies.
Management interference with auditor communications.
Insufficient attention to significant financial reporting risks.
Ineffective Audit Committee oversight is an indicator of a material weakness under AS 2201.
This reinforces the importance of governance as part of ICFR.
18. Documentation Requirements
A well-executed ICFR audit requires appropriate workpaper documentation.
The audit file should support the auditor's understanding of the company, identified risks, selected controls, testing procedures, results, and conclusions.
Important ICFR workpapers
Workpaper | Purpose |
ICFR planning memorandum | Document overall audit approach |
Financial reporting risk assessment | Identify significant risks |
Entity-level control evaluation | Assess governance and organization-wide controls |
Significant account matrix | Identify significant accounts and relevant assertions |
Process narratives and flowcharts | Document transaction flows |
Walkthrough documentation | Support process understanding |
Risk-control matrix | Connect risks, assertions, and controls |
Control testing workpapers | Document procedures and results |
IT control evaluation | Address relevant technology risks |
Deficiency evaluation memorandum | Support severity assessments |
ICFR conclusion memorandum | Support the overall opinion |
Audit Committee communications | Document required communications |
Workpapers should demonstrate the nature, timing, and extent of procedures performed.
They should also support the conclusions reached.
Documentation should comply with applicable PCAOB requirements, including AS 1215.
19. Integrating ICFR Testing With the Financial Statement Audit
An integrated audit allows the auditor to coordinate financial statement and internal control procedures.
Control testing may provide evidence relevant to the assessment of control risk.
Substantive procedures may identify misstatements that indicate potential control deficiencies.
However, the auditor must satisfy the objectives of both audits.
Example
The auditor identifies a material misstatement in revenue.
Management records an adjustment.
The auditor must evaluate the effect on the financial statements.
The auditor must also consider whether the misstatement indicates that ICFR failed to prevent or detect a material error.
Correcting the financial statements does not automatically correct the underlying control deficiency.
20. Reporting on ICFR
At the conclusion of an integrated audit, the auditor must evaluate the evidence and determine the appropriate ICFR opinion.
An unqualified ICFR opinion indicates that the company maintained effective ICFR, in all material respects, as of the specified date, based on the applicable control framework.
If one or more material weaknesses exist, the auditor must express an adverse opinion on ICFR, assuming sufficient appropriate evidence has been obtained.
A scope limitation may require a different reporting response under the applicable requirements.
The auditor should also satisfy the requirements for communicating identified deficiencies to management and the Audit Committee.
Important distinction
An adverse ICFR opinion does not automatically mean the financial statements are materially misstated.
The auditor must evaluate and report on the financial statements separately under the applicable standards.
21. Common ICFR Audit Mistakes
Several practices can undermine audit quality:
Testing too many controls: Selecting controls without connecting them to significant financial reporting risks.
Testing too few controls: Failing to identify controls necessary to address relevant assertions.
Overreliance on inquiry: Accepting management explanations without sufficient corroborating evidence.
Weak management review testing: Failing to evaluate precision, investigation thresholds, and follow-up.
Inadequate IT consideration: Overlooking technology risks that affect automated controls or financial reporting information.
Incomplete deficiency evaluation: Assessing control failures individually without considering their combined effect.
Weak documentation: Failing to explain the basis for important audit judgments.
Insufficient entity-level control evaluation: Overlooking governance and management override risks.
Improper reliance on compensating controls: Accepting broad reviews that cannot detect potentially material misstatements.
These weaknesses can result in unsupported conclusions and potential PCAOB inspection findings.
22. Using Artificial Intelligence in ICFR Audits
Artificial intelligence can assist audit teams with organizing documentation, developing risk-control matrices, analyzing process descriptions, and identifying potential gaps.
Example: COSO mapping
Review the documented entity-level controls and map them to the five COSO components and 17 principles. Identify gaps requiring further audit investigation. Do not assume operating effectiveness based solely on control descriptions.
Example: Risk-control matrix
Analyze this revenue process narrative. Identify potential risks of material misstatement, relevant assertions, and controls that may address those risks. Distinguish existing documented controls from proposed controls.
Example: Control testing
Develop preliminary design and operating effectiveness testing procedures for this management review control. Address review precision, information reliability, investigation thresholds, and evidence of follow-up.
Example: Deficiency evaluation
Organize the evidence concerning these identified control deficiencies. Identify facts relevant to likelihood, potential magnitude, compensating controls, and aggregation. Do not assign a final severity classification without sufficient evidence.
AI can improve efficiency and help auditors identify matters requiring attention.
However, auditors remain responsible for validating information, obtaining appropriate evidence, protecting confidential client data, and exercising professional judgment.
23. An Important AS 2201 Update Effective December 15, 2026
The PCAOB has adopted an amendment to AS 2201 that becomes effective December 15, 2026.
The amendment affects paragraph .09 concerning planning the audit and adds paragraph .99.
Auditors should review the amended standard and its applicability to their engagements rather than assuming that prior-year planning templates fully reflect the requirements.
This is an important reason for audit firms to periodically update their PCAOB training and engagement methodologies.
24. A Practical ICFR Audit Completion Checklist
Before concluding an integrated audit, the engagement team should evaluate whether it has:
Properly planned and supervised the ICFR audit.
Identified relevant financial reporting risks.
Applied the required top-down approach.
Evaluated important entity-level controls.
Identified significant accounts and disclosures.
Determined relevant assertions.
Understood significant transaction processes.
Selected controls addressing assessed risks.
Evaluated design effectiveness.
Tested operating effectiveness.
Addressed relevant IT risks.
Evaluated management review control precision.
Considered fraud and management override.
Evaluated deficiencies individually and in combination.
Assessed relevant compensating controls.
Communicated deficiencies as required.
Documented significant audit judgments.
Obtained sufficient appropriate evidence to support the ICFR opinion.
This checklist is a practical planning and completion aid, not a substitute for the complete PCAOB requirements.
CCS CPE Training: PCAOB AS 2201 — An Audit of ICFR
Earn 4 CPE Credits and Strengthen Your ICFR Audit Skills
Corporate Compliance Seminars offers a focused four-CPE-credit webinar covering the requirements and practical application of PCAOB AS 2201.
The event is designed to help external auditors, internal auditors, and compliance professionals improve their understanding of ICFR audit planning, risk assessment, control testing, and documentation.
What participants will learn
The CCS program addresses:
PCAOB AS 2201 requirements: Understand the standard and its application to integrated audits.
The top-down approach: Learn how to identify significant financial reporting risks and select relevant controls.
COSO and COBIT frameworks: Examine the frameworks and their application to ICFR and related technology controls.
Entity-level controls: Understand how governance and organization-wide controls affect financial reporting risks.
Testing key controls: Explore design effectiveness, operating effectiveness, and control testing methods.
Audit documentation: Improve workpapers and support for significant audit conclusions.
Fraud risk: Examine how internal controls address fraud and management override.
PCAOB guidance: Review relevant PCAOB requirements and guidance affecting ICFR audits.
Event Details
Course information | Details |
Course | PCAOB AS 2201: An Audit of ICFR |
CPE credits | 4 |
Registration fee | $280 per participant |
Format | Live, Group Internet-Based |
Schedule | Tuesdays, 10:00 a.m.–2:30 p.m. Central Time |
Frequency | Approximately every eight weeks |
Fields of study | Auditing and Information Technology |
Program level | Basic |
Prerequisites | None |
Advance preparation | None |
Private training | Available for groups of two or more participants |
Select an available session date on the CCS registration page.
Who should attend?
External auditors: Strengthen integrated audit planning, control testing, and ICFR reporting skills.
Audit partners and managers: Improve engagement methodology, risk assessment, supervision, and audit documentation.
Audit seniors and staff: Develop practical skills for identifying, testing, and documenting key controls.
Internal auditors: Better understand ICFR requirements and the relationship between management controls and external audit procedures.
Compliance and SOX professionals: Strengthen knowledge of COSO, entity-level controls, and financial reporting risk management.
Register for the PCAOB AS 2201 CPE Event
Why Choose Corporate Compliance Seminars?
Corporate Compliance Seminars specializes in practical CPE training for accounting, auditing, internal control, and compliance professionals.
Our PCAOB programs focus on applying auditing standards to actual engagement responsibilities.
The AS 2201 event connects the requirements of the standard with risk assessment, COSO, entity-level controls, control testing, workpaper documentation, and audit quality.
For CPA firms performing integrated audits, this knowledge is essential to developing supportable ICFR opinions and improving engagement execution.
Conclusion: Effective ICFR Auditing Requires More Than Control Checklists
PCAOB AS 2201 establishes a disciplined framework for evaluating internal control over financial reporting.
The auditor must understand the company's financial reporting risks, evaluate relevant entity-level controls, identify significant accounts and assertions, select appropriate controls, and obtain sufficient evidence of design and operating effectiveness.
The auditor must also evaluate control deficiencies and determine whether material weaknesses exist.
These responsibilities require technical knowledge, professional skepticism, sound judgment, and appropriate documentation.
The objective of an ICFR audit is not to demonstrate that the company has numerous controls. It is to determine whether the controls that matter are effective in preventing or detecting material financial reporting misstatements.
Corporate Compliance Seminars' PCAOB AS 2201: An Audit of ICFR event provides four CPE credits of focused training to help professionals develop these skills.
Corporate Compliance Seminars — Professional CPE Training in PCAOB Auditing Standards, COSO, ICFR, Audit Evidence, Internal Controls, and Audit Quality.
Comments