PCAOB AS 2201: Why Auditing Internal Control Over Financial Reporting Remains One of the Biggest Challenges for External Auditors
Learn the Top-Down, Risk-Based Approach to ICFR Auditing with Corporate Compliance Seminars
A public company can produce materially correct financial statements and still have a serious internal control problem.
That distinction sits at the heart of PCAOB Auditing Standard AS 2201 — An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.
The external auditor is not simply asking:
“Are the financial statements materially correct?”
In an integrated audit, the auditor must also determine whether the company maintained, in all material respects, effective internal control over financial reporting (ICFR) as of the assessment date. PCAOB AS 2201 establishes the requirements for that work.
That requires much more than checking whether management has documented controls.
Auditors must understand risk, identify the controls that matter, evaluate design effectiveness, test operating effectiveness, assess deficiencies and obtain sufficient evidence to support the ICFR opinion.
Corporate Compliance Seminars developed its PCAOB Auditing Standard 2201: An Audit of ICFR CPE webinar to help auditors develop those practical skills.
The live webinar provides 4 NASBA-approved CPE credits and concentrates on the areas where auditors need to exercise judgment rather than simply follow a checklist.
PCAOB AS 2201 Is About Risk—not the Number of Controls Tested
One of the most important concepts in AS 2201 is the top-down approach.
The auditor does not begin at the bottom of the organization and test every control management has documented.
The process begins at the financial-statement level.
The auditor moves from:
Financial Statements
↓
Significant Accounts and Disclosures
↓
Relevant Assertions
↓
Risks of Material Misstatement
↓
Entity-Level Controls
↓
Processes and Transactions
↓
Controls Addressing the Identified Risks
↓
Controls Selected for Testing
This is fundamentally different from a control-based approach in which the auditor starts with management's inventory of controls.
AS 2201 says the auditor should test the controls that are important to the auditor's conclusion about whether the company's controls sufficiently address the assessed risk of misstatement to each relevant assertion. It specifically states that auditors do not need to test every control or redundant controls unless redundancy itself is a control objective.
That makes risk assessment the foundation of the entire ICFR audit.
Stop Asking “What Controls Does Management Have?”
A better question is:
“What could cause a material misstatement, and what controls prevent or detect it?”
Consider revenue.
Management might provide an auditor with 25 documented revenue controls.
That does not mean the auditor should test all 25.
The auditor first needs to understand the risks associated with relevant assertions such as:
Occurrence
Completeness
Accuracy
Cutoff
Classification
The auditor can then determine which controls, individually or in combination, sufficiently address those risks.
This is where experienced auditors distinguish themselves from checklist auditors.
More control testing does not necessarily produce a better audit.
Testing the right controls does.
Entity-Level Controls Matter
AS 2201 specifically requires auditors to test entity-level controls that are important to the auditor's ICFR conclusion.
These can include controls associated with:
Control environment
Management philosophy
Board oversight
Audit Committee oversight
Risk assessment
Ethics
Fraud-risk management
Financial reporting oversight
Monitoring
Corrective action
The CCS course therefore spends significant time examining entity-level controls and their relationship to organizational risk.
Why?
Because transaction controls do not operate in isolation.
Suppose a company has excellent accounts-payable controls.
Purchase orders require authorization.
Receiving is documented.
Invoices are matched.
Payments require approval.
But senior executives routinely override established procedures.
That changes the auditor's risk assessment.
The auditor cannot evaluate transaction-level controls without understanding the environment in which those controls operate.
COSO Provides the Internal Control Architecture
Most public companies use the COSO Internal Control—Integrated Framework as the framework underlying their assessment of ICFR.
CCS therefore incorporates the COSO Framework and its 17 principles into the AS 2201 program, along with discussion of COBIT for technology controls.
Auditors need to understand the interaction among:
Control Environment
Risk Assessment
Control Activities
Information and Communication
Monitoring Activities
The key word is interaction.
COSO is not simply five boxes on a PowerPoint slide.
It is a quality control system.
The external auditor needs to determine whether the company's system of internal control provides reasonable assurance regarding reliable financial reporting.
Walkthroughs Are One of the Auditor's Most Important Tools
A walkthrough should never become an annual ritual in which the auditor opens last year's narrative and asks:
“Has anything changed?”
AS 2201 describes a much more substantive process.
During a walkthrough, the auditor follows a transaction from its origination through the company's processes and information systems until it reaches the financial records. Walkthrough procedures ordinarily combine inquiry, observation, inspection and reperformance.
The standard also emphasizes probing questions.
That is critical.
Suppose the auditor is performing a Procure-to-Pay walkthrough.
Instead of asking:
“Are invoices approved before payment?”
ask:
“Show me the last invoice you approved.”
Then:
“What exactly did you review?”
“What would cause you to reject an invoice?”
“What happens when the purchase order doesn't match?”
“Who can override the exception?”
“How would you know if the vendor's banking information had recently changed?”
“Show me the evidence.”
Now the auditor is beginning to understand the control.
Design Effectiveness Comes Before Operating Effectiveness
This distinction is fundamental to PCAOB Auditing Standard 2201.
Design Effectiveness
The auditor determines whether the control, if operated as prescribed by people possessing appropriate authority and competence, satisfies the control objective and can effectively prevent or detect errors or fraud capable of producing a material misstatement.
In simpler terms:
Could this control actually work?
Operating Effectiveness
The auditor then determines whether the control actually operated as designed and whether the person performing it possessed the necessary authority and competence.
In simpler terms:
Did it actually work?
This sequence matters.
There is little value in selecting 25 samples to demonstrate that a poorly designed control operated exactly as designed.
Don't Test the Signature—Test the Review
Consider a management review control:
“The Controller reviews the monthly financial results.”
The auditor obtains twelve spreadsheets.
Each contains the Controller's initials.
Did the control operate effectively?
Not necessarily.
The initials may establish that the Controller touched the document.
They do not establish what the Controller did.
The auditor should understand:
What information was reviewed?
What constituted an unusual variance?
At what threshold did the Controller investigate?
How precise was the review?
What exceptions were identified?
What follow-up occurred?
Was the underlying information complete and accurate?
Was resolution documented?
This is one of the most important practical distinctions in ICFR auditing.
Evidence that a review occurred is not necessarily evidence that an effective review occurred.
Inquiry Alone Isn't Enough
AS 2201 identifies four principal procedures for testing controls, generally progressing from less persuasive to more persuasive evidence:
Inquiry → Observation → Inspection → Reperformance
The PCAOB explicitly states that inquiry alone does not provide sufficient evidence to support a conclusion about control effectiveness.
Management saying:
“Yes, we perform that control every month.”
is evidence.
But it is not enough.
The auditor must corroborate.
That may involve:
Observing the control
Examining documentation
Inspecting electronic evidence
Reviewing exception resolution
Reperforming aspects of the control
The nature, timing and extent of testing should respond to the risk associated with the control.
The Auditor Must Evaluate the Control Owner
A control does not operate independently.
A person—or increasingly a combination of people and technology—performs it.
PCAOB AS 2201 therefore requires the auditor to consider whether the person performing the control possesses the necessary authority and competence.
Suppose a junior accountant is responsible for reviewing a highly complex valuation model.
The accountant signs the review every quarter.
The signatures are present.
The review happened.
But did the reviewer possess sufficient competence to identify a material error?
That is an PCAOB AS 2201 question.
Information Used in Controls Can Become the Weak Link
Modern controls depend heavily on information.
A Controller may review a revenue report.
A Treasury Manager may review a bank reconciliation.
A security administrator may review a user-access report.
A CFO may review a financial dashboard.
But if the information is incomplete or inaccurate, the effectiveness of the review can be compromised.
The auditor therefore needs to understand:
Where the information originated
Whether the population is complete
Whether calculations are accurate
Which report parameters were used
Whether users can alter the information
Whether relevant IT controls are effective
This is where ICFR auditing increasingly intersects with information technology auditing.
It is also why the CCS program incorporates both COSO and COBIT concepts and carries CPE fields of study in Auditing and Information Technology.
An ICFR Audit Is Integrated with the Financial Statement Audit for a Reason
PCAOB AS 2201 is not designed as a completely separate compliance exercise.
It is an integrated audit.
Information learned during substantive financial-statement procedures can affect the auditor's evaluation of controls.
For example, the auditor should consider matters such as:
Fraud-related findings
Illegal acts
Related-party transactions
Management bias in accounting estimates
Misstatements discovered through substantive testing
Importantly, PCAOB AS 2201 also warns that the effectiveness of a control cannot simply be inferred from the absence of misstatements discovered through substantive procedures.
In other words:
“We didn't find an error” does not prove the control worked.
The control has to be tested directly.
Control Deficiencies Require Professional Judgment
Finding a control exception is not the end of the analysis.
The auditor must determine what the exception means.
Is it:
An isolated deviation?
A design deficiency?
An operating deficiency?
Evidence of a broader problem?
An indicator of management override?
A deficiency that combines with other deficiencies?
A significant deficiency?
A material weakness?
PCAOB AS 2201 defines a design deficiency as existing when a necessary control is missing or when an existing control is designed such that, even if it operates as intended, the control objective would not be met.
This is why simply counting exceptions is inadequate.
Auditors must understand the risk and potential consequence represented by those exceptions.
Workpapers Need to Demonstrate the Auditor's Thinking
Strong ICFR documentation should enable an experienced reviewer to understand:
Risk → Control → Testing → Evidence → Exceptions → Evaluation → Conclusion
The workpaper should answer:
Why was this control selected?
Which risk does it address?
Which assertion is involved?
How was design effectiveness evaluated?
How was operating effectiveness tested?
What evidence was obtained?
Were exceptions identified?
How were they evaluated?
Why does the evidence support the conclusion?
The CCS program specifically includes methods for improving audit workpapers as one of its learning objectives.
“Tested with no exceptions” is not an explanation of the auditor's reasoning.
AI Can Help—but PCAOB AS 2201 Still Requires Auditor Judgment
Artificial intelligence is beginning to change ICFR auditing.
An auditor using an approved AI environment may be able to accelerate tasks such as:
Researching the client
Developing walkthrough questions
Analyzing process narratives
Comparing controls with identified risks
Reviewing risk-control matrices
Summarizing walkthroughs
Identifying inconsistencies
Analyzing exceptions
Drafting workpaper narratives
But AI creates an important distinction.
AI can help an auditor identify a question.
It cannot assume responsibility for the auditor's conclusion.
An AI tool might identify that a management review control does not specify a variance threshold.
The auditor must determine whether the control operates at sufficient precision to address the relevant risk.
AI can summarize the evidence.
The auditor must evaluate the evidence.
That makes understanding PCAOB AS 2201 even more important as firms introduce AI into their audit methodologies.
PCAOB AS 2201 Is a Standard Auditors Need to Know—Not Merely Reference
PCAOB AS 2201 contains some of the most important concepts underlying modern public-company auditing:
Risk-based auditing
Top-down audit planning
Entity-level controls
Significant accounts and disclosures
Relevant assertions
Walkthroughs
Control selection
Design effectiveness
Operating effectiveness
Nature, timing and extent of testing
Deficiency evaluation
ICFR reporting
These are not concepts auditors should encounter only when they search their firm's methodology.
They should become part of the auditor's tradecraft.
What You'll Learn in the CCS PCAOB AS 2201 CPE Webinar
Corporate Compliance Seminars designed the program around the practical application of the standard.
The agenda addresses:
Introduction and Background — including the history of public-company audits, internal control definitions and PCAOB standards.
Top-Down vs. Control-Based Compliance — including the development of COSO and AS 2201's risk-based approach.
Internal Control Frameworks Under SOX — including COSO's 17 principles and the COBIT IT framework.
PCAOB AS 2201 — including audit planning, the top-down approach, testing controls and evaluating deficiencies.
Entity-Level Internal Controls — including how these controls relate to organizational risks.
Participants should leave with a stronger understanding not only of what AS 2201 says, but of how to apply it during an actual ICFR engagement.
Who Should Attend?
The webinar is particularly appropriate for:
External Auditors
Internal Auditors
SOX Professionals
Audit Managers
Compliance Professionals
ICFR Specialists
IT Auditors
Risk Professionals
Finance and Accounting Professionals
CCS lists the program at the Basic level with no prerequisites or advance preparation required. It is presented as a live Group Internet Based seminar and provides 4 CPE credits based on 50 minutes of instruction per credit hour.
The Bottom Line: Audit the Risk, Not the Checklist
The central lesson of PCAOB AS 2201 can be expressed very simply:
Start with risk. Identify the controls that matter. Understand how they work. Test them with persuasive evidence. Evaluate deficiencies intelligently. Document why the evidence supports your conclusion.
A successful ICFR audit is not measured by how many controls the auditor tested.
It is measured by whether the auditor obtained sufficient appropriate evidence to support the opinion on the effectiveness of ICFR.
That requires more than compliance.
It requires risk assessment, professional skepticism, technical competence and audit judgment.
Those are exactly the capabilities Corporate Compliance Seminars' PCAOB AS 2201: An Audit of ICFR webinar is designed to strengthen.
Comments