Auditing Standards Update

1. Auditing Standards Update Ensuring Integrity: Third Annual Auditing Conference Harold L. Monk, Jr. CPA, CFE

2. Session Objectives • Discuss recent ASB activity and obtain an understanding of recently issued auditing and quality control standards. • Discuss other recent audit activities and obtain an understanding of guidance available to assist practitioners in improving the effectiveness and efficiency of their engagements and practices.

3. Recent Auditing Standards Board Activities Clarity Project

4. Clarity • Background • Discussion paper issued March 2007 • ASB considered comments received and approved direction forward August 2007 • Goals: • Address concerns over length and complexity of standards • Make standards easier to read, understand and implement • Will lead to enhancements in audit quality

5. Clarity Drafting Conventions • Introduction • Objective • Definitions • Terms used in the SAS are defined • Establish separate glossary of terms • Requirements and Application Material

6. Objective • Create objectives for each standard • Establish obligation relating to the objective • Provide a framework for the application of professional judgment • Outcome based goal • Difficult to achieve the overall objective of the audit if individual objectives are not achieved

7. Requirements and Application Material • Application and other explanatory material presented in a separate section that follows the requirements • Application and other explanatory material paragraphs numbered using an A prefix • Cross-referencing between requirements and related application material

8. Other • Special considerations sections • for governmental entities • for smaller, less complex entities

9. Convergence Of Auditing Standards

10. Convergence means my way

11. What do the words mean?

12. Other challenges:Large vs. Small

13. Other challenges:Rules vs. Principles

14. Clarity and Convergence • Convergence with ISAs • Removal of unnecessary differences • Supplemental materials with EDs • Exhibit of substantive differences with ISA • Mapping of the requirements and guidance contained within extant AU section to the proposed SAS; and • Schedule of proposed changes in requirements and explanatory material as a result of redrafting. • Schedule of detailed changes in language between the proposed SAS and the ISA.

15. Audit and Attest UpdateClarity Project • Project will take 2 - 3 years to complete • During this period, few new standards will be issued • Only those that are needed to respond to emerging issues (e.g. SAS 74) • “Clarified standards” will be exposed over the next few years and finalized • Target date for final approval June 2010

16. Audit and Attest UpdateClarity Project • Once finalized, they’ll be made available to practitioners. • However, the standards will not become effective piecemeal. • With limited exceptions, all “clarified standards” will become effect at the same time • Most likely 2011

17. Audit and Attest Update Risk Assessment Standards SASs 104-111

18. Risk Assessment Standards • The risk assessment standards consist of: • SAS No. 104, Amendment to Statement on Auditing Standards No. 1 • SAS No. 105, Amendment to Statement on Auditing Standards No. 95, Generally Accepted Auditing Standards • SAS No. 106, Audit Evidence • SAS No. 107, Audit Risk and Materiality in Conducting an Audit (Audit Risk and Materiality) • SAS, No. 108, Planning and Supervision • SAS No. 109, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement (Assessing Risks) • SAS No. 110, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (Performing Procedures) • SAS No. 111, Amendment to Statement on Auditing Standards No. 39, Audit Sampling

19. Background • Objective is to guide auditors to areas of greatest risk whether caused by error or fraud • Issued in March 2006. • Effective for periods beginning after 12/15/06.

20. Risk Assessment Standards • Enhances the auditor’s application of the audit risk model in practice by requiring: • More in-depth understanding of the entity and its environment, including its internal control • More rigorous assessment of the risks of material misstatement • Improved linkage between the assessed risks and the nature, timing, and extent of audit procedures performed

21. Overview of Risk Assessment Process Gain an understanding of the entity Perform risk assessment procedures Assess the risks of material misstatement Assertion Level Overall financial statement Level Further audit procedures Overall Responses Evaluate Sufficiency of Audit Evidence

22. Q&A—Internal Control • Question—Can I still default to a maximum control risk? • Answer—No. The standards require that the auditor obtain a sufficient understanding of the five components of the client’s internal control to assess control risk. TIS 8200.10

23. Q&A—Internal Control • Question—The standards say the auditor should test controls when they have an “expectation of the operating effectiveness of controls.” What does that phrase mean? • Answer—It means the auditor’s initial assessment of control risk is at less than maximum; and the auditor’s strategy contemplates a combined approach. TIS 8200.06

24. Q&A—Internal Control • Question—Can an auditor design a substantive audit approach even if the auditor’s assessment of internal control causes him or her to believe that controls are designed effectively? • Answer—Yes, if the auditor believes that the costs of testing controls exceeds the benefits of testing. (Consider there are numerous assessments, not one.) TIS 8200.07

25. Q&A—Inherent Risk • Question— Inherent risk is “the susceptibility of a relevant assertion to a misstatement that could be material… assuming that there are no related controls.” Can an auditor ignore all controls if the auditor assesses inherent risk as low? • Answer—No. A low inherent risk does not mean a low risk of material misstatement. The auditor is required to assess RMM (IR X CR). Be careful as to assumed controls. TIS 8200.09

26. Q&A—Use of Walkthroughs • Question—How often do walkthroughs need to occur? • Answer—Auditors will most likely perform walkthroughs annually to document their understanding of internal control and to establish the continued reliance of audit evidence obtained in prior periods. TIS 8200.12

27. Q&A—Journal Entries • Question—Paragraph 52 of SAS No. 110 refers to “adjustments made during the course of preparing the financial statements” to address entries prepared by the client during the process of drafting the financial statements (rather than all entries posted in the accounting system at year end). Is this correct? • Answer—Yes, this requirement relates to entries posted during the financial statement closing process. SAS 99 establishes requirements to test journal entries during the audit period. TIS8200.16

28. Risk Assessment Standards • Resources available • Audit Guide – Assessing and Responding to Audit Risk in a Financial Statement Audit • Audit Risk Alert – Issued in March 2006 • CPE Courses • Articles in JOA • Technical Practice Aid

29. Audit and Attest Standards Update Revisions of AT 501 And SAS 112

30. Revisions of AT 501 • ASB task force worked with bank regulators to revise AT 501 • Incorporates elements of PCAOB AS5 • Finalized in August, 2008 • Revised AT 501 is to be effective for years ending on or after December 15, 2008 • Most firms who would use AT 501 will already be using AS 5

31. Revisions of AT 501 • Like AS 5, an AT 501 examination is an integrated engagement with the audit of the financial statements. • Will only be able to use AT 501 when financial statements are also audited • Examining and reporting on only design effectiveness of internal control has been moved to AT 101 and then audited financial statements are not required.

32. Revisions of AT 501 • A material weakness is a deficiency, or a combination of deficiencies, in internal control, such that there is a reasonable possibility that a material misstatement of the entity’s financial statements will not be prevented or detected on a timely basis. • Note: There is a reasonable possibility of an event, as used in this Statement, when the likelihood of the event is either "reasonably possible" or "probable," as those terms are used in Financial Accounting Standards Board Statement No. 5, Accounting for Contingencies

33. Revisions of AT 501 • A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance.

34. Revisions of SAS 112 • Conforming changes have been made using these same definitions. • Definitional changes will be effective in 2009 (early implementation will be allowed). • Other changes will be made through the clarity project at a later date.

35. Audit and Attest Standards Update Other Current ASB Projects

36. Audit and Attest Standards UpdateOther Current ASB Projects • Revisions to SAS 74 and other conforming changes in response to PCIE report • Revisions to SAS 70 • Move Service Organization examination to AT Standards • Revisions to auditing estimates and fair value • Finalize SAS 69 to remove GAAP hierarchy for FASB incorporation • Revise AU 534 “Financial Statements Prepared for Use in Other Countries” now that IFRS is recognized as equivalent U.S. GAAP

37. SAS 74 Amendments • Amend SAS 74 to provide additional auditing guidance when an audit of compliance is performed in connection with a GAAS and GAGAS audit of financial statements (i.e. OMB A-133 Audit). • A Compliance examination performed when an audit is not required, would continue to be performed under AT 601

38. TPA Issued on AU 543 Use of Other Auditors • Question—Can U.S. auditor divide responsibility and refer to other auditor’s report if other audit was conducted in accordance with International Standards of Auditing or another country’s auditing standards? • Answer—No, presumption is that audit of group was conducted in accordance with auditing standards generally accepted in the U.S.

39. Audit and Attest Standards Update Statement of Quality Control Standard 7

40. SQCS No. 7 • Issued October 2007 • Effective as of January 1, 2009 • Supersedes all previous SQCSs

41. SQCS No. 7 The firm must establish a system of quality control designed to provide it with reasonable assurance that: • The firm and its personnel comply with professional standards and applicable regulatory and legal requirements, and • Reports issued are appropriate in the circumstances

42. SQCS No. 7 A system of quality control consists of: • Policies designed to achieve these objectives and • The procedures necessary to implement and monitor compliance with those policies.

43. SQCS No. 7 Documentation and Communication • Required to document QC policies and procedures. • Extent based on firm characteristics • Required to communicate QC policies and procedures to personnel. • More effective if in writing, but not required to be.

44. Required Elements of QC System • Leadership responsibilities for quality within the firm (the “tone at the top”) • Relevant ethical requirements • Acceptance and continuance of client relationships and specific engagements • Human resources • Engagement performance • Monitoring

45. Tone at the Top Objective – Promote a quality-oriented internal culture • Requires firms to assign its management responsibilities so that commercial considerations do not override the quality of work performed. • Address personnel performance evaluation, compensation and advancement to demonstrate the firm’s overarching commitment to quality.

46. Questions?