PCAOB Audit Standard 2

When auditing a public company that reports to the SEC, the auditor must also perform an audit
of internal control over financial reporting (ICOFR) to determine if management has complied
with Rule 404 of Sarbanes-Oxley

 The auditor must (a) evaluate the process undertaken by management to assess
ICOFR
and (b) perform an independent assessment of ICOFR, expressing opinions on both
these matters.

 The auditor must obtain reasonable assurance of detecting any material

weaknesses in
ICOFR, indicated by (a) restatements of prior years, (b) material misstatements not
identified by management, (c) ineffective control environment, internal audit function, or
audit committee oversight, (d) fraud by senior management, or (e) significant deficien-
cies in ICOFR that remain uncorrected after a reasonable period of time.

 Since management is responsible for ICOFR, they may not delegate responsibility to
test and document ICOFR to the auditor. The auditor may not delegate audit tests of
ICOFR to the client's internal auditors or others outside the auditor's firm.
 The auditor must perform a walkthrough of each major class of transactions.
 When reviewing interim information, the auditor must inquire about changes in
ICOFR.

84
Focus on
Internal Control - Module 2

Substantive Tests
Evidential Matter
. . d~Or'fJli it
Auditor must gather sufficient cempe ent evidential matter as basis for opinion
. . (". 2-
EVidence consists of.·underIYln accounting data & corroborating information that will either cor-
roborate or contradict management's assertions -
 Underlying accounting data-client's accounting records

Corroborating information-information supporting underlying data available from client

& outside sources

Focus on
Evidence - Module 3 85