The new PCAOB AS5 will save compliance costs

The PCAOB’s Auditing Standard No. 2 is the rule largely blamed for creating excessively high audit fees for companies complying with the Sarbanes-Oxley Act. Since auditors began using AS2, companies have complained that common interpretations of the standard wrought burdensome audits by promoting work for work’s sake and encouraging a rigid checklist approach.

PCAOB recently replaced AS2 with AS5 with improved guidelines which will benefit both companies and auditors. The changes will also make small and medium companies comply easier. Once it is officially approved by SEC, audit firms would have to reference the standard for audits of internal control for fiscal years ending on or after November 15, 2007.  Here are some analysis of new changes to companies, auditors, and software and service providers:

1. Auditors No Longer Report On Management’s Process

This is considered as the most important change. In the past, auditors will not only assess the internal controls of the company, but also assess company’s management assessment of their own internal controls. It will take much less effort for auditors to make a separate judgement on company’s internal control, than to make additional assessment on management assessment process.

Pros: Companies will save great deal on auditing fees, and companies can follow SEC principle based guidance to decide what needs to do for its compliance.

Cons: Some people are concerned that management will do less work on compliance. My guess is that most companies will always try to do their best to prepare for the auditing like the way we prepare for school exams. This might require SEC to come up with more detailed guideline for management to follow.

2. More efficiency to reduce the work

• Auditors are encouraged to take a truly risk-based approach to multilocation testing, where testing controls over a “large portion” of the company are no longer required. This will enable companies and auditors to focus on key risks and controls, a quality over quantity approach.
• Auditors will no longer need to obtain the “principal evidence,” and there are greater opportunities to use management’s work;
• There will be less work in performing “walkthroughs,” because it takes less effort to walk through each significant process rather than each major class of transactions. And less work will be needed in testing the design of controls, as the rules say a sufficient evaluation of design is done during the walkthrough.

As companies and auditors will focus on key risks, key controls and key processes. Out of the box, best practice key automatic controls for specific industries will be competitive advantage to GRC vendors.