15.4 PCAOB Reporting & Integrated Audits of ICFR (AS 3101 & AS 2201)

15.4 PCAOB Reporting & Integrated Audits of ICFR (AS 3101 & AS 2201)

Core Principle: Audits of public companies (issuers) registered with the U.S. Securities and Exchange Commission (SEC) operate under the oversight and standards of the Public Company Accounting Oversight Board (PCAOB). Auditing Standard AS 3101 dictates the required format and mandatory disclosures of the financial statement audit report (including Critical Audit Matters and auditor tenure). For public filers subject to Section 404(b) of the Sarbanes-Oxley Act, AS 2201 governs the integrated audit of financial statements and Internal Control Over Financial Reporting (ICFR), where the presence of a single material weakness mandates an adverse internal control opinion.

---

1. PCAOB AS 3101: Structure of the Issuer Unqualified Report

PCAOB Auditing Standard AS 3101 (The Auditor's Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion) sets a standardized architecture for issuer audit reports.

+-------------------------------------------------------------------------------------------------------+
|                                 PCAOB AS 3101 REPORT ARCHITECTURE                                     |
|                                                                                                       |
|   1. TITLE               --> "Report of Independent Registered Public Accounting Firm"                |
|   2. ADDRESSEE           --> "To the Shareholders and the Board of Directors of XYZ Company"           |
|   3. OPINION SECTION     --> Positioned FIRST: Identifies statements and expresses unqualified opinion |
|   4. BASIS FOR OPINION   --> Management vs Auditor duties, PCAOB standards, and SEC INDEPENDENCE       |
|   5. CRITICAL AUDIT      --> Details challenging, subjective, or complex matters communicated to      |
|      MATTERS (CAMs)          the audit committee concerning material accounts/disclosures             |
|   6. SIGNATURE & TENURE  --> Firm signature, "We have served as Company auditor since [Year]"          |
|   7. CITY / STATE / DATE --> Office city and state, Date of completion of fieldwork                   |
+-------------------------------------------------------------------------------------------------------+

Detailed Analysis of Mandatory Sections

Title and Addressee

• Title: Must explicitly state: "Report of Independent Registered Public Accounting Firm". The inclusion of both "Independent" and "Registered" is legally required.
• Addressee: Addressed to the shareholders and the board of directors (or equivalents for non-corporate entities). It is never addressed solely to management.

Opinion on the Financial Statements (First Section)

Unlike historical audit reports that placed the opinion at the end, AS 3101 places the Opinion section at the very beginning of the report. It:

• Identifies the name of the company and each financial statement audited.
• Identifies the dates and periods covered by each statement.
• Expresses the unqualified opinion that the financial statements "present fairly, in all material respects, the financial position... in conformity with U.S. generally accepted accounting principles."

Basis for Opinion Section

The Basis for Opinion section explicitly outlines the division of responsibility and regulatory compliance:

• States that the financial statements are the responsibility of the company's management.
• States that the auditor's responsibility is to express an opinion on the statements.
• Explicitly asserts registration and independence: "We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB."
• Explains that the audit was conducted in accordance with the standards of the PCAOB.
• Describes the audit procedures performed (evaluating accounting principles, significant estimates, testing evidence on a sample basis).

Auditor Tenure Disclosure

AS 3101 requires an explicit statement disclosing the year in which the auditor began serving consecutively as the company's auditor (e.g., "We have served as the Company's auditor since 2014"). If tenure is uncertain due to firm mergers, the statement reflects the earliest predecessor firm.

---

2. Critical Audit Matters (CAMs) per AS 3101

A Critical Audit Matter (CAM) is defined as any matter arising from the audit of the financial statements that satisfies a three-prong statutory test:

                                      THE THREE-PRONG CAM TEST (AS 3101)
                                                     |
        +--------------------------------------------+--------------------------------------------+
        |                                            |                                            |
     PRONG 1                                      PRONG 2                                      PRONG 3
  COMMUNICATED TO AUDIT                        RELATES TO ACCOUNTS                         ESPECIALLY CHALLENGING,
        COMMITTEE                                 OR DISCLOSURES                           SUBJECTIVE, OR COMPLEX
  Communicated or required                     Relates to accounts or                       Involved especially challenging,
  to be communicated to                        disclosures that are                         subjective, or complex
  the audit committee.                         MATERIAL to the statements.                  auditor judgment.

Factors Determining Especially Challenging Auditor Judgment

When determining whether a matter involved especially challenging, subjective, or complex judgment, the auditor takes into account:

• The auditor's assessment of the risks of material misstatement, including significant risks.
• The degree of auditor judgment related to areas involving significant management judgment or estimation uncertainty.
• The nature and timing of significant unusual transactions.
• The degree of auditor subjectivity in applying audit procedures or evaluating results.
• The nature and extent of audit effort required, including the extent of specialized skill or knowledge needed.
• The nature of audit evidence obtained regarding the matter.

The Four Mandatory Reporting Elements for Each CAM

For every CAM communicated in the audit report, the auditor must:

1. Identify the Critical Audit Matter.
2. Describe the principal considerations that led the auditor to determine that the matter was a CAM.
3. Describe how the CAM was addressed in the audit (e.g., specific audit procedures performed, controls tested, specialists engaged).
4. Refer to the relevant financial statement accounts or disclosures.

Exemptions from CAM Reporting

CAMs are not required for:

• Emerging Growth Companies (EGCs) as defined under the JOBS Act.
• Brokers and dealers reporting under SEC Rule 17a-5.
• Investment companies registered under the Investment Company Act of 1940 (other than business development companies).
• Employee stock purchase, savings, and similar benefit plans.

Exam Trap: Do not confuse PCAOB Critical Audit Matters (CAMs) with AICPA Key Audit Matters (KAMs per AU-C 701). CAMs are mandatory for all standard issuer audits (except EGCs). For non-issuers under AICPA standards, KAMs are communicated only when the auditor is explicitly engaged by the non-issuer to do so!

---

3. Integrated Audits of ICFR (PCAOB AS 2201 & SOX 404)

Under Section 404 of the Sarbanes-Oxley Act of 2002 (SOX):

• SOX 404(a): Management must assess and report on the effectiveness of the company's internal control over financial reporting annually.
• SOX 404(b): The independent auditor must attest to and issue an audit opinion on management's assessment of ICFR.

+-------------------------------------------------------------------------------------------------------+
|                                   SOX 404(b) AUDIT APPLICABILITY MATRIX                               |
|                                                                                                       |
|   FILER CATEGORY              PUBLIC FLOAT THRESHOLD       SOX 404(a) (MGMT)    SOX 404(b) (AUDITOR)  |
|   Large Accelerated Filer     $700 Million or greater      MANDATORY            MANDATORY (AS 2201)   |
|   Accelerated Filer           $75 Million to $700 Million  MANDATORY            MANDATORY (AS 2201)   |
|   Non-Accelerated Filer       Less than $75 Million        MANDATORY            EXEMPT (No ICFR audit)|
+-------------------------------------------------------------------------------------------------------+

*Since 2020, a smaller reporting company with annual revenues under $100 million is not an accelerated filer even if its public float is between $75 million and $700 million, so it has no 404(b) auditor attestation. Emerging growth companies are also exempt from 404(b).

Audit Objective in an ICFR Audit

The objective of an audit of ICFR under AS 2201 is to express an opinion on the effectiveness of the company's internal control over financial reporting as of a point in time (typically the final day of the fiscal year, matching the balance sheet date).

---

4. The Top-Down, Risk-Based Approach (AS 2201)

PCAOB AS 2201 mandates that the auditor apply a top-down, risk-based approach to select controls for testing. The auditor begins at the highest entity level and works down to significant accounts and individual controls.

                                     TOP-DOWN APPROACH HIERARCHY (AS 2201)
                                                      /\
                                                     /  \
                                                    /ELC \     1. Entity-Level Controls (ELCs)
                                                   /------\    - Control environment, Tone at top, Management override
                                                  /  Acct  \   2. Significant Accounts & Disclosures
                                                 /----------\  - Identified by size, susceptibility to misstatement
                                                / Assertions \ 3. Relevant Financial Statement Assertions
                                               /--------------\- Existence, Completeness, Valuation, Rights, Presentation
                                              / WCGW & Controls\4. Understand Points of Misstatement (Walkthroughs)
                                             /------------------\- Select controls to test (Design & Operating Effectiveness)

Step-by-Step Implementation

1. Evaluate Entity-Level Controls (ELCs):
   • The Control Environment (integrity, ethical values, board and audit committee oversight).
   • Controls over management override.
   • The company's risk assessment process.
   • Centralized processing and controls to monitor results of operations.
   • The period-end financial reporting process.
2. Identify Significant Accounts and Disclosures & Their Relevant Assertions:
   • Evaluate risk factors: size, susceptibility to fraud or loss, volume of activity, accounting complexity, related-party exposure, and significant changes from prior periods.
3. Understand Likely Sources of Misstatement (Walkthroughs):
   • Use walkthroughs, often the most effective way to understand each significant process (tracing a transaction from origination through information systems until reflected in financial statements).
   • Identify points within the process where errors or fraud could occur ("What Could Go Wrong" or WCGW points).
4. Select and Test Controls:
   • Test Design Effectiveness (TOD): Determine whether controls, if operating properly, satisfy control objectives and prevent or detect material misstatements.
   • Test Operating Effectiveness (TOE): Determine whether controls operated as designed, by individuals possessing necessary authority and competence.
   • Methods: Inquiry alone is NEVER sufficient! The auditor must combine inquiry with observation, inspection of documentation, and reperformance.

---

5. Evaluating Control Deficiencies & ICFR Reporting Opinions

Control deficiencies are classified into three severity levels:

+-------------------------------------------------------------------------------------------------------+
|                                 INTERNAL CONTROL DEFICIENCY SPECTRUM                                  |
|                                                                                                       |
|   SEVERITY LEVEL             MAGNITUDE                   COMMUNICATION REQUIREMENT    REPORT OPINION  |
|   Control Deficiency         Immaterial                  Management only              Unqualified     |
|   Significant Deficiency     Merits Attention (Not Mat.) Management & Audit Committee Unqualified     |
|   Material Weakness          REASONABLE POSSIBILITY OF   Management, Audit Committee, ADVERSE OPINION |
|                              MATERIAL MISSTATEMENT       and PUBLIC AUDIT REPORT      ON ICFR         |
+-------------------------------------------------------------------------------------------------------+

The Material Weakness Mandate

• Definition: A deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis.
• The Golden Rule: The existence of even a single material weakness existing as of the balance sheet date MANDATES AN ADVERSE OPINION ON ICFR!

The Classic CPA Exam Scenario: Clean FS + Adverse ICFR

Can an auditor express an unmodified (unqualified) opinion on the financial statements while simultaneously expressing an adverse opinion on ICFR?

• YES! This is common and heavily tested.
• Explanation: An entity may have ineffective internal controls (e.g., no segregation of duties, absence of supervisory review over complex revenue calculations), representing a material weakness. However, through exhaustive substantive testing (such as auditing 100% of large revenue contracts or detecting and adjusting errors), the auditor obtains sufficient appropriate evidence that the actual financial statement numbers are free of material misstatement.

Reporting Formats: Combined vs. Separate Reports

Under AS 2201, the auditor may issue:

• A Combined Report: A single document containing both the opinion on the financial statements and the opinion on ICFR.
• Separate Reports: Two independent reports—one for the financial statements and one for ICFR. Each report MUST include an explanatory paragraph cross-referencing the other report and stating the opinion expressed therein.

---

6. PCAOB Issuer vs. AICPA Non-Issuer Master Comparison