1.2 Regulatory Authorities & Auditing Standards Hierarchy

1.2 Regulatory Authorities & Auditing Standards Hierarchy

Core Principle: Auditing in the United States is bifurcated into two primary regulatory regimes: private non-issuers governed by the American Institute of CPAs (AICPA), and public issuers governed by the Public Company Accounting Oversight Board (PCAOB). Knowing which standard-setter holds jurisdiction and understanding the hierarchy of auditing guidance is essential for exam success.

---

1. Standard-Setting Bodies & Their Jurisdictions

Prior to 2002, the accounting profession was largely self-regulated under the auspices of the AICPA. The passage of the Sarbanes-Oxley Act of 2002 (SOX) fundamentally reshaped this environment by creating federal statutory oversight for auditors of public companies.

Comprehensive Authority Comparison

---

2. Detailed Profile of Regulatory Bodies

AICPA Auditing Standards Board (ASB)

The ASB is the senior technical committee of the American Institute of Certified Public Accountants authorized to issue auditing, attestation, and quality management standards for non-issuers (entities not required to register with the SEC). Its Clarity Project (clarified standards effective for periods ending on or after December 15, 2012) redrafted and recodified the standards under the prefix AU-C to align numbering and terminology closely with International Standards on Auditing (ISAs).

Public Company Accounting Oversight Board (PCAOB)

Established under Title I of the Sarbanes-Oxley Act of 2002, the PCAOB is an independent, non-profit corporation overseen by the SEC. It is tasked with protecting investors and the public interest by promoting informative, accurate, and independent audit reports. Key PCAOB functions include:

• Registering public accounting firms that audit issuers or SEC-registered broker-dealers.
• Establishing auditing, quality control, ethics, and independence standards for registered public accounting firms.
• Conducting mandatory inspections: annually for firms that audit more than 100 issuers, and at least once every three years for firms auditing between 1 and 100 issuers.
• Investigating and disciplining registered firms and associated persons for violations of SOX, SEC rules, or PCAOB standards.

Securities and Exchange Commission (SEC)

The SEC is the independent federal agency established by the Securities Exchange Act of 1934 to regulate U.S. securities markets. The SEC oversees the PCAOB, approves all PCAOB rules and standards before they take effect, and enforces federal securities acts (Securities Act of 1933, Securities Exchange Act of 1934, Investment Company Act of 1940, and SOX).

Government Accountability Office (GAO) & Yellow Book Standards

The GAO, led by the Comptroller General of the United States, publishes Government Auditing Standards, commonly known as the Yellow Book or GAGAS. GAGAS applies to audits of government agencies, state and local governments, non-profits receiving federal awards, and entities subject to the Single Audit Act. GAGAS imposes heightened requirements regarding auditor independence, continuing professional education (80 hours every 2 years, including 24 hours directly related to government auditing or the government environment), and mandatory reporting on internal control and compliance with laws and regulations.

State Boards of Accountancy

While the AICPA and state CPA societies are private professional associations, State Boards of Accountancy are sovereign governmental agencies. They derive their authority from state statutes. Only a State Board of Accountancy has the legal power to:

• Issue a Certified Public Accountant license.
• Renew, suspend, or revoke a CPA license.
• Enforce peer review and state-level continuing professional education (CPE) requirements.

Exam Trap: The AICPA can reprimand, suspend, or expel a CPA from AICPA membership, but the AICPA cannot revoke a CPA license. Only the State Board of Accountancy that granted the license has the sovereign authority to revoke it.

---

3. GAAP vs. GAAS: The Essential Dichotomy

A foundational distinction tested across multiple AUD exam questions and simulations is the difference between accounting standards and auditing standards:

+------------------------------------+-------------------------------------+
|                GAAP                |                GAAS                 |
|   (Financial Reporting Framework)  |        (Auditing Standards)         |
+------------------------------------+-------------------------------------+
| Promulgated by FASB / GASB         | Promulgated by AICPA ASB / PCAOB    |
| Criteria for measuring, valuing,   | Criteria for planning, performing,  |
| and presenting financial data.     | gathering evidence, and reporting.  |
| Answer: "Did management record     | Answer: "Did the auditor obtain     |
| the numbers properly?"             | sufficient appropriate evidence?"   |
+------------------------------------+-------------------------------------+

• GAAP (Generally Accepted Accounting Principles): Represents the criteria or benchmark against which financial statements are evaluated. Management is responsible for preparing financial statements in accordance with GAAP.
• GAAS (Generally Accepted Auditing Standards): Represents the rules and guidelines governing the auditor's conduct, performance, professional skepticism, and reporting. The auditor is responsible for conducting the audit in accordance with GAAS.
• Report Phrasing Rule: An auditor expresses an opinion on whether the financial statements are presented fairly, in all material respects, in accordance with GAAP (or another applicable reporting framework), based on an audit conducted in accordance with GAAS (or PCAOB standards).

---

4. The GAAS Authority Hierarchy (AU-C Section 200)

AU-C Section 200 (Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance With Generally Accepted Auditing Standards) organizes professional auditing literature into a three-tier hierarchy of authority:

                    [TIER 1: AUDITING STANDARDS]
                   (SASs / AU-C Sections, PCAOB AS)
                     *Authoritative Requirements*
                     - Must (Unconditional)
                     - Should (Presumptively Mandatory)
                                  |
                                  v
                  [TIER 2: INTERPRETIVE PUBLICATIONS]
              (AICPA Audit Guides, SOPs, Interpretations)
           *Must consider; document departure if not followed*
                                  |
                                  v
                [TIER 3: OTHER AUDITING PUBLICATIONS]
            (Journal of Accountancy, Textbooks, CPE Courses)
             *Non-authoritative; evaluate relevance & logic*

Tier 1: Auditing Standards (Authoritative)

Statements on Auditing Standards (SASs) issued by the ASB and codified in AU-C are authoritative standards. Within these standards, the ASB uses specific imperative terminology to define the auditor's degree of obligation:

1. Unconditional Requirement ("Must"): The auditor must comply with an unconditional requirement in all cases in which such requirement is relevant. Failure to perform an unconditional requirement is an automatic violation of GAAS.
2. Presumptively Mandatory Requirement ("Should"): The auditor should comply with a presumptively mandatory requirement in all cases in which such requirement is relevant. In rare circumstances, an auditor may judge it necessary to depart from a presumptively mandatory requirement. If so, the auditor must document why the standard requirement was not relevant or how the alternative audit procedures performed achieved the objective of the requirement.

Tier 2: Interpretive Publications (Recommending Guidance)

Interpretive publications are not auditing standards, but they provide authoritative recommendations on how to apply SASs in specific industries or engagements. Examples include:

• Auditing Interpretations of Statements on Auditing Standards
• Auditing guidance in AICPA Audit and Accounting Guides (e.g., Audits of Employee Benefit Plans, Construction Contractors)
• AICPA Auditing Statements of Position (SOPs)

An auditor should consider applicable interpretive publications. If an auditor chooses not to apply the guidance in an interpretive publication, they must be prepared to explain and document how compliance with the underlying SAS was achieved.

Tier 3: Other Auditing Publications (Non-Authoritative)

Other auditing publications have no authoritative status. They provide informal practical assistance, discussion of emerging issues, or academic perspective. Examples include:

• Articles in the Journal of Accountancy or The CPA Letter
• Continuing professional education (CPE) courses, webinars, and study manuals
• Auditing textbooks and academic treatises
• Firm-published technical newsletters and audit guidance

Before relying on other auditing publications, the auditor must evaluate the publication's relevance, logical soundness, and consistency with Tier 1 and Tier 2 standards.