[barelystayingsane]

When SOX says that auditors are required to attest to management’s assessment of the effectiveness of internal control over financial reporting, is that just saying that the auditor must audit the effectiveness of internal controls (i.e., perform an integrated audit)? I know that you can report directly on the internal control, or you can report on management’s assertion. Reporting on management’s assertion sounds like attesting to management’s assessment of internal control to me. Is that correct? So if you report directly on internal control, do you still have to attest to management’s assessment?

Thanks!

[tough_kitty]

OK, I had to read your post like 3 times 😉

Here is what I learned with Roger:

SOX requires an integrated audit: assurance about the fairness of financial statements AND about the effectiveness of internal control over financial reporting.

Per AU500, management's assertions are representations made by management in the financial statements being audited. So, they relate to the financial statements audit, NOT internal control.

The 13 management assertions are grouped within 3 main categories:

– about classes of transactions and events for the period under audit

– about account balances at the period end

– about presentation and disclosure

Hope it helps….

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[tough_kitty]

OK, I had to read your post like 3 times 😉

Here is what I learned with Roger:

SOX requires an integrated audit: assurance about the fairness of financial statements AND about the effectiveness of internal control over financial reporting.

Per AU500, management's assertions are representations made by management in the financial statements being audited. So, they relate to the financial statements audit, NOT internal control.

The 13 management assertions are grouped within 3 main categories:

– about classes of transactions and events for the period under audit

– about account balances at the period end

– about presentation and disclosure

Hope it helps….

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[barelystayingsane]

According to Becker, management must make an assertion about the effectiveness of internal control, which must be included in both the representation letter and the management's report on internal control.

[barelystayingsane]

According to Becker, management must make an assertion about the effectiveness of internal control, which must be included in both the representation letter and the management's report on internal control.

[barelystayingsane]

I believe I may have figured this out last week. The auditor can either report directly on internal controls or on management's assertion when auditing nonissuers. However, for issuers, the auditor must report directly on internal control and then point out if management missed anything in their report (i.e., the attest of management's assessment). Can anyone confirm if this is correct? Or must the auditor make a statement about management's assessment even when it is all correct? Thanks!

[barelystayingsane]

I believe I may have figured this out last week. The auditor can either report directly on internal controls or on management's assertion when auditing nonissuers. However, for issuers, the auditor must report directly on internal control and then point out if management missed anything in their report (i.e., the attest of management's assessment). Can anyone confirm if this is correct? Or must the auditor make a statement about management's assessment even when it is all correct? Thanks!

[tough_kitty]

Correct. OK, let's do this again 🙂

You wrote: “When SOX says that auditors are required to attest to management's assessment of the effectiveness of internal control over financial reporting, is that just saying that the auditor must audit the effectiveness of internal controls (i.e., perform an integrated audit)?”

ANSWER: YES.

You wrote: “I know that you can report directly on the internal control, or you can report on management's assertion.”

ANSWER: In my opinion, you report on the internal control AND on management's assertions in regard to the financial statements…so not exactly sure what you meant here…

You wrote: “Reporting on management's assertion sounds like attesting to management's assessment of internal control to me. Is that correct?”

ANSWER: Not per my understanding. See my answer above. These are 2 different things.

You wrote: “So if you report directly on internal control, do you still have to attest to management's assessment?”

ANSWER: Not sure if I understand this sentence correctly, but it sounds like it's the same thing – “to attest on management's assessment of internal control” = report on effectiveness of internal control. Management's assertions, however, is something else.

Does it make sense? 🙂

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[tough_kitty]

Correct. OK, let's do this again 🙂

You wrote: “When SOX says that auditors are required to attest to management's assessment of the effectiveness of internal control over financial reporting, is that just saying that the auditor must audit the effectiveness of internal controls (i.e., perform an integrated audit)?”

ANSWER: YES.

You wrote: “I know that you can report directly on the internal control, or you can report on management's assertion.”

ANSWER: In my opinion, you report on the internal control AND on management's assertions in regard to the financial statements…so not exactly sure what you meant here…

You wrote: “Reporting on management's assertion sounds like attesting to management's assessment of internal control to me. Is that correct?”

ANSWER: Not per my understanding. See my answer above. These are 2 different things.

You wrote: “So if you report directly on internal control, do you still have to attest to management's assessment?”

ANSWER: Not sure if I understand this sentence correctly, but it sounds like it's the same thing – “to attest on management's assessment of internal control” = report on effectiveness of internal control. Management's assertions, however, is something else.

Does it make sense? 🙂

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[tough_kitty]

Do you have a sample of a report for a nonissuer? Auditors do not report on internal controls for nonissuers.

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[tough_kitty]

Do you have a sample of a report for a nonissuer? Auditors do not report on internal controls for nonissuers.

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[barelystayingsane]

When auditors are performing an integrated audit for a nonissuer (i.e., a financial audit combined with an examination of internal control), then they do report on IC for nonissuers. Becker has examples in their AUD book of both a report directly on IC and a report on management's assertion, both for nonissuers.

[barelystayingsane]

When auditors are performing an integrated audit for a nonissuer (i.e., a financial audit combined with an examination of internal control), then they do report on IC for nonissuers. Becker has examples in their AUD book of both a report directly on IC and a report on management's assertion, both for nonissuers.

[tough_kitty]

Oh yeah, that's right. Just found my chart….I am using Roger….There are 2 types of audits for non-issuers – “Financial Statement Audit” (no opinion on internal control) and “Attestation Engagement” – in accordance with attestation standards by the AICPA. In this case you do express an opinion on internal control and management's assertion is fairly stated. Also, you comment on inherent limitations.

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[tough_kitty]

Oh yeah, that's right. Just found my chart….I am using Roger….There are 2 types of audits for non-issuers – “Financial Statement Audit” (no opinion on internal control) and “Attestation Engagement” – in accordance with attestation standards by the AICPA. In this case you do express an opinion on internal control and management's assertion is fairly stated. Also, you comment on inherent limitations.

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[tough_kitty]

So now I am confused – what are you confused about? 🙂

FAR: 81 (May 2013)
BEC: 81 (July 2013)
REG: 83 (August 2013)
AUD: 82 (November 2013)
California CPA since 1/30/14

[Author]

Replies