Letters to Regulators
Proposed Auditing Standard-An Audit of Internal Control Over Financial Reporting
November 20, 2003
Office of the Secretary
Re: PCAOB Rulemaking Docket No. 008: Proposed Auditing Standard An Audit of Internal Control Over Financial Reporting
The Independent Community Bankers of America (ICBA)1 appreciates the opportunity to offer the following comments on proposed auditing standards by the Public Company Accounting Oversight Board (PCAOB). If adopted, these standards will be the required standards that auditors must follow when they attest to the internal controls of companies subject to the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley).
While ICBA commends the PCAOB on its attempt to establish standards for auditors when they are performing audits of internal control, ICBA is concerned that the proposed standards will be burdensome and costly for community banks and bank holding companies that are either (1) publicly-held and are subject to Sarbanes-Oxley, or (2) have assets of $500 million or more and therefore are subject to the internal control attestation requirements of Section 36 of the FDI Act as implemented by Part 363 of the FDIC's regulations. Those regulations require a covered financial institution's independent public accountant to examine, attest to, and report separately on management's assertion concerning internal controls. The banking agencies have indicated that the PCAOB's auditing standards for internal controls under Section 404 of Sarbanes-Oxley will most likely be the standards that auditors must follow when they audit the internal controls of financial institutions that have assets of $500 million or more.
ICBA is concerned that auditing costs will rise substantially if the proposed standards for internal control audits are adopted by the PCAOB. Several community banks have already filed notice with the SEC this year that they intend to withdraw registration of their securities and go private. One of the primary reasons cited by these banks is the higher auditing costs associated with being a publicly-held company subject to Sarbanes-Oxley. ICBA offers the following responses to some of the questions raised in the proposal:
Question 4. Does the Board's proposed standard give appropriate consideration to how internal control is implemented in, and how the audit of internal control over financial reporting should be conducted at, small and medium-sized issuers?
The Board says that it is "sensitive to the possible effects of the proposed standard on small and medium-sized companies" and that the "nature and extent of controls that are necessary depend, to a great extent, on the size and complexity of the company." However, the Board does not make any specific recommendations for how audits of internal accounting controls should be conducted by small and medium-sized companies. Appendix E, which is entitled "Special Internal Control Over Financial Reporting Considerations for Small and Medium-Sized Companies" offers very little in the way of concrete suggestions for reducing the auditing required of small and medium-sized companies. In ICBA's opinion, the Board should specifically recommend that auditors of smaller companies rely more on sampling and less on extensive testing. For example, Appendix E should say that walkthroughs and other kinds of testing should only be required of a sample of "significant processes" rather than all of them. Such specific suggestions would reduce the costs of audits for small and medium sized companies.
Question 10. Is it appropriate to require the walkthrough be performed by the auditor himself or herself, rather than allowing the auditor to use walkthrough procedures performed by management, internal auditors, or others?
No, it is not appropriate to require that the walkthroughs be performed only by the outside auditor. If a company has an internal audit staff that follows professional auditing standards and reports directly to the audit committee, the auditor should be able to rely on the walkthroughs performed by the internal auditors. It would be very expensive to require external auditors to duplicate all the tasks that are done by the internal auditors.
Question 11. Is it appropriate to require the auditor to obtain evidence of the effectiveness of controls for all relevant assertions for all significant accounts and disclosures every year or may the auditor use the audit evidence obtained in previous years to support his or her current opinion on management's assessment?
While each auditor must obtain whatever evidence is necessary to provide a basis for an opinion, generally, an auditor should be able to use the audit evidence obtained in previous years to support his or her current opinion on management's assessment. Otherwise, if the auditor has to obtain evidence yearly in every case, audit costs will be substantial. Furthermore, public accounting firms should be attesting to the assessment made by management about internal controls. They should be testing controls and procedures to the extent necessary to corroborate management's assessment of the internal controls and not be performing a detailed audit of internal controls each year.
Questions 22 and 23. Is it appropriate to require the auditors to evaluate the effectiveness of the audit committee's oversight of the company's external financial reporting and internal control over financial reporting? Will the auditors be able to effectively evaluate the effectiveness of the audit committee's oversight?
ICBA believes that it would be costly and impractical to require the outside auditors to audit the audit committee. Under Sarbanes-Oxley, the audit committee has the responsibility to hire the outside auditors, approve non-audit services, and resolve disagreements between the auditors and management regarding financial reporting. It would pose a conflict to the auditors if they were then required to audit the audit committee. While auditors should have access to the audit committee members and, in some cases, to their records, the board of directors should evaluate the effectiveness of the audit committee, not the outside auditors.
ICBA hopes that the PCAOB will consider the costs of performing audits particularly for small and medium-sized companies as it establishes standards for auditors and audits. While we commend the Board for its efforts so far, we hope the Board will be more cost conscious with its proposals in the future. If you have any questions or need any additional information, please contact Chris Cole, ICBA's regulatory counsel at 202-659-8111 or Chris.Cole@icba.org.
1 ICBA is the nation's leading voice for community banks and the only national trade association dedicated exclusively to protecting the interests of the community banking industry. ICBA has some 4,600 members with branches in more than 17,000 locations nationwide. Our members hold more than $526 billion in insured deposits, $728 billion in assets and more than $405 billion in loans for consumers, small businesses, and farms. They employ more than 231,000 people in the communities they serve.