PCAOB AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements

Why it Matters

An integrated audit under AS 2201 is the independent test behind every public company's assertion that its financial reporting controls work. A material weakness reported under the standard is disclosed to investors, so the way controls are scoped, tested, and evidenced determines both the audit outcome and management's own Section 404(a) assessment.

Key benefits include:

• One audit, two opinions

The integrated audit achieves the objectives of the financial statement audit and the ICFR audit together, so evidence gathered for one supports the other.

• Top-down, risk-based scoping

The auditor begins at the financial statement level with the overall risks to ICFR and works down to entity-level controls and the significant accounts, disclosures, and assertions that matter, rather than testing every control.

• A shared definition of material weakness

The standard defines material weakness and significant deficiency, giving management, auditors, and audit committees the same terms for evaluating control failures.

• Clear expectations for entity-level controls

Controls over management override, the control environment, and the period-end financial reporting process are singled out as the ones that shape the rest of the audit.

• Predictable reporting

Paragraphs .85 onward set out what the auditor's report must say, including when a material weakness exists, so companies know how findings will be communicated.

How it Works

AS 2201 is organized in numbered paragraphs. Planning the audit begins at paragraph .09 and covers the role of risk assessment, scaling the audit to the company, fraud risk, and using the work of others; the top-down approach begins at .21 and covers entity-level controls, significant accounts and disclosures and their relevant assertions, likely sources of misstatement, and the selection of controls to test; testing controls begins at .42 and covers the evidence needed to test design and operating effectiveness, the timing of tests, and the use of prior-year evidence; evaluating identified deficiencies begins at .62; wrapping up begins at .71 and covers management's written representations and communicating matters to management and the audit committee; and reporting on ICFR begins at .85. Appendix A defines the terms, Appendix B addresses special topics such as multiple locations and benchmarking automated controls, and Appendix C covers special reporting situations.

In practice the auditor obtains an understanding of the company's ICFR, identifies significant accounts and disclosures and their relevant assertions, walks through transactions to identify the points at which a misstatement could occur, and selects the controls that sufficiently address the assessed risk of misstatement for each assertion. The auditor tests the design and operating effectiveness of those controls with inquiry, observation, inspection, and reperformance, evaluates each deficiency for its severity, and issues an opinion. Management's own assessment, the work of internal audit, and the company's control documentation are inputs the auditor may use, subject to the standard's requirements on competence and objectivity.

Within SmartSuite, finance and compliance teams keep the ICFR control library, risk and control matrices, test plans, and evidence in one system that mirrors the AS 2201 structure: each control is linked to the accounts, assertions, and risks it addresses, tests and their results are recorded with reviewers and dates, and deficiencies are evaluated, aggregated, and tracked to remediation so the auditor's requests can be answered from the record.

Key Elements

• Integrated audit objective

The auditor plans and performs the ICFR audit and the financial statement audit together so that evidence and conclusions from each inform the other.

• Top-down approach

Scoping starts at the financial statement level and the overall risks to ICFR, moves to entity-level controls, and then to significant accounts, disclosures, and relevant assertions.

• Entity-level controls

Controls related to the control environment, management override, and the period-end financial reporting process are evaluated because they affect the extent of testing elsewhere.

• Testing design and operating effectiveness

Selected controls are tested to determine whether they are designed to prevent or detect material misstatements and whether they operated as designed during the period.

• Evaluation of deficiencies

Each deficiency is assessed for severity, individually and in combination, to determine whether it is a material weakness.

• Material weakness definition

A material weakness is a deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

• Reporting on ICFR

The auditor's report expresses an opinion on the effectiveness of ICFR as of the year end and describes any material weakness identified.

Framework Scope

AS 2201 applies to audits of internal control over financial reporting performed by PCAOB-registered firms for issuers whose auditors must attest to ICFR under Section 404(b) of the Sarbanes-Oxley Act. It governs the auditor's work, not management's; management's assessment is addressed by SEC rules, though companies use the standard's definitions and top-down approach to organize their own testing. Smaller reporting companies and emerging growth companies exempt from Section 404(b) are outside its reach unless they obtain an ICFR audit voluntarily.

Framework Objectives

The standard exists so that an auditor can form and report an opinion on the effectiveness of a company's internal control over financial reporting.

Integrate the audit of internal control with the audit of the financial statements so that each supports the other.

Focus audit effort on the controls that address the risk of material misstatement through a top-down, risk-based approach.

Obtain sufficient evidence about the design and operating effectiveness of selected controls.

Evaluate identified deficiencies consistently against the definitions of significant deficiency and material weakness.

Communicate deficiencies to management and the audit committee and obtain management's written representations.

Report clearly to investors on whether ICFR was effective as of the year end.

Framework in Context

AS 2201 operates within the Sarbanes-Oxley Act's Section 404 regime, in which management assesses ICFR and the auditor attests to it, and it relies on a suitable control framework such as the COSO Internal Control – Integrated Framework (2013) as the criteria for that assessment. It connects to other PCAOB standards including AS 1000 on the auditor's general responsibilities, AS 2110 on identifying and assessing risks of material misstatement, AS 2605 on using the work of internal auditors, AS 2801 on subsequent events, AS 2805 on management representations, AS 2905 on subsequent discovery of facts, and AS 4105 on reviews of interim financial information. Service organization reports under SOC 1 and ISAE 3402 supply evidence about outsourced controls, and COBIT 2019 is often used to structure the IT general controls the audit examines.

Common Framework Mappings

AS 2201 is commonly mapped to the law that requires the ICFR audit, the control framework used as its criteria, and the assurance standards that supply evidence about outsourced and IT controls.

Mapped frameworks include:

SOX

COSO IC 2013

COSO ERM 2017

SOC 1

ISAE 3402

ISAE 3000

COBIT 2019