As expected, the U.S. Securities and Exchange Commission (SEC) voted unanimously July 25 to approve the proposed Public Company Accounting Oversight Board (PCAOB) Auditing Standard 5 (AS5). This action finally gives companies the power that they have wanted since the Sarbanes-Oxley Act (SOX) was passed in 2002: the unassailable right to take a top-down, principles-based approach to SOX, rather than the costly and time-consuming documentation free-for-all that characterized the first five years.

AS5, which replaces the PCAOB's previous Auditing Standard 2, was created in concert with new SEC guidance to give the regulators' official blessings to a risk-assessment methodology. The new streamlined standard, approved days before the fifth anniversary of SOX, will be effective for fiscal years ending after Nov. 15, 2007.

“We are pleased with the SEC's approval of AS5,” said Mark W. Olson, PCAOB chairman, in a statement. “However, this does not mark the finish line for the PCAOB.”

Following the vote, the PCAOB said it is planning to undertake initiatives to support successful implementation of the standard. These include working closely with the audit firms, early in their process, as they evaluate how the new standard will affect their firms' audits of internal control. Other initiatives include continued outreach to public companies and smaller audit firms regarding the new standard.

Many finance experts expect the SEC's endorsement to lead to lower costs for SOX 404 compliance. “With AS5, we now have clearer more substantial support for a risk-based approach,” says Brett Curran, vice president of governance, risk and compliance (GRC) and privacy practices at Axentis Corp. “It will be a catalyst to help auditors rely more on their judgment and that will cut costs.”

AS5 was approved over last-minute requests for reforms by NASDAQ, which echoed the concerns of others who felt AS5 didn't go far enough in providing a workable definition for “materiality,” an important component necessary to determine which risks have the greatest potential to impact the bottom line. NASDAQ also wants to see an ombudsman established at the PCAOB to advocate for issuers who feel their internal controls are being overaudited, and also permission for companies with no material weaknesses one year to skip the auditor portion of 404 the next. These reforms could work their way into future PCAOB comments and standards.

Finance, audit and information technology professionals were mostly enthusiastic, though that was tempered by some irritation that it took so long for the SEC and PCAOB to finally give their stamps of approval to what managers have said all along: It was a waste of time and money to test audit controls for uncritical processes such as, say, petty cash and the company coffee budget. “It came four years too late, but it's essentially an admission that the delay has contributed to the extensive costs associated with Sox Section 404 compliance,” says John McLaughlin, senior managing director of advisory business services at Smart Business Advisory Consulting LLC, based in Devon, Penn.

Some companies, perhaps 10% of all the large public companies covered by SOX, have been assertive in adopting a risk-based approach before AS5 was cast in stone. It wasn't easy, though, because external auditors, in many cases, refused to veer from the strict SOX doctrine despite PCAOB hints that risk-assessment was a reasonable approach because, perhaps, the pendulum had swung too far in the direction of overauditing.

Celebrate Sarbanes-Oxley's fifth anniversary with Treasury & Risk magazine. Read “Finally, the Party Can Start”, the Cover Story of T&R's summer double issue.

Instant Insights /

SEC Approves PCAOB Auditing Standard 5

Related Stories

Recommended For You