As expected, the U.S. Securities and Exchange Commission (SEC)voted unanimously July 25 to approve the proposed Public CompanyAccounting Oversight Board (PCAOB) Auditing Standard 5 (AS5). Thisaction finally gives companies the power that they have wantedsince the Sarbanes-Oxley Act (SOX) was passed in 2002: theunassailable right to take a top-down, principles-based approach toSOX, rather than the costly and time-consuming documentationfree-for-all that characterized the first five years.

AS5, which replaces the PCAOB's previous Auditing Standard 2,was created in concert with new SEC guidance to give theregulators' official blessings to a risk-assessment methodology.The new streamlined standard, approved days before the fifthanniversary of SOX, will be effective for fiscal years ending afterNov. 15, 2007.

“We are pleased with the SEC's approval of AS5,” said Mark W.Olson, PCAOB chairman, in a statement. “However, this does not markthe finish line for the PCAOB.”

Following the vote, the PCAOB said it is planning to undertakeinitiatives to support successful implementation of the standard.These include working closely with the audit firms, early in theirprocess, as they evaluate how the new standard will affect theirfirms' audits of internal control. Other initiatives includecontinued outreach to public companies and smaller audit firmsregarding the new standard.

Many finance experts expect the SEC's endorsement to lead tolower costs for SOX 404 compliance. “With AS5, we now have clearermore substantial support for a risk-based approach,” says BrettCurran, vice president of governance, risk and compliance (GRC) andprivacy practices at Axentis Corp. “It will be a catalyst to helpauditors rely more on their judgment and that will cut costs.”

AS5 was approved over last-minute requests for reforms byNASDAQ, which echoed the concerns of others who felt AS5 didn't gofar enough in providing a workable definition for “materiality,” animportant component necessary to determine which risks have thegreatest potential to impact the bottom line. NASDAQ also wants tosee an ombudsman established at the PCAOB to advocate for issuerswho feel their internal controls are being overaudited, and alsopermission for companies with no material weaknesses one year toskip the auditor portion of 404 the next. These reforms could worktheir way into future PCAOB comments and standards.

Finance, audit and information technology professionals weremostly enthusiastic, though that was tempered by some irritationthat it took so long for the SEC and PCAOB to finally give theirstamps of approval to what managers have said all along: It was awaste of time and money to test audit controls for uncriticalprocesses such as, say, petty cash and the company coffee budget.“It came four years too late, but it's essentially an admissionthat the delay has contributed to the extensive costs associatedwith Sox Section 404 compliance,” says John McLaughlin, seniormanaging director of advisory business services at Smart BusinessAdvisory Consulting LLC, based in Devon, Penn.

Some companies, perhaps 10% of all the large public companiescovered by SOX, have been assertive in adopting a risk-basedapproach before AS5 was cast in stone. It wasn't easy, though,because external auditors, in many cases, refused to veer from thestrict SOX doctrine despite PCAOB hints that risk-assessment was areasonable approach because, perhaps, the pendulum had swung toofar in the direction of overauditing.

Celebrate Sarbanes-Oxley's fifth anniversary withTreasury & Risk magazine. Read “Finally, the Party CanStart”, the Cover Story of T&R's summer double issue.