"Have we identified, documented and tested controls to address the risks to Internal Control over Financial Reporting (ICFR) rules?"

Greg Scates, deputy chief auditor of the PCAOB, agrees. "Some of us are of the view that some companies out there may not have accurate books, records and controls over how these level two pricings are produced" by the pricing service firms, he says. "How does management know that the prices are good? What checks do they have to challenge the numbers they get? Does management know what technique was used to calculate a price for a security? If companies are just reporting numbers that are provided to them by a service, that's a problem."

The growing use of pricing service firms, such as Bloomberg, Standard & Poor's and Interactive Data Corp., as well as many smaller players, "puts auditors in a difficult situation," Scates says. "Under our rules, the auditor has to get behind those numbers. They need to do some testing."

There is currently no regulation of pricing firms, he says, and no proposal to regulate them. But the PCAOB has a task force on the issue and "we're developing some additional guidance for auditors," he notes.

That should put managers of companies that are using pricing firms or are considering using them on notice that they should be prepared to stand behind the numbers.

"It's definitely an area of focus for auditors, and clearly it is going to be a focus for both management and auditors," says Mike Santay, a partner at Grant Thornton responsible for auditing standards. "Management is going to be asked more questions about these numbers going forward."

For a discussion of another recent effort by accounting regulators, a PCAOB proposal to require that companies switch outside auditors regularly, read A New Spin for Audit.