When reporting on a financial institution’s internal control over financial reporting pursuant to the requirements of the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA), the auditor’s attestation engagement is required to be performed in accordance with American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements No. 10, Chapter 5, “Reporting on an Entity’s Internal Control Over Financial Reporting” (AT 501). Earlier this year, the AICPA’s Auditing Standards Board (ASB) issued an Exposure Draft of a new AT 501 that would have substantially conformed AT 501 to Public Company Accounting Oversight Board (PCAOB) Auditing Standard (AS) No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction With an Audit of Financial Statements. The proposed effective date of the new AT 501 was for calendar 2006 FDICIA engagements; however, there have been recent developments relative to the proposed revisions to AT 501.
On May 17, 2006, the PCAOB announced its intentions to amend certain aspects of AS2 to improve its implementation. Because the forthcoming changes to AS2 would be relevant to the revision of AT 501, the ASB, with the agreement of various banking regulators, has decided that it would be prudent to defer action on the final issuance of the new AT 501 pending the outcome of the PCAOB’s amendments to AS 2. As a result of the ASB’s deferral of acting on the final issuance of the proposed revisions to AT 501, and with the agreement of various banking regulators, the proposed AT 501 will not be effective in 2006. It is expected that the new AT 501 (as revised to reflect PCAOB amendments to AS 2) will be issued and will be effective in 2007.
It should be noted, however, that the ASB has certain conforming changes to the existing AT 501 which require that when performing and reporting on an AT 501 engagement, the auditor should use the definitions of control deficiency, significant deficiency, and material weakness as defined in AICPA Statement on Auditing Standards No. 112, Communicating Internal Control Related Matters Identified in an Audit (SAS 112). The following changes have been made to AT 501 to bring that standard into conformity with corresponding aspects of SAS 112:
- Deleting the term reportable condition and its definition;
- Replacing the definition of the term material weakness;
- Defining the terms control deficiency and significant deficiency;
- Replacing the guidance on evaluating control deficiencies with the relevant guidance from SAS 112;
- Identifying areas in which a control deficiency ordinarily is at least a significant deficiency in internal control;
- Identifying indicators of a control deficiency that should be regarded as at least a significant deficiency and a strong indicator of a material weakness in internal control;
- Requiring written communication of significant deficiencies and material weaknesses to management and those charged with governance; and
- Revising the illustrative reports contained in AT 501 to be consistent with the changes enumerated in the preceding bullets.
These conforming changes are effective when the subject matter or assertion is as of or for a period ending on or after December 15, 2006. The conformed version of AT 501 is available in full at http://www.aicpa.org/download/members/div/auditstd/AT-00501.PDF. |
