An auditor’s good judgment is very important. You’ll understand the significance of this trait when you learn about SOX 404 requirements – Work of Others and Materiality as explained in Auditing Standards No. 5 of PCAOB.
Part 3 will cover the following sections of Auditing Standards No. 5 (AS5):
I suggest you watch the video. It’s easier to understand if you are a visual/audio learner. The content below is the same as the video. It’s for those who learn by reading.
This section applies to both SOX service providers, internal auditors, and to everybody else who is NOT the external auditor. This section covers AS5 paragraphs 16 to 18. The summaries are below.
- Paragraph 16 – The auditor should be able to assess up to what extent can he or she use the work of others to reduce the work to be performed on his or her own. This is auditor’s consideration of the internal audit function in an audit of financial statements.
- Paragraph 17 – An external auditor can use the work performed by or receive direct assistance from internal auditors, company personnel, and third parties working under the direction of management or the audit committee.
- Paragraph 18 – When an auditor should use the work of others, the competence and objectivity of the owner or performer of the work to be used should be assessed. The higher degree of competence and objectivity, the greater the external auditor can use the work.
One of the notes under this paragraph explains the meaning of competency, which is having knowledge and the skills to do the work well and maintaining the skills and knowledge that enables that third party to do the work well.
It also defines objectivity, which is the ability to perform the task impartially and with intellectual honesty. If you are an outside party, you are more likely to do the testing with objectivity.
The second note tells that if only one of the two qualities are present (competent but not objective and vice versa), then the auditor should not use that particular work.
- Paragraph 19 – This talks about the extent to which the auditor can use the work of others would depend on the risk being tested. There are some firms that have policies on allowing auditors to rely on the work for low and medium risk areas, but for the high risk areas, they have to do the work themselves.
Now you know why using the work of others is so important for firms that provide outsourcing or co-sourcing for SOX. That is why external auditors have been asking us for the resumes or the bios of the A2Q2 team doing SOX work.
This section has only one paragraph in AS5 focusing on this sole subject, thus, denoting the importance of materiality.
Paragraph 20 basically says that in planning the audit, the auditor has to use the same materiality that they would use in the financial statement audit.
Here, the details and calculations of materiality are left open to interpretation by the PCAOB.
Across the industry, there are similar ways to calculate materiality. It has now been defined as 5% of either of the following: revenue, total assets, EBITDA, or some other industry metric.
|Other Typical Metrics
|Metric to be used
|Net Operating Income
|Software or Services
|Net Revenue or Gross Revenue (depending on business model)
This is all about using materiality as a filter and using that same amount for the financial statement audits.
It’s also important to know that materiality is not just the numbers. It also has to do with knowing who the stakeholders are or if the people are looking at revenue versus EBITDA. By using those different metrics, you get different numbers, and there is judgment involved in what numbers you used.
This is the end of part 3 of the Auditing Standards No. 5. If you want to learn more on AS5, go to part 4 – Using Top-Down Approach.