Comments on PCAOB-2007-02

On December 20, 2004, a working group of representatives from the major accounting firms in the U.S.A. outlined a suggested framework for evaluating manual and automated process/ transaction level, and information technology general control (“ITGC”) exceptions and deficiencies, in the context of ‘AUDITING STANDARD No. 2 – An Audit of Internal Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements’ issued March 9, 2004 by the Public Company Accounting Oversight Board. While the Introduction to this framework document cautioned readers that ‘the mere mechanical application of this framework will not, in and of itself, necessarily lead to an appropriate conclusion’, it uses unproven logic to provide guidance to auditors that could lead to increased audit sampling risk and non-sampling risk, particularly when complex information systems are being evaluated by audit teams lacking appropriate experience and expertise. This aspect of the framework should not be adopted by regulatory and standards setting bodies without debate, since it sets the stage for liberal assessment of internal controls over financial reporting.