(The news featured below is a selection from the news covered in SEC Today, which is distributed to subscribers of SEC Today.)

Accounting Firms Create Framework for Evaluating Internal Control

The Big Four accounting firms, along with five other accounting firms, have developed a framework to assist with the evaluation of a company's internal control over financial reporting. PCAOB Chief Auditor Douglas Carmichael referred to the framework at the recent meeting of the PCAOB's Standing Advisory Group, and said the Board believes the framework is a useful tool. Both he and the firms noted, however, that the framework is not a substitute for Accounting Standard No. 2 and the other relevant professional literature.

The accounting firms caution that the framework is not intended for use in evaluating control deficiencies in IT general controls and other types of exceptions and deficiencies. The firms also advise that the framework requires significant judgment and is intended to assist knowledgeable and experienced individuals. Different individuals evaluating similar fact patterns may reach different conclusions on the basis of their judgment and quantitative and qualitative factors, according to the firms.

The firms considered the concepts of likelihood and magnitude outlined in AS2 in evaluating deficiencies in developing the framework. The framework considers quantitative and qualitative factors. Among the key assumptions the firms considered in developing the framework is that all exceptions and deficiencies resulting from the testing of controls must be evaluated since they relate to accounts and disclosures that are material to the financial statements as a whole.

The sample sizes used to test controls should provide a high level of assurance that the controls are operating effectively. The magnitude of a control deficiency under the framework is evaluated based on the impact of known and/or potential misstatements on the annual and interim financial statements. The firms note that some of the concepts in the framework relate to statistical sampling, but it is not required. In testing the internal controls, it may not be practical to randomly select samples, but the tests should be selected in an unbiased manner.

The framework does not address the determination of materiality, but refers users to AS2. AS2 states that the same conceptual definition of materiality that applies to financial reporting also applies to information on internal control over financial reporting, including the relevance of both quantitative and qualitative considerations.

The framework establishes guiding principles that correspond with charts on evaluating exceptions and deficiencies. In evaluating exceptions found in the testing of operating effectiveness, the paper notes that a control objective may be achieved by a single control or by a combination of controls. If a test objective is not met, the firms recommend consideration of whether additional testing could support a conclusion that the deviation rate does not represent the total population. The test could be extended and reevaluated or the exceptions could be considered a control deficiency that requires an assessment of its significance. The potential magnitude of deficiencies is based on the potential effect on annual and interim financial statements.

The potential magnitude of misstatement may be based on gross exposure, adjusted exposure or other methods that consider the likelihood of misstatement. If there are controls that effectively mitigate a control deficiency, it is classified as a deficiency. An unmitigated deficient control may be deemed a significant deficiency.

In evaluating the likelihood and magnitude of a material weakness, the framework considers a number of factors including the nature of the financial statement accounts, disclosures and assertions, the susceptibility of the related assets or liability to loss or fraud and the complexity or extent of judgment needed to determine the amount involved. Additional factors include the interaction or relationship with other controls, possible future consequences of a deficiency and the history of misstatements.