The Auditing Standards Board (ASB) has issued an exposure draft of a proposed Statement on Auditing Standards (SAS) titled Amendment to Statement on Auditing Standards No. 55, Consideration of Internal Control in a Financial Statement Audit, as Amended by Statement on Auditing Standards No. 78, Consideration of Internal Control in a Financial Statement Audit: An Amendment to Statement on Auditing Standards No. 55.

The proposed SAS provides guidance to auditors about the effect of information technology (IT) on internal control, and on the auditor's understanding of internal control and assessment of control risk. The ASB believes the guidance is needed because entities of all sizes increasingly are using IT in ways that affect their internal control and the auditor's consideration of internal control in a financial statement audit. Consequently, in some circumstances, auditors may need to perform tests of controls to perform an effective audit.

The proposed SAS—

• Incorporates and expands the concept from SAS No. 80, Amendment to Statement on Auditing Standards No. 31, Evidential Matter (AU sec. 326.14), that in circumstances where a significant amount of information supporting one or more financial statement assertions is electronically initiated, recorded, processed, and reported, the auditor may determine that it is not practical or possible to restrict detection risk to an acceptable level by performing only substantive tests for one or more financial statement assertions. In such circumstances, the auditor should obtain evidential matter about the effectiveness of both the design and operation of controls to reduce the assessed level of control risk.

• Describes how IT may affect internal control, evidential matter, and the auditor's understanding of internal control and assessment of control risk.

• Describes both the benefits and risks of IT to internal control, and how IT affects the components of internal control, particularly the control activities and information and communication components.

• Provides guidance to help auditors determine whether specialized skills are needed to consider the effect of computer processing on the audit, to understand the controls, or to design and perform audit procedures.

• Clarifies that in obtaining an understanding of the entity's financial reporting process, the auditor should understand how both standard, recurring entries and nonstandard, nonrecurring entries are initiated and recorded, and should also understand the controls that have been placed in operation to ensure that such entries are authorized, complete, and correctly recorded.

• Updates terminology and references to IT systems and controls.

The proposed SAS does not—

• Eliminate the alternative of assessing control risk at the maximum level and performing a substantive audit, if that is an effective approach.

• Change the requirement to perform substantive tests for significant account balances and transaction classes.

The proposed effective date of the amendments is for audits of financial statements for periods beginning on or after June 1, 2001. Earlier application would be permitted.

Accounting and Review Services Committee Issues SSARS No. 8

By Kim M. Gibson

The Accounting and Review Services Committee (ARSC) has issued Statement on Standards for Accounting and Review Services (SSARS) No. 8, Amendment to Statement on Standards for Accounting and Review Services No. 1, Compilation and Review of Financial Statements.

SSARS No. 8 makes fundamental changes to the way in which accountants view compilation engagements. It creates new options for the accountant when performing compilation engagements in which the financial statements are not expected to be used by a third party, and also allows the accountant to use his or her professional judgment in dealing with a client. The following are two of the major changes introduced by the new standard.

• SSARS No. 8 revises the definition of the term submission of financial statements. The new definition of submission is "presenting to a client or third party financial statements that the accountant has prepared either manually or through the use of computer software." The new definition will solve the majority of the applicability problems that the profession has faced. Although practitioners will still have to use their professional judgment to determine if they have prepared and presented a financial statement, this modification was the best way to address today's technological environment, while still maintaining a minimum level of service.

• SSARS No. 8 provides new communication options for the accountant. If an accountant submits financial statements to a client that are not expected to be used by a third party, the following communication options are available:

  • Issuing a compilation report in accordance with the reporting requirements of SSARS No. 1

  • Documenting an understanding with the entity through the use of an engagement letter, preferably signed by management, regarding the services to be performed and the limitations on the use of those financial statements

The ARSC believes that by providing these communication options in a compilation engagement, the accountant will be able to use his or her professional judgment about the type of communication that is appropriate for the client, provide a quality service, and appropriately respond to the needs of clients. SSARS No. 8 is effective for financial statements submitted after Dec. 31, 2000.

The AICPA is also developing a companion Compilation and Review Alert titled Practical Guidance for Implementing SSARS No. 8: How to Understand and Apply the Amendments to SSARS No. 1, Compilation and Review of Financial Statements. The alert will include an overview of SSARS No. 8, suggest ways of implementing the standard, point out pitfalls that frequently occur in compilation engagements, and provide a series of questions and answers to help implement SSARS No. 8. The alert will be available in November 2000.

To order SSARS No. 8 and the companion Compilation and Review Alert, see the ordering information on page 13 and request product numbers 060661 and 022274, respectively.

New Director and Senior Technical Manager for the Audit and Attest Standards Team

By Judith M. Sherinsky

Charles (Chuck) E. Landes has joined the AICPA as Director of the Audit and Attest Standards Team. Chuck is here for a two-year tenure from the firm of Barnes, Dennig & Co. in Cincinnati where he serves as director in charge of accounting and audit.

Chuck recently completed a four-year term on the Auditing Standards Board of the AICPA where he chaired the Attestation Recodification Task Force and was a member of the Audit Issues Task Force. He is the former chair of the AICPA's Peer Review Committee of the Private Companies Practice Section of the AICPA. Additionally, he is a past member of the board of directors of the Ohio Society of CPAs, and has authored many articles for the Society's magazine.

Chuck is a frequent discussion leader and has twice received the AICPA/OSCPA outstanding discussion leader award. He is a graduate of Miami University with a B.S. in accounting. He received his M.B.A. from Bowling Green State University.

Susan Jones has become Senior Technical Manager for the AICPA's Audit and Attest Standards Team. She joined the AICPA in 1996 as a technical manager in the AICPA's Technical Information Team and then staffed the Private Companies Practice Section's Technical Information Committee (TIC). She was seconded to the International Federation of Accountants from 1997 to 1999 where she was a technical manager for the International Auditing Practices Committee.

Prior to joining the AICPA, Susan spent several years in industry, in the finance department of a consumer products company, and several years in public accounting in a small firm in New Jersey.

Susan is a CPA and holds a BS in Accounting from the University of Delaware, and an MBA in Finance from New York University.

Version 2.0 of SysTrust^SM

By Judith M. Sherinsky

The Systems Reliability Task Force of the AICPA's Assurance Services Committee in conjunction with the Canadian Institute of Chartered Accountants (CICA) is about to issue version 2.0 of the SysTrust^TM Principles and Criteria for Systems Reliability, which presents the criteria, illustrative controls, and implementation guidance for performing a SysTrust assurance engagement.

The objective of a SysTrust service is to increase the confidence of management, customers, and business partners in systems that support a business or a particular activity. Version 1.0 of SysTrust was issued in November 1999 as an examination-level attestation engagement in which the practitioner reports on the availability, security, integrity and maintainability of a system. Following are the principal changes introduced in version 2.0 of SysTrust.

• Revision of the guidance to permit practitioners to perform an engagement that addresses any one of the four SysTrust principles of availability, security, integrity or maintainability. In version 1.0, a practitioner could not accept a SysTrust engagement to report on less than all four principles and related criteria. In version 2.0, an engagement can be undertaken to report on any one or more of the four principles.

• Provision for engagements to report on systems that are in the preimplementation phase. Version 2.0 provides guidance for engagements in which the practitioner reports on the suitability of the design of controls for systems that have not yet been placed in operation. The related report for these engagements would be for a point in time rather than for a period of time.

• Expansion of the guidance to include agreed-upon procedures and consulting engagements. Version 2.0 includes agreed-upon procedures and consulting engagements in the range of services encompassed by SysTrust. An example of a SysTrust consulting engagement is one in which the practitioner assists an entity in evaluating its readiness for a SysTrust attestation engagement.

The SysTrust engagement was jointly developed by the AICPA and the CICA; accordingly, the guidance and illustrative reports address the professional standards of both countries.

Highlights of Technical Activities

The Auditing Standards Board (ASB) performs its work through task forces composed of members of the ASB and others with technical expertise in the subject matter of the projects. The findings of the task forces periodically are presented to the members of the ASB for their review and discussion. Listed below are the current task forces of the ASB and a brief summary of their objectives and activities.

SAS and SSAE Task Forces

Attestation Recodification Task Force—Revision of Standards (Staff Liaison: Jane M. Mancino; Task Force Chair: Charles E. Landes). At its September 2000 meeting, the ASB voted to issue the proposed Statement on Standards for Attestation Engagements (SSAE) titled Attestation Standards: Revision and Recodification as a final attestation standard. The revised standard improves the understandability and utility of the attestation standards and will be SSAE No. 10 when it is issued in January 2001. SSAE No. 10 is effective when the subject matter or assertion is as of or for a period ending on or after June 1, 2001. Early application is permitted. A detailed article about the new SSAE will be included in the January 2001 issue of In Our Opinion.

Audit Documentation Task Force (Staff Liaison: Gretchen Fischbach; Task Force Chair: W. Scott McDonald). This task force is developing guidance regarding the objective, nature, and extent of audit documentation required for compliance with generally accepted auditing standards in a financial statement audit. The task force will either develop a Statement on Auditing Standards (SAS) to replace SAS No. 41, Working Papers, or amend that standard. It also will review the documentation guidance and requirements in other SASs to ensure consistency with the concepts and guidance in the new standard.

Continuous SysTrust Task Force (Staff Liaison: Judith M. Sherinsky; Task Force Chair: O. Ray Whittington). The task force is developing a conceptual model for continuous assurance engagements using the SysTrust attestation engagement to operationalize the model. At its October meeting, the task force developed "fundamental propositions" about continuous assurance as applied to a SysTrust engagement. The task force also considered procedures a practitioner might perform to monitor controls that address the availability, security, integrity, and maintainability of a system, and further refined a report for the engagement.

Financial Instruments Task Force (Staff Liaison: Judith M. Sherinsky; Task Force Chair: Stephen D. Holton). In September 2000, the ASB issued SAS No. 92, Auditing Derivative Instruments, Hedging Activities, and Investments in Securities. The ASB is concurrently developing a companion audit guide to help practitioners implement the new SAS. The guide will include an overview of derivatives and securities and the general accounting considerations for them, as well as case studies that address topics such as the use of interest rate futures contracts to hedge the forecasted issuance of debt, the use of put options to hedge available-for-sale securities, separately accounting for a derivative embedded in a bond, the use of foreign-currency put options to hedge a forecasted sale denominated in a foreign currency, and control risk considerations when service organizations provide securities services. The audit guide will be available in January 2001.

Fraud Task Force (Staff Liaison: Kim M. Gibson; Task Force Chair: David L. Landsittel). This new task force will consider revising SAS No. 82, Consideration of Fraud in a Financial Statement Audit, or recommend other related standard-setting initiatives based on—

• The recommendations of the Fraud Standard Steering Task Force
• The results of academic research on the effectiveness of SAS No. 82
• The recommendations of the Public Oversight Board's Panel on Audit Effectiveness regarding earnings management and fraud
• Information and recommendations provided by other financial reporting stakeholders

The task force also will be sensitive to international developments and the long-term need to work towards global audit standard-setting solutions.

Materiality Task Force (Staff Liaison: Judith M. Sherinsky; Task Force Chair: Andrew J. Capelli). In October 2000, the ASB approved the issuance of four interpretations of SAS No. 47, Audit Risk and Materiality in Conducting an Audit, (AU sec. 312) that address—

• The meaning of the term misstatement
• The auditor's evaluation of the difference between an estimate best supported by the audit evidence and the estimate included in the financial statements
• Factors to be considered in determining quantitative measures of materiality, for example, the perceived needs of the financial statement users
• Factors to be considered in determining the qualitative characteristics of misstatements, for example, the potential effect of the misstatement on trends in profitability

Omnibus SAS—2000 Task Force (Staff Liaison: Gretchen Fischbach; Task Force Chair: James S. Gerson). In October 2000, the ASB issued SAS No. 93, Omnibus Statement on Auditing Standards—2000. The SAS—

• Withdraws SAS No. 75, Engagements to Apply Agreed-Upon Procedures to Specified Elements, Accounts, or Items of a Financial Statement, and transfers that guidance to the attestation standards to consolidate the guidance on agreed-upon procedures engagements.
• Amends SAS No. 58, Reports on Audited Financial Statements, to include a reference in the auditor's report to the country of origin of the accounting principles used to prepare the financial statements, and the auditing standards the auditor followed in performing the audit.
• Amends SAS No. 84, Communications Between Predecessor and Successor Auditors, to clarify the definition of a predecessor auditor.

To obtain a copy of SAS No. 93, see the ordering information on page 13 and request product number 060695.

Risk Assessments Task Force (Staff Liaison: Julie Anne Dilley; Task Force Chair: John A. Fogarty, Jr.). The task force will revise the risk assessment framework to more clearly articulate the relationship of inherent, control, fraud, and other risks and the auditor's consideration of and response to these risks. The framework likely will reside in a new auditing standard related to the second standard of fieldwork and will incorporate relevant material from SAS No. 47. In addition, the task force will draft a new standard that will provide guidance to the auditor in assessing inherent risk. The standard may provide guidance on how other risks such as fraud risk, business risk, and engagement risk affect inherent risk. The task force may also decide to issue other non-authoritative guidance, such as industry specific guidance to help the auditor in understanding the business. The task force will consider the recommendations of the Panel on Audit Effectiveness, the recommendations of the Joint Working Group, and the actions of the International Auditing Practices Committee in its deliberations.

Technology Issues Task Force (Staff Liaison: Julie Anne Dilley; Task Force Chair: George H. Tucker). In September 2000, the ASB issued an exposure draft that proposes amendments to AU section 319, Consideration of Internal Control in a Financial Statement Audit, to address both the benefits and the risks of information technology on internal control, and the auditor's consideration of internal control in a financial statement audit. For additional information about this project, see the article, "Revision of SAS No. 55 for Technology," on page 1.

Other Task Forces and Committees

Accounting and Review Services Committee (ARSC) (Staff Liaison: Kim M. Gibson; Committee Chair: Diane S. Conant). The ARSC has issued Statement on Standards for Accounting and Review Services No. 8, Amendment to Statement on Standards for Accounting and Review Services No. 1, Compilation and Review of Financial Statements. For additional information about this project, see the article "Accounting and Review Services Committee Issues SSARS No. 8" on page 2.

Audit Issues Task Force (Staff Liaison: Gretchen Fischbach; Task Force Chair: James S. Gerson). The task force meets on a monthly basis to (1) oversee the ASB's planning process, (2) evaluate technical issues raised by various constituencies and determine their appropriate disposition, including referral to an ASB task force or development of an interpretation or other guidance, (3) address emerging audit and attestation practice issues and provide guidance for communication, as necessary, (4) provide advice on ASB task force objectives and composition, and monitor the progress of task forces, and (5) assist the ASB Chair and the Audit and Attest Standards staff in carrying out their functions, including liaison with other groups.

Auditing Revenues Steering Task Force (Staff Liaison: Julie Anne Dilley; Task Force Chair: Robert C. Steiner). The task force is overseeing the development of a guide on auditing revenue in certain industries that are not covered by existing AICPA Audit and Accounting Guides. The guide will focus on suggested auditing procedures to address industry-specific issues that present audit risks in revenue recognition. The task force hopes to issue guidance by the end of the year on auditing revenue transactions in the computer software, high technology manufacturing, and telecommunications services industries.

FASB 125 Audit Issues Task Force (Staff Liaison: Julie Anne Dilley; Task Force Chair: Tracey Barber). The task force will develop auditing guidance that addresses the use of legal interpretations as evidential matter for transfers of financial assets by banks for which a receiver, if appointed, would be the Federal Deposit Insurance Corporation (FDIC) or its designee. One of the criteria for a transfer of financial assets to be accounted for as a sale under Statement of Financial Accounting Standards No. 125, Accounting for Transfers and Servicing of Financial Assets and Extinguishments of Liabilities, is that the transferred assets have been isolated from the transferor and its creditors, even in bankruptcy or other receivership. The task force will meet in early December to discuss issues related to the type of legal letter that would be appropriate in light of the FDIC's final rule, issued in late July, entitled "Treatment by the Federal Deposit Insurance Corporation as Conservator or Receiver of Financial Assets Transferred by an Insured Depository Institution in Connection With a Securitization or Participation."

Fraud Standard Steering Task Force (Staff Liaison: Jane Mancino; Task Force Chair: Andrew J. Capelli). The following four proposals were selected by the ASB for academic research on the effectiveness of SAS No. 82, Consideration of Fraud in a Financial Statement Audit:

• Assessing the Effectiveness of SAS No. 82, by Steven Glover, Mark Zimbelman, and Douglas Prawitt of Brigham Young University and Joseph J. Schultz of Arizona State University. Using the prior study by Zimbelman (Journal of Accounting Research, Supplement, 1997) as a benchmark, the researchers attempt to determine, through behavioral experiments, changes in the nature and extent of planned audit testing due to elevated fraud risk.

• Audit Fraud Risk Assessment Information and Its Relationship to Audit Programs, by Theodore Mock of the University of Southern California and Jerry L. Turner of Florida International University. The researchers use archival methodology to study (1) the extent to which fraud risk assessments vary between clients in similar industry groups and over time, (2) the extent to which auditing procedures have been affected by the fraud risk assessment required by SAS No. 82, and (3) the nature of the adjustments in audit programs resulting from differences in fraud risk assessments.

• The Impact of a Standard Audit Program and Management Strategic Behavior on the Planning of Fraud Detection Procedures, by Steven K. Asare of the University of Florida and Arnie Wright of Boston College. Using a behavioral experiment, the researchers examine the effect of a standard program and management diversionary tactics on auditors' effectiveness in designing appropriate fraud-related procedures.

• Factors Used in Assessing the Risk of Management Fraud, by Barbara Apostolou of Louisiana State University and John M. Hassell of Indiana University. This study attempts to determine the relative importance of the SAS No. 82 risk factors to practicing auditors using the Analytic Hierarchy Process.

The ASB plans to discuss the results of the research at a meeting in the fall of 2000. The AICPA also has published the results of a research project commissioned by the ASB titled Fraud-Related SEC Enforcement Sanctions Against Auditors: 1987-1997, by Mark S. Beasley of North Carolina State University, Joseph V. Carcello of the University of Tennessee, and Dana R. Hermanson of Kennesaw State University. This study examines fraud-related SEC enforcement actions against auditors from January 1987 to December 1997 to identify the settings in which auditors were cited by the SEC, as well as the alleged deficiencies in the audit process that caused the auditors to be cited. To order a copy of this study see the ordering information on page 13 and request product number 990040.

Projected ASB Agenda

Codes: DI- Discussion of issues, DD - Discussion of draft document, ED-Vote to ballot a document for exposure, EP-Exposure Period, CL- Discussion of comment letters, FI- Vote to ballot a document for final issuance, SU- Status Update

Recently Issued and Approved Documents

Members of the Auditing Standards Board

AICPA Audit and Attest Standards Staff

For additional information about projects of the Audit and Attest Standards Staff and the ASB, call 212/596-6036.

In Our Opinion is published by the Audit and Attest Standards Staff of the American Institute of Certified Public Accountants, 1211 Avenue of the Americas, New York, NY 10036-8775. The views expressed herein are those of the authors and do not necessarily reflect the views of the American Institute of Certified Public Accountants. Official positions of the AICPA are determined through certain specific committee procedures, due process, and deliberation.

Editor: Judith M. Sherinsky
Administrative Editor: Jacqueline E. Walker