Page 187 - COSO Guidance Book

Are independent auditors part of the entity’s

internal control?

A question often arises when auditors of nonpublic entities help their clients prepare their financial
statements: Can the auditor become part of the entity’s system of internal control? The answer, in short,
is no. The auditor cannot be a part of the entity’s internal control.

How an auditor responds to a client’s deficient internal control, in terms of designing and carrying out
further audit procedures, does not affect or mitigate that client’s internal control. Just as an auditor’s
response in terms of detection risk is independent of the client’s control risk, the auditor’s response to a
control weakness does not change the control weakness. Only the client — not the auditor — can correct
deficiencies in internal control. However, a CPA firm other than the auditor can be part of a client’s
internal control. This may raise new questions regarding the role of outsourcing in achieving
management’s internal control objectives.

A related issue that may cause concern is the extent to which the auditor may be involved in drafting an
entity’s financial statements. It is a strong indication of material deficiencies in an audit client’s internal
control if, in the preparation of their financial statements (including related footnotes), their controls are
absent or ineffective at preventing or detecting material misstatements. Although the auditor can
propose adjustments, he or she cannot establish or maintain the client’s controls, including monitoring
ongoing activities; doing so would impair independence.

A potential area of confusion in practice is the issue of independence when the auditor also performs
certain services in conjunction with an attest engagement. Activities such as financial statement
preparation, cash-to-accrual conversions, and reconciliations are considered outside the scope of an
attest engagement and, therefore, constitute a nonattest service subject to the interpretations under the
“Nonattest Services” subtopic (AICPA, Professional Standards, ET section 1.295) of the “Independence
Rule” (AICPA, Professional Standards, ET section 1.200) in the AICPA Code of Professional Conduct.

© 2020 Association of International Certified Professional Accountants. All rights reserved. 1-17