Page 153 - Auditing Standards

As of December 15, 2017

.72 After forming an opinion on the effectiveness of the company's internal control over financial reporting,

the auditor should evaluate the presentation of the elements that management is required, under the SEC's
rules, to present in its annual report on internal control over financial reporting. 16

.73 If the auditor determines that any required elements of management's annual report on internal control

over financial reporting are incomplete or improperly presented, the auditor should follow the direction in
paragraph .C2.

.74 The auditor may form an opinion on the effectiveness of internal control over financial reporting only
when there have been no restrictions on the scope of the auditor's work. A scope limitation requires the
auditor to disclaim an opinion or withdraw from the engagement (see paragraphs .C3 through .C7).

Obtaining Written Representations

.75 In an audit of internal control over financial reporting, the auditor should obtain written representations
from management -

a. Acknowledging management's responsibility for establishing and maintaining effective internal control
over financial reporting;

b. Stating that management has performed an evaluation and made an assessment of the effectiveness
of the company's internal control over financial reporting and specifying the control criteria;

c. Stating that management did not use the auditor's procedures performed during the audits of internal
control over financial reporting or the financial statements as part of the basis for management's
assessment of the effectiveness of internal control over financial reporting;

d. Stating management's conclusion, as set forth in its assessment, about the effectiveness of the
company's internal control over financial reporting based on the control criteria as of a specified date;

e. Stating that management has disclosed to the auditor all deficiencies in the design or operation of

internal control over financial reporting identified as part of management's evaluation, including
separately disclosing to the auditor all such deficiencies that it believes to be significant deficiencies
or material weaknesses in internal control over financial reporting;

f. Describing any fraud resulting in a material misstatement to the company's financial statements and
any other fraud that does not result in a material misstatement to the company's financial statements
but involves senior management or management or other employees who have a significant role in

the company's internal control over financial reporting;

g. Stating whether control deficiencies identified and communicated to the audit committee during

previous engagements pursuant to paragraphs .78 and .80 have been resolved, and specifically

150