Other regulatory bodies

Learning outcome statements

The learning outcome statements relevant for this section are:

1. identify the role of the Public Company Accounting Oversight Board (PCAOB) in providing guidance on the auditing of internal controls
2. differentiate between a top-down (risk-based) approach and a bottom-up approach to auditing internal controls
3. identify the PCAOB preferred approach to auditing internal controls
4. identify and describe the major internal control provisions of the Foreign Corrupt Practices Act

Public Company Accounting Oversight Board (PCAOB)

The Public Company Accounting Oversight Board (PCAOB) was established under Title I of the Sarbanes-Oxley Act (SOX) of 2002 in response to major corporate accounting scandals. Its primary mission is to oversee the audits of public companies and broker-dealers in order to protect investors and promote accurate, transparent, and independent financial reporting.

The PCAOB conducts inspections of registered public accounting firms on a regular basis: (1) annually for firms that audit more than 100 issuers; and (2) at least once every three years for other registered firms. Registered public accounting firms include all audit firms that prepare or issue audit reports for publicly traded companies or broker-dealers registered with the SEC. These firms must register with the PCAOB before performing such audits. to assess their compliance with auditing standards and the quality of their audit work.

It also has the authority to conduct investigations and disciplinary proceedings in cases of misconduct or violation of standards. The PCAOB’s jurisdiction covers auditors of publicly traded companies and broker-dealers that file reports with the U.S. Securities and Exchange Commission (SEC). The PCAOB provides standards and guidance for auditors, particularly in the area of internal control over financial reporting (ICFR). A key element of its role is issuing auditing standards that define how audits should be planned, performed, and documented.

Top-down (risk-based) vs. bottom-up approach:

• The top-down approach, preferred by the PCAOB, begins with identifying and assessing entity-level controls and major risks, then moves down to significant accounts, disclosures, and relevant assertions. This helps auditors focus on areas of greatest risk.
• The bottom-up approach involves detailed testing of individual controls at the transaction or process level without necessarily aligning to overall risk assessment. It can be less efficient and less effective at identifying systemic weaknesses.

Through its oversight, standard-setting, and inspection activities, the PCAOB plays a critical role in enhancing audit quality and ensuring investor confidence in capital markets.

Foreign Corrupt Practices Act (FCPA)

The Foreign Corrupt Practices Act (FCPA) is a U.S. federal law that addresses both anti-bribery and accounting transparency requirements for companies. While it is widely known for prohibiting bribery of foreign officials, the FCPA also imposes significant internal control and recordkeeping obligations on companies to prevent and detect corruption. Key internal control provisions of the FCPA include:

Books and records requirement

Companies must maintain books, records, and accounts that accurately and fairly reflect the company’s transactions and disposition of assets. This requirement applies even if the company is unaware of the corruption.

Internal controls requirement

Companies must design and maintain a system of internal accounting controls sufficient to provide reasonable assurance that:

1. Transactions are executed with management’s authorization.
2. Transactions are recorded accurately to permit preparation of financial statements and to maintain accountability of assets.
3. Access to assets is permitted only with proper authorization.
4. Recorded assets are compared with existing assets at reasonable intervals and appropriate action is taken regarding any discrepancies.

These provisions apply to issuers of securities registered with the U.S. Securities and Exchange Commission (SEC), including U.S. public companies and certain foreign issuers. Even without evidence of bribery, failure to comply with these internal control provisions can lead to enforcement actions.

The FCPA emphasizes the importance of strong internal controls not only for accurate financial reporting but also as a deterrent against corrupt practices across global operations.