Other regulatory bodies

Learning outcome statements

The learning outcome statements relevant for this section are:

1. identify the role of the Public Company Accounting Oversight Board (PCAOB) in providing guidance on the auditing of internal controls
2. differentiate between a top-down (risk-based) approach and a bottom-up approach to auditing internal controls
3. identify the PCAOB preferred approach to auditing internal controls
4. identify and describe the major internal control provisions of the Foreign Corrupt Practices Act

Public Company Accounting Oversight Board (PCAOB)

The Public Company Accounting Oversight Board (PCAOB) was established under Title I of the Sarbanes-Oxley Act (SOX) of 2002 in response to major corporate accounting scandals. Its primary mission is to oversee the audits of public companies and broker-dealers in order to protect investors and promote accurate, transparent, and independent financial reporting. The PCAOB’s jurisdiction covers auditors of publicly traded companies and broker-dealers that file reports with the U.S. Securities and Exchange Commission (SEC).

Registered public accounting firms are audit firms that prepare or issue audit reports for SEC-registered public companies or broker-dealers; they must register with the PCAOB before performing such audits. The PCAOB inspects these firms to assess their compliance with auditing standards and the quality of their audit work: (1) annually for firms that audit more than 100 issuers, and (2) at least once every three years for other registered firms.

It also has the authority to conduct investigations and disciplinary proceedings in cases of misconduct or violation of standards. The PCAOB provides standards and guidance for auditors, particularly in the area of internal control over financial reporting (ICFR). A key element of its role is issuing auditing standards that define how audits should be planned, performed, and documented, including how auditors should approach testing internal controls.

Top-down (risk-based) vs. bottom-up approach

• The top-down approach, preferred by the PCAOB under Auditing Standard AS 2201, begins with identifying and assessing entity-level controls and major risks, then moves down to significant accounts, disclosures, and relevant assertions. This approach is considered more effective because it directs testing toward the accounts and assertions with a reasonable possibility of material misstatement, and it can reduce the amount of testing needed for lower-risk controls.
• The bottom-up approach involves detailed testing of individual controls at the transaction or process level without necessarily aligning to overall risk assessment. It can be less efficient and less effective at identifying systemic weaknesses.

Foreign Corrupt Practices Act (FCPA)

The Foreign Corrupt Practices Act (FCPA) is a U.S. federal law that addresses both anti-bribery and accounting transparency requirements for companies. While it is widely known for prohibiting bribery of foreign officials, the FCPA also imposes significant internal control and recordkeeping obligations on companies to prevent and detect corruption. Key internal control provisions of the FCPA include:

Books and records requirement

Companies must maintain books, records, and accounts that accurately and fairly reflect the company’s transactions and disposition of assets. This requirement applies even if the company is unaware of the corruption.

Internal controls requirement

Companies must design and maintain a system of internal accounting controls sufficient to provide reasonable assurance that:

1. Transactions are executed with management’s authorization.
2. Transactions are recorded accurately to permit preparation of financial statements and to maintain accountability of assets.
3. Access to assets is permitted only with proper authorization.
4. Recorded assets are compared with existing assets at reasonable intervals and appropriate action is taken regarding any discrepancies.

These provisions apply to issuers of securities registered with the U.S. Securities and Exchange Commission (SEC), including U.S. public companies and certain foreign issuers. Even without evidence of bribery, failure to comply with these internal control provisions can lead to enforcement actions.

Example: Mischaracterized bribe

A foreign subsidiary pays a local government official to win a contract, then records the payment in its books as a “consulting fee.” Even if regulators can’t prove the anti-bribery charge, the company has still violated the FCPA’s books-and-records provision, since the entry doesn’t accurately reflect the true nature of the transaction, and its internal-controls provision, since the payment was never properly authorized or reviewed. Both violations stand on their own, independent of whether bribery is proven.