1. Auditing Standards Update Dallas CPA Society 7 th Annual Education Conference May 26, 2011

2. 2 Today’s agenda ► Dodd-Frank Act and SOX 404(b) ► PCAOB Update ► AICPA Update

3. Dodd-Frank Act and SOX 404(b)

4. 4 ► Dodd-Frank Act permanently exempts non-accelerated filers from SOX 404(b) auditor attestation requirement ► Companies with less than $75 million of worldwide public float (at end of 2 nd fiscal quarter) ► Companies with no public float (only registered debt and preferred securities) ► Former accelerated filers after public float drops below $50 million ► Under current SEC regulations, non-accelerated filers must continue to report on management’s assessment of internal control (SOX 404(a))

5. PCAOB Update

6. 6 New PCAOB Board members ► PCAOB ► James R. Doty, Chairman ► Partner at Baker Botts LLP ► Jay D. Hanson, Member ► Partner at McGladrey & Pullen LLP ► Lewis H. Ferguson ► Partner at Gibson, Dunn & Crutcher LLP ► Founding members Bill Gradison and Charles D. Niemeier have retired

7. 7 PCAOB risk assessment standards - Background ► The PCAOB issued eight auditing standards in August 2010 (collectively, the risk assessment standards) ► The risk assessment standards: ► Update the PCAOB’s interim standards ► Address observations from the PCAOB’s inspection findings ► Consider the standard-setting activities of the ASB and IAASB ► Effective for audits of issuers for fiscal years beginning on or after 15 December 2010 (i.e., 2011 audits of calendar year-end entities)

8. 8 PCAOB risk assessment standards – Areas of emphasis ► Consideration of risks of material misstatement due to fraud and error ► Obtain a thorough understanding of the entity to inform risk assessments ► Consider information obtained throughout the audit process to assess if there are additional risks of material misstatement due to fraud ► Consideration of financial statement disclosures ► Develop expectations about the necessary disclosures ► Consider risks of material misstatement due to inaccurate, incomplete or omitted disclosures

9. 9 PCAOB risk assessment standards – What’s new ► Understand the business ► Nature of the entity ► Sources of the entity’s earnings, including relative profitability of key products and services ► Key supplier and customer relationships ► Significant accounting policies ► Consider financial reporting competencies of personnel involved in selecting and applying significant new or complex accounting principles ► Consider accounts or disclosures for which judgment is used in the application of significant accounting policies ► Develop expectations about the necessary disclosures ► Considerations from other engagements ► Review of information ► Public information about the entity ► Transcripts of earnings calls ► Compensation arrangements with senior management ► Trading activity in the entity’s securities and holdings in the company’s securities

10. 10 PCAOB risk assessment standards – What’s new (cont.) ► Significant risks ► Develop an overall and a specific response ► Include tests of details in the specific response ► Team planning event ► Include team members with significant engagement responsibilities in the TPE ► Discussion should include: ► The entity’s selection and application of significant accounting policies ► Disclosures that are necessary for fair presentation of the financial statements ► How fraud may be perpetrated or concealed by omitting disclosures or by presenting incomplete or inaccurate disclosures

11. 11 PCAOB risk assessment standards – What’s new (cont.) ► Tests of controls ► Rotating tests of controls is not applicable for any issuer audits ► Lower risk controls guidance can be applied on all issuer audits ► Summary of audit differences (SAD) ► Omitted or inaccurate disclosures are considered misstatements ► Perform additional procedures around offsetting entries identified by management ► Expanded qualitative considerations when evaluating the SAD ► Multilocation engagements ► The Primary Team: ► Assesses whether the components significant based on size and significant based on risk provide sufficient evidence about the group financial statements and add additional components into our audit scope as necessary ► Concludes that the components not included in the group audit scope do not, individually or in the aggregate, have a reasonable possibility of containing a material misstatement to the group financial statements ► Considers the factors in the multilocation supplement when performing this evaluation ► Document our consideration of components to be included in scope

12. AICPA Standard setting update

13. 13 Clarity Project Overview ► Goals ► Address concerns over length and complexity of standards ► Make standards easier to read, understand and implement ► Will lead to enhancements in audit quality

14. 14 Convergence with International Standards ► International Standards on Auditing (ISAs) issued by IAASB ► Clarity drafts use ISAs as base while avoiding unnecessary differences with PCAOB standards ► Harmonize, not adopt ► Most audits performed internationally are of nonpublic entities – therefore, ASB and IAASB have a similar focus IAASB, ASB, GAO, PCAOB

15. 15 Clarity Drafting Conventions ► Introduction ► Objective ► Definitions ► Terms used in the SAS are defined ► Establish separate glossary of terms ► Requirements ► Application Material

16. 16 Objective of each SAS ► Create objectives for each standard ► Establish obligation relating to the objective ► Provide a framework for the application of professional judgment ► Outcome based goal ► Difficult to achieve the overall objective of the audit if individual objectives are not achieved

17. 17 Requirements & Application Material ► Requirements ► Expressed with must or should ► Application and other explanatory material ► Presented in a separate section that follows the requirements ► Indicated with may ► Paragraphs numbered using an A prefix ► Cross-referencing between requirements and related application material

18. 18 Status of Clarity Project ► Once all clarified standards have been finalized, most will be issued in one SAS (SAS No. 12X) that will be codified in “AU section” format ► Planned effective date for financial statements for periods ending on or after December 15, 2012 (2012 year-end audits) ► To address practice issues, certain clarified SASs (SASs No. 117 – 120) have been assigned numbers and already been issued

19. 19 SAS No. 117, Compliance Auditing ► SAS responds to federal study indicating need for improvements in quality of audits under OMB Circular A133, Audits of States, Local Governments, and Non- Profit Organizations ► Supersedes SAS 74, Compliance Auditing Considerations in Audits of Governmental Entities and Recipients of Governmental Financial Assistance ► Issued in December 2009, effective for periods ending after June 15, 2010

20. 20 SAS No. 117, Compliance Auditing ► Applicable when performing a compliance audit in accordance with all of the following: ► GAAS ► The standards for financial audits under Government Auditing Standards (AKA: Yellow Book or GAGAS) ► A governmental audit requirement requiring the auditor to express an opinion on compliance ► Appendix identifies the AU sections that are not applicable to a compliance audit

21. 21 SAS No. 118, Other Information in Documents Containing Audited Financial Statements ► Effective for audits of financial statements for periods beginning on or after December 15, 2010 ► Early application is permitted ► Supersedes AU section 550 and (along with SAS No. 119) AU section 551

22. 22 SAS No. 118, Other Information in Documents Containing Audited Financial Statements ► Other Information (OI) = information that is included in a document containing audited financial statements and the auditor’s report thereon, excluding required supplementary information ► Eliminates the distinction between OI that is in an auditor submitted vs. client prepared document ► Make arrangements with management or those charged with governance to obtain the OI prior to the report release date ► Read the OI that the auditor is aware of in order to identify material inconsistencies with the AFS

23. 23 SAS No. 119, Supplementary Information in Relation to the Financial Statements as a Whole ► Effective for audits of financial statements for periods beginning on or after December 15, 2010 ► Early application is permitted ► Supersedes (along with SAS No. 118) AU section 551

24. 24 SAS No. 119, Supplementary Information in Relation to the Financial Statements as a Whole ► In order to opine on whether SI is fairly stated in relation to the financial statements as a whole, the auditor determines that all of the following conditions are met: ► The SI was derived from, and relates directly to, the underlying accounting and other records used to prepare the f/s ► The SI relates to the same period as the f/s ► The f/s were audited, and the auditor served as the principal auditor in that engagement

25. 25 SAS No. 119, Supplementary Information in Relation to the Financial Statements as a Whole ► In addition to procedures performed during the f/s audit, in order to provide an IRT opinion, the auditor performs the following procedures (using the same materiality level as used during the f/s audit): ► Inquire of management about the purpose of the SI and the criteria used by management to prepare the supplementary information (Regulator criteria, contractual, other) ► Determine whether the form and content of the SI complies with the applicable criteria ► Obtain an understanding about the methods of preparing the SI and determine whether the methods of preparing the SI have changed from those used in the prior period and, if the methods have changed, the reasons for such changes. ► Compare and reconcile the SI to the underlying accounting and other records used in preparing the f/s or the f/s themselves

26. 26 SAS No. 119, Supplementary Information in Relation to the Financial Statements as a Whole ► Inquire of management about any significant assumptions or interpretations underlying the measurement or presentation of the SI ► Evaluate the appropriateness and completeness of the SI, considering the results of the procedures performed and other knowledge obtained during the audit of the f/s ► Obtain written representations from management

27. 27 SAS No. 120, Required Supplementary Information ► Effective for audits of financial statements for periods beginning on or after December 15, 2010 ► Early application is permitted ► Supersedes AU section 558

28. 28 SAS No. 120, Required Supplementary Information ► RSI ► Information that a designated accounting standard setter requires to accompany an entity’s basic f/s ► RSI is not part of the basic f/s ► A designated accounting standard setter considers the information to be an essential part of the financial reporting for placing the basic f/s in an appropriate operational, economic, or historical context ► Authoritative guidelines for the methods of measurement and presentation of the information have been established

29. 29 SAS No. 120, Required Supplementary Information ► Required procedures: ► Inquire of management about the methods of preparing the information, including ► Whether it has been measured and presented in accordance with prescribed guidelines, ► Whether methods of measurement or presentation have changed from those used in the prior period and the reasons for any such changes, and ► Whether there were any significant assumptions or interpretations underlying the measurement or presentation of the information. ► Compare the information for consistency with ► Management’s responses to the inquires, ► The basic f/s, and ► Other knowledge obtained during the audit of the basic f/s. ► Obtain written reps from management

30. 30 SAS No. 120, Required Supplementary Information ► Include an explanatory paragraph in the auditor’s report on the f/s referring to the RSI. Different language is required based on whether: ► The RSI is included and the auditor has applied all of the required procedures ► The RSI is omitted ► Some RSI is missing and some is presented in accordance with the prescribed guidelines ► The auditor has identified material departures from the prescribed guidelines ► The auditor is unable to complete the required procedures ► The auditor has unresolved doubts about whether the RSI is presented in accordance with prescribed guidelines

31. 31 SAS 70 superseded ► Two new standards combined to supersede SAS 70 ► ISAE 3402, Assurance Reports on Controls at a Service Organization ► SSAE No. 16, Reporting on Controls at a Service Organization ► Several factors drove the need for the new standards ► Changes to service organizations’ reporting processes and reports ► Changes to service auditor responsibilities ► Moving from an audit standard to an assurance/attestation standard ► Using the work of internal audit ► Little effect on the user auditor as a result of this change ► Effective for reports covering periods ending on or after 15 June 2011

32. 32 Service Organizations What’s new? SSAE 16 ► Requires a service auditor to obtain an assertion from management of the service organization ► States that evidence obtained in prior engagements about the satisfactory operation of controls does not provide a basis for a reduction in testing

33. 33 Service Organizations What’s new? SSAE No. 16 ► Requires the service auditor’s description of tests of controls to identify work performed by internal audit and the service auditor’s procedures with respect to that work ► For type 2 reports, changes the period covered by the service organization’s description of the system SAS No. 70SSAE No. 16 Type 2 ReportAs of a periodFor a period

34. 34 Service Organizations ► SSAE 16 is effective for periods ending on or after June 15, 2011. ► SAS for user auditors is provisionally effective for periods ending on or after December 15, 2012 (same as other clarified SASs)

35. 35 Questions