You can read the press release for details. A brief summary is below.
The New Auditing Standard
The Board’s new standard is designed to achieve four objectives:
1. Focus the Internal Control Audit on the Most Important Matters – The new standard focuses auditors on those areas that present the greatest risk that a company’s internal control will fail to prevent or detect a material misstatement in the financial statements. It does so by incorporating certain best practices designed to focus the scope of the audit on identifying material weaknesses in internal control, before they result in material misstatements of financial statements, such as using a top-down approach to planning the audit. It also emphasizes the importance of auditing higher risk areas, such as the financial statement close process and controls designed to prevent fraud by management. At the same time, it provides auditors a range of alternatives for addressing lower risk areas, such as by more clearly demonstrating how to calibrate the nature, timing and extent of testing based on risk, as well as how to incorporate knowledge accumulated in previous years' audits into the auditors' assessment of risk and use the work performed by companies’ own personnel, when appropriate.
2. Eliminate Procedures that Are Unnecessary to Achieve the Intended Benefits – The Board examined every area of the internal control audit to determine whether the previous standard encouraged auditors to perform procedures that are not necessary to achieve the intended benefits of the audit. As a result, among other things, the new standard does not include the previous standard’s detailed requirements to evaluate management's own evaluation process and clarifies that an internal control audit does not require an opinion on the adequacy of management’s process. As another example, the new standard refocuses the multi-location direction on risk rather than coverage by removing the requirement that auditors test a "large portion” of the company’s operations or financial position.
3. Make the Audit Clearly Scalable to Fit the Size and the Complexity of Any Company – In coordination with the Board’s ongoing project to develop guidance for auditors of smaller, less complex companies, the new standard explains how to tailor internal control audits to fit the size and complexity of the company being audited. The new standard does so by including notes throughout the standard on how to apply the principles in the standard to smaller, less complex companies, and by including a discussion of the relevant attributes of smaller, less complex companies as well as less complex units of larger companies. The upcoming guidance for auditors of smaller companies will develop these themes even further.
4. Simplify the Text of the Standard – The Board’s new standard is shorter and easier to read. This is in part because it uses simpler terms to describe procedures and definitions. It is also because the standard has been streamlined and reorganized to begin with the audit itself, to move definitions and other background information to appendices, and to avoid duplication by cross-referencing to existing concepts and requirements that appear elsewhere in the Board’s standards and relevant laws and SEC rules. For example, the new standard eliminates the previous standard’s discussion of materiality, thus clarifying that the auditor’s evaluation of materiality for purposes of an internal control audit is based on the same long-standing principles applicable to financial statement audits. Also, in order to better coordinate the final standard and the SEC’s new rules and management guidance, the new standard conforms certain terms to the SEC’s rules and guidance, such as the definition of “material weakness” and use of the term “entity-level controls” instead of “company-level controls.”
