Excerpts from Auditing Standard No.2   SEC & PCAOB > PCAOB > Auditing Standard No. 2 On June 18, 2004, the Public Company Accounting Oversight Board announced that its Auditing Standard No. 2, “ An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements,” had been approved by the Securities and Exchange Commission. This standard is the standard on attestation engagements referred to in Section 404(b) as well as Section 103(a)(2)(A) of the Sarbanes-Oxley Act of 2002. It addresses both the work that is required to audit internal control over financial reporting and the relationship of that audit to the audit of the financial statements. SOX-online has provided the full text of the standard. But it's very long, so we've also provided the following excerpts. Note: Do not use any excerpt itself to guide your company's actions or approaches. This standard is complicated, and should be interpreted carefully by the proper functions in your organization. Dates and Definitions Effective Date Definitions Related to Internal Controls Over Financial Reporting The Concept of Reasonable Assurance Controls Control Environment Identifying Company Level Controls Identifying Controls to Test Testing Controls Management Self Assessment of Controls Inherent Limitations of Internal Controls Management Responsibilities Framework used by Management Required Management Certifications Testing and Evaluating Design Effectiveness Management Documentation Identifying Significant Processes Management Self Assessment of Controls Management Responsibilities in an Audit Testing Testing Controls Management Self Assessment of Controls Evaluating the Results of Testing The Audit Performing an Audit Evaluating Management Assessment Processes Forming an Opinion and Reporting Auditing Evaluating the Significance of a Deficiency Examples of Significant Deficiencies Additional Performance Requirements and Directions