ACC 4150 Module 7 Final Project: Comparing Major Auditing Standards Example

One Company, Four Rulebooks: How PCAOB, AICPA, GAGAS and International Auditing Standards Differ and Why It Matters

Student Name

Bachelor of Science in Business Administration, Thomas Edison State University

ACC-4150: Advanced Audit

Mentor Name

Month Day, Year

One Company, Four Rulebooks: How PCAOB, AICPA, GAGAS and International Auditing Standards Differ and Why It Matters

Introduction

An auditor in the United States may work under four different sets of auditing standards in the same year. Audits of public companies are performed under the auditing standards that the PCAOB sets. Privately held clients are audited under the American Institute of Certified Public Accountants' (AICPA) auditing standards. An audit of a government or of an organization spending federal grants follows Generally Accepted Government Auditing Standards (GAGAS), issued by the Government Accountability Office. And an audit of a foreign subsidiary, or of a company reporting abroad, may follow the International Standards on Auditing (ISAs) issued by the International Auditing and Assurance Standards Board (IAASB).

The four sets share a common foundation: risk assessment, sufficient appropriate evidence, professional skepticism and a reasonable assurance opinion. Since the AICPA's clarity project, its standards have been largely converged with the ISAs, and GAGAS builds on AICPA standards rather than replacing them. Yet meaningful differences remain, and they reflect different users and different regulatory purposes. This paper analyzes those differences in seven areas and then applies them to a single composite company.

Scope and Authority

The PCAOB was created by the Sarbanes-Oxley Act of 2002 to oversee the audits of public companies after the accounting scandals of that period. Its standards, numbered as AS sections, apply to audits of issuers and registered broker-dealers, and the PCAOB inspects registered firms and can discipline them. For larger public companies, PCAOB standards also require the auditor to report on how well internal control over financial reporting works.

The AICPA's Auditing Standards Board issues Statements on Auditing Standards, codified in AU-C sections, for audits of nonissuers: private companies, nonprofits and many smaller entities. Enforcement comes through state licensing boards, the AICPA's professional ethics program and peer review rather than a government inspector.

GAGAS applies when law, regulation, contract or policy requires it, most often for governments and for recipients of federal awards subject to the Single Audit. For financial audits, GAGAS incorporates the AICPA standards by reference and adds requirements on independence, qualifications, quality management and reporting (Government Accountability Office [GAO], 2024).

The ISAs are issued by the IAASB, an independent standard setter supported by the International Federation of Accountants. They have no force of their own; they apply where national regulators or laws adopt them, which many countries have done, sometimes with local additions.

The Auditor's Report

The most visible difference is the report. Since 2017 the PCAOB's standard has required the opinion to appear first, a statement of the auditor's tenure and, for most audits of public companies, a description of critical audit matters: matters communicated to the audit committee that relate to material accounts or disclosures and involved especially challenging, subjective or complex judgment (Public Company Accounting Oversight Board [PCAOB], 2017). Each critical audit matter must describe the principal considerations and how the auditor addressed it.

The ISAs introduced a similar concept earlier through ISA 701, requiring key audit matters in reports on listed entities: the matters of most significance in the audit, selected from those communicated with those charged with governance. Key audit matters are drawn from a somewhat broader pool than critical audit matters, which are tied to material accounts or disclosures, and international reports also include sections on going concern and other information.

The AICPA's Statement on Auditing Standards No. 134 aligned the private company report's layout with the international and PCAOB formats, with the opinion first and expanded descriptions of responsibilities, but it does not require key audit matters; an auditor reports them only when engaged to do so. The GAGAS report on the financial statements follows the AICPA form and adds a statement that the audit was conducted under GAGAS, accompanied by the separate report on internal control and compliance.

Evidence on whether expanded reports help users is mixed. Gutierrez et al. (2018) studied the United Kingdom's adoption of expanded reports and found little change in investors' reactions, audit fees or audit quality. In an experiment, Gimbar et al. (2016) found that the effect of a critical audit matter paragraph on jurors' assessments of auditor liability depended on how precise the underlying accounting standard was, suggesting that the new disclosures carry legal as well as informational consequences.

Going Concern

Every one of the four makes the auditor ask whether the entity will survive the coming year, but each measures that year from a different starting point. PCAOB standards look to a reasonable period not exceeding one year beyond the date of the financial statements being audited. AICPA standards, revised in 2017, look to the period required by the financial reporting framework; under U.S. GAAP, that means looking twelve months past the day the statements are released, which normally ends later than the PCAOB window. ISA 570 requires the auditor to consider at least the same period management uses, which under international accounting standards is at least twelve months from the end of the reporting period.

Terminology also differs. U.S. standards speak of substantial doubt; the ISAs speak of a material uncertainty related to going concern. The reporting consequence is similar: an unmodified opinion with a separate section when the disclosure is adequate, and a qualified or adverse opinion when it is not. Carson et al. (2013) note that going concern reporting involves trade-offs between issuing warnings that turn out to be unnecessary and failing to warn before a failure, and the differing look-forward periods mean the same facts could produce different conclusions under different standards.

Independence

Independence rules differ in source and strictness. For public company audits, the SEC's independence rules and the PCAOB's own rules apply in addition to the AICPA Code of Professional Conduct, and the Sarbanes-Oxley Act prohibits specific nonaudit services, such as bookkeeping, financial information systems design and internal audit outsourcing, and requires audit committee preapproval of permitted services. Audit partners must rotate off public company engagements after five years.

The AICPA Code uses a conceptual framework supported by specific interpretations and permits some nonaudit services for private companies, such as preparing financial statements, if management takes responsibility and safeguards apply. GAGAS uses its own conceptual framework, requires documentation of threats and safeguards and prohibits certain services that the AICPA Code might allow. Internationally, the IESBA Code of Ethics serves a similar role, with stricter provisions for public interest entities, including partner rotation and limits on fees from nonaudit services.

Quality Management

Each standard setter has moved from quality control to quality management, requiring firms to design systems around a risk assessment of their own practice. The IAASB led with ISQM 1 and ISQM 2, effective in December 2022. The AICPA followed with Statements on Quality Management Standards, effective for systems in place by December 2025. The PCAOB adopted QC 1000 in 2024, replacing standards inherited from the AICPA in 2003, with an effective date set later to give firms time to implement it. GAGAS's 2024 revision likewise requires audit organizations to operate a quality management system and to undergo external peer review every three years.

The convergence here is substantial, but oversight differs. A firm auditing public companies is inspected by the PCAOB, while a firm auditing only private entities is subject to peer review administered by the profession. GAGAS adds its own peer review requirement, and an international firm faces whatever inspection regime its country has adopted.

Audit Documentation

Documentation rules show smaller but concrete differences. Under PCAOB standards, the auditor must assemble a complete and final set of documentation within 45 days after the report release date and retain it for seven years. Under AICPA standards, assembly must be completed within 60 days after the report release date, and documentation must be kept for at least five years. The ISAs ordinarily expect assembly within 60 days and leave the retention period to firm policy and national law, ordinarily at least five years. PCAOB standards also state that a lack of documentation is evidence that work was not done, a presumption that has shaped inspection findings.

Engagement Quality Review

An engagement quality review, a second partner's objective evaluation of significant judgments before the report is released, is required for every audit of a public company under PCAOB standards. Under the AICPA's and the IAASB's quality management standards, it is required for audits the firm's policies identify, including audits of listed entities under the ISAs and engagements the firm judges to carry higher risk. GAGAS relies on the firm's quality management system to determine when such reviews are performed.

Auditing Internal Control

The standards also differ on whether, and how, an auditor reports on internal control. Since Sarbanes-Oxley, the bigger listed companies receive a combined audit in which PCAOB rules govern both the statement opinion and a second opinion on whether reporting controls worked at year end. The AICPA has a parallel standard for an audit of internal control integrated with a financial statement audit, but private companies are not required to obtain one; it is performed only when a lender, regulator or board requests it. The ISAs contain no standard for an opinion on internal control at all. Where a country requires assurance on controls, auditors typically use the broader international standard for assurance engagements other than audits. GAGAS takes a fourth approach: it does not require an opinion on internal control in a financial audit, but it does require the separate report describing the scope of control testing and any significant deficiencies and material weaknesses found.

These differences mean that the same control weakness can produce an adverse opinion on internal control for a public company, a written communication to management and the board for a private company and a published finding in a government entity's audit report. Users therefore learn about control problems through very different channels, and with very different visibility, depending on the type of entity.

Fraud and Noncompliance

On fraud, the four sets of standards are closest. All four make the team brainstorm how the numbers could be falsified, start from a presumption that revenue is a fraud risk unless facts rebut it, and treat executives overriding controls as a danger in every engagement, so journal entries, estimates and odd one-off transactions always get scrutiny. The differences lie in what happens after fraud or illegal acts are found. Public company auditors have reporting obligations under the securities laws if management and the board fail to act on illegal acts that have a material effect. GAGAS goes further for public money, requiring auditors to report findings of fraud and noncompliance in the GAGAS report and, in some circumstances, directly to outside parties such as the agency that funded a program if the entity fails to do so. Private company auditors under AICPA standards communicate with management and those charged with governance and generally owe no duty to report outside the entity, subject to legal requirements.

Summary of Differences

Applying the Differences: A Composite Company

Consider Lenape Valley Instruments, Inc., a composite maker of laboratory instruments in Warren County, New Jersey. Its parent, Lenape Valley Holdings, is listed on the Nasdaq exchange. The New Jersey subsidiary holds a federal research grant of $1.8 million, and the group owns a subsidiary in Germany. One audit firm network could face all four sets of standards in one year.

The consolidated audit of the parent follows PCAOB standards: an integrated audit, a report with critical audit matters, perhaps on the valuation of the German subsidiary's goodwill, and documentation kept seven years. The German subsidiary's statutory audit follows the ISAs as adopted in Germany, with key audit matters only if the subsidiary is a listed or public interest entity. If the New Jersey subsidiary issued separate statements for its lenders, they would be audited under AICPA standards. Because it spends more than $1 million of federal awards, it also needs a Single Audit under GAGAS, with the report on internal control and compliance, compliance opinions on major programs and auditors meeting GAGAS continuing education requirements.

The practical risks lie at the edges. A going concern evaluation for the subsidiary might look one year beyond the issuance date under AICPA standards but only one year beyond the balance sheet date under PCAOB standards. A nonaudit service that the AICPA Code permits for the private subsidiary could be prohibited for the public parent if the subsidiary is consolidated, since SEC independence rules extend to affiliates. And documentation assembled on a 60-day schedule for the subsidiary would miss the 45-day deadline if the same work papers support the parent's audit. A firm managing such a group needs a mapping of which requirements apply to which entity, and in conflicts it usually applies the stricter rule to all. In practice that means planning documentation for the 45-day assembly deadline across the group, applying SEC independence rules to every affiliate the parent consolidates, and using the later of the two going concern horizons when evaluating the subsidiary. It also means staffing the Single Audit with team members whose continuing education meets GAGAS requirements, which may not be true of every auditor assigned to the public company engagement. A firm that treats the four sets of standards as interchangeable risks a PCAOB inspection finding, a deficient peer review or a federal agency's rejection of the Single Audit, each a costly outcome from what began as a scheduling decision.

Conclusion

The four sets of auditing standards share a common core but differ in ways that follow from whom they serve. PCAOB standards, built for public capital markets under a government regulator, emphasize communication to investors, strict independence and inspection. AICPA standards serve private companies and lenders and allow more flexibility. GAGAS adds accountability for public money through independence documentation, qualifications and reporting on internal control and compliance. The ISAs aim for a common global standard that countries adopt and adapt. Auditors working across these boundaries must know not only the shared principles but also the points where the rules part, because those are where engagements are most likely to go wrong (Messier et al., 2017).

References

Carson, E., Fargher, N. L., Geiger, M. A., Lennox, C. S., Raghunandan, K., & Willekens, M. (2013). Audit reporting for going-concern uncertainty: A research synthesis. Auditing: A Journal of Practice & Theory, 32(Supplement 1), 353-384. https://doi.org/10.2308/ajpt-50324

Gimbar, C., Hansen, B., & Ozlanski, M. E. (2016). The effects of critical audit matter paragraphs and accounting standard precision on auditor liability. The Accounting Review, 91(6), 1629-1646. https://doi.org/10.2308/accr-51382

Government Accountability Office. (2024). Government auditing standards: 2024 revision (GAO-24-106786).

Gutierrez, E., Minutti-Meza, M., Tatum, K. W., & Vulcheva, M. (2018). Consequences of adopting an expanded auditor's report in the United Kingdom. Review of Accounting Studies, 23(4), 1543-1587. https://doi.org/10.1007/s11142-018-9464-0

Messier, W. F., Glover, S. M., & Prawitt, D. F. (2017). Auditing and assurance services: A systematic approach (10th ed.). McGraw-Hill Education.

Public Company Accounting Oversight Board. (2017). The auditor's report on an audit of financial statements when the auditor expresses an unqualified opinion and related amendments to PCAOB standards (PCAOB Release No. 2017-001).