Google SAS 104-115 and you will find mostly articles by us (Vibato) discussing the need for auditors to pay special attention to internal controls as part of their audit. Why? Because the AICPA & the PCAOB dictates standards that the auditors must adhere to in order to perform their audits. Parts of these requirements include reviewing your internal controls and this applies to ANY COMPANY THAT IS AUDITED – public, private, non-profit; it doesn’t matter. If you are audited, your auditors must look at your internal controls as part of your audit. If you do not have any documented internal controls then be prepared for a higher audit bill because your auditors will have to go looking for internal controls at your company on your dime year-over-year. Moreover, due to independence issues, they are not allowed to share their work with you to use going forward so they will do this work each year and all you will see for it is a higher bill. Period.
We always harp on the idea that being an external auditor is not a right but a privilege and that privilege can be revoked if they do not do a good enough job. The AICPA & PCAOB will subject your external auditor to peer reviews and the results of this review will be published publically (talk about pressure).
Therefore, next time you wish your external auditor would just accept good enough and just move onto another client, keep this in mind – they are going to be audited too and if they fail, they could be forced out of business, like this company: http://pcaobus.org/Enforcement/Adjudicated/Documents/Cordovano_and_Honeck.pdf
So, why should you care? If your external auditor is doing things that could cause them to “get in trouble” with the AICPA or PCAOB such as violating their independence rules or not reviewing your internal controls, etc., the PCAOB could force you to restate your 10Q or 10K because the opinion rendered by your external audit was not considered appropriate.
To this day, we see a lot of external auditors treading the independence line so this is not a topic that was just relevant in the Enron days. Just last month we had a public client whose external auditor wanted to perform revenue analysis work and external audit work and luckily the client said no. The external auditor argued that the client would have to pay more in audit fees if they did not allow them to do this work too but the client wouldn’t budge and nor should they – auditors are not allowed to audit their own work and if they are caught doing so, it could cost you a restatement. Keep this in mind when they try these things and read the above link. You must be your own advocate and know what you have to look out for at all times.