the internal control structure, and attesting to the substantive correctness of the financial statements are all mutually exclusive activities. In some cases the audit committee can make an exception, but it is assumed that a conflict of interest will result.
Even worse, formal control structure is not an area in which small businesses thrive. The extra bureaucracy it creates can be costly and complicated when one person is performing multiple jobs.
The group generally believed many small companies did not have the internal controls in place to comply with the new reporting requirements. In addition, they said it might not be economically feasible for some of those small companies to come into compliance. (Coustan et al.)
In cases like this, auditors have relied on the traditional substantive tests that are at the heart of an audit. The main purpose of the test of controls, from the financial statement perspective, was to limit substantive tests because they are more costly in large firms. In small firms there are few enough transactions that it is cheaper to skip the tests of controls altogether.
"CPAs who have audited small, publicly listed companies voiced concern about those for which the auditor develops audit evidence primarily through substantive testingà.
These CPAs were concerned that section 404's internal control requirements would call into question this audit strategy. In other words, it is possible for a client to receive a clean audit opinion while "failing" its internal control attestation. How will the marketplace interpret this? (Coustan et al.)
One must question whether internal control weakness in small companies constitutes a significant threat to the security of capital markets. If indeed the risk is immaterial, the cost is certainly burdensome.
The Sarbanes-Oxley Act also placed additional burdens upon the board of directors, such that the cost of finding and compensating indepe...