PCAOB Auditing Standard 2201 governs an audit of internal control over financial reporting (ICFR) that is performed together with the audit of the financial statements. The auditor forms two opinions from one set of work: whether the financial statements are fairly stated, and whether the company maintained effective ICFR. The method is top-down, starting from risk and working down to the controls that matter.
Last reviewed: 17 October 2026. Facts checked. A web search returned the PCAOB's page for AS 2201 and secondary summaries; the search summary noted amendments to paragraph .09 and a new paragraph .99 adopted by the PCAOB and approved by the SEC, effective 15 December 2026. We did not open the standard's full text, so we cannot describe what those amendments say. Paragraph numbers beyond that are not cited. Check the current text on pcaobus.org before relying on any detail.
Who this applies to
AS 2201 is a US PCAOB standard. It applies when an auditor of an SEC-registered company reports on ICFR, which in general depends on the company's filer status under SEC rules. Smaller companies may not need an auditor's ICFR opinion. Management still assesses its own controls in many such cases. Confirm the status of a specific company with the relevant SEC rules rather than assuming.
For an Indian reader the closest local parallels are the auditor's report on internal financial controls under section 143(3)(i) of the Companies Act, with ICAI's guidance note on the topic. The structure is similar in spirit, but the two are different requirements and should not be treated as interchangeable. We cover the Indian angle for US-parented groups in SOX compliance for Indian subsidiaries.
"Integrated" means one audit, two opinions
The financial statement audit and the ICFR audit are planned and run together. Evidence gathered for one informs the other. If control testing finds a problem, the auditor has to consider what it means for the nature, timing and extent of substantive procedures. If substantive work turns up a misstatement the controls did not catch, that is a signal about the controls.
The top-down approach
The standard's central idea is that the auditor does not test every control. The work moves in this order:
- Start at the financial statements. Identify significant accounts and disclosures, and the relevant assertions for each. This follows the same logic as the audit assertions used in any risk-based audit.
- Identify where misstatement could arise. Understand the likely sources of misstatement and think about what could go wrong, including fraud.
- Evaluate entity-level controls first. These include the control environment, management override controls, risk assessment, and monitoring. Strong entity-level controls can affect how much testing is needed at the process level, though they do not replace it for higher-risk areas.
- Select the controls to test. Choose controls that address the identified risks. A control is worth testing if it would, on its own or with others, prevent or detect a material misstatement.
- Test design and operating effectiveness. Design asks whether the control, if it works as described, would meet its objective. Operating effectiveness asks whether it actually worked, and whether the person performing it had the authority and competence to do so.
The point to take from this list is the order. Scoping starts with risk to the financial statements, not with a list of controls.
Testing a control: the usual evidence
The auditor uses the same evidence types as in any audit: inquiry, observation, inspection and reperformance. Inquiry alone is not enough for a control test. For an approval control, for example, the auditor would inspect a sample of approved items and reperform the check.
Where the control is a system-generated report or an automated rule, the auditor also needs comfort that the report is complete and accurate, and that IT general controls over the system are sound. Our guide to audit evidence types and reliability covers the general principles.
Evaluating deficiencies
When a control fails, the auditor evaluates the severity of the deficiency. US terminology uses three levels:
- Deficiency, the lowest level.
- Significant deficiency, which is less severe than a material weakness but important enough to merit attention of those overseeing financial reporting.
- Material weakness, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.
The severity depends on whether there is a reasonable possibility the control will fail to prevent or detect a misstatement, and on the potential magnitude. Compensating controls may be considered. Our detailed post on classifying control deficiencies works through examples.
If one or more material weaknesses exist at the reporting date, the auditor cannot conclude that ICFR was effective.
Practical points for a team working on a US group
- Documentation of the control, not just the test. A control description should say who does what, how often, using what information, and what happens when an exception is found.
- Precision matters. A review control that says only "reviewed by manager" is hard to test. Record the threshold, the follow-up of exceptions and the evidence kept.
- Timing. The conclusion is as of a date. Remediation made after that date does not change the conclusion, though it is valuable information for management.
- Reliance on others. The standard allows the auditor to use the work of others in defined circumstances. The auditor must still evaluate their competence and objectivity.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error