What is the auditor's responsibility for obtaining an understanding of internal control? How does that responsibility differ for audits of public and nonpublic companies?

A. The auditor's responsibility for obtaining an understanding of internal control for a large public company, when an opinion is issued on the effectiveness of internal controls, is significantly greater than the understanding necessary when the auditor is solely expressing an opinion on the financial statements. To express an opinion on internal controls for a large public company, the auditor obtains an understanding of controls for all significant account balances, classes of transactions, and disclosures and related assertions in the financial statements. In contrast, for an audit of a nonpublic company or a smaller public company, the auditor will obtain an understanding of internal controls that are relevant to the financial statement audit in order to assess the risks of material misstatement. Thus, the level of understanding of internal controls required for the audit of internal controls exceeds the level required for an audit of only the financial statements.

B. The auditor's responsibility for obtaining an understanding of internal control for a large public company, when an opinion is issued on the effectiveness of internal controls, is essentially the same as the understanding necessary when the auditor is solely expressing an opinion on the financial statements. To express an opinion on internal controls for a large public company or preparing an audit of a nonpublic company, the auditor obtains an understanding of controls for all account balances regardless of their size for all classes of transactions. For both engagements, the auditor must obtain an understanding of internal controls that are relevant to the financial statement audit in order to assess the risks of material misstatement. Thus, the level of understanding of internal controls required for the audit of internal controls is the same as the level required for an audit of only the financial statements.

C. The auditor's responsibility for obtaining an understanding of internal control for a large public company, when an opinion is issued on the effectiveness of internal controls, is significantly less than the understanding necessary when the auditor is solely expressing an opinion on the financial statements. To express an opinion for a nonpublic company, the auditor obtains an understanding of controls for all significant account balances, classes of transactions, and disclosures and related assertions in the financial statements. In contrast, for an audit of a public company, the auditor will obtain an understanding of internal controls that are relevant to the financial statement audit in order to assess the risks of material misstatement. Thus, the level of understanding of internal controls required for an audit of only the financial statements exceeds the level required for the audit of internal controls.

D. In audits of public companies, there is no requirement for an audit of internal control over financial reporting. The auditor, therefore, focuses on internal control only to the extent needed to assess the risks of material misstatements and perform a quality audit of financial statements. In contrast, in audits of nonpublic companies, the auditor's responsibility for obtaining an understanding of internal control when an opinion is issued on the effectiveness of internal controls, is significantly less than the understanding necessary when the auditor is solely expressing an opinion on the financial statements.