In concept, auditors can use bottom-up approach or a top-down approach to the audit of internal control over financial reporting. A top-down approach begins at the overall financial statement level and with the auditor's understanding of the overall risks to internal control over financial reporting. A bottom-up approach, by contrast, begins by treating all controls equally regardless of their underlying risk profile, such that routine controls that address relatively low risks are tested. According to the PCAOB, auditors of public companies:

a.Should choose carefully about whether to use a bottom-up or top-down approach

b.Must use a bottom-up approach.

c.Must use a top-down approach.

d.Should rotate use of top-down and bottom-up approaches to keep management on its toes.