Along with Sarbanes-Oxley came the concept of a different audit combined with management's assessment of internal control. Our focus here is to clarify the two audit approaches. We will also explore audit reports issued to private companies, along with the differences between them and audits of publicly traded companies. The new audit is in reality two audits that cannot be separated for publicly traded companies. Audit standards for privately held companies do not include a requirement for a management assessment of internal control, which is required by Audit Standard No. 2 under Section 404.

When viewing the new audit opinion rendered for a public company, investors know that management has self-assessed its design of internal controls and tested and documented its operating effectiveness. A reader of a private company's financial report has only the assurance from the auditor that the financial statements are presented in accordance with GAAP, with no mention of or reference to the strength of internal controls supporting the statements. The AICPA is responsible for audit standards for private companies. The PCAOB is the standard setter for audit reports of public companies. In fact, an audit report of a public company could be presented in accordance with GAAP and contain the disclosure of a material internal control weakness. The question has to be asked if a material control weakness should be excluded from private audit reports when good business practice for public companies requires the disclosure. When we have two standard setters,...