264 /304
沙賓法
404
條及審計準則第
5
號是否會減少內部控制揭露錯誤？
264
weaknesses could result in many reported material weaknesses that do not lead to
misstatements (Doyle et al., 2007a), which in turn may increase the likelihood of making
Type I errors. Thus, our Hypothesis 1b is as follows.
Hypothesis 1b: The implementation of SOX 404 increases Type I errors, measured as
the likelihood that a non-restatement company concludes that its
internal control system is ineffective for the non-restatement period.
2.4 AS5 and ICFR-Disclosure Errors
The PCAOB has noted that although audits of internal control under AS2 has
improved audit committee oversight as well as the quality and transparency of the
financial reporting process, AS2 has inevitably incurred several significant costs (PCAOB,
2006). For instance, some auditors retest items tested by management only to opine on
management assessments or in some cases, auditors inappropriately dictated that
management perform unnecessary evaluations (PCAOB, 2006). In response to concerns
from the business community about the onerous and costly requirement of internal control
audits, the PCAOB, on December 15, 2007, replaced AS2 with AS5, a newly simplified,
less prescriptive standard for internal control audits. AS5 adopts a top-down, risk-based
approach, which includes three key steps: (1) identifying significant financial reporting
elements and associated risks of material misstatements, (2) determining appropriate
entity- and/or transaction-level controls that can address these risks with sufficient
precision, and (3) determining the nature, extent, and timing of audit evidence, which
needs to be gathered to complete assessments of ICFR systems. By eliminating the
unnecessary procedures and testing the audits of internal controls, AS5 is designed to
reallocate limited corporate resources to notable, high-risk areas (SEC, 2007). Bell et al.
(2008) have argued that a risk-based audit approach which AS5 has adopted might result
in efficiency gains for auditees that are less risky, as well as improvement in audit efficacy
for riskier auditees. Following this argument, AS5 is expected to improve not only the
efficiency but also the efficacy of audits of internal controls and therefore, to reduce
reporting errors of public ICFR disclosures (i.e., the aforementioned Type I and Type II
errors).
Nevertheless, the audits of internal controls prescribed by AS5 involve more auditor
professional judgment, which raises concerns that such leeway may allow auditors to
make excuses to cut back on their work instead of improving the efficacy of internal