PCAOB Auditing Standard No. 2 has three key elements:

(i) The auditor must perform a full-scale audit of control instead of a limited review or attestation;

(ii) The auditor must opine specifically on internal control effectiveness rather than permitting it to simply comment on or endorse management's statements;

(iii) If the auditor finds any "material weakness" in the internal controls, the auditor must issue an adverse opinion rather than a qualified opinion.

The announced goal of Section 404 of the Sarbanes-Oxley Act (SOX), and Auditing Standard No. 2 implementing Section 404, was the creation of an early warning system to the readers of a company's financial statements that internal deficiencies or irregularities may impair a company's ability to provide reliable financial statements in the future. Although accomplishing this goal is speculative, there are a number of legal implications flowing from Accounting Standard No. 2. 
 
Currently, under Central Bank of Denver v. First Interstate Bank of Denver, 511 U.S. 164 (1994), it is difficult to impose civil liability against the outside auditor because aiding and abetting is no longer a basis for civil liability under the antifraud provisions of the Securities Exchange Act of 1934. Auditing Standard No. 2 now requires the outside auditor to affirmatively make representations as to the internal control effectiveness of the company's financial reporting. Plaintiff's counsel can now contend that because the auditor is the speaker, he or she is no longer an aider or abettor but rather a direct participant.
 
Under this new auditing standard, the existence of a "material weakness" requires the auditor to issue an adverse control opinion. In contrast, if the auditor decides that an internal problem or irregularity amounts only to a "significant deficiency," then an adverse control opinion is no longer required. The PCAOB defines "material weakness" to be:

"A significant deficiency or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected."

The meaning of the term "more than a remote likelihood" will be the subject of much litigation, especially because plaintiff's counsel has twenty-twenty hindsight and will conclude, after the fact, that the auditors should have defined a problem as "a material weakness" rather than a "significant deficiency."
 
Other issues to be resolved:

• What is the outside auditor's appropriate response after issuing an adverse control opinion?
• What are the legal obligations of the audit committee once the company has received an adverse control opinion from its outside auditor?
• What are the legal obligations of the audit committee when it receives advice from its outside auditor that there is a significant deficiency?
• How will the application of Auditing Standard No. 2 affect the accounting for acquisitions of foreign companies that are not subject to the SOX?
• Are the independent auditors willing to run the risk of being sued for only noting "significant deficiencies" to appease management, when in hindsight someone will contend that it should have issued an adverse control opinion because there was a "material weakness" rather than a "significant deficiency" in the company's internal financial controls?

For financial professionals involved with public companies, the world is rapidly changing. The stakes are substantially increased, and the same is true for the time pressures and complexity of the issues. The financial professionals and their attorneys who understand the new terrain will survive and thrive.

CHARLES HECHT has been a principal of his own law firm specializing in securities law since 1971. He was previously on the staff of the Division of Corporate Finance of the Securities and Exchange Commission at its headquarters in Washington, DC. Contact him at 212.490.3232 or visit www.securitiescounselors.com