PCAOB Auditing Standard No. 12: Controls, IT, and Fraud Risk

PCAOB Auditing Standard No. 12, now designated AS 2110, sets the process a public company auditor must follow to identify and assess the risks that the financial statements contain a material misstatement. It is the planning backbone of the audit: the understanding built, the controls evaluated, the fraud scenarios considered, and the risks ranked during this phase determine every substantive test that follows. If the risk assessment is wrong, the rest of the audit is aimed at the wrong targets.

What the Standard Is and Who Must Follow It

The standard’s full title is “Identifying and Assessing Risks of Material Misstatement.” The Public Company Accounting Oversight Board adopted it in 2010 as Auditing Standard No. 12. In 2016, the PCAOB reorganized its entire auditing standards library and renumbered AS 12 as AS 2110.¹ Both numbers refer to the same standard; older CPA review materials still use AS 12, while the PCAOB’s current library uses AS 2110.

The standard applies to audits of SEC-registered issuers. It does not govern private company audits, which follow the AICPA’s standards. In an integrated audit, where the auditor opines on both the financial statements and internal control over financial reporting, AS 2110 drives the planning for both opinions: the risk assessment is performed once and informs testing across the entire engagement.²

Building an Understanding of the Company

Risk assessment begins with gathering context. AS 2110 organizes the required understanding into five areas: relevant industry, regulatory, and external factors; the nature of the company; the company’s accounting principles and disclosures; its objectives, strategies, and related business risks; and the way it measures and analyzes its financial performance.²

The external review covers competitive conditions, technological change, applicable regulation, and economic conditions. A company in a shifting regulatory space, such as data privacy or environmental compliance, carries different reporting risks than one operating in a stable industry. Changes in accounting standards or SEC disclosure requirements also count as external risks.

Understanding the nature of the company means examining organizational structure, management, capital structure and debt instruments, significant investments such as joint ventures and equity method interests, and major supplier and customer relationships. A company that relies on a single customer for 40% of revenue has a different risk profile than one with a diversified base at the same revenue level.

Reviewing objectives and strategies lets the auditor trace business risks into financial reporting risks. An aggressive acquisition strategy, for example, introduces complex fair value measurements for acquired assets and goodwill impairment calculations, which are areas where misstatements tend to concentrate.

Performance measures matter because they create pressure. If management bonuses depend on hitting an EBITDA target, that incentive factors into the risk assessment for revenue recognition and expense timing. External measures tracked by analysts and rating agencies produce similar pressure to present favorable numbers.²

Evaluating Internal Controls

The auditor must obtain a sufficient understanding of each component of the company’s internal controls to identify potential misstatement types, assess factors that affect risk, and design further procedures. The depth of the evaluation scales with the size and complexity of the company; a straightforward operation does not require the same procedures as a multinational with dozens of subsidiaries and multiple ERP systems.²

Internal controls break into five components:

Control environment: management’s integrity, ethical values, and the culture around controls.
Risk assessment process: how management itself identifies and responds to business risks affecting financial reporting.
Control activities: the specific approvals, reconciliations, performance reviews, and separation of duties that carry out management’s directives.
Information and communication: the accounting systems that capture transactions and communicate reporting responsibilities.
Monitoring: how the company evaluates whether its controls are actually working over time.

For each relevant control, the auditor performs two separate evaluations. The design evaluation asks whether the control, operating as intended, would prevent or detect a misstatement. The implementation evaluation asks whether the control actually exists in practice and is used by the people responsible. A well-designed approval process means nothing if nobody follows it. Both conclusions feed into the control risk component of the overall assessment.

Information Technology Risks

Appendix B of AS 2110 addresses how a company’s use of information technology affects the financial statements. The auditor must understand the mix of manual and automated controls, including the IT general controls that keep automated processes functioning.² The standard identifies specific IT risks for consideration:

Systems that process data inaccurately or process inaccurate data
Unauthorized access to data, particularly where multiple users share a database
IT personnel gaining access beyond what their duties require, breaking down segregation of duties
Unauthorized changes to data in master files, systems, or programs
Failure to make necessary changes to systems or programs
Inappropriate manual intervention in automated processes
Loss of data or inability to access data when needed

Where a company runs its entire revenue cycle through an ERP system, looking at invoices alone is not enough. The auditor has to assess whether the system’s logic captures transactions accurately and whether access controls prevent unauthorized changes.

The Fraud Brainstorming Discussion

AS 2110 requires key engagement team members, including the engagement partner, to hold a discussion about how and where the company’s financial statements could be susceptible to material misstatement through fraud. Team members are directed to approach the discussion with professional skepticism, setting aside prior assumptions about management’s honesty.² The discussion must cover:

How management could perpetrate and conceal fraudulent financial reporting, including through related party transactions, incomplete disclosures, and biased accounting estimates
How company assets could be misappropriated
External and internal factors creating incentives, pressure, or opportunity for fraud
The risk of management override of controls, which is always present regardless of how strong the control environment appears
Potential audit responses to the identified fraud susceptibilities

For multi-location audits, the discussion may occur in multiple sessions, but the engagement partner or other senior members must communicate the important points to team members who were not present. PCAOB inspectors examine whether the documented session reflects genuine exchange rather than a form filled out after the fact.

Assessing the Risks of Material Misstatement

Everything gathered so far feeds into the formal assessment. The risk of material misstatement is the risk that the financial statements already contain a material error before the audit begins, and it breaks into two components.

Inherent risk is the likelihood that an assertion about a transaction, balance, or disclosure is wrong before considering any controls. A derivative valuation involves complex models, market assumptions, and significant judgment, so it carries more inherent risk than a straightforward cash balance. Industry volatility, regulatory complexity, and management estimates all push inherent risk higher.³

Control risk is the chance that the company’s own controls will fail to catch or prevent a misstatement. Poor segregation of duties in the revenue cycle raises control risk for revenue assertions. High inherent risk combined with weak controls is the combination that demands the most audit attention.

Linking Risks to Assertions

Identified risks must be tied to specific financial statement assertions at the account and disclosure level. Under AS 1105, those assertions fall into five categories: existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure.⁴ This linkage is what makes the audit response precise. A risk that revenue is being recorded too early directs testing specifically at the occurrence and cutoff aspects of revenue transactions, not at revenue accounts generally.

Significant Risks

Some risks rise to the level of significant risks requiring special audit consideration. The auditor evaluates seven factors:²

The likelihood and potential size of a misstatement based on quantitative and qualitative risk factors
Whether the risk involves fraud (fraud risks are automatically significant risks)
Whether the risk relates to recent significant economic, accounting, or other developments
The complexity of the underlying transactions
Whether the risk involves significant related party transactions
The degree of judgment involved, especially where a wide range of possible outcomes exists
Whether the risk involves significant unusual transactions

Because fraud risks are automatically significant risks, the audit team cannot treat fraud as a low priority regardless of how trustworthy management appears. Significant risks demand more intensive procedures, often performed closer to the balance sheet date to reduce the window for manipulation.

Documentation

AS 2110 requires thorough documentation of every stage of the risk assessment. The workpapers must record the understanding gained about the company and its environment, the evaluation of internal controls (including both the design and implementation conclusions), and the specific risks of material misstatement identified.²

Each identified risk must be linked to the assertion it affects. The assessment of likelihood and magnitude must be recorded, along with the rationale for designating any risk as significant. The fraud brainstorming session requires its own documentation capturing the specific scenarios considered, the factors that create incentive or opportunity, and the team’s planned responses.

What the Risk Assessment Drives

AS 2110 ends where AS 2301 (The Auditor’s Responses to the Risks of Material Misstatement) begins. AS 2301 requires the auditor to design and perform procedures that directly address each assessed risk for every relevant assertion of each significant account and disclosure. The guiding principle is proportionality: the higher the assessed risk, the more persuasive the evidence must be.⁵ When the risk assessment is poorly done, the downstream consequences cascade: an underestimated risk means insufficient testing and a higher chance of missing a material misstatement. That is why PCAOB inspection teams spend so much time scrutinizing risk assessment documentation.

Amendments Effective December 15, 2026

The PCAOB has adopted amendments to AS 2110 with an effective date of December 15, 2026.⁶ Separately, the PCAOB adopted amendments to AS 1105 and AS 2301 addressing how auditors design and perform procedures involving technology-assisted analysis, effective for fiscal years beginning on or after December 15, 2025.⁷ Firms planning 2026 engagements should work from the amended standard text, which the PCAOB has published with the changes marked, so that risk assessment procedures reflect the updated requirements.

1
Public Company Accounting Oversight Board. PCAOB Auditing Standards Reorganized and Pre-Reorganized Reference Table
2
Public Company Accounting Oversight Board. AS 2110 – Identifying and Assessing Risks of Material Misstatement
3
Public Company Accounting Oversight Board. AS 1101 – Audit Risk
4
Public Company Accounting Oversight Board. AS 1105 – Audit Evidence
5
Public Company Accounting Oversight Board. PCAOB Auditing Standards
6
Public Company Accounting Oversight Board. AS 2110 – Identifying and Assessing Risks of Material Misstatement (Effective on 12-15-2026)
7
Public Company Accounting Oversight Board. Amendments Related to Aspects of Designing and Performing Audit Procedures