PCAOB's Auditng Standard 2 is a comprehensive guideline on how an audit of internal control over financial reporting can be performed in conjunction with an audit of financial statements. One of the most basic requirements of AS 2 is for the auditor to express an opinion whether management's assessment of the effectiveness of internal control over financial reporting is fairly stated in all material aspects and the company maintained effective internal control over financial reporting.

In a scenario where an auditor determines that a material weakness exists, the first thing an auditor should do is communicate in writing the material weakness / signficant deficiency noted to the management and audit committee. Here's the approach my team took when we determined a material weakness during SOX compliance.

- Communicate in writing to management and audit committee. This can be done through a note.

- Distinguish clearly in the note between significant deficiencies and material weakness.

- Apart from the above, we disclosed all deficiencies in internal control over financial reporting to the client management identified during the audit. We informed the audit audit committee that such a communication had been made.

- Finally, since the material weakness existed, we as auditors had to express an adverse opinion on the company's internal control over financial reporting. We described the nature of material weakness clearly in the report.

More on Sarbanes Oxley

Cost Effective Approach to SOX Compliance
Evaluating Internal Controls
SOX Sustainability Challenge
Benefits of Section 404 Implementation