This was not
Fourthly, the assessment and audit should
focus on the internal control system rather than
on individual controls. Both CTI and its auditor
used a control-by-control approach for testing,
which meant that the severity of every
failed test was evaluated in isolation. The
PCAOB saw this as one of the reasons why
audits were not as effective as they could have
been, and it “expects that in future years,
auditors and issuers alike will have more
time to address identified control deficiencies
and evaluate compensating controls”
(PCAOB, 2005, p. 4)