As shown in Figure 1, the auditor’s ICOFR report is the input to the model. Broadly
speaking the ICOFR report could be unqualified or adverse. Users process the ICOFR
report to assess information and verification risks, the quality of controls, and an
expectation of the SAR.5 This is followed by a consistency checking phase where users
compare their expected SAR to the auditor’s SAR. A positive check reinforces
confidence in the SAR while a negative check undermines confidence.6 Thus, the
essence of the model is that users’ confidence in the SAR is determined by their
assessment of the consistency of the message conveyed by the ICOFR disclosure and
the SAR