In reporting on internal control for nonissuers, what is a permissible approach?

In the context of reporting on internal control for nonissuers, the approach that allows auditors to combine opinions on both the effectiveness of internal controls and management's assertions is permissible. This integrated approach benefits stakeholders by streamlining information. Auditors can present their findings in a single report, thereby providing a comprehensive overview that encompasses both the effectiveness of internal control systems and the validity of management’s assertions regarding those controls.

This combined reporting is especially useful for nonissuers, where the cost of preparing separate reports may not be justified given the nature of their business operations. By merging these assessments, auditors can enhance the clarity and accessibility of their communications with stakeholders, reducing confusion about the internal control landscape and overall financial statement reliability.

The other approaches mentioned do not align with current auditing standards for nonissuers. For instance, while auditors may consider management's assertions, they are not required to report on them exclusively, nor is it necessary to provide separate reports or to limit opinions to only negative findings. This flexibility reflects an understanding of the auditing process in a way that adapts to the needs of smaller or private entities, promoting efficiency without sacrificing the quality of the audit.