Only issuers are required to have a test of internal controls. Small issuers have an exception. Non-issuers are optional - yet reporting is tricky as this is more internal use.
Private companies - non-issuers follow SSAE (examination of internal control - which will be integrated with the audit). Optional. SAS is the guidance for the audits of non-issuers - which does not provide for an opinion on internal controls; however, one must obtain an understanding to assist with the audit. If such deficiencies are found, the auditor has a reporting responsibility - guided by SAS.
Public companies - issuers follow PCAOB and it's required as an integrated audit with internal controls - opinions for both audit and internal controls.
AUD - Passed:)
FAR - Passed:)
REG - Retake TBD
BEC - Missed by 3 points Retake TBD