EXECUTIVE
SUMMARY | THE ACCOUNTING
PROFESSIONALS interviewed for
this article were positive about some
Sarbanes-Oxley requirements, saying
management’s reporting on and the external
auditor’s attestation to the internal
controls are good ideas. They advocated
audit committees’ hiring CPAs because it
could reduce the pressure on audit fees
and lead to better-quality audits. All
agreed that having top management certify
it had reviewed the quarterly and annual
reports would force it to become more
engaged in the financial reporting
process. All believed the legislation
would have a positive impact, but would
not be a panacea. Their concerns included
DOCUMENTATION COSTS AND
ATTESTATION FEES, which will
be substantial. There was apprehension
about preparing internal control
attestation reports; no widely
recognized standards to do so currently
exist.
FEARS THAT SMALL,
PUBLICLY LISTED COMPANIES
might not meet internal control
reporting requirements without
substantial additional expense; some may
have to delist because of it. It could
mean only larger companies will go
public.
AUDITORS’ QUALMS ABOUT
POSSIBLE MARKETPLACE reaction
to their small, publicly listed clients
whose financial statements can be
“signed off on” based on substantive
testing, but which had adverse
attestations on their internal control
structure.
THE “CASCADE” EFFECT,
which might mean having as many
as 54 different sets of laws for
nonlisted companies.
THE ACCOUNTING
PROFESSION’S IMAGE ,
which has suffered unjustly
because of the wrongdoings of a few.
| HARVEY
COUSTAN, CPA, is a former partner with
Ernst & Young LLP. His e-mail address
is
CPAcou@aol.com . LINDA M. LEINICKE,
PhD, is a professor of accounting at
Illinois State University at Normal. Her
e-mail address is lmleini@ilstu.edu
. W. MAX REXROAD, PhD, is a professor
of accounting at the same university. He
can be reached at wmrexro@ilstu.edu
. Also contributing to this article
was JOYCE A. OSTROSKY, PhD, CMA, a
professor of accounting at Illinois State
University. She can be reached at jaostro@ilstu.edu
.
Arleen Thomas is vice-president of
professional standards and services of
the AICPA. Ms. Thomas is an employee
of the AICPA and her views, quoted
above in the article, do not
necessarily reflect the views of the
Institute. Official positions are
determined through certain specific
committee procedures, due process and
deliberation.
|
he Sarbanes-Oxley Act of 2002 has
ushered in the most sweeping changes in the
accounting profession since the Securities Acts of
1933 and 1934. In order to gain insight into how
this act will affect external auditors and
corporate managers, we interviewed 10 people from
public accounting, corporate management, the
National Association of State Boards of
Accountancy (NASBA) and the AICPA. They expressed
their opinions on management’s and the auditor’s
assessment of internal controls; requiring
management to certify the financial statements;
the setting of auditing standards; the “cascade”
effect; the implications of audit committees’
hiring CPA firms, CEOs’ certifying reports, the
systematization of Sarbanes-Oxley regulations and
the act’s impact on financial reporting and on the
accounting profession.
ASSESSMENT OF INTERNAL CONTROLS
Section 404 of the
Sarbanes-Oxley Act requires each issuer’s annual
report to include an “internal control report
which shall…contain an assessment, as of the end
of the most recent fiscal year of the issuer, of
the effectiveness of the internal control
structure and procedures of the issuer for
financial reporting.” In addition, section 404
requires each issuer’s auditor to attest to and
report on management’s internal control
assessment. When asked about management’s
requirement to assess internal controls, the
interviewees were unanimous in agreeing this was a
good idea. They believed this requirement would
increase management’s knowledge and concern about
the quality of its internal control structure,
thus sending significant signals that management
takes such controls very seriously.
All
interviewees believed the new internal
control reporting requirement would cause
significant increases in external auditing
costs. Such expenses would result from the
requirement that external auditors must
attest to and report on the internal
control assessment made by the management
of the issuer. Ken Peterson, partner and
professional practice director for the
Lake Michigan area office of Ernst &
Young LLP, said, “The consideration of
internal controls has been a tool used in
planning the audit, but now internal
controls will be an objective of the
audit.” John Fogarty, partner and director
of auditing policies, procedures and
methodologies in the United States and
globally of Deloitte & Touche, member
of the AICPA auditing standards board and
technical adviser on the international
auditing and assurance standards board,
said: “The internal control report will be
very expensive. It is a significant
extension of auditing responsibilities.”
Interviewees estimated this additional
attestation fee would range from 25% to
more than 100% of current audit fees.
|
When asked about
management’s requirement to
assess internal controls,
the interviewees were
unanimous in agreeing this
was a good idea.
| |
Although most of the CPAs we interviewed
reported that large companies already had internal
controls in place to comply with the new reporting
requirements, those controls “will require a lot
more work and testing than we’ve ever performed
before,” said Peterson, and “clients will need a
lot more documentation than they’ve ever had
before to support their assertions.”
Several interviewees questioned the
cost-benefit of these documentation costs.
“Additional procedures have to be performed that
are not value-added,” said Michael Keane, senior
vice-president and CFO of UNOVA Inc., Everett,
Washington, “and they scream out bureaucracy and
added costs. It will be a lot of time and effort
to prove what we’ve already been doing.”
The interviewees were in agreement that
management’s assessment of internal controls and
the auditor’s attestation of them were positive
requirements for all companies, large and small,
because these requirements help protect investors.
However, these new internal control mandates,
initially, will be a hardship on small, publicly
listed companies. For example, Ed Drosdick,
partner in charge of SEC practice and
high-technology practice at Moss Adams LLP,
Seattle, said: “Very large companies will have the
resources to deal with Sarbanes-Oxley
requirements. Smaller companies will have a great
deal of trouble being compliant because the cost
is very large. Sarbanes-Oxley does not allow for
size differences; all SEC registrants will be
measured by the same yardstick.” The group
generally believed many small companies did not
have the internal controls in place to comply with
the new reporting requirements. In addition, they
said it might not be economically feasible for
some of those small companies to come into
compliance. Kris Kaland, partner and director of
assurance services at Clifton Gunderson LLP,
Milwaukee, asked: “Does a small publicly listed
company have the resources to comply with
Sarbanes-Oxley? For example, does it have an audit
committee? Does it have a code of ethics? Can it
meet the internal control documentation
requirements?” The only alternative for some small
companies may be to delist. However, Kaland
warned, “It takes resources to delist, too.”
CPAs who have audited small, publicly listed
companies voiced concern about those for which the
auditor develops audit evidence primarily through
substantive testing. This approach often is used
for small clients and is supported by GAAS.
“Smaller companies won’t have robust internal
control systems in place, yet you can sign off on
the financial statements,” Drosdick said. These
CPAs were concerned that section 404’s internal
control requirements would call into question this
audit strategy. In other words, it is possible for
a client to receive a clean audit opinion while
“failing” its internal control attestation. How
will the marketplace interpret this?
Another small-company issue is whether a
company even should go public. “Sarbanes-Oxley is
going to raise the bar on access to public
markets,” said Michelle Collins, chairperson of
the audit committee of CDW Corp., Vernon Hills,
Illinois. “It may be harder to go public, but the
real challenge to smaller companies will be the
costs, which will be incredibly prohibitive. The
company is going to have to be a certain size and
really want to go public. New companies that come
out are probably going to be a lot bigger.”
Fogarty, concerned with the mechanics of an
internal control attestation, said: “Although we
have the COSO framework (Committee of Sponsoring
Organizations of the Treadway Commission’s
Internal Control—Integrated Framework )
to use as criteria in determining whether control
deficiencies are significant or material
weaknesses, we lack a body of experience for
making these determinations comparable to what we
have for making accounting decisions. It will take
time to gain and interpret this experience to fill
in many of the details needed to consistently make
determinations about the severity of control
deficiencies.” Some interviewees were
concerned that if they made a mistake in complying
with the many details Sarbanes-Oxley required it
would be used against them. “People don’t know
what will happen to them if they violate the law,”
said Bill England, partner and U.S. leader for
consumer and industrial products practice and
client service vice-chairman of
PricewaterhouseCoopers, Chicago. “My major concern
is not about our ability to comply with
Sarbanes-Oxley given our company’s currently
existing strong internal control systems,” Keane
added. “I just hope there will not be some small
regulation we’ve overlooked that will be used as a
club against us.”
“CASCADE” EFFECT
The “cascade” effect
is the possibility that state legislators and
regulators might apply all or some portions of the
act to all companies and their auditors. The AICPA
responded quickly to this possible threat by
forming the Special Committee on State Regulation.
Working closely with state CPA societies, this
high-level volunteer committee was charged with
providing guidance to states that were faced with
state legislative or regulatory accounting reform
proposals as a result of the Sarbanes-Oxley Act.
The special committee identified three overarching
themes: The profession should advocate for a
reasoned approach to reform at the state level,
uniformity of state laws is essential to
protecting the public interest and the complexity
of the issues needs to be articulated and
communicated. In January 2003 the committee
released a compendium of white papers and issue
briefs called A Reasoned Approach to Reform.
A second edition was released in October
2003. During 2003 many states, faced with state
legislative and regulatory reform proposals, made
reference to A Reasoned Approach, which
allowed the profession a seat at the negotiation
table. Another facet, said David Costello,
president and CEO of NASBA, is audit partner
rotation, which “is tempting for states to adopt,
but would be devastating for smaller CPA firms.”
Of course, the cost of applying Sarbanes-Oxley to
nonpublic companies would be prohibitive for most
small companies and their accountants, not to
mention the disruption it could cause to the
operation of many businesses. “There are
potentially high costs to small and medium-sized
businesses. Protecting the public interest will be
expensive,” said Costello. For many nonpublic
companies that regularly rely on their outside
accountants for many nonaudit services, the effect
could be even more severe. “States should
not overreact to the emotional issue of the day.
The temptation for state government is to act
quickly without regard necessarily to what other
states are doing,” Costello said. “They needed a
reasonable response to Sarbanes-Oxley, which NASBA
developed and issued as ‘Answering the SOX
Challenge: Guidelines for State Boards of
Accountancy.’ NASBA task forces, comprising state
board of accountancy representatives, researched,
studied and developed a consensus approach to
applying Sarbanes-Oxley principles at the state
level. It would be easy to take Sarbanes-Oxley and
apply it to all companies, but one size does not
necessarily fit all. We might very well end up
with 54 different approaches to this topic. We
need more uniformity, not less.” Fogarty expressed
concern that states would adopt dissimilar rules
and companies and their auditors would have to
determine which state’s rules would apply. For
example, “California and New York have added to
the Sarbanes-Oxley documentation requirements.
There is a proliferation of rules. People are
making more rules on top or rules that have not
yet been implemented,” he said.
AUDIT COMMITTEE HIRES CPA FIRM
Section 301 of the Sarbanes-Oxley
Act requires the audit committee of each issuer to
be directly responsible for the appointment,
compensation and oversight of the external
auditor. The interviewees were much in favor of
this requirement. They said the audit committee
would be concerned that a quality audit be
performed. Accordingly, they thought the audit
committee’s hiring the external auditor might
relieve some of the pressure on audit fees.
“Having the audit committee hire the auditors is
good for audit quality,” Peterson said,” because
it helps prevent management from inadvertently
restricting the audit scope in a desire to control
costs.” Ken Zika, retired controller of
Caterpillar Inc., Peoria, Illinois, added: “It is
hard to measure the value of good internal
controls and good financial statements. Thus,
there can be pressure to perform these activities
with a ‘least cost’ mind-set. So I believe that
turning the hiring and firing of the external
auditor and negotiation of its fees over to the
audit committee is probably a good thing.” England
added: “Audit committees are highly motivated to
get audit risks covered and have an audit scope
sufficient to cover those risks. Therefore, they
are willing to pay for high-quality audit
services.” However, Fogarty cautioned: “Many audit
committees currently do not have complete control
over directing the scope of the audit. Audit
committees will need to keep moving toward this
control even though they may come into conflict
with management’s objectives.”
FEAR OF THE ROUTINE
Several in the group expressed
concern that internal control and financial
reporting structures would become systematized
within a few years and render the whole process
routine. “As people get accustomed to
requirements, they often become complacent and
lulled into comfort,” Collins said. “Regulators’
focus on internal controls may atrophy,” Fogarty
added. “They need to keep these rules in the
forefront and emphasize them in rhetoric and
actions.”
Some feared the possibility of
perfunctory processes could lead to
unethical behavior. “Regulating, requiring
very specific disclosures and having all
these systems on an annual and even
quarterly basis can be ‘gamed’ in later
years,” said Collins. “Unfortunately, some
people will try to get around them.” A
final thought concerned the impact the
legislation would have on auditors and
their need to use professional judgment
while conducting an audit. Arleen
Thomas, vice-president of professional
standards and services of the AICPA,
stated: “If auditing standards become
overly prescribed, auditors could lose
their judgment capabilities. The
accounting profession will not be
considered a professional career.”
THE ACCOUNTING PROFESSION’S
IMAGE
The interviewees
expressed anxiety about the impact of
the act on the accounting profession. “I
am concerned about the profession’s
image,” Costello said. “It does not help
if regulators see the profession as
unethical and not independent.
Regulation has an undeniable negative
aura, that is, ‘We have to regulate them
to a higher degree because they have
been bad.’” Thomas added, “The fact that
we even have Sarbanes-Oxley is a hit to
the profession.” This negative image
also caused the group to worry about
recruiting students into the profession.
Several wondered about the profession’s
ability to attract high-quality
individuals. “In light of doubts about
the credibility and effectiveness of
auditing,” Fogarty said, “we have a
challenge to show that auditing can be a
rewarding lifelong career.” |
RESOURCE
S
Publications and resources
of the AICPA special committee
on state regulation are
available at
www.aicpa.org/statelegis/index.asp
.
Webcast
Internal
Control Reporting for Public
Companies (Originally webcast
July 17) Available on
CD-ROM (# 737132HSJA). Viewers
can receive 2 CPE credits.
Publications
Financial
Reporting Fraud: A Practical
Guide to Detection and
Internal Control by
Charles R. Lundelius Jr. (#
029879JA).
Corporate
Ethics for Financial
Managers: Navigating with
Case Studies and Practical
Solutions by Robert W.
Walter (# 029880JA).
Financial
Reporting Alert, Internal
Control
Reporting—Implementing
Sarbanes-Oxley Section 404
(# 029200JA).
Internal
Control—Integrated
Framework, report of
the Committee on Sponsoring
Organizations of the Treadway
Commission (COSO) (#
990012JA).
CPE SEC
Reporting, a self-study course
that includes some coverage of
Sarbanes-Oxley.
Conferences
For bankers and
CPAs who audit banks:
Sarbanes-Oxley One Year
Later: Section 404 Assessing
Internal Controls
Orlando, March 10, 2004
Las Vegas, April 29,
2004 For more
information about any of these
resources or to place an
order, go to
www.cpa2biz.com or call
the Institute at 888-777-7077.
| |
The interviewees also believed the legislation
has painted all accountants with the same broad
brush. In other words several thought many were
unfairly tainted by the actions of a few bad
auditors. “I’m paying the price for the sins of
those who were lax or who were abusing their
controls,” Keane said. Zika added: “Congress has
underestimated the relationship between most
companies and their auditors. It has
underestimated the independence that exists. In
many situations there are very positive,
professional relationships between companies and
their auditors.” Thus, many accountants believe
Sarbanes-Oxley has called into question the
character of the entire accounting profession
when, in fact, only a small minority of
accountants may have acted unethically.
Furthermore, Zika said: “The act may not go far
enough in holding other people accountable. What
roles have investment bankers, financial analysts,
lawyers, audit committee members and boards of
directors played in recent accounting scandals?
They also should be held more accountable.”
Costello aptly summed up Sarbanes-Oxley’s
impact: “The profession has suffered unfairly, but
we must work with regulators, make Sarbanes-Oxley
work and regain the public trust. We have an
outstanding auditing and accounting profession in
this country—the message is not getting out. Let’s
fix our problems and move forward.”
WILL FINANCIAL REPORTING IMPROVE?
The interviewees unanimously
agreed the legislation has many good aspects.
Specifically mentioned as a good idea was the part
of section 302 requiring top management to certify
it had reviewed each quarterly and annual report.
Furthermore, requiring management to certify that
the financial statements—and other financial
information included in the reports—fairly present
the issuer’s financial condition, as well as the
results of operations, will force management to
become more engaged in the financial reporting
process. Drosdick said: “The dumb CEO is no excuse
any more. There will be zero tolerance. Companies
must find CEOs who understand financial
statements.” Keane added, “Some companies will
improve their reporting, and some of their
disclosures will be clearer.” In addition, the CEO
and CFO must report their conclusions about the
effectiveness of the internal controls in their
company. The majority of interviewees believed the
potential for increased discussions on the
company’s internal controls by top management and
the audit committee could have a positive impact
on financial reporting. The independence of audit
committee members and the increased involvement of
the audit committee in company affairs also were
cited as positive results of the legislation.
When asked whether the legislation was a
panacea for improving financial reporting, the
majority of interviewees said it was too early to
tell. “Sarbanes-Oxley won’t eliminate all fraud,”
Drosdick said. “Time will tell how much ‘good’
will come from it.” While all thought the
legislation would improve the financial reporting
process, several were quick to point out that
financial statement fraud wouldn’t disappear. It
comes down to the ethics of the people running
corporations, they said. Morality and ethical
behavior cannot be imposed by law. Some people
will always try to do illegal things. Fogarty
expressed the consensus of opinion on the
Sarbanes-Oxley legislation: “The act will help. It
has a good system of checks and balances. However,
‘tone at the top’ is what counts.” |