Corporate Finance Advisory
SEC and PCAOB Adopt Guidelines for Internal Control
Reporting
By Marcus
J. Williams and Trinh
C. Tran
On June 17, 2004, the Securities Exchange Commission approved Auditing
Standard No. 2, An Audit of Internal Control over Financial Reporting
Performed in Conjunction with an Audit of Financial Statements.
Auditing Standard No. 2 provides the professional standards and
related performance guidance for independent auditors to attest
to, and report on, management’s assessment of the effectiveness
of the issuer’s internal control structure and procedures
for financial reporting pursuant to Section 404 of the Sarbanes-Oxley
Act of 2002. The Commission adopted the standard as proposed by
the Public Company Accounting Oversight Board (PCAOB), stating that
the standard is “a reasonable exercise of the Board’s
standards setting authority under the Act.” According to PCAOB
Chairman William J. McDonough, Auditing Standard No. 2 is “one
of the most important and far-reaching auditing standards [PCAOB]
will ever adopt.”
Deadlines
Issuers that are accelerated filers under the Securities Exchange
Act of 1934 must comply with the internal control reporting and
disclosure requirements of Section 404 in their annual reports for
fiscal years ending on or after Nov. 15, 2004. Accordingly, auditors
engaged to audit the financial statements of such issuers are also
required to comply with Auditing Standard No. 2 by that time. Other
filers, including small business issuers, foreign private issuers
and companies with only registered debt securities, must comply
not later than their first fiscal year ending on or after July 15,
2005. Compliance will require significant work well in advance of
the applicable deadline.
Regulatory background
Section 404(a) of the Sarbanes-Oxley Act directs the Commission
to adopt rules requiring management of a public company to assess
the effectiveness of the company’s internal control structure
and procedures over financial reporting as of the end of the company’s
most recent fiscal year. Pursuant to the rules adopted by the Commission
under Section 404(a), a company subject to the reporting requirements
of the Exchange Act must include in its annual report a report of
management about the company’s internal control over financial
reporting. The report must include management’s conclusions
about its assessment of the effectiveness of the company’s
internal control over financial reporting as of the end of the company’s
most recent fiscal year.
Section 404(b) of the Act requires the company's auditor to attest
to and report on management’s assessment of the company's
internal control and directs the PCAOB to adopt standards for the
auditor’s attestation. Auditing Standard No. 2 addresses both
the work that is required to audit internal control over financial
reporting and the relationship of that audit to the audit of the
financial statements under Section 404(b).
Scope of auditor’s testing
As the term “audit” suggests, the auditor must do
more than “attest” to management’s report on internal
controls. While the control auditor need not be a different auditor
from the auditor of the issuer's financial statements, the Standard
emphasizes independence of the control auditor, as already required
of auditors under generally accepted auditing standards. If the
control auditor is also the auditor of the financial statements,
the Standard requires pre-approval from the issuer’s audit
committee. The auditor must test internal controls directly and
evaluate both the design and effectiveness of those controls, even
if management asserts that its internal control is ineffective.
The auditor must evaluate, among other things, the process management
used to perform its assessment of internal control effectiveness,
the effectiveness of both the design and operation of the internal
control, and the effectiveness of the audit committee’s oversight
of the company’s financial reporting and internal control
over financial reporting. He or she must then form an opinion about
whether internal control over financial reporting is effective.
In addition, the auditor must express an opinion as to whether management
has fairly stated its assessment of the effectiveness of internal
control over financial reporting as of the end of the fiscal year
and that there is an appropriate basis for the conclusion. In short,
Auditing Standard No. 2 requires the auditor to express two opinions
– one on management’s assessment and another on the
effectiveness of the company’s internal control over financial
reporting. However, the auditor’s testing is limited to the
company’s financial statements and notes as presented in accordance
with generally accepted accounting principles (GAAP) and does not
extend to the preparation of management’s discussion and analysis
or other similar financial information presented outside a company’s
GAAP-basis financial statements and notes.
Deficiencies and material weaknesses
The basis of the audit under Auditing Standard No. 2 is management’s
assessment of the effectiveness of internal control over financial
reporting, expressed at the level of “reasonable assurance.”
Management’s internal control report must disclose all material
weaknesses, and management may not conclude that the company’s
internal control over financial reporting is effective if a material
weakness exists unless the control has been corrected and favorably
tested before the report date.
An issuer need not disclose changes in internal control over financial
reporting made in preparation for the first report under Audit Standard
No. 2. In addition, the Board identified three types of control
deficiencies of increasing severity: “deficiency,” “significant
deficiency” and “material weakness,” with the
reporting standard arising at the most serious, material weakness,
level. Management need not disclose a significant deficiency that
does not rise to the level of “material weakness,” although
multiple significant deficiencies may rise to the level of a material
weakness that must be disclosed.
Auditor’s involvement in management’s internal control
process
Among the circumstances regarded as a significant deficiency and
as a strong indicator of a material weakness is management’s
failure to identify a material misstatement in the financial statements
in the current reporting period, even if management later corrects
the mistake. The auditor may not consider the results of the audit
process when evaluating whether the issuer’s internal control
provides reasonable assurance for its financial statements. In the
past, however, issuers often worked closely with auditors to perform
the audit procedures on one or more preliminary drafts.
The Board has provided guidance that some type of information-sharing
on a timely basis between management and the auditor is necessary.
To avoid the auditor’s finding that statements or omissions
in a preliminary draft constitute material weaknesses, management
should communicate clearly to the auditor, either in writing or
orally, the state of completion of the financial statements, the
extent to which controls have operated at the time, and the purpose
for which the draft was given.
Conversely, the standard calls on the auditor to exercise considerable
judgment to determine whether certain types of information discovered
during the auditor’s involvement with management’s internal
process are indications of weaknesses in the company’s internal
control over financial reporting. Thus, “[the auditor’s]
discussion with management about an emerging accounting issue that
the auditor has recently become aware of, or the application of
a complex and highly technical accounting pronouncement in the company’s
particular circumstances, are all types of timely auditor involvement
that should not necessarily be indications of weaknesses in a company’s
internal control over financial reporting.” In order to maintain
a balance between information-sharing by management and the auditor’s
objectives under the standard, “some aspects of the traditional
audit process may need to be carefully structured as a result of
this increased focus on the effectiveness of the company’s
internal control …”
Communication of deficiencies
If an auditor discovers a deficiency, the auditor must communicate
it in writing to management and advise the audit committee that
the communication has been made. If the deficiency rises to the
level of a significant deficiency or a material weakness, the auditor
must communicate the deficiency or weakness to the audit committee
in writing. If there is a deficiency in the audit committee’s
oversight of the company’s internal control over financial
reporting, the auditor must communicate that conclusion to the full
board of directors.
Auditor’s reliance on work of others
Auditing Standard No. 2 permits auditors to exercise considerable
judgment about the extent to which they may rely on the work of
others as long as the auditor’s own work provides the principal
evidence for the auditor’s position. The auditor’s judgment
must be based on the nature of the controls in question, an evaluation
of the competency and objectivity of the persons who performed the
work, and the results of testing of the work of others. However,
the auditor may not use the work of others to reduce the amount
of work he or she performs to test controls. In addition, the auditors
must personally perform the required walkthroughs of significant
processes and major classes of transactions affecting significant
accounts. The auditor’s walkthrough should encompass the entire
process of initiating, authorizing, recording, processing, and reporting
individual transactions and controls for each of the significant
processes identified, including controls intended to address the
risk of fraud.
Further guidance
In response to numerous questions on the implementation of Auditing
Standard No. 2, both the Commission and the Board have offered guidance
on issues such as recent acquisitions, consolidated but non-controlled
subsidiaries, and equity investees, as well as on concerns raised
by issuers surrounding qualification of the report on internal controls,
transition periods, disclosure requirements relating to significant
deficiencies and material changes made in internal controls, and
the timing of assessment of internal control over financial reporting
in relation to certain foreign subsidiaries. However, some commentators
have noted that even with the guidance, the standard will likely
be applied inconsistently, leading to inconsistent results, because
auditors have too much discretion in interpreting key terms, such
as “significant deficiencies” and “material weaknesses,”
as well as in deciding how much testing is to be done. The guidance
is available on the Commission’s and Board’s Web sites.
FOR FURTHER INFORMATION, PLEASE CONTACT:
This Corporate Finance Advisory is a publication of the Business
Transactions/Corporate Finance Group of Davis Wright Tremaine LLP.
Our purpose in publishing this Advisory is to inform our clients
and friends of developments in business, corporate finance and securities
laws. It is not intended, nor should it be used, as a substitute
for specific legal advice as legal counsel may only be given in
response to inquiries regarding particular situations.
Copyright © 2004,
Davis Wright Tremaine LLP.
return
to Advisory Bulletins main page
|
