| 
SEC and PCAOB Adopt Guidelines for Internal
Control Reporting
By Marcus
J. Williams and Trinh
C. Tran
On June 17, 2004, the Securities Exchange Commission approved
Auditing Standard No. 2, An Audit of Internal Control over Financial
Reporting Performed in Conjunction with an Audit of Financial
Statements. Auditing Standard No. 2 provides the professional
standards and related performance guidance for independent auditors
to attest to, and report on, management’s assessment of
the effectiveness of the issuer’s internal control structure
and procedures for financial reporting pursuant to Section 404
of the Sarbanes-Oxley Act of 2002. The Commission adopted the
standard as proposed by the Public Company Accounting Oversight
Board (PCAOB), stating that the standard is “a reasonable
exercise of the Board’s standards setting authority under
the Act.” According to PCAOB Chairman William J. McDonough,
Auditing Standard No. 2 is “one of the most important
and far-reaching auditing standards [PCAOB] will ever adopt.”
Deadlines
Issuers that are accelerated filers under the Securities Exchange
Act of 1934 must comply with the internal control reporting
and disclosure requirements of Section 404 in their annual reports
for fiscal years ending on or after Nov. 15, 2004. Accordingly,
auditors engaged to audit the financial statements of such issuers
are also required to comply with Auditing Standard No. 2 by
that time. Other filers, including small business issuers, foreign
private issuers and companies with only registered debt securities,
must comply not later than their first fiscal year ending on
or after July 15, 2005. Compliance will require significant
work well in advance of the applicable deadline.
Regulatory background
Section 404(a) of the Sarbanes-Oxley Act directs the Commission
to adopt rules requiring management of a public company to assess
the effectiveness of the company’s internal control structure
and procedures over financial reporting as of the end of the
company’s most recent fiscal year. Pursuant to the rules
adopted by the Commission under Section 404(a), a company subject
to the reporting requirements of the Exchange Act must include
in its annual report a report of management about the company’s
internal control over financial reporting. The report must include
management’s conclusions about its assessment of the effectiveness
of the company’s internal control over financial reporting
as of the end of the company’s most recent fiscal year.
Section 404(b) of the Act requires the company's auditor to
attest to and report on management’s assessment of the
company's internal control and directs the PCAOB to adopt standards
for the auditor’s attestation. Auditing Standard No. 2
addresses both the work that is required to audit internal control
over financial reporting and the relationship of that audit
to the audit of the financial statements under Section 404(b).
Scope of auditor’s testing
As the term “audit” suggests, the auditor must
do more than “attest” to management’s report
on internal controls. While the control auditor need not be
a different auditor from the auditor of the issuer's financial
statements, the Standard emphasizes independence of the control
auditor, as already required of auditors under generally accepted
auditing standards. If the control auditor is also the auditor
of the financial statements, the Standard requires pre-approval
from the issuer’s audit committee. The auditor must test
internal controls directly and evaluate both the design and
effectiveness of those controls, even if management asserts
that its internal control is ineffective. The auditor must evaluate,
among other things, the process management used to perform its
assessment of internal control effectiveness, the effectiveness
of both the design and operation of the internal control, and
the effectiveness of the audit committee’s oversight of
the company’s financial reporting and internal control
over financial reporting. He or she must then form an opinion
about whether internal control over financial reporting is effective.
In addition, the auditor must express an opinion as to whether
management has fairly stated its assessment of the effectiveness
of internal control over financial reporting as of the end of
the fiscal year and that there is an appropriate basis for the
conclusion. In short, Auditing Standard No. 2 requires the auditor
to express two opinions – one on management’s assessment
and another on the effectiveness of the company’s internal
control over financial reporting. However, the auditor’s
testing is limited to the company’s financial statements
and notes as presented in accordance with generally accepted
accounting principles (GAAP) and does not extend to the preparation
of management’s discussion and analysis or other similar
financial information presented outside a company’s GAAP-basis
financial statements and notes.
Deficiencies and material weaknesses
The basis of the audit under Auditing Standard No. 2 is management’s
assessment of the effectiveness of internal control over financial
reporting, expressed at the level of “reasonable assurance.”
Management’s internal control report must disclose all
material weaknesses, and management may not conclude that the
company’s internal control over financial reporting is
effective if a material weakness exists unless the control has
been corrected and favorably tested before the report date.
An issuer need not disclose changes in internal control over
financial reporting made in preparation for the first report
under Audit Standard No. 2. In addition, the Board identified
three types of control deficiencies of increasing severity:
“deficiency,” “significant deficiency”
and “material weakness,” with the reporting standard
arising at the most serious, material weakness, level. Management
need not disclose a significant deficiency that does not rise
to the level of “material weakness,” although multiple
significant deficiencies may rise to the level of a material
weakness that must be disclosed.
Auditor’s involvement in management’s internal control
process
Among the circumstances regarded as a significant deficiency
and as a strong indicator of a material weakness is management’s
failure to identify a material misstatement in the financial
statements in the current reporting period, even if management
later corrects the mistake. The auditor may not consider the
results of the audit process when evaluating whether the issuer’s
internal control provides reasonable assurance for its financial
statements. In the past, however, issuers often worked closely
with auditors to perform the audit procedures on one or more
preliminary drafts.
The Board has provided guidance that some type of information-sharing
on a timely basis between management and the auditor is necessary.
To avoid the auditor’s finding that statements or omissions
in a preliminary draft constitute material weaknesses, management
should communicate clearly to the auditor, either in writing
or orally, the state of completion of the financial statements,
the extent to which controls have operated at the time, and
the purpose for which the draft was given.
Conversely, the standard calls on the auditor to exercise considerable
judgment to determine whether certain types of information discovered
during the auditor’s involvement with management’s
internal process are indications of weaknesses in the company’s
internal control over financial reporting. Thus, “[the
auditor’s] discussion with management about an emerging
accounting issue that the auditor has recently become aware
of, or the application of a complex and highly technical accounting
pronouncement in the company’s particular circumstances,
are all types of timely auditor involvement that should not
necessarily be indications of weaknesses in a company’s
internal control over financial reporting.” In order to
maintain a balance between information-sharing by management
and the auditor’s objectives under the standard, “some
aspects of the traditional audit process may need to be carefully
structured as a result of this increased focus on the effectiveness
of the company’s internal control …”
Communication of deficiencies
If an auditor discovers a deficiency, the auditor must communicate
it in writing to management and advise the audit committee that
the communication has been made. If the deficiency rises to
the level of a significant deficiency or a material weakness,
the auditor must communicate the deficiency or weakness to the
audit committee in writing. If there is a deficiency in the
audit committee’s oversight of the company’s internal
control over financial reporting, the auditor must communicate
that conclusion to the full board of directors.
Auditor’s reliance on work of others
Auditing Standard No. 2 permits auditors to exercise considerable
judgment about the extent to which they may rely on the work
of others as long as the auditor’s own work provides the
principal evidence for the auditor’s position. The auditor’s
judgment must be based on the nature of the controls in question,
an evaluation of the competency and objectivity of the persons
who performed the work, and the results of testing of the work
of others. However, the auditor may not use the work of others
to reduce the amount of work he or she performs to test controls.
In addition, the auditors must personally perform the required
walkthroughs of significant processes and major classes of transactions
affecting significant accounts. The auditor’s walkthrough
should encompass the entire process of initiating, authorizing,
recording, processing, and reporting individual transactions
and controls for each of the significant processes identified,
including controls intended to address the risk of fraud.
Further guidance
In response to numerous questions on the implementation of
Auditing Standard No. 2, both the Commission and the Board have
offered guidance on issues such as recent acquisitions, consolidated
but non-controlled subsidiaries, and equity investees, as well
as on concerns raised by issuers surrounding qualification of
the report on internal controls, transition periods, disclosure
requirements relating to significant deficiencies and material
changes made in internal controls, and the timing of assessment
of internal control over financial reporting in relation to
certain foreign subsidiaries. However, some commentators have
noted that even with the guidance, the standard will likely
be applied inconsistently, leading to inconsistent results,
because auditors have too much discretion in interpreting key
terms, such as “significant deficiencies” and “material
weaknesses,” as well as in deciding how much testing is
to be done. The guidance is available on the Commission’s
and Board’s Web sites.
FOR FURTHER INFORMATION, PLEASE CONTACT:
This Corporate Finance Advisory is a publication of the Business
Transactions/Corporate Finance Group of Davis Wright Tremaine
LLP. Our purpose in publishing this Advisory is to inform our
clients and friends of developments in business, corporate finance
and securities laws. It is not intended, nor should it be used,
as a substitute for specific legal advice as legal counsel may
only be given in response to inquiries regarding particular
situations.
Copyright ©
2004, Davis Wright Tremaine LLP.
return
to Advisory Bulletins main page |
