AS5 Approved: No 404 Delay; More Guidance Coming

As Corporate America finally bids a not-so-fond farewell to the onerous standard known as Auditing Standard No. 2, companies and their auditors are already preparing for life under its replacement.

As expected, the Securities and Exchange Commission last week unanimously approved a proposed new standard for auditors to report on the effectiveness of a company’s internal control over financial reporting.

The Public Company Accounting Oversight Board’s Auditing Standard No. 5, approved by the SEC July 25, replaces AS2, the exacting and rigid standard blamed for excessive auditing by accounting firms, resulting in sky-high compliance costs.

What the SEC didn’t do—undoubtedly to the dismay of some companies and lawmakers—was further delay SOX 404 compliance for companies that haven’t yet come under the rule. While another postponement wasn’t explicitly on the Commission’s agenda, the topic had made news recently and was discussed at the open meeting.

As Compliance Week has reported, lawmakers and many business groups recently stepped up calls for the SEC to push back the deadline for smaller companies, allowing them more time to digest the new auditing rules and related guidance for management. Smaller companies are scheduled to comply with the management requirements of 404 when they file their 2008 annual reports; they must comply with the external auditor attestation requirement one year later. The Commission had already twice postponed the compliance dates for non-accelerated filers.

Last month, however, the House of Representatives passed an amendment that would, in effect, delay compliance for smaller companies though 2008. That measure is still awaiting Senate action.

White

Some expected the SEC to consider the House action, but remarks during last week’s meeting suggest the SEC is standing firm on the current compliance dates. Referring to the deadline for non-accelerated filers to file their first management assessment reports, SEC Division of Corporation Finance Director John White said, “We are confident companies will be able to follow the new management guidance and comply with the requirement in that timeframe … We don’t believe there are any extensions needed with respect to 404 today.”

Regarding the auditor attestation deadline, White added, “We have a season to see how [AS5 is] working with larger companies. This is not something we necessarily have to address at this stage.”

There was some dissent, however. Commissioners Paul Atkins and Kathleen Casey voiced their support for further delaying compliance for non-accelerated filers. Atkins specifically said smaller companies should be given an additional year “to observe how their larger counterparts implement AS5.”

Casey

Similarly, Casey said she’s “become convinced” further delay of the 404 audit requirement at least, is “necessary and appropriate” for smaller companies.

“If we find the costs aren’t coming down and that the unnecessary burdens of 404 are not lifting," Casey added, the SEC must be willing to consider further revisions and guidance “so we can discover causes and provide a remedy.”

Much Improved: One Opinion

SEC approval of AS5 and the related rules and amendments was expected, coming a month after the Public Company Accounting Oversight Board approved the rule. It also marks the culmination of more than two years of work by both regulators to overhaul the rules for implementing the requirements of Section 404, the most costly and onerous provision of the now five-year-old legislation.

The end result of that effort is a “very much improved” AS5 that’s “shorter, less prescriptive, focuses on areas of highest risk, and is clearly scalable to fit any company’s size and complexity,” White said during last Wednesday’s open meeting.

One major—and somewhat controversial—change in the final standard is the elimination of a previous requirement for outside auditors to provide an opinion on management’s assessment process. The final rule requires only one external audit opinion on the effectiveness of ICFR.

“No longer does management have to follow the audit standard,” White said. “Instead, the auditors have to adjust their procedures to follow what management does.”

Palmrose

Deputy Chief Accountant Zoe-Vonna Palmrose said the elimination of the second opinion responds to concerns that management’s evaluation process was being driven by their outside auditors.

Addressing criticism that the SEC and the PCAOB “retained the wrong opinion,” Palmrose said the staff “carefully considered” those comments, adding, “We continue to believe that, consistent with Sections 103 and 404 of SOX and the Commission’s recent rule amendments, AS5 requires the appropriate opinion to be expressed by the auditor.”

Hewitt

AS5 is effective for audits of fiscal years ended on or after Nov. 15, 2007. However, the staff encourages early adoption, SEC Chief Accountant Conrad Hewitt noted.

Meanwhile, Palmrose noted that amendments to Regulation S-X, which were adopted in May, take effect Aug. 27, which means companies can begin filing single ICFR opinions in accordance with AS5 in their filings on or after that date.

Now The Hard Part: Monitoring Implementation

At last week’s meeting, the Commission also adopted a related amendment to define in its rules a definition of the term “significant deficiency,” the same one that appears in the PCAOB’s audit standard. By doing so, White said, management can refer to the SEC’s guidance and rules, rather than to the audit standard, as had been the case under the old rules.

The SEC also approved a PCAOB independence rule that requires auditors to obtain audit committee pre-approval of nonaudit services related to ICFR, a requirement previously contained in AS2. (At the same meeting, the SEC also voted to publish a Concept Release to seek comments on giving U.S. issuers the option to file financial statements in accordance to International Financial Reporting Standards; the Commission proposed publishing for comment two opposing rules on shareholder proxy access. See related coverage in the box above, right.)

As acknowledged by SEC officials at the meeting, the remaining—and perhaps most challenging—tasks the SEC faces as it pertains to SOX 404 is monitoring the implementation of the new auditing rule by the auditors and monitoring the PCAOB’s oversight of auditors under the new standard.

Echoing a sentiment expressed by others, Hewitt noted, “Appropriate implementation will be just as important as having an improved auditing standard in place.”

Cox

SEC chairman Christopher Cox said the Commission will monitor whether audit firms are implementing AS5 “in a manner designed to achieve the intended results of audit efficiency and cost reduction” and whether the PCAOB is inspecting audit firms “in a manner consistent with our expectations.”

Hewitt noted that the PCAOB will have to retrain its inspection team and adjust its inspection program and that external audit firms will need to retrain their staffs and change their audit programs for a more integrated audit. In addition, he said management “should challenge its own evaluation” of internal controls based on the SEC’s interpretive guidance. Finally, he said audit committees should play a “more active and direct role, with particular attention to management guidance implementation and the scope of the external auditors’ year-end audits on an integrated basis in accordance with [AS5].”

More Guidance Coming

Meanwhile, other guidance for issuers and auditors is on its way, SEC officials said. Palmrose cited a project underway by the Committee of Sponsoring Organizations to develop guidance for companies on monitoring activities.

In addition, she said guidance for auditors of smaller companies being developed by the PCAOB will be available for comment “in the not too distant future,” with final guidance expected “well before” their first filings are due in 2009. At the same time, White said the SEC staff is finishing work on a brochure for smaller companies that’s intended as a “plain English guide” to using its management guidance.

Further, the SEC Office of Economic Analysis will conduct an analysis to address whether the costs and benefits of implementing Section 404 are in line with SEC expectations, Palmrose said.

While the commissioners hailed the approval of the audit standard, they too cautioned that proper implementation and monitoring of the results of the changes is paramount.

Atkins

Commissioner Paul Atkins, who said the old standard “is not being laid to rest a day too soon,” added that it is “incumbent upon auditors to take the new guidance to heart.” He also said auditors should “abandon the notion that AS5 governs management,” and should allow management to follow the top-down, risk-based approach set forth in the management guidance.

In addition, he said both the PCAOB and SEC “need to be prepared to make changes if AS5 fails to deliver on its promises of reshaping internal control auditing.”