For smaller companies planning to file thinly supported internal control assessments, beware: Your auditor may have more leverage over your filing than you think.
Auditors have been wringing their hands over the Securities and Exchange Commission’s allowance for smaller public companies to comply with Sarbanes-Oxley Section 404 internal control reporting with unaudited management assessments. Now auditors are taking more careful stock in their role in the financial statement audit when not required to audit management’s internal control assessment—and they’re finding other regulatory provisions that still compel a thoughtful look at the internal control review.
In response to criticism that Section 404 compliance is too burdensome and too costly, especially for smaller companies, the SEC is allowing non-accelerated filers to complete their first Section 404 assessments of internal control without an accompanying auditor’s opinion. Calendar-year filers are preparing those filings now. The SEC is even considering giving companies an additional year to submit unaudited management assessments (extending the compliance deadline from the end of 2008 to the end of 2009), although it hasn’t finished that decision.
McLaughlin
Auditors worry that affected companies will view the pass on the auditor’s report as a license to do little or no meaningful work in assessing internal controls. “Some companies have chosen to do nothing or very little about this and just deal with the consequences,” says John McLaughlin, senior managing director at Smart Business Advisory and Consulting. “They ask, ‘What are the consequences if we do nothing?’ Our answer is, ‘You’re not compliant with the law.’”
Auditors pondering their role in such a circumstance find it’s not their place to watch in silence as their clients file such a report. The Center for Audit Quality issued an alert recently reminding auditors to review rules published by the SEC and the Public Company Accounting Oversight Board regarding how they should act on information contained in a financial statement that they know to be false, inconsistent, or poorly supported.
For example, the alert reminds auditors to review the requirements of PCAOB standards in AU Section 550, Other Information in Documents Containing Audited Financial Statements; it requires auditors to consider internal control as a basis for planning the financial statement audit. “An auditor may become aware of information that causes him or her to believe that management’s assertion on the effectiveness of internal control contains a material misstatement of fact,” the alert says.
The auditing standard says auditors may not be required to audit the information, but they have to act when they find a “material inconsistency” to determine how it can be reconciled: by revising financial statements, withholding the audit opinion, or resigning the audit engagement. The CAQ also reminds auditors of Section 10(a) of the Securities Exchange Act, which requires auditors to report illegal acts they discover in the course of an audit.
Newton
Keith Newton, a partner in charge of audit methodologies for Grant Thornton, says auditors get the message that they have no role in the process of reporting on internal control, but they can’t ignore internal control when planning and conducting the financial statement audit. “The auditor would have to read management’s report, and if they knew the conclusion was not correct, then the auditor would have a responsibility to communicate that to management, the board, and ultimately the SEC,” he says.
Rich Howard of the audit firm Mayer Hoffman McCann also says auditors are bound to consider internal controls in the financial statement audit, even if not required to give an opinion on internal controls.
AUDITOR’S EXIT STRATEGY
Below is an excerpt of AU Section 550: Circumstances Requiring a Modified Disclaimer, that auditors must follow when issuing opinions.
If the accountant concludes on the basis of facts known to him that the unaudited financial statements on which he is disclaiming an opinion are not in conformity with generally accepted accounting principles, which include adequate disclosure, he should:
suggest appropriate revision;
failing that, he should describe the departure in his disclaimer of opinion. This description should refer specifically to the nature of the departure and, if practicable, state the effects on the financial statements or include the necessary information for adequate disclosure.
When the effects of the departure on the financial statements are not reasonably determinable, the disclaimer of opinion should so state. When a departure from generally accepted accounting principles involves inadequate disclosure, it may not be practicable for the accountant to include the omitted disclosures in his report. For example, when management has elected to omit substantially all of the disclosures, the accountant should clearly indicate that in his report, but the accountant would not be expected to include such disclosures in his report.
If the client will not agree to revision of the financial statements or will not accept the accountant’s disclaimer of opinion with the description of the departure from generally accepted accounting principles, the accountant should:
refuse to be associated with the statements
if necessary, withdraw from the engagement.
Source
PCAOB Section 550.
“We need to understand what a company has done and whether it’s a sufficient basis to reach the conclusions going into the report to make sure we’ve considered the results of management’s work to plan the audit,” he says “If a company doesn’t have sufficient basis to make its opinion and wants to file its report anyway, the auditor has a responsibility to read other sections of the filing, even if not giving an opinion on those sections, to determine if it’s consistent with assertions made in the financial statements they have audited.”
Howard
Howard says auditors are growing accustomed to the integrated audit—where for accelerated filers the audit of financial statements and internal controls are conducted in tandem—so auditors are naturally more attuned to the effect of internal controls on the financial statements. “They’re very interrelated in the sense that if you’re going to audit both, you would design them together,” he says. “The integrated audit for accelerated filers has been evolving since the original passage of Sarbanes-Oxley.”
In some cases, smaller companies are pushing back against auditors’ assertions that they have to at least look at the internal control assessment, Howard says. “Companies have said, ‘It’s our report, not yours. We think we have sufficient basis to reach that conclusion, and we’re ready to sign.’”
Leech
Tim Leech with Navigant Consulting says that attitude puts the auditor in a tough spot. “If an auditor is saddled with the knowledge that the client has very little support for the claim made in the filing, that’s an ethical dilemma,” he says. “If the auditor knows the controls are wrong and therefore the numbers may be wrong, a smart plaintiff lawyer would say the auditor was an accomplice in fraud because they didn’t say anything when they assessed the controls were not effective.”
Howard says auditors are bound by standards either to withhold an opinion or to resign the audit under such circumstances. “Auditors would generally choose to withhold an opinion until the filing is complete or management can produce something to show the filing is complete,” he says.
Newton says he doesn’t expect such standoffs to occur in significant number of engagements. “After communication with the auditor and management, in 99 percent of cases management will change the report,” he says.
Howard says he’s not aware of companies doing nothing to back up an internal control report, but “I know there are more than I would have thought who have left it to the very end. Now in the first quarter they’re struggling to get it finished.”
No comments yet