SEC, PCAOB Promise New Internal Control Guidance

The staffs of the Securities and Exchange Commission and the Public Company Accounting Oversight Board are churning new guidance on how companies can better navigate the internal control provisions of The Sarbanes-Oxley Act of 2002. That’s the promise of those agencies’ respective chairmen, made at a packed SEC roundtable event last week. The PCAOB has promised guidance by mid-May, while the SEC offered no precise timeline.

During the roundtable, comments focused on the cost of first-year compliance, the scope of internal control testing and reporting, and lack of communication between auditors and their clients. In the end, panel discussions turned toward the creation of a risk-based approach, where auditors could exercise more judgment about which controls deserve greatest attention.

Walker

David Walker, the chief accountability officer for the U.S. government and head of the Government Accounting Office, said the federal government relies on a risk-based approach that allows auditors to determine which controls to test each year, with some assurance that all controls are tested over a defined period of time. Walker said the risk-based approach creates “a better balance between cost and benefit,” and, if adopted for public companies, would be backed up by the PCAOB inspection process to assure it is exercised reasonably.

Walker’s suggestion would address the common theme of criticism that auditors went too far in the first year of compliance with Section 404 of Sarbanes-Oxley, which requires companies to test and report on their internal control over financial reporting. Companies complained that auditors’ implementation of PCAOB’s Audit Standard No. 2 resulted in excessive, redundant testing of internal controls, and excessive cost as a result.

Auditors As “Whipping Boy”

Howell

Jay Howell, associate director of assurance for BDO Seidman and a panelist at the roundtable, said auditors are just as eager as companies for guidance about how best to proceed. “We didn’t implement [the PCAOB’s Audit Standard No. 2] in a vacuum,” Howell said. “We conducted meetings with the PCAOB to understand how we were to implement the standard.”

Howell said companies experienced high costs not just because of the way auditors implemented the new rules. “There was a lot of deferred maintenance to be done,” he said. “A lot of companies had not been focused enough on internal controls, so there was some catch-up to do.”

Panelist Lynn Turner, managing director of research for Glass Lewis & Co. and a former SEC chief accountant, said accountants became the “whipping boy” during the course of the day. “If I were one of those firms, I would have been livid,” Turner said. “Either you want good auditing, or you don’t. You can’t have it both ways.”

Turner says company complaints about excessive auditing are more likely grounded in angst over auditor findings rather than method. “It wasn’t a problem with the audit,” he said. “It was a problem with something the auditor found that management didn’t like.”

PricewaterhouseCoopers said a study of 225 of its public company clients revealed that the recent audit process revealed an average of about 275 internal control problems per company. The accounting firm said most problems were corrected by the end of the review process.

Compliance Week has been tracking the reporting of internal control problems and found that in March filings alone, the number of reported problems was four times greater in 2005 than in the 2004 reporting season.

Howell agreed companies and auditors alike need new guidance before delving into another year of internal control reporting and testing. Companies want and need more guidance about how to implement the accepted framework that guides the testing and reporting process, he said, and auditors need more guidance about the scope of testing and the concept of materiality. Howell says a risk-based approach would answer many of the concerns.

Marketplace Expectations

SEC and PCAOB officials made no promise about the direction their guidance would take, but PCAOB Chairman William McDonough agreed his staff needs to look at the communication problems widely reported between auditors and clients. Auditors who have adopted a strict interpretation of AS2 conclude that pre-audit counsel amounts to a control weakness for the company, contrary to standard-setters’ intention, McDonough has said.

Carcello

“The SEC is more circumspect,” said Joseph Carcello, director of research for the University of Tennessee Corporate Governance Center. He said SEC officials are awaiting some guidance from their Small Business Advisory Group and guidance from the Committee of Sponsoring Organizations of the Treadway Commission on how its widely accepted control framework can be adapted to better serve small companies.

Carcello is a member of the COSO task force studying the small issuer challenges and said the group is on target to issue its guidance in mid-July. The task force has made no specific determinations about what the guidance will contain, but is considering a risk-based model. “Could a registrant dial up some aspects of the internal controls while dialing back other areas?” Carcello said. “The cost burden would be reduced while the effectiveness of the control would not be appreciably reduced.”

Carcello said the task force is planning a roundtable for Chicago for early May to gather comments on the challenges for smaller issuers, but details have not been finalized or announced.

BDO Seidman’s Howell says accountants are looking forward to COSO’s and the SEC’s guidance for smaller companies, who were given an a one-year extension by SEC and won’t begin their first round of reporting until their fiscal year ending on or after July 16, 2006.“When they come on, that will represent a large amount of work that will strain the current audit system,” Howell said. Many smaller companies are still in the “formative thinking process” about Section 404 requirements, he said, awaiting the outcome of the current reporting season for larger companies and awaiting more guidance from SEC and COSO.

“[SEC officials] need to discern something quickly,” Howell said. “There’s a lot of expectation in the marketplace. They’re looking for rules to be rolled back or made easier for them.”