Using Work of Others (or Not) in SOX Audits

At the request of subscribers, Compliance Week offers a Remediation Center, in which readers can submit questions anonymously to securities and accounting experts. Compliance Week’s editors will review all questions and then submit them—confidentially, of course—to specialists who can address the issues. The questions and responses will then be reprinted in a future edition of Compliance Week. Below is one of the Q&As; ask your own questions by clicking here.

QUESTION

We’re finishing our first year of SOX compliance and have used third-party testers to help us create control matrices and strengthen our key controls. I thought we’d done a great job—but when our external auditors began their walkthroughs for our year-end audit, they told us that SOX 404 audits are separate from year-end audits and they will not rely on our testing!

Have other non-accelerated filers experienced this? We spent a lot of time and money on this, and Auditing Standard No. 5 specifically says auditors can rely on the work of others, yet our auditors still will not rely on our consulting firm’s work! Is this normal?

ANSWER

Accelerated filers have voiced your exact complaint to regulators—a reluctance by external auditors to rely significantly on control assessment work done by the companies themselves—on many occasions. The problem goes back decades to decisions reached by auditing standards setters (the AICPA at the time) that allowed external auditors not to rely on management’s accounting controls, set “audit risk” to “limited or zero reliance,” and use an audit approach that relied heavily on substantive testing of balances and analytical review—sometimes regardless of the actual quality of the controls management has put in place.

In the perfect, theoretical world of SOX compliance, this would all change radically. Management would carefully assess its controls and identify any areas of their control systems where, under Auditing Standard No. 5, there is more than a reasonable chance (rather than AS2’s strict “more than a remote possibility”) that a material error could still be present in the draft statements provided to the external auditor. The control assessment work, done perfectly well by the managers in our theoretical world, would have very little chance of even a single material error in the draft statements provided to the company’s auditor for review. (That is, even a single material error in draft statements should be cause for serious reflection and review of the control assessment process.)

In cases where management does disclose material control weaknesses to the external auditor, the auditor would do additional work to compensate for the lack of effective controls and issue a reliable audit opinion on the financial statements. Again, in our perfect SOX world, if the external auditors did enough work to assess the effectiveness of accounting controls and concurred with management’s conclusions on control effectiveness, there should be very little need for the auditor to complete much, if any, substantive testing on the account balances.

Unfortunately, we are nowhere near this perfect, theoretical world.

According to research from Audit Analytics, more than 10 percent of accelerated filers in 2006 had control effectiveness opinions, from both management and external auditors, that later proved to be wrong. An error rate of more than 1 in 10 does not encourage external auditors to believe either management’s or their own control effectiveness opinions—hence the need, for extra substantive testing. Until both management and auditors are able to produce more reliable control effectiveness opinions, it’s very likely that many, if not all, external auditors will still believe that they must do lots of substantive testing to mitigate the risk of giving the wrong opinion on the fairness of the financial statements. While the 90 percent of companies that get their control opinions and financial statements right will suffer, the 10 percent getting it wrong will continue to undermine the confidence of auditors, investors, credit agencies, and regulators.

The Institute of Management Accountants is currently studying this problem and will make a range of recommendations to Congress, the Securities and Exchange Commission, and the Public Company Accounting Oversight Board to try to address the problems that come with high SOX 404 spending that still produces high rates of material errors in audited financial statements.

Your best course of action is to produce draft financial statements free of even a single material error for your auditors for at least three years in a row, in addition to the work you do to assess and report on internal control. If you have been accomplishing this, I recommend you consider putting the audit of accounts out to bid on the basis that your current auditor is being unreasonable.

Conversely, if the draft financial statements you produce this year for your auditor are found to contain material errors in areas where you have reported that accounting controls are effective, I would encourage you to re-evaluate how you assess the effectiveness of your accounting controls. Even a single material error suggests your control assessment process may have reliability problems. Until we see significant improvements in the ability of both management and auditors to assess and report on control, few audit firms will accept the perfect theoretical SOX approach I outlined above.

Good luck, and best wishes for a fault-free draft financial statement and a restatement-free 2008.