A changing corporate culture: how companies are adjusting to Sarbanes-Oxley.

Recent corporate failures and frauds have called into question the value of the financial statement audit. The auditor's association with failing or distressed companies has created a firestorm of controversy. Two of the principal outcomes of this conflict have been the ASB's issuing SAS no. 99, Consideration of Fraud in a Financial Statement Audit and Congress's passing the Sarbanes-Oxley Act of 2002. These initiatives caused the accounting profession to reevaluate its position on corporate misconduct and deceptive reporting. Most would agree this was a necessary step in building renewed faith in corporate reporting and the audit function.

The purpose of this article is to provide businesses and their auditors with essential information by examining the changes resulting from the passage of Sarbanes-Oxley based on a field study of medium and large companies. We elicited feedback in a structured survey of top-level management including CEOs, CFOs and internal audit directors. (See "Survey Method," page 58, for more details.) Although critical to the auditor as baseline information, the general availability of these kinds of data is sparse for several reasons.

* It is hard to gain access to top management at most midsize of large corporations.

* Time constraints make it difficult to expect extensive responses to questionnaires or surveys.

* Any information collected from management as part of an audit typically is proprietary to the firm conducting it, which is likely to include it only in the audit documentation and never compare it or combine it with other clients' responses.

Thus, although our sample is small, it can provide CPAs with important benchmarks to gauge what they can expect from Sarbanes-Oxley. It also can be useful to companies because in their responses survey participants identified many best practices.

THE BACKGROUND

SAS no. 99 reiterates the theme of earlier standards that ethical corporate behavior begins with the "tone at the top" and the values established by senior management. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) said in its report, "Integrity must be accompanied by ethical values, and must start with the chief executive and senior management and permeate the organization." GAAS mandate that the auditor consider the corporate environment in assessing the risk of fraud and misconduct. The COSO report concluded that internal control systems "cannot rise above the integrity and ethical values of the people who create, administer and monitor them."

Sarbanes-Oxley recognizes the importance of the corporate culture by mandating additional governance responsibilities and reporting requirements for top-level management. Section 406, for example, requires companies that report to the SEC as securities issuers to disclose whether they have adopted a code of ethics for senior financial officers--and if not, why. In light of recent scandals, all CPA firms, whether responsible for audits of large corporations or smaller entities, should be concerned about management's attitude and the tone at the top.

EFFECT OF RECENT LEGISLATION

The survey asked respondents how the financial turmoil and legislative events of the last few years changed their company's controls over corporate governance and accounting management. Many executives were reluctant to acknowledge specific changes their companies had made. Most emphasized their company had always had a strong focus on corporate governance and financial reporting. However, during the course of the interviews, it became evident companies were making some significant changes.

Focus on ethics and accounting accuracy. Companies were using a number of tools to draw attention to this focus, including

* Representation letters. The majority of companies interviewed began requiring employees with significant financial or operational responsibility to sign letters before the CEO and CFO certified the company's public filings, under Sarbanes-Oxley. The purpose of the letters was to ask subordinates to justify stances on questionable reporting issues.

* Internal campaign to reassure employees the company has the highest regard for financial reporting and ethics. One company displayed posters promoting ethics and corporate governance. The CEO traveled worldwide to meet with department heads to emphasize they must uphold the highest standards of corporate responsibility. Another company invited employees to meet with directors after a board meeting. The objective was to emphasize the company was taking the reforms seriously and to provide an opportunity for discussion.

More active audit committee role. CFOs and audit committee members confirmed the level of contact between the two has increased considerably following Sarbanes-Oxley. Some specific actions included

* Recruiting more independent board and audit committee members. This is especially true for potential members who meet the financial expertise requirement. The companies in our sample said they have been adding board members with more accounting skills to strengthen the entire board and the audit committee.

* Increasing scrutiny of consuming services the company's external auditors provide. Many executives said although they did not necessarily agree with the ban on certain consulting services from their auditors, the risk of using them even for services not banned by Sarbanes-Oxley was too great.

* Asking more questions between audit committee meetings. Some CFOs said they were having weekly conversations with the audit committee chairperson. Committee members were initiating many of these communications. A strategy several companies used was to fax financial articles to the CFOs with questions from audit committee members on how the topics applied to their company.

* Asking external auditors more questions. Some audit committees were asking broad questions about matters the company's public filings should disclose. They also were asking auditors to provide information on the risks the audit committee should consider. Some survey participants reported these discussions could be difficult since the external auditor's responsibility and risk assessment focuses mostly on the financial statements.

* Seeking immediate fixes to control weaknesses. When the external or internal auditors identified a flaw, audit committees were less likely to be understanding of missed implementation deadlines. They demanded the staff address problems immediately.

* Putting greater focus on earnings quality. CFOs were getting more questions from the committee about earnings, including reserve reversals, one-time charges or credits and accounting principle changes.

* Increasing education for audit committee members. Most committees were conducting or initiating special corporate governance presentations.

* Requesting special risk reviews. At the audit committee's request, several companies had examined key risk areas. Areas of concern mentioned most often were revenue recognition, related party transactions, reserve reversals, accounting for capital expenditures and loans to officers.

Increased focus on internal audit. Many companies have long underutilized this department. Recent changes have made the internal audit function much more prominent. Some of the major changes included:

* Creating new departments. Some companies may need to implement and staff entire internal audit departments quickly. Sarbanes-Oxley encourages corporate controls such as those internal auditors provide. Moreover, the New York Stock Exchange listing standards require all NYSE companies to have an internal audit department. Other exchanges may follow suit.

* Filling existing staffing needs. It is not unusual for an internal audit department to be perpetually staffed at 80% of capacity. Sarbanes-Oxley and the NYSE rules create a greater sense of urgency to fill vacancies so a company can complete its approved audit plans on time.

* Bringing issues to the CEO and CFO's attention immediately. After an internal audit is complete, it can take time before the staff issues its formal report. Some internal audit departments reported they were initiating immediate discussions with the CEO and CFO when they discovered significant concerns.

We next asked executives to assess how much the new legislation would improve financial reporting: Two executives believed the improvement would be significant, eleven thought it would be moderate and four believed it would be slight. None thought there would be no improvement. Many explained that while it is impossible to legislate morality and ethics, greed was at the core of many of the past problems. However, respondents acknowledged the legislation would compel companies to implement processes to detect problems sooner.

We also asked the executives to identify what change would have the most positive effect on financial reporting. By far the most frequent response was "jail time." In general those we interviewed believed the highly publicized cases were causing everyone to rethink their roles and make sure they not only fulfilled their responsibilities but documented them as well.

Finally, we asked respondents how much having the CEO and CFO personally sign public reports attesting to their accuracy would increase their oversight of the filings. A majority believed there would be a significant or moderate increase. Most were clearly comfortable with making the required certification, pointing out they always believed it was their job to make sure the company's financial statements were fairly presented. There was generally a higher level of concern about certifying financial reports among executives who said they did not have an accounting background.

FINANCIAL REPORTING QUALITY

The survey asked executives to evaluate the performance of several groups responsible for financial reporting. Specifically, it asked them to use an A to F scale to grade the performance of the company's accounting management, external auditors, internal auditors and audit committee in fulfilling their responsibilities. The exhibit below summarizes the results. From their answers it was clear respondents believed there was room for considerable improvement. Most executives said the audit committee required the most change. In fact audit committee members were their own harshest critics.

Given these somewhat poor grades, we asked respondents to identify what each of these groups should do to improve their performance. Here are their answers.

Accounting management. This group got the highest marks, although there appeared to be some room for improvement. The survey participants made a number of recommendations.

* The CFO needs more independence and objectivity. CFOs themselves were the most outspoken about this point. Some of the initiatives they said would help address this issue were as follows:

* Make sure the CFO's and controller's incentive compensation plans are not too heavily weighted toward profits and stock growth. Although this strategy is obviously an important part of their job, there needs to be more balance between quality financial reporting and profits.

* Consider having the CFO and the audit committee bold private meetings together. This would provide a forum for the CFO to discuss various issues, among which might be pressure from the CEO to engage in "creative accounting."

* Have CFOs and controllers complete annual ethics and fraud training.

* One person in the accounting department should be a GAAP technician. With the increasing complexity of these procedures, some companies are relying more heavily on their external auditors to keep them updated on accounting changes. However, a number of CFOs believed it was important to have at least one technician who was an expert not only in GAAP, but also highly familiar with the company's operations. This would help ensure the entity identified all unique accounting situations, regardless of whether the external auditor became aware of them.

* The pressure for creative accounting must be reduced. CFOs believed there needed to be greater focus on accurate financial reporting and less on creative accounting. Some ways to accomplish this included the following:

* Have the CEO emphasize the importance of accurate financial reporting regardless of the consequences. CEOs should meet with department heads and create a direct communication channel for anyone who becomes uncomfortable with the company's accounting of disclosure policies.

* Require CFOs of subsidiaries of divisions to get corporate approval before making significant accounting decisions.

* Have external auditors and the audit committee meet privately with the CFO to ask specific questions about whether there has been any pressure for aggressive accounting.

* Get back to the basics of looking more closely at the numbers. Respondents noted that over the last decade, the CFO's job had evolved from being highly transaction oriented to being focused on strategy. The recent accounting issues led some executives to suggest CFOs needed to allocate more of their time to traditional accounting duties.

External auditors. Several respondents had been previously employed as auditors by top accounting firms and were fairly opinionated about this group. The suggestions mentioned most often were these:

* Quit consulting. Most executives we interviewed said a CPA firm focused exclusively on providing external audit services would do better audits and have more thorough quality control.

* Be more skeptical and realize the client may be misleading the auditor. Many audit procedures assume the client is telling the truth. Auditors need to develop methods that put less reliance on client representations.

* Do more "ticking and tying." Over the years most large accounting firms have moved away from substantive audits based on the balance sheet to ones with more of a risk-based approach. Many executives we interviewed thought it was time to move back to the basic approach while maintaining some of the positive aspects of the risk-based method.

* Vary the audit plan. Many CPA firms use a similar plan every year. Management knows what to expect. In some situations auditors let management provide too much input on the plan scope. The audit plan needs to be different each year, and management should have less input.

* Maintain the audit partner's independence from management. Survey participants said audit committees needed to have frequent and active dialogue with the audit partner without management present. In addition, audit partners needed to be involved in decisions at all levels of the audit.

Internal auditors. The question of what internal auditors could do to improve their performance was difficult for many executives to answer. Respondents generally acknowledged they were underutilizing their own internal audit departments. However, these thoughts on improving internal audit emerged:

* Stop using the department as a training ground. Although internal audit traditionally has been a prime source of employees for the rest of the company, ongoing turnover has made it difficult to develop a quality staff. Internal audit professionals need to develop their skills and knowledge of the company over a period of years and then apply them to auditing the company rather than moving into other departments.

* Do more risk analysis before agreeing on an audit plan. Internal auditors sometimes rely too heavily on questionnaires they give to managers and department supervisors to assess the adequacy of their internal controls. Although these questionnaires provide useful information, internal auditors should perform independent, objective analyses to corroborate departments' self-assessments.

* Focus more auditing resources on financial areas. Over the last several years, internal auditors have transformed themselves from a compliance function to a consulting function. Many executives said internal auditors should reallocate their time to the "traditional auditing of the numbers." In addition some thought companies should develop an overlap between their internal and external auditors in key risk areas.

* Have the chief internal audit executive report to the audit committee. This step, plus frequent private meetings with the committee without other management present can help ensure independence. If a "dotted line" to management on the organization chart is necessary, the audit committee should consider having it report outside of the CFO. However, many executives recognized the difficulty of doing this since typically the CFO has the best background to provide daily direction.

* View the internal audit department as more critical to the company's success. Internal audit budgets should be brought into line with the entity's risk profile, and executives should make internal auditors part of their initiatives and operations.

Audit committees. Most executives we interviewed generally graded the audit committee's performance the lowest. However, survey participants frequently singled out the committee as being the most important. Here are some ways the audit committee can improve:

* Make sure all members are independent and qualified. Under the new Sarbanes-Oxley and SEC rules, many companies acknowledged they need to replace or add audit committee members. Although they generally believed their committee members were of high caliber, some executives reported their audit committees did not include anyone they would consider a financial expert.

* Spend more time in meetings and focus on the details. The days of the 30-minute audit committee meeting are over. The schedule should include private meetings with the internal and external auditors and possibly the CFO and CEO. Audit committee members need to ask for more details on estimates and how management made them. They need to challenge accounting issues and make sure they under stand why management did not choose more conservative alternatives.

* Implement a risk management plan. More needs to be done to assess corporate risks. One company had a formal risk management process where the "risk owners" reported directly to the audit committee, helping it better understand risks and impressing on the owners the importance of their job.

* Do performance reviews for the CEO and CFO. The audit committee should regularly review the job performance of these executives and have input into their compensation. This will help emphasize the importance of accurate financial reporting.

* Expand participation in audit committee meetings. More interaction is crucial. Some companies said they invited the chairman, CEO and chief legal counsel to attend all audit committee meetings (as well as the CFO and internal and external auditors who normally attend).

A LONG ROAD AHEAD

While the current focus on improved corporate governance is a good start, companies need to implement policies, procedures and systems that will ensure this emphasis remains even after media attention declines. Financial reporting breakdowns will continue to receive close public scrutiny. How a company addresses corporate governance should take into account the suggestions of the various executives interviewed for this survey. Businesses also should develop a process for continually enhancing internal controls for corporate governance and financial reporting. An effectively functioning business-risk-management process will serve to augment the company's corporate governance.

Corporate Board Overhaul

* The average board of directors has become 69% independent, compared with 62% five years ago.

* Despite increased demands on board members, a typical director's compensation dropped 4% in 2003--the first decline in five years--due in large measure to a 22% decline in the average value of stock option grants.

* Nearly 80% of audit committees have become fully independent, a dramatic increase from 1999 when only 56% of companies surveyed had independent audit committees.

* The number of companies using deferred stock awards, time-lapsing restricted stock and stock units to compensate directors rose to 28% in 2003 from 24% the previous year. Some large companies stopped granting stock options to nonemployee directors altogether.

Source: Investor Responsibility Research Center, Washington, D.C., survey of board practices and pay, www.irrc.org, 2004.

Survey Method

We interviewed 17 executives including 3 CEOs. 7 CFOs, 1 president and 6 individuals who either were involved at the top level of the internal audit function or were audit committee chairpersons. Their companies had average annual sales of $3.9 billion, with a range from $30 million to $17 billion. Three of the companies were privately held with the remainder publicly traded. The interviews involved a series of both open-ended and "check the box"-type questions and took approximately one hour. The data were collected following the passage of Sarbanes-Oxley in mid-2002.

The survey questions were designed to examine executives' beliefs in two major areas: the effect of recent events and legislation on financial reporting and the quality of financial reporting in the past and the prospects for future improvement, including how the executives' companies have reacted. The approach was structured in a way that allowed for the same questions to be asked of each respondent, who had an opportunity to explain his or her answers.

PRACTICAL TIPS TO REMEMBER

* CPAs should encourage employers and clients to have employees with significant financial of operational responsibility sign representation letters before the company's CEO and CFO certify its public filings under Sarbanes-Oxley.

* Companies should see that their CFOs have weekly conversations with the audit committee chairperson to discuss pertinent issues. Some are encouraging audit committee members to fax financial articles to the CFO with questions about how a topic applies to their company.

* To enable the department to fulfill its new responsibilities under Sarbanes-Oxley and complete its audit plans on time, CPAs should emphasize the urgency of filling vacancies in a company's internal audit department so it is fully staffed.

* The CFO and controller's incentive compensation plans should not be too heavily weighted toward profits and stock growth. At the same time the audit committee must have a regular role in reviewing the job performance of the CEO and CFO. Both steps will help ensure their independence and emphasize the importance of accurate financial reporting.

AICPA

RESOURCES

* AICPA Audit Committee Effectiveness Center. Includes access to the AICPA Audit Committee Toolkit and the audit committee matching system as well as related news, guidance and resources. Visitors can also sign up to receive audit committee e-alerts. Go to www.aicpa.org and click on Audit Committee Effectiveness Center.

* AICPA Sarbanes-Oxley Act/ PCAOB Implementation Center. At www.aicpa.org visitors can access background documents, implementation guidance and other useful tools as well as find links to PCAOB activities. Members can call the AICPA Sarbanes-Oxley Act Hotline at 866-265-1977 for additional assistance.

* Internal Control Reporting--Implementing Sarbanes-Oxley Section 404. A guide highlighting significant technical issues of interest to CEOs, CFOs, internal auditors and other financial managers. Product no. 029200JA. To order call the AICPA service center at 888-777-7077 or shop online at www.cpa2biz.com/store.

Performance Grades for Key Groups

                        Number of responses

                        A    B    C   D   F   GPA

Accounting management   1   11    4   0   1   2.6
External auditors       1    5   10   0   1   2.1
Internal auditors *     0    8    6   2   0   2.4
Audit committees        1    3    4   8   1   1.7

Grade point average (GPA): A = 4, B = 3, C = 2, D = 1, F = 0

* One respondent indicated his company did not have an internal
audit department and did not respond to this question.

EXECUTIVE SUMMARY

* RECENT CORPORATE FAILURES HAVE CALLED INTO question the value of the financial statement audit. One of the results was the Sarbanes-Oxley Act of 2002, which has the potential to change corporate culture by mandating additional governance responsibilities and reporting requirements for top management.

* A SURVEY OF FINANCIAL EXECUTIVES SHOWS one of the most visible changes from Sarbanes-Oxley is a more independent and active board of directors and audit committee. Many audit committees are seeking to add members with accounting skills. And audit committee members are asking more questions of the company's financial staff and external auditors.

* FOLLOWING SARBANES-OXLEY AND STOCK EXCHANGE mandates, companies need fully staffed internal audit departments now more than ever. As the internal audit staff does its work, it needs to bring pressing issues to the attention of the CEO and CFO immediately instead of waiting to issue a formal report.

* SURVEY PARTICIPANTS CAVE ACCOUNTING MANAGEMENT the highest marks, although there still is room for improvement. External auditors need to quit consulting, be more skeptical and vary the audit plan so the client doesn't always know what to expect. Internal auditors need to focus more resources on financial areas and do more risk analysis before agreeing on an audit plan.

* WITH LOW GRADES FROM THE EXECUTIVES SURVEYED, the audit committee needs to make the most changes, including finding members who are both independent and qualified. With the days of the 30-minute audit committee meeting over, members need to spend more of their time focusing on the details. This includes meeting privately with internal and external auditors as well as with the company's CEO and CFO.

TINA D. CARPENTER, CPA, is a doctoral candidate at Florida State University in Tallahassee. Her e-mail address is tld8218 @garnet.acns.fsu.edu. M.G. FENNEMA, CPA, PhD, is Ernst & Young Professor of Accounting and department chairman at Florida State University. His e-mail address is [e-mail]. PHILLIP Z. FRETWELL, CPA, is managing director at Protiviti in Orlando, Florida. His e-mail address is [e-mail]. WILLIAM HILLISON, CPA, PhD, is Andersen Professor of Accounting at Florida State University. His e-mail address is [e-mail].