A question of balance: assessing the final PCAOB auditing standard.

As of this writing, the Public Company Accounting Oversight Board (PCAOB) had just issued its long-awaited final standard on the integrated audits of internal control over financial reporting and financial statements, as required under Section 404 of the Sarbanes-Oxley Act.

The standard is complex. It is both a good news and a bad news story.

On a positive note, the final standard places greater reliance on auditor judgment, allowing him or her to rely at least partially on the work of others. In this important change, the standard has become far less prescriptive than had been originally proposed. The auditor can now exercise his or her professional judgment and rely on the work of competent and objective personnel--and particularly on a competent and objective internal audit function. This is particularly true in the areas of general information technology controls and controls over the period-end financial reporting process.

[ILLUSTRATION OMITTED]

The new standard establishes a three-part test for determining the extent to which the auditor can rely on others' work. The auditor must first examine the nature of the controls and assess their significance. Secondly, he or she must look at both the competency and objectivity of the party assessing those controls, carefully evaluating both and calculating a combined score--one cannot offset the other. And thirdly, he or she must test some of the work performed by others to evaluate its quality and effectiveness.

The Sins of the Few

I am very pleased that the Board agreed to consider the significant experience and judgmental integrity of most auditors and allow them, in turn, to factor in the collected expertise and honesty of the vast bulk of financial managers and internal auditors. I continue to believe that the corruption and excesses that led to Sarbanes-Oxley remain the sins of the few, not the many. Would an Enron or a WorldCom scandal have been avoided had these companies been required to document internal controls? I doubt it.

However, the new standard is very clear: the auditor must obtain the "principal evidence" to support an assessment. This means that although the auditor can rely on the work of others to a larger extent than in the previous draft, he or she must perform enough audit work directly to obtain the "principal evidence" for an attestation. The net result, then, is that the new standard should enable the auditor to reduce the extent of original testing.

In the negative column, the final standard now expressly requires the auditor to issue two opinions: one on the effectiveness of internal control over financial reporting and a second evaluating management's assessment in the internal control report. This requires direct testing by the auditor to support both opinions, in addition to what has already been performed by management.

Such duplicative testing is, of course, very costly. FEI has always maintained that, whatever the final standard is, it must take care to strike a reasoned balance between the cost of compliance and the ultimate benefit to shareholders and the public. Those scales are still tipped in the wrong direction, and I remain concerned over this imbalance. Based on existing attestation standards, the cost for an independent auditor to render an opinion directly on the effectiveness of an issuer's internal control systems is, in my opinion, far in excess of the potential benefits to the investing public.

FEI's recent survey of 321 member companies on the anticipated costs of Section 404 compliance--taken in January--has identified excessively high costs. Large companies anticipate their total incremental costs will be in excess of $4.6 million per year, with smaller companies expecting to add an extra $2 million. These are significant costs by any measure.

Additionally, these companies estimated that audit fees would increase by about 38 percent. However, at the time of the survey, many audit firms, lacking a final standard, had not provided their clients with a revised fee, so these are truly estimates.

I am also concerned that these high compliance costs will fall especially harshly on small to mid-sized companies. The Board has committed to watching this closely.

As you read this, the new standard will almost certainly have been approved by the Securities and Exchange Commission and be a fait accompli. We need, therefore, to manage our way through these compliance challenges, no matter how onerous. They, and the aggressive legislation from which they stem, are reflective of the heavy price that must be paid by all American companies when a few choose to subvert the law and manipulate information for their own selfish ends.