Are regulations changing management reports? A recent Financial Executives Research Foundation (FERF) survey reviews year-one disclosure practices for management's reports on internal controls, and looks at trends likely for year two.

One of the provisions of the Sarbanes-Oxley Act of 2002 led to new regulations over internal control disclosures. But the resulting U.S. Securities and Exchange Commission (SEC) rules provide companies with discretion when writing and disclosing their Management's Reports on Internal Controls. This report on internal controls was not required prior to Section 404. However, certain companies voluntarily chose to provide management's report on the financial statements.

What practices are most common and what interesting approaches did specific companies develop?

In order to find out about the emerging trends in management reports, Financial Executives Research Foundation (FERF) studied companies' reports, released during the spring 2005 reporting season. The study provides a portrait of these trends and techniques that can serve as a guide for practitioners preparing year two disclosures.

The report addresses a number of areas where there is variation in practice--for example, companies disclosing two separate management reports (one on internal control and another on the financial statements); the location of management reports within Form 10-K; specific statements provided by some, but not all, companies in their reports; and the issuance of a single "integrated" audit report.

SEC Regulations

Section 404 of Sarbanes-Oxley directs the SEC to require annual reports (in Forms 10-K) to contain an internal control report that includes: 1) a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and 2) an assessment of the effectiveness of the company's internal control structure and financial reporting procedures.

Section 404 also requires the company's independent registered public accounting firm to attest to and report on management's assessment.

In response to Section 404, the SEC issued its final rule: Management's Reports on Internal Control over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, setting forth specific requirements for Management's Reports on Internal Control Over Financial Reporting.

The SEC final rule requires four statements to be included in the report: 1) management's responsibility for internal control over financial reporting; 2) the internal control framework used; 3) management's assessment; and 4) reference to the auditor's attestation report. Domestic accelerated filers--companies with equity market capitalization exceeding $75 million (among other criteria)--are required to meet the requirements for fiscal years ending on or after Nov. 15, 2004.

In addition, the Public Company Accounting Oversight Board's Auditing Standard No. 2: An Audit of Internal Control Over Financial Reporting Performed in Conjunction With an Audit of Financial Statements (AS2) provides guidance for auditing a company's internal control over financial reporting and establishes the content of the auditor's report.

Common Disclosures

The FERF study, Management's Reports on Internal Controls, summarizes a review of SEC Forms 10-K and 10-K/A for 198 accelerated filers, including the 102 largest SEC filers in the Fortune 500 that had effective internal controls over financial reporting and did not report any material weaknesses or control deficiencies, and 96 additional filers that reported material weaknesses or control deficiencies.

The sample of companies reported average market value of $27 billion. Because of the selection method, the samples of companies reporting material weaknesses had considerably lower average market value ($7.1 billion) than companies reporting no deficiencies ($45.6 billion). However, this difference does not indicate that larger companies are less likely to have material weaknesses than smaller companies.

Approximately 72 percent of the sample companies had fiscal years ending in December 2004, and about 20 percent had fiscal years ending in January 2005. Most made the statements in the order provided in the rule, with only a handful of companies reporting these attributes in a different order. All companies in the sample used the framework established by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).

The FERF study identified many additional statements that companies commonly placed into the management reports. Most companies (59 percent) included a statement about the purpose of internal controls, using language similar to that provided by SEC Rule 13a-15 and 15d-15. In fact, many companies also referred to these SEC rules in either their disclosure controls and procedures evaluations located in Item 9A (Controls and Procedures) or in the management report on internal control itself.

A majority of companies (74 percent) also included a statement about the function of internal control procedures, again as defined by SEC rules. Finally, most companies (60 percent) included a statement regarding the limitations of internal controls, culled from AS2, explaining that due to its inherent limitations, internal controls over financial reporting cannot provide absolute assurance that financial reporting objectives will be achieved.

Number of Management's Reports and Location within 10-K

Companies have discretion on where to place the management's reports in their 10-K filings. FERF found that most companies (58 percent) provided a single management's report located in Item 9A.

Another 13 percent provided a single report in Item 8 (Financial Statements and Supplementary Data), while 12 percent provided a single report in Item 15 (Exhibits, Financial Statement Schedules and Reports on Form 10-K). The remainder of the companies provided this information in other 10-K items or in a combination of the items previously mentioned.

One area of variation was in the number of management reports issued. While most companies provided just one management report on internal controls over financial reporting in their 10-Ks, 15 percent of the companies in the sample included an additional management report on the financial statements. A number of these companies reprinted internal control management report in two different parts of the 10-K.

For example, Comcast Corp. was one of 30 companies in the sample that provided two separate management reports. Item 8 of its 10-K includes management's report on financial statements. It follows with management's report on internal control over financial reporting, continues with the auditor's report and ends with the financial statements.

According to Lawrence J. Salva, senior vice president, chief accounting officer and controller of Comcast and current chairman of FEI's Committee on Corporate Reporting (CCR), the reports were positioned this way for users looking for the financial statements. "It's logical that if [readers were looking for financial statements, they] would automatically see all three reports," he says.

Voluntary Disclosures

In conjunction with its management's reports, several companies discussed corporate codes of ethics. Others explained specific procedures within the code of ethics, such as an anonymous hotline. Still others explained the role of their audit committee and their role in working with the independent auditor.

Immediately following its internal control report in Items 8 and 9A of its 10-K, The Dow Chemical Co. provides a section titled Management's Process to Assess the Effectiveness of Internal Control Over Financial Reporting. This section states that its conclusion is based on a comprehensive evaluation and analysis of the five elements of COSO and provides five key procedures upon which the company's assessment was based.

Frank H. Brod, corporate vice president and controller of Dow and past chair of CCR (who, along with the company's CEO and CFO, signed the report), says that Dow did not want to take a standard boilerplate approach to its management report. "Our goal was to write the management's report in plain English so it would be more useful to investors and readers of the financial statements. We felt it was important to go beyond the basic required language to describe the process we used to arrive at management's conclusion [on the effectiveness of internal control over financial reporting]."

Salva concurs, noting that: "The management reports provided the company with the opportunity to address the respective roles of management, external auditors and the audit committee." Comcast's internal control management report, for example, was followed by a section titled Audit Committee Oversight that addressed the committee's oversight responsibility for the financial reporting process and related audits. Additionally, Salva points out that Comcast made a decision to include those words in its management reports relative to the preparation of financial statements.

Control Deficiency and Material Weakness Reporting

Three companies in the sample reported control deficiencies that were not considered material weaknesses. The management reports for these companies concluded that a control deficiency existed that led to a restatement. However, the companies and auditors made a final determination that the internal control over financial reporting was effective. Such disclosures explained the nature of the deficiencies, why they were not classified as material weaknesses and remedial action taken by the respective companies to address the weaknesses.

The most commonly reported weakness among the companies reporting material weaknesses was found to be with respect to leases (28 percent of companies), income taxes (20 percent) and inventory or cost of goods sold (10 percent).

Auditors' Reports

While the focus of the FERF study was on management's reports, auditor reports were also collected and analyzed. While most audit firms issued two separate auditor reports to their clients--one on the audit of the financial statements and a second attesting to management's assessment of internal controls--one audit firm, PricewaterhouseCoopers LLP, issued a single "integrated audit report" for each of its clients in the FERF sample.

"We spent a lot of time thinking about how to present our report," says John May, a partner with PricewaterhouseCoopers' national office. Additionally, he says, "We think the integrated reporting framework is beneficial to investors and the markets because it provides them with a single point of reference for all of our opinions in a given filing." Finally, he adds, "We also believe that this reporting model best reflects our integrated audit approach and the close link between the financial statements and internal controls."

As many companies approach the end of year two of 404, both Brod and Salva don't expect any major changes to management's report on internal control. "We did enough thinking [about preparing this report] in the first year," Salva says. "Unless we missed something, we don't want to spend significant time on it this year."

Dr. Mark P. Holtzman, CPA ([e-mail]), is Assistant Professor of Accounting at Seton Hall University. Cheryl de Mesa Graziano, CPA ([e-mail]), is Vice President of Research and Operations for Financial Executives Research Foundation (FERF).

RELATED ARTICLE: take aways

* A provision of Sarbanes-Oxley directs the SEC to require companies to submit Management's Reports on Internal Controls; the company's independent public accounting firm also is required to attest to and report on management's assessment.

* The rules provide discretion when writing and disclosing, and there is variation in practice.

* The most commonly reported material weakness disclosed applied to leases; the next highest, taxes, and then inventory or cost of goods sold.

* While most audit firms issued two auditor reports, PwC issued single "ingregrated audit" reports to clients.

TABLE 1 Number of audit reports issued

                                              Issuing one   Issuing two
                            No. of companies  integrated    audit
Auditor                     in sample         audit report  reports

BDO Seidman LLP               4                               4
Deloitte & Touche LLP        48                7             41
Ernst & Young LLP            42                              42
Grant Thornton LLP            3                               3
Grobstein, Horwath & Co.      1                               1
KPMG LLP                     44                1             43
PricewaterhouseCoopers LLP   55               55
All auditors                198               63            134

TABLE 2 Material Weaknesses Disclosed

Number of companies  Material Weakness

 6                   Derivatives
 6                   Liabilities
 7                   Personnel
 9                   Revenue
10                   Inventory/COGS
19                   Income Taxes
27                   Leases
75                   Other

Note: Table made from bar graph.