Ask FERF about ... Internal Control over Financial Reporting.

Internal Control over Financial Reporting (ICFR) continues to be a hot topic as companies strive to achieve a sustainable model for assessing the effectiveness of ICFR and supporting their auditor's opinion, as required by Section 404 of the Sarbanes-Oxley Act (Section 404).

In addition to public companies required to comply with Section 404, many privately held companies have voluntarily adopted Section 404 at the request of their boards or management, or at the request of an outside lender, equity holder or business partner.

The U.S. Securities and Exchange Commission (SEC) rule implementing Section 404 requires management's assessment of ICFR be made with reference to a "suitable, recognized control framework established by a body of experts that followed due-process procedures, including the broad distribution of the framework for public comment." The SEC identified as suitable the framework of the Committee of Sponsoring Organizations of the Treadway Commission's (COSO) Internal Control--Integrated Framework ("COSO Framework").

The SEC noted there may be other "suitable, recognized" control frameworks, including "Guidance on Assessing Control," published by the Canadian Institute of Chartered Accountants (CICA), www.cica.ca, and the Turnbull Report, published by the Institute of Chartered Accountants in England & Wales. (A draft of revised guidance for Turnbull is currently open for consultation (comment) by September 16, and the draft guidance and original Turnbull Framework are available from the U.K.'s Financial Reporting Council at www.frc.org.uk/corporate/interna/contro/.cfm.)

Importantly, the SEC rule added, "Under our final rules, management of a foreign reporting company which relies on such an evaluation framework used in its home country is nevertheless under an obligation to state affirmatively whether its company's internal controls are, or are not, effective." The U.S. Public Company Accounting Oversight Board (PCAOB) also recognizes COSO.

At the request of the SEC Chief Accountant, COSO formed a task force in 2005 to develop guidance for smaller companies in implementing the COSO framework. As this goes to press, COSO is preparing to issue an Exposure Draft (ED) of proposed guidance for small businesses during September, for a comment period of approximately 60 days. Updated announcements, including a link to the ED once posted, can be found at www.coso.org. Companies of all sizes, public and private, may want to review the COSO ED.

Resources for companies of all sizes for implementing and sustaining the ICFR assessment process are offered by many organizations, a sample of which follow; all of them have relationships with FEI. Financial Executives Research Foundation (FERF) makes no claim as to the quality of the products and services offered by the providers listed in alphabetical order below; this is for reference only.

Accounting firms of varying sizes offer Sarbanes-Oxley solutions, including out-sourcing and consulting to companies other than their own audit clients. Some firms offering such services include: Deloitte LLP (www.deloitte.com); Ernst & Young LLP (www.ey.com); Grant Thornton LLP (www.grantthornton.com); KPMG LLP (www.kpmg.com); and PricewaterhouseCoopers LLP (www.pwc.com).

The Board Institute (www.theboardinstitute.com) provides risk management products aimed at increasing board effectiveness.

CSC Consulting (www.csc.com) provides IT services including consulting, out-sourcing and systems integration.

Hyperion (www.hyperion.com) offers Business Performance Management (BPM) solutions, including Sarbanes-Oxley management solutions.

IBM Global Services--Financial Management Services (www.ibm.com) provides support for Sarbanes-Oxley initiatives, as well as transforming business processes and moving to a real-time, ondemand environment.

Jefferson Wells (www.jeffersonwells.com) provides services in internal audit, technology risk management, tax and finance and accounting.

Oracle Corp. (www.oracle.com) provides help in managing, using, sharing and protecting information.

Hyland Software provides On-Base, an Enterprise Compliance Management solution (www.onbase.com).

Paisley Consulting (www.paisleyconsulting.com) offers software, consulting and training solutions for compliance, risk management, corporate assurance and auditing.

Parson Consulting (www.parsonconsulting.com) is a financial management consultancy that helps senior finance executives improve the efficiency and effectiveness of finance and other support functions.

Protiviti (www.protiviti.com) provides independent internal audit and business and technology risk consulting services.

Robert Half Management Resources Inc. (www.rhmr.com) provides senior-level accounting and finance professionals on a project and interim basis.

Edith Orenstein ([e-mail]) is Manager of Research for Financial Executives Research Foundation (FERF).

contributed by FERF