Companies sensing a big chill with auditors: the outside auditor-corporate client relationship has changed considerably in the advent of Sarbanes-Oxley and the PCAOB rules. Stricter standards and an insistence on independence have created uncertainty and some friction.

The rules fashioned by the Sarbanes-Oxley Act have been the source of a lot of grumbling, and not a little public criticism. H. Rodgin Cohen, chairman of the Sullivan & Cromwell law firm, has compared Sarbanes-Oxley to the Patriot Act passed in the wake of the 9/11 attacks. Both laws were enacted in a time of crisis, he says, and both present "the risk of an unrealistic oversight and enforcement process that places institutions in undue jeopardy and discourages rational, in favor of defensive, compliance policies."

Perhaps nowhere has Sarbanes-Oxley affected companies as profoundly as in the audit relationship. Of course, the Act outlined some general principles with which no reasonable person could disagree, such as the principle that an auditor should be somewhat more independent of management than Arthur Andersen was of Enron Corp. But subsequent (somewhat delayed) rules and guidance and standards from the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB) have had what more than one CFO has called a "chilling effect" on the relationship between auditors and management.

This is one point on which management and auditors can both agree. "It's not good policy, "said Garrett L. Stauffer, senior partner in the national risk and quality practice of PricewaterhouseCoopers, during the SEC's public roundtable on Sarbanes-Oxley implementation in April. "It's driven bad behavior, it's prevented good communications and it has the impact of going backwards when you think about the quality of financial reporting."

"What you're finding is ultra-conservatism," observes David L. Shedlarz, vice chairman and former CFO of Pfizer Inc. Many executives believe the auditors have drawn into a kind of shell, and the executives say they can no longer rely on their auditors for answers to questions about how to interpret accounting standards. Some are afraid to even ask--worried that by posing a question they will betray ignorance, and therefore find themselves cited for a control deficiency. Some have found it necessary to hire two separate audit firms--one to provide advice, the other to attest.

Others have tried to hire another audit firm and found it impossible to get any auditor to go on the record with an answer to their question. Audit committee members say that a certain amount of tension in the relationship between managers and auditors is good, but worry that they're now getting too much of a good thing. Tension, it seems, is approaching the breaking point.

"Probably some level of tension is constructive, because you want oversight responsibility between the auditor and management," says Jim Copeland, former chairman of Deloitte & Touche, who chairs the audit committee of Equifax and serves on the boards of Conoco Philips and The Coca-Cola Co. "But when it becomes too great, you worry about a lack of transparency and willingness to be open that makes the auditor's job more difficult."

Relief could be on the way. At the conclusion of the April 13 SEC roundtable on the implementation of Sarbanes-Oxley, PCAOB Chairman William McDonough took his own staff by surprise, announcing that new guidance would be forthcoming on some of the more problematic issues raised by PCAOB standards. Meanwhile, at companies such as Lockheed-Martin Corp. and Continental Airlines Inc., internal auditors have learned the delicate art of being both internal and independent--so that external auditors can rely on their work, and therefore minimize duplication of effort and expense.

The Big Chill

Lee Level, corporate vice president and CFO of Computer Sciences Corp., had an accounting question whose answer seemed obvious to him but was not specifically covered by an accounting rule. He wanted to get some feedback from an auditor, but couldn't get it.

"Our auditor thought we had to prepare our position paper without interacting with them in advance," he said in an interview. He approached two of the remaining three Big Four firms to get some confirmation of his position. "The two firms indicated that they were convinced that we were correct, but because of the new environment, could not provide us anything in writing to support our position."

Philip D. Ameen, vice president and comptroller of General Electric Co., says that the "chilling effect" of the new environment has made him reluctant to bring matters to the attention of GE's auditor. "It was true before that we never ran into any sort of risk of having the auditors observe to our managers or to the audit committee that we had a deficient depth or breadth of accounting expertise," he said during the course of the SEC roundtable on Sarbanes-Oxley.

In the past, Ameen said, he could consult with auditors to get the benefit of their experience with other clients. "All of that information is relevant sometimes to the way I structure, the way I execute, the way I account for transactions. I think that it is unfortunate that we have lost that, but I do think that under the current interpretations, it has been lost."

Ameen also notes that while GE used to send draft financial statements to its auditor as soon as the drafts were ready, now it waits until completion of internal review. "Those early drafts inevitably have errors in them, and I don't want ... auditors saying that error is evidence of a weakness in internal controls," he says.

[ILLUSTRATION OMITTED]

This chill is slowing the pace of business and investment, putting a damper on everything from risk management to technology investments. According to Peter D. Lyons, a partner in the law firm of Shearman & Sterling, companies involved in carve-outs are reluctant to provide financial statements as promptly as they used to, because they worry about what will happen when the statements go to the auditors. "They're going in with a mindset that there will be a lot of changes. They're very concerned about it, and it's affecting transactions in a material way."

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

Audit costs are up, but some wonder what they're paying for. Smaller companies carry a particularly heavy burden. Dr. Albert Teplin, former chief of the flow of funds section of the Federal Reserve, now chairs the audit committee for Viad Corp. and serves on the audit committee of MoneyGram International, a reverse spinoff of Viad completed in 2004. Viad's audit fees were over $2 million in 2004, on net income just over $20 million.

"We were paying them a lot more, but didn't know if we could talk to them as much as before," Teplin says. There are other costs as well. Viad postponed a technology investment because if it had made the investment in mid-2004, it might not have been completely debugged by the time the auditors arrived. "If they are going to invest millions in a new system, they have to make sure it's working perfectly so it can be audited. The whole timing of the investment has to take into account the [Section] 404 audit process," he observes.

Duplication by external auditors of work already done by internal auditors has driven a big chunk of costs, as well. Steve Goepfert, senior director of internal audit for Continental Airlines, observes, "If a certain number of quarterly reconciliations need to be done, we'd test a number to make sure they hit the key attributes. The redundancy is that the external auditor may come back and do the same level of work on the same reconciliations in order to make their assessment. Is that duplicative? Do they have to do the same amount of testing all over again?"

Common sense says no. The wording of the various regulations and standards seems to allow plenty of room for auditors to approach audits with more judgment. Why aren't they doing so? Two factors seem to be responsible: fear and inexperience.

There's good reason for auditors to be wary. First, there are the regulators. The PCAOB's McDonough, speaking off the cuff at the conclusion of the SEC's roundtable, said bluntly, "They know fully well that if they do something wrong, especially if it involved moral turpitude, we will beat the hell out of them." Second, there are the lawyers. The destruction of Arthur Andersen is still a fresh memory, and one apt to discourage auditors from even approaching, to say nothing of pushing, the regulatory envelope.

When regulations use undefined terms like "reasonable" and "material," they seem to cry out for the use of judgment. Yet there is a downside to judgment, as Robert Hodgkinson, secretary of the United Kingdom's Turnbull Review Group, observed: "You can't have judgment which always leads to the same outcome in all circumstances. A lot of people are asking for more and more guidance, presumably to give them certainty that they're exercising judgment properly--in which case they're not exercising judgment."

Auditors say that much of the cost and confusion around 2004 was part of a "learning curve." Financial executives say that auditors often seemed unable to make any sort of judgment or decision without first checking with a higher authority.

PricewaterhouseCoopers' Stauffer confirmed that his firm, like others, urged local auditors to confer with national "to make sure we had consistency." Timothy P. Flynn, vice chair of KPMG's audit practice, observed during the roundtable that in the coming year, auditors should be able to integrate the financial and control audits, make better use of other's work and be more "consultative" with clients.

Lawyers aren't so sure. "The whole environment accountants face is driving a lot of the conservatism we see, and I don't think it will change unless and until the accountants can see a change in the regime they face that will allow them to exercise more judgment and allow their general counsel to see they're not crazy for doing it," says Shearman & Sterling's Lyons.

One ray of hope came at the end of the SEC roundtable, when PCAOB Chairman McDonough promised new guidance by May 16 (Financial Executive's deadlines precluded getting any information about that guidance for this article).

"The reason we want to do it through staff guidance is that we can do it quickly," he explained. McDonough also promised that the PCAOB would discuss reopening Auditing Standard No. 2 (AS2) at the meeting of a PCAOB advisory group this month.

At Sempra Energy, the California utility, CFO Neal Schmale says his firm spent "north of $10 million" on Sarbanes-Oxley compliance in 2004, and notes that despite a lot of advance work by internal audit, "in our case, there was a ton of duplication." He isn't sanguine about the prospects for addressing the issue through new rules or guidance. "I'm not sure how you craft a formula that says to audit firms, 'here's a formula by which you rely on a company's own work.'"

Internal Audit

At Lockheed Martin, Kimberly Parker Gavaletz, vice president, corporate internal audit, says a scrupulous attention to her own unit's independence helped her keep the work of internal audit acceptable for use by external auditors. During the process of testing IT controls, for example, managers asked for help from the internal audit group.

"That would have compromised my independence," she says. "We checked and found that management was capable of completing it, and said, 'you do it.' We were able to maintain management's ownership, our independence and the external auditor's ability to rely on our work."

It no doubt helps that at Lockheed Martin, internal audit reports regularly to the audit committee, and directly to the CEO. So, says Gavaletz, "instead of being just objective, we were independent."

Dominique Vincenti, executive director of the Institute of Internal Auditors (IIA) Research Foundation, says that more and more companies are moving in the direction of having outside auditors report to the audit committee. But that isn't always enough to stop duplication, and with good reason. Continental's Steve Goepfert, who reports functionally to the audit committee, notes that AS2 specifically says that "the auditor's own work must provide the principal evidence for the audit opinion."

At this point, it seems that management's relationship with the auditors has changed, perhaps permanently. A permanent change was, after all, one of the intentions of Sarbanes-Oxley. Also changed, though, and in some cases for the better, is the auditor's relationship with the audit committee. Ron Lalonde, senior executive vice president and chief administrative officer of the Canadian Imperial Bank of Commerce, suggests that "audit committees are using auditors much better as advisors and consultants. Management may be getting less value out of the relationship, but I think our audit committee is getting more value."

With the PCAOB set to issue new guidance and discuss reopening AS2, the situation is very much in flux--so much so that financial executives are demanding more rules to clarify the existing rules. In this environment, one thing is almost certain: the U.S. is a long way from Britain, where the Turnbull Commission framework for internal controls was able to keep its guidance for boards to a mere 15 pages and its guidance for auditors to only five.

RELATED ARTICLE: take aways

Sarbanes-Oxley and the creation of the Public Company Accounting Oversight Board (PCAOB) have altered the relationship between companies and their auditors.

Financial executives sense that auditors have become far more cautious and averse to providing opinions on a consultative basis.

Audit firms themselves concede that the new rules have created a learning curve, and that local staffers have been told to confer with national offices to ensure consistency.

The PCAOB is promising new guidance to help mitigate some of the issues created by the new auditing standards.

Gregory J. Millman ([e-mail]) is a New Jersey-based freelance business writer and frequent contributor to Financial Executive.