Regulators taking open approach to 404 changes.

Companies would love management reporting under Sarbanes-Oxley Section 404 to be easier. This month, the Securities and Exchange Commission (SEC) will attempt to make it more efficient and effective. Proposed actions will be taken up at an SEC Open Commission meeting on December 13, and the Public Company Accounting Oversight Board (PCAOB) is also working on revisions to Auditing Standard No. 2 (AS2).

The degree to which the SEC's and PCAOB's actions will be integrated will be closely watched; in particular, if internal auditors (or management) increase the amount of work they perform to assess (self-assess) internal control, will there be an equal reduction in work performed by outside auditors--and a reduction in audit fees? Limitations set forth in AS2 on the auditor's ability to rely on work of management and internal audit, as well as limitations on the ability of the auditor (and management) to rely on routine monitoring and testing performed throughout the year and in prior years, are things the SEC and PCAOB will revisit.

In a comment letter filed by FEI's Committee on Corporate Reporting (CCR) in September, the committee urged the SEC to "move forward with [SEC] management guidance and [PCAOB] revisions to AS2 that is more risk-focused with greater reliance on entity-level and monitoring controls, and revised materiality definitions allowing for higher thresholds."

CCR's comments were echoed by a host of other professional associations, including the American Bar Association (ABA). The ABA's comment letter called for a revised definition of materiality for purposes of the internal control assessment, and for the SEC to encourage the PCAOB to eliminate one of the two overlapping auditor reports on internal control that are required under AS2.

Like CCR, ABA recommended that the regulators use their rulemaking authority to drive a more risk-based approach to auditor attestations. ABA also suggested the PCAOB eliminate from AS2 the assertion that "reasonable assurance" equals a "high level of assurance." And, ABA recommended the PCAOB "provide guidance to small registrants on the extent to which formal controls are necessary where the registrant relies on day-to-day management oversight."

Foreign Associations Weigh In

In this day and age of increasing globalization, and concerns about cross-border "regulatory creep," the SEC also has a number of comment letters from foreign associations to consider. The European Association of Listed Companies (EALIC) echoed CCR's comments about problems with the current emphasis by some of an overly quantitative and not sufficiently qualitative approach, and the need to drive a more risk-based approach to internal control auditing and reporting, which CCR noted would better implement the intent of Section 404.

The Institute of Chartered Accountants of England and Wales (ICAEW) comment letter calls for a "fundamental change in implementation approach," stating, "the crux of the issue is that management should not be remade in the image of the regulators and auditors ... [but that] the SEC should be requiring and enabling the management of issuers to think for themselves."

ICAEW added, "The objective of the SEC should be a high-level document of, say, 10 to 15 pages based on general principles that can be applied by the management of all sizes of company ... There is always a temptation for regulators to provide many detailed requirements, the objective of which is to tighten the accountability of management. However, a balance has to be struck to ensure that more detailed requirements do not merely lead to a loss of direct ownership by management."

This open and thoughtful approach being taken by the regulators should be applauded by preparers, auditors and investors. Whether the regulators' ultimate actions are viewed as a holiday-time gift or a lump of coal may be in the eye of the beholder. To the extent that new ideas (and perhaps some old ones) can be considered to make implementation of Section 404 more efficient and effective, it would be a very welcome gift indeed.

Edith Orenstein ([e-mail]) is Director, Technical Policy Analysis, for FEI.

[ILLUSTRATION OMITTED]