Sarbanes-Oxley: what it means to the marketplace; from support to apprehension, accounting professionals express their thoughts.

EXECUTIVE SUMMARY

THE ACCOUNTING PROFESSIONALS INTERVIEWED for this article were positive about some Sarbanes-Oxley requirements, saying management's reporting on and the external auditor's attestation to the internal controls are good ideas. They advocated audit committees' hiring CPAs because it could reduce the pressure on audit fees and lead to better-quality audits. All agreed that having top management certify it had reviewed the quarterly and annual reports would force it to become more engaged in the financial reporting process. All believed the legislation would have a positive impact, but would not be a panacea. Their concerns included

* DOCUMENTATION COSTS AND ATTESTATION FEES, which will be substantial. There was apprehension about preparing internal control attestation reports; no widely recognized standards to do so currently exist.

* FEARS THAT SMALL, PUBLICLY LISTED COMPANIES might not meet internal control reporting requirements without substantial additional expense; some may have to delist because of it. It could mean only larger companies will go public.

* AUDITORS' QUALMS ABOUT POSSIBLE MARKETPLACE reaction to their small, publicly listed clients whose financial statements can be "signed off on" based on substantive testing, but which had adverse attestations on their internal control structure.

* THE "CASCADE" EFFECT, which might mean having as many as 54 different sets of laws for nonlisted companies.

* THE ACCOUNTING PROFESSION'S IMAGE, which has suffered unjustly because of the wrongdoings of a few.

The Sarbanes-Oxley Act of 2002 has ushered in the most sweeping changes in the accounting profession since the Securities Acts of 1933 and 1934. In order to gain insight into how this act will affect external auditors and corporate managers, we interviewed 10 people from public accounting, corporate management, the National Association of State Boards of Accountancy (NASBA) and the AICPA. They expressed their opinions on management's and the auditor's assessment of internal controls; requiring management to certify the financial statements; the setting of auditing standards; the "cascade" effect; the implications of audit committees' hiring CPA firms, CEOs' certifying reports, the systematization of Sarbanes-Oxley regulations and the act's impact on financial reporting and on the accounting profession.

ASSESSMENT OF INTERNAL CONTROLS

Section 404 of the Sarbanes-Oxley Act requires each issuer's annual report to include an "internal control report which shall ... contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting." In addition, section 404 requires each issuer's auditor to attest to and report on management's internal control assessment.

When asked about management's requirement to assess internal controls, the interviewees were unanimous in agreeing this was a good idea. They believed this requirement would increase management's knowledge and concern about the quality of its internal control structure, thus sending significant signals that management takes such controls very seriously.

All interviewees believed the new internal control reporting requirement would cause significant increases in external auditing costs. Such expenses would result from the requirement that external auditors must attest to and report on the internal control assessment made by the management of the issuer. Ken Peterson, partner and professional practice director for the Lake Michigan area office of Ernst & Young LLP, said, "The consideration of internal controls has been a tool used in planning the audit, but now internal controls will be an objective of the audit." John Fogarty, partner and director of auditing policies, procedures and methodologies in the United States and globally of Deloitte & Touche, member of the AICPA auditing standards board and technical adviser on the international auditing and assurance standards board, said: "The internal control report will be very expensive. It is a significant extension of auditing responsibilities." Interviewees estimated this additional attestation fee would range from 25% to more than 100% of current audit fees.

Although most of the CPAs we interviewed reported that large companies already had internal controls in place to comply with the new reporting requirements, those controls "will require a lot more work and testing than we've ever performed before," said Peterson, and "clients will need a lot more documentation than they've ever had before to support their assertions."

Several interviewees questioned the cost-benefit of these documentation costs. "Additional procedures have to be performed that are not value-added," said Michael Keane, senior vice-president and CFO of UNOVA Inc., Everett, Washington, "and they scream out bureaucracy and added costs. It will be a lot of time and effort to prove what we've already been doing."

The interviewees were in agreement that management's assessment of internal controls and the auditor's attestation of them were positive requirements for all companies, large and small, because these requirements help protect investors. However, these new internal control mandates, initially, will be a hardship on small, publicly listed companies. For example, Ed Drosdick, partner in charge of SEC practice and high-technology practice at Moss Adams LLP, Seattle, said: "Very large companies will have the resources to deal with Sarbanes-Oxley requirements. Smaller companies will have a great deal of trouble being compliant because the cost is very large. Sarbanes-Oxley does not allow for size differences; all SEC registrants will be measured by the same yardstick."

The group generally believed many small companies did not have the internal controls in place to comply with the new reporting requirements. In addition, they said it might not be economically feasible for some of those small companies to come into compliance. Kris Kaland, partner and director of assurance services at Clifton Gunderson LLP, Milwaukee, asked: "Does a small publicly listed company have the resources to comply with Sarbanes-Oxley? For example, does it have an audit committee? Does it have a code of ethics? Can it meet the internal control documentation requirements?" The only alternative for some small companies may be to delist. However, Kaland warned, "It takes resources to delist, too."

CPAs who have audited small, publicly listed companies voiced concern about those for which the auditor develops audit evidence primarily through substantive testing. This approach often is used for small clients and is supported by GAAS. "Smaller companies won't have robust internal control systems in place, yet you can sign off on the financial statements," Drosdick said. These CPAs were concerned that section 404's internal control requirements would call into question this audit strategy. In other words, it is possible for a client to receive a clean audit opinion while "failing" its internal control attestation. How will the marketplace interpret this?

Another small-company issue is whether a company even should go public. "Sarbanes-Oxley is going to raise the bar on access to public markets," said Michelle Collins, chairperson of the audit committee of CDW Corp., Vernon Hills, Illinois. "It may be harder to go public, but the real challenge to smaller companies will be the costs, which will be incredibly prohibitive. The company is going to have to be a certain size and really want to go public. New companies that come out are probably going to be a lot bigger."

Fogarty, concerned with the mechanics of an internal control attestation, said: "Although we have the COSO framework (Committee of Sponsoring Organizations of the Treadway Commission's Internal Control--Integrated Framework) to use as criteria in determining whether control deficiencies are significant or material weaknesses, we lack a body of experience fur making these determinations comparable to what we have for making accounting decisions. It will take time to gain and interpret this experience to fill in many of the details needed to consistently make determinations about the severity of control deficiencies."

Some interviewees were concerned that if they made a mistake in complying with the many details Sarbanes-Oxley required it would be used against them. "People don't know what will happen to them if they violate the law," said Bill England, partner and U.S. leader for consumer and industrial products practice and client service vice-chairman of PricewaterhouseCoopers, Chicago. "My major concern is not about our ability to comply with Sarbanes-Oxley given our company's currently existing strong internal control systems" Keane added. "I just hope there will not be some small regulation we've overlooked that will be used as a club against us."

"CASCADE" EFFECT

The "cascade" effect is the possibility that state legislators and regulators might apply all or some portions of the act to all companies and their auditors. The AICPA responded quickly to this possible threat by forming the Special Committee on State Regulation. Working closely with state CPA societies, this high-level volunteer committee was charged with providing guidance to states that were faced with state legislative or regulatory accounting reform proposals as a result of the Sarbanes-Oxley Act. The special committee identified three overarching themes: The profession should advocate for a reasoned approach to reform at the state level, uniformity of state laws is essential to protecting the public interest and the complexity of the issues needs to be articulated and communicated. In January 2003 the committee released a compendium of white papers and issue briefs called A Reasoned Approach to Reform. A second edition was released in October 2003. During 2003 many states, faced with state legislative and regulatory reform proposals, made reference to A Reasoned Approach, which allowed the profession a seat at the negotiation table.

Another facet, said David Costello, president and CEO of NASBA, is audit partner rotation, which "is tempting for states to adopt, but would be devastating for smaller CPA firms." Of course, the cost of applying Sarbanes-Oxley to nonpublic companies would be prohibitive for most small companies and their accountants, not to mention the disruption it could cause to the operation of many businesses. "There are potentially high costs to small and medium-sized businesses. Protecting the public interest will be expensive," said Costello. For many nonpublic companies that regularly rely on their outside accountants for many nonaudit services, the effect could be even more severe.

"States should not overreact to the emotional issue of the day. The temptation for state government is to act quickly without regard necessarily to what other states are doing," Costello said. "They needed a reasonable response to Sarbanes-Oxley, which NASBA developed and issued as 'Answering the SOX Challenge: Guidelines for State Boards of Accountancy.' NASBA task forces, comprising state board of accountancy representatives, researched, studied and developed a consensus approach to applying Sarbanes-Oxley principles at the state level. It would be easy to take Sarbanes-Oxley and apply it to all companies, but one size does not necessarily fit all. We might very well end up with 54 different approaches to this topic. We need more uniformity, not less." Fogarty expressed concern that states would adopt dissimilar rules and companies and their auditors would have to determine which state's rules would apply. For example, "California and New York have added to the Sarbanes-Oxley documentation requirements. There is a proliferation of rules. People are making more rules on top or rules that have not yet been implemented," he said.

AUDIT COMMITTEE HIRES CPA FIRM

Section 301 of the Sarbanes-Oxley Act requires the audit committee of each issuer to be directly responsible for the appointment, compensation and oversight of the external auditor. The interviewees were much in favor of this requirement. They said the audit committee would be concerned that a quality audit be performed. Accordingly, they thought the audit committee's hiring the external auditor might relieve some of the pressure on audit fees. "Having the audit committee hire the auditors is good for audit quality," Peterson said," because it helps prevent management from inadvertently restricting the audit scope in a desire to control costs." Ken Zika, retired controller of Caterpillar Inc., Peoria, Illinois, added: "It is hard to measure the value of good internal controls and good financial statements. Thus, there can be pressure to perform these activities with a 'least cost' mind-set. So I believe that turning the hiring and firing of the external auditor and negotiation of its fees over to the audit committee is probably a good thing." England added: "Audit committees are highly motivated to get audit risks covered and have an audit scope sufficient to cover those risks. Therefore, they are willing to pay for high-quality audit services." However, Fogarty cautioned: "Many audit committees currently do not have complete control over directing the scope of the audit. Audit committees will need to keep moving toward this control even though they may come into conflict with management's objectives."

FEAR OF THE ROUTINE

Several in the group expressed concern that internal control and financial reporting structures would become systematized within a few years and render the whole process routine. "As people get accustomed to requirements, they often become complacent and lulled into comfort," Collins said. "Regulators' focus on internal controls may atrophy," Fogarty added. "They need to keep these rules in the forefront and emphasize them in rhetoric and actions."

Some feared the possibility of perfunctory processes could lead to unethical behavior. "Regulating, requiring very specific disclosures and having all these systems on an annual and even quarterly basis can be 'gamed' in later years," said Collins. "Unfortunately, some people will try to get around them."

A final thought concerned the impact the legislation would have on auditors and their need to use professional judgment while conducting an audit. Arleen Thomas, vice-president of professional standards and services of the AICPA, stated: "If auditing standards become overly prescribed, auditors could lose their judgment capabilities. The accounting profession will not be considered a professional career."

THE ACCOUNTING PROFESSION'S IMAGE

The interviewees expressed anxiety about the impact of the act on the accounting profession. "I am concerned about the profession's image," Costello said. "It does not help if regulators see the profession as unethical and not independent. Regulation has an undeniable negative aura, that is, 'We have to regulate them to a higher degree because they have been bad.'" Thomas added, "The fact that we even have Sarbanes-Oxley is a hit to the profession." This negative image also caused the group to worry about recruiting students into the profession. Several wondered about the profession's ability to attract high-quality individuals. "In light of doubts about the credibility and effectiveness of auditing," Fogarty said, "we have a challenge to show that auditing can be a rewarding lifelong career."

The interviewees also believed the legislation has painted all accountants with the same broad brush. In other words several thought many were unfairly tainted by the actions of a few bad auditors. "I'm paying the price for the sins of those who were lax or who were abusing their controls," Keane said. Zika added: "Congress has underestimated the relationship between most companies and their auditors. It has underestimated the independence that exists. In many situations there are very positive, professional relationships between companies and their auditors." Thus, many accountants believe Sarbanes-Oxley has called into question the character of the entire accounting profession when, in fact, only a small minority of accountants may have acted unethically. Furthermore, Zika said: "The act may not go far enough in holding other people accountable. What roles have investment bankers, financial analysts, lawyers, audit committee members and boards of directors played in recent accounting scandals? They also should be held more accountable."

Costello aptly summed up Sarbanes-Oxley's impact: "The profession has suffered unfairly, but we must work with regulators, make Sarbanes-Oxley work and regain the public trust. We have an outstanding auditing and accounting profession in this country--the message is not getting out. Let's fix our problems and move forward."

WILL FINANCIAL REPORTING IMPROVE?

The interviewees unanimously agreed the legislation has many good aspects. Specifically mentioned as a good idea was the part of section 302 requiring top management to certify it had reviewed each quarterly and annual report. Furthermore, requiring management to certify that the financial statements--and other financial information included in the reports--fairly present the issuer's financial condition, as well as the results of operations, will force management to become more engaged in the financial reporting process. Drosdick said: "The dumb CEO is no excuse any more. There will be zero tolerance. Companies must find CEOs who understand financial statements." Keane added, "Some companies will improve their reporting, and some of their disclosures will be clearer." In addition, the CEO and CFO must report their conclusions about the effectiveness of the internal controls in their company. The majority of interviewees believed the potential for increased discussions on the company's internal controls by top management and the audit committee could have a positive impact on financial reporting. The independence of audit committee members and the increased involvement of the audit committee in company affairs also were cited as positive results of the legislation.

When asked whether the legislation was a panacea for improving financial reporting, the majority of interviewees said it was too early to tell. "Sarbanes-Oxley won't eliminate all fraud," Drosdick said. "Time will tell how much 'good' will come from it." While all thought the legislation would improve the financial reporting process, several were quick to point out that financial statement fraud wouldn't disappear. It comes down to the ethics of the people running corporations, they said. Morality and ethical behavior cannot be imposed by law. Some people will always try to do illegal things. Fogarty expressed the consensus of opinion on the Sarbanes-Oxley legislation: "The act will help. It has a good system of checks and balances. However, 'tone at the top' is what counts."

AICPA

RESOURCES

Publications and resources of the AICPA special committee on state regulation are available at www.aicpa.org/statelegis/index.asp.

Webcast

Internal Control Reporting for Public Companies (Originally webcast July 17) Available on CD-ROM (# 737132HSJA). Viewers can receive 2 CPE credits.

Publications

* Financial Reporting Fraud: A Practical Guide to Detection and Internal Control by Charles R. Lundelius Jr. (# 029879JA).

* Corporate Ethics for Financial Managers: Navigating with Case Studies and Practical Solutions by Robert W. Walter (# 029880JA).

* Financial Reporting Alert, Internal Control Reporting--Implementing Sarbanes-Oxley Section 404 (# 029200JA).

* Internal Control--Integrated Framework, report of the Committee on Sponsoring Organizations of the Treadway Commission (COSO) (# 990012JA).

CPE

SEC Reporting, a self-study course that includes some coverage of Sarbanes-Oxley.

Conferences

For bankers and CPAs who audit banks: Sarbanes-Oxley One Year Laser: Section 404 Assessing Internal Controls Orlando, March 10, 2004 Las Vegas, April 29, 2004

For more information about any of these resources or to place an order, go to www.cpa2biz.com or call the Institute at 888-777-7077.

HARVEY COUSTAN, CPA, is a former partner with Ernst & Young LLP. His e-mail address is [e-mail]. LINDA M. LEINICKE, PhD, is a professor of accounting at Illinois State University, at Normal. Her e-mail address is [e-mail]. W. MAX REXROAD, PhD, is a professor of accounting at the same university. He can he reached at [e-mail]. Also contributing to this article was JOYCE A. OSTKOSKY, PhD, CMA, a professor of accounting at Illinois State University. She can be reached at [e-mail].

Arleen Thomas is vice-president of professional standards and services of the AICPA. Ms. Thomas is an employee of the AICPA and her views, quoted above in the article, do not necessarily reflect the views of the Institute. Official positions are determined through certain specific committee procedures, due process and deliberation.