Sarbanes-Oxley Section 404: remediation, communication, education; Financial Executives Research Foundation (FERF) asked three audit firms for insights on testing of remediation of internal control weaknesses, and the need for communicating what the new internal control reports will mean.

As reporting season begins, many financial executives are understandably focused on the approaching deadline for initial reporting under Section 404 of The Sarbanes-Oxley Act. Securities and Exchange Commission (SEC) and Public Company Accounting Oversight Board (PCAOB) rules for implementing 404 will require companies to provide, in their 10-Ks, a management report assessing the effectiveness of internal control over financial reporting, and will also require auditors to perform an audit of internal control over financial reporting in conjunction with the audit of the financial statements. Based on this work, the auditors must provide a new opinion attesting to management's assertion and a direct opinion on the internal control effectiveness.

Thus far, much of the focus has been on designing, documenting, testing and evaluating the system of internal control. But now concentration is turning to the reports to be issued--including the degree to which remediation of internal control weaknesses during the fourth quarter will impact those reports--and how these new reports will be understood and interpreted by investors and others in the capital markets.

To this end, the accounting profession is emphasizing the need to communicate with and educate investors and other stakeholders in anticipation of the 404 reports. One of the first to call publicly for such education and communication efforts was the CEO of Ernst & Young, James S. Turley, who testified in September on the impact of Sarbanes-Oxley at a hearing of the U.S. Senate Banking, Housing and Urban Affairs Committee.

Turley warned of the potential for many more material weaknesses to be reported and adverse opinions issued than many observers may expect, and expressed concern about the potential public and capital market reaction, should this occur. He said, "We, the profession, policymakers, issuers, directors and investor leaders, need to collectively engage in a public dialogue to educate others regarding the new internal control reporting process and how to interpret potential findings and responses."

The Need to Educate Investors, Others

Reflecting on his Senate testimony, Turley observes, "The Senate Banking panel understood that, especially in the first year [of 404 reporting], there will be some levels of deficiencies, material weaknesses and adverse opinions." However, while some people may expect a certain level of adverse opinions to be issued by companies, others may overreact if they are surprised by such opinions.

"For private, retail investors, it will be a very hard message to understand, and that is why it is so important for everyone to communicate openly to the marketplace," says Turley, who believes providing this information will help avoid expectation gaps.

How would he help investors understand the relationship between the new internal control report and the traditional auditor's report on the financial statements? Turley explains that "the 404 internal control audit, and resulting audit opinion, answer a totally different question than the financial statement audit is answering." He clarifies with two points:

1. The financial statement audit answers the question: "Are there material errors in the financial statements, after the audit is completed?"

2. The 404 internal control audit opinion answers the question: "Could there, theoretically, have been material errors in the financial statements that management put together, before the external auditor completed its audit?"

Some investors may struggle with understanding the potential for seemingly divergent opinions (a clean opinion on the financial statements, with a concurrent adverse opinion on internal control) and what that may mean. Turley explains, "A classic example would be, if during the financial statement audit, the auditor detected material errors for which adjustments have to be made, and the company records its adjustment to make the financial statements accurate."

The Big Picture

Raymond J. Bromark, who serves as Americas Theater Leader, Professional, Technical, Risk and Quality, at PricewaterhouseCoopers, offers the following guidance: "Particularly in this first year of the integrated internal control and financial statement audit, the issue that people are going to have to come to grips with, is that the integrity of the current period's financial statements is not necessarily adversely impacted by an adverse opinion on the internal control assessment." He notes, "The PCAOB standard requires an adverse opinion even if there is only one material weakness--irrespective of the functional area to which that material weakness relates; so, within that framework, it is imperative that people consider the extent of weaknesses, and to what they relate."

Raymond J. Beier, PricewaterhouseCoopers' Leader, National Technical Services, observes there is the potential for an investor to interpret a material weakness as casting a shadow over a company's entire system of internal control on financial reporting, when it may only be a single aspect of the system that resulted in the adverse opinion. One of Beier's key concerns is that the investor may move toward making [his or her] assessment of the internal control report a binary decision.

He explains, "That is, if a company receives an adverse opinion, the investor [may] automatically assume the worst. This would be caused by a failure to properly digest what caused the material weakness." However, Beier notes, a material weakness involving the "tone at the top" may be considered more serious than one involving a transaction process already is in the process of remediation.

Beier also notes that a key question investors will ask is whether the condition of the company's internal control should negatively affect their assessment of the company's future prospects. While healthy risk analysis is something that investors should do, the degree to which investors understand the 404 reports and the impact of any material weaknesses disclosed, in conjunction with the auditors' report on the financial statements and related information, will weigh on these risk assessments.

That is why, Beier says, "Emerging thinking coming out of the accounting profession is that key capital market participants--especially investors--will be challenged to understand the implications of this new internal control reporting," says Beier. "We are assessing ways to educate the marketplace in a manner that allows them to digest what they will be seeing for the first time ... to [understand] what these internal control reports really mean."

How Many Adverse Opinions Will We See?

As noted earlier, Turley has warned that there is the potential for many more material weaknesses to be reported and adverse opinions issued than perhaps anyone imagined. He explains that at some level, the auditing profession has been "living in 404" more than any individual preparer has. Each of the firms, he says, has armies of people working on this every day, continuing to think about it, and drill deeply into it.

Turley also notes it is the first time many companies will be scrutinizing their internal controls to the extent that the new SEC and PCAOB standards require. In addition, he notes, "The PCAOB's new standards require a rigorous evaluation and provide low thresholds for defining significant deficiencies and defining material weaknesses." Furthermore, he adds, "The pass/fail nature of the standard doesn't allow for a qualified opinion; it only allows for a clean or an adverse opinion."

Edward R. Nusbaum, CEO of Grant Thornton, says, "Since no firm has yet issued a 404 opinion, we have no way of knowing how many adverse opinions are likely to result. We have heard broad ranges from 10 percent to 40 percent of public companies, but there is no evidence yet to support those or any other estimates. Complex, geographically dispersed companies that operate in an ad hoc, decentralized manner are most likely to have internal control issues that need to be addressed."

Nusbaum explains that companies that have a general lack of appropriately skilled accounting resources, poor segregation of duties controls, and/or poor information system controls--whether they are small or large--are also likely to have material control weaknesses that cannot be remediated quickly.

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

How Remediation Will Be Tested

The corporate community has been looking for insight to anticipate how the auditing profession will approach testing of the effectiveness of internal control for which remediation occurs in the fourth quarter. Nusbaum observes that remediation late in the fiscal year adds a layer of complexity to both management's and the auditor's processes for determining if the remediated controls are, in fact, operating effectively. "It is generally not possible for controls to be fixed on December 30, and then be blessed on December 31 as being effectively in operation," he notes.

Is there a guideline for how much time is required to test remediation? "The length of time a remediated control needs to function depends on how often the control operates," says Nusbaum. He adds, "The important thing is for management to be able to prove that the control operates consistently and effectively as of the end of the fiscal year."

Bromark says while not "bright lines," there are some rules of thumb, and "the idea is you need more than one quarter of effectiveness on a quarterly control, but whether an auditor would insist on that depends on the importance of the control and the frequency of the transactions or processes that it applies to." He wants to be able to let people use judgment; however, there has to be a level of satisfaction that remediation has been effective. "Can you see it work once, and be satisfied it's effective? If it's a control that's part of the quarterly close, that is a different determination than one that is applied daily to be satisfied as to effectiveness; [you] can't apply the same bright line."

Turley explains, "How we're looking at it--and, as you might expect, the profession and, we believe, the PCAOB is looking at it--is that, if remediation is needed, management must first make the changes and go through its processes to confirm its controls are now effective. The auditors would then have to satisfy themselves that the controls are in place and effective."

Beier emphasizes the role of management in leading the remediation process. "Let's keep in mind that Step One of the process of remediation is that the preparer first has to make judgments about the effectiveness of the remediation. The preparer should not rely on the auditors to make its judgment. Further, the preparer should back up their assessment as to whether remediation has been effective with good, solid analytical thinking and judgment, including documentation."

Looking Ahead

The accounting profession has begun to address the need for investors and others to have sufficient information and education to interpret the new internal control reports under Section 404 and related SEC and PCAOB rules. Bromark emphasizes, "The objective is to get 404 right," adding "It is important to the restoration of investor confidence."

Turley concurs, saying that each of the firms is doing the best it can to communicate with clients and regulators as to how to best address these 404 interpretation issues. "All of us--the accounting profession, Congress, the SEC, PCAOB and other capital market participants--must do a better job educating the public on the internal controls reporting process: what it means and how to best interpret it. We are all moving forward in that effort."

Edith G. Orenstein ([e-mail]) is Manager of Research for Financial Executives Research Foundation (FERF).