Who does what to whom? closing the expectation gap of section 404.

Issues surrounding the various facets of Sarbanes-Oxley continue to emerge, challenging us as financial executives. Perhaps one of the thorniest areas of debate is Section 404 on Management Assessment of Internal Controls, which requires corporate managers to evaluate and report on the effectiveness of internal controls over financial reporting, identifying any "material weaknesses" they find. Further, the act requires a public company's outside auditors to attest to management's assessment of those internal controls.

And at that point, interpretations diverge. There is an ongoing debate between issuers and public accounting firms over how deeply auditors should delve. Preparers contend--and FEI agrees--that auditors should attest only to management's assessment and evaluation of internal controls. Audit firms, on the other hand, believe that auditors must attest to the actual internal control environment itself. They believe that they cannot attest to management's assessment without doing substantial work to conclude that the actual internal control environment is effective.

On July 29, I participated in a roundtable discussion held by the Public Company Accounting Oversight Board (PCAOB) to solicit views on this divisive issue--from auditors, investors, public companies, regulators and other stakeholders. I can tell you that feelings run very high on both sides of the debate.

In weighing the merits of both interpretations, it is important to remember one essential point: The internal control environment is ultimately the responsibility of management. It should not be delegated to the auditors. To do so would represent an abrogation of fiscal responsibility on the part of management and an inappropriate assumption of that responsibility by the public accounting firms.

FEI believes that the clear intent of Sarbanes-Oxley regulation in this area was to ensure that management took the necessary and appropriate responsibility for not only creating an effective internal control system, but also reviewing it on an ongoing basis. Further, we believe that Sarbanes-Oxley recognizes that independent auditors have a responsibility to understand the internal controls so that they can plan their audit. By having the independent auditor attest to management's assertion, we believe the intent of Congress--to have the independent auditors fulfill this responsibility in a manner more transparent to investors--is satisfied.

The material failures in corporate governance procedures that have rocked the corporate world lately result not from breakdowns of basic transaction controls, but from subsequent manipulations by management of the information provided by these systems. Our view remains that, based on existing attestation standards, the cost for the independent auditor to render an opinion directly on the effectiveness of an issuer's internal control system far exceeds the potential benefits for the investing public.

We believe that the focus of the auditor's work should be restricted to a review and evaluation of management's assertion on the effectiveness of its internal controls and the related documentation--not retesting--and revalidating the entire internal control environment. There is a significant difference in the degree of work involved in the two approaches. This translates, not surprisingly, into a significant difference in cost.

We recognize that the auditors need to test management's assessment in order to attest, and that this work is not free. What is important, however, is striking a balance between the cost to implement and the value received. As with other aspects of Sarbanes-Oxley implementation, FEI feels strongly that the best regulation is one that accomplishes its stated objectives without placing an undue burden on businesses.

Relative to the nature and extent of documentation required, FEI believes that it would be highly desirable for the PCAOB to use principles-based rather than rules-based standard setting. We do not believe that the PCAOB should dictate the level of documentation required, but should set the conceptual standard that documentation of all significant processes, related risks and controls must be in place for those processes and risks that create the possibility of significant error in the financial statements. Determining how best to execute that standard remains the purview of management.

I was very glad to participate in the PCAOB discussion, and we remain hopeful that an appropriate balance between the costs to implement Section 404 and a value-added level of documentation and testing can be achieved. As we move through this complex process, it is well to focus clearly on the ultimate goal, which is nothing less than the restoration of investor confidence. That is a truly significant and worthy challenge that demands our most rigorous efforts, discipline and intellectual honesty.