AS2: when the pedal hits the metal; Although the costs and opportunity cost of the PCAOB's new audit standard are substantial, Financial Executives Research Foundation (FERF) finds that financial executives also view it as an opportunity to reinvigorate and reinforce the importance of internal controls.

In March, the Public Company Accounting Oversight Board (PCAOB) issued what may go down in history as one of the most significant auditing standards of all time: PCAOB Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements (AS2). (PCAOB standards are subject to approval by the Securities and Exchange Commission, and as this article went to press, the SEC had not yet approved or disapproved AS2.)

The impact of the second auditing standard issued by PCAOB since its inception last year will be strongly felt--not only in the process and methodologies of public accounting firms, but also, in the corridors of corporate America, as managements look for the most efficient and effective way to implement the new standard.

Under AS2, the auditor will be required to provide two new audit opinions: one on management's assessment of the effectiveness of internal control over financial reporting, and one on the effectiveness of internal control over financial reporting itself.

In driving the implementation process, some believe the detailed requirements of AS2--combined with a flood of other rules and standards arising from The Sarbanes-Oxley Act, and competing so strongly for management's attention--can make it difficult to see the road ahead. Financial Executives Research Foundation (FERF) sought the early views of some leading financial executives closely involved in analyzing and implementing AS2 for their assessment of the standard and its anticipated impact.

How Much Will it Cost?

As detailed in the March/April 2004 issue of Financial Executive (page 76), a survey conducted by Financial Executives International (FEI) found that implementation of standards resulting from Section 404 of Sarbanes-Oxley, such as AS2, are estimated to cost the largest U.S. companies over $4.6 million each, and are expected to require companies to spend, on average, an additional $732,100 for external services other than the external auditors fee, plus over $592,100 (an average 38 percent increase) in audit fees. Some executives talk of receiving estimates from their auditors for fees rising by multiples of their current fee.

Jim Campbell, corporate controller of Intel Corp., is concerned with the cost/benefit of AS2. "We think the original intent of The Sarbanes-Oxley Act was pretty straightforward and focused on management accountability. Management was to acknowledge its responsibility, assess its internal controls and establish a framework, and then have that audited. So, in simple terms, it was to ensure management is held accountable, accompanied with audit assurance," says Campbell.

"However, every time we tally the investment [for AS2 and Sarbanes Oxley], it increases, and we believe we have the benefit of solid internal controls," Campbell adds.

In addition to dealing with the raw cost of the standard, many executives are expressing concern with the opportunity costs of AS2, which has taken up a great deal of time and energy to implement, leaving less time to focus on their core business.

[ILLUSTRATION OMITTED]

"The views of business on the cost/benefit debate have been overshadowed by the views of the investment community," argues Campbell. "Will we realize some residual benefit? Sure, but not to the extent of the investment, and if you include the opportunity cost, we're deep into the red." He believes that it's not clear, from a distance, if the investment community truly understands what it is really receiving in exchange for this investment. "The controls, in and of themselves will not prevent another WorldCom from occurring," he argues.

Additionally, Campbell believes we're in danger of losing sight of the forest for the trees. "FASB is on a fair value-based agenda, which implicitly means far more reliance on judgment and estimates in the future, and PCAOB is focused on auditing transactions," he says.

While cost/benefit issues will continue to be a matter of debate as implementation of AS2 rolls out, executives recognize that PCAOB did make an effort to be responsive to cost/benefit concerns voiced in response to the initial version of the standard, originally proposed in October 2003.

[ILLUSTRATION OMITTED]

Seeking Balance

Kate Asbeck, senior vice president and controller of Corning Inc., serves as Chair of the PCAOB liaison subcommittee of FEI's Committee on Corporate Reporting (CCR), which meets periodically with PCAOB to discuss matters of mutual interest. Asbeck says of AS2 that she is "relatively pleased with the changes in the final PCAOB standard that allow more auditor judgment in setting the scope of testing, and more reliance by external auditors on work performed by internal auditors and, in some cases, management."

However, Asbeck notes, "We continue to be concerned with the cost of implementation of the standard, both in terms of audit fees and management effort." In order to address these concerns, Asbeck says her group plans to continue to work with PCAOB, "to define the specific requirements as this guidance is implemented to obtain a reasonable balance between the benefits of improved control and the cost of compliance."

Others agree that the role of PCAOB working groups and other feedback loops to PCAOB will serve a key role in this process. Procter & Gamble Co.'s Vice President of Corporate Accounting, Teri List, says, "Having the final rule is an important step in getting better clarity on the specific requirements, but there is still much to learn," she says, and that "it is only through the interpretations that will occur as the rules are actually implemented that we'll fully understand the requirements and associated costs."

List cautions, "It is particularly important that the PCAOB interpretive process involve sufficient input from auditors, companies and investors to adequately evaluate the cost relative to the benefits of the final rule." Without discipline in that process, she argues, "we risk adding costs that ultimately are borne by investors--without associated benefits."

List describes what she has found helpful at P & G in terms of practical implementation: "We will be relying heavily on our existing control self-assessment process that we have enhanced to serve as a key element of our Section 404 evaluation and assertion. Leveraging this process brings some degree of efficiency, and has the benefit of creating clear accountability for management ownership of the control environment."

However, she warns, "Companies should not underestimate the extent of formalization and documentation that may be required to comply with the proposed rules and, importantly, their auditors' interpretation of the requirements."

New Opportunities

Despite their cost/benefit concerns, financial executives also see AS2 as an opportunity to reinvigorate and reinforce the importance of internal controls, beginning with the tone at the top and continuing throughout the organization. They also view this as an opportunity to strengthen the quality of the interaction between management, the audit committee, the internal audit function and the external auditor.

Betsy Rafael, vice president and corporate controller of Cisco Systems Inc., says, "We are fully supportive of enhancing corporate governance. Many of the business failures we've seen recently have been directly correlated to inadequate practices in this area."

"Conceptually," she explains, "The Sarbanes-Oxley Act makes sense--management acknowledges its responsibilities over the internal control environment, documents and tests the key processes and controls, and the auditors test to verify their effectiveness. The development of the rules and their implementation continues to have its challenges." PCAOB has spent a great deal of time redefining concepts that have existed for some time, she adds, and "this could result in companies and their auditors working in ambiguity and making substantial investments to apply new rules without realizing incremental benefit for their shareholders."

Looking ahead, Rafael says, "We do believe that there is an overall benefit to corporate America and investors with Sarbanes-Oxley, and we are hopeful that PCAOB develops implementation guides that help to reduce the ambiguity that currently exists and that leverage more of the concepts that have previously been developed. We encourage audit firms and companies to work with PCAOB to help to provide insight on their experiences to further improve the ability to operationalize these practices."

The Road Ahead

AS2 is certain to have a profound impact on those involved in the corporate reporting process--both qualitatively and quantitatively. Qualitatively, financial executives are finalizing what they need to do to assess the effectiveness of internal control over financial reporting and provide a related report in accordance with SEC standards, and are focused on meeting their auditors' related documentation, testing and other requirements under AS2.

Quantitatively, substantial costs have already been expended in gearing up for this new standard. How the costs and benefits will eventually play out will be watched closely.

Nick Cyprus, vice president and controller of AT & T Corp., is optimistic: "I believe that the control environment for most companies will be improved as a result of these new rules. I know ours has. As for the cost/benefit impact, only time will tell, but my guess is that this is a good thing." And, he sums up: "How do you put a price on investor confidence, anyway? Conforming to these new rules is a challenge, and I, for one, am looking forward to it."

Edith G. Orenstein is Manager of Research for Financial Executives Research Foundation (FERF). She can be reached at eorenstein@fei.org.