Summary of General Themes from SEC Roundtable on Implementation of Internal Control Reporting Provisions - April 14, 2005 On Wednesday, April 13, 2005, the Securities and Exchange Commission (SEC) hosted a roundtable discussion on the implementation of the internal control reporting requirements for public companies as outlined under Section 404 of The Sarbanes-Oxley Act of 2002. The roundtable was comprised of six panels that were designed to address the following subjects: The first year Reporting to the public Planning and design Documentation and testing Using judgment in communication and testing Next steps Members of the Public Company Accounting Oversight Board (PCAOB) were in attendance and participated at the roundtable. In advance of the roundtable, the Commission sought written submissions from all interested persons about their experience with the internal control provisions. The Commission invited representatives of public companies, auditors, investors, members of the legal community and others to participate in the roundtable. The SEC staff used 30 discussion questions to facilitate the panel discussion during this one-day event. Several themes emerged during the roundtable dialogue. First and foremost, there was an overall consensus that the Section 404 concept is valid. Many panel participants asserted, however, that the Year One compliance and auditing costs were too high and must be reduced going forward. They asserted, in essence, that the "cost/benefit equation" is out of balance. Some explained that the high costs were partly due to the lack of documentation and inadequate attention to and emphasis on improving internal control over financial reporting, i.e., in effect, the buildup of years of deferred maintenance. There was a general view that first year adoption was a learning experience, impacted by the timing of the release of PCAOB Auditing Standard No. 2 (AS2) and other guidance materials issued by the accounting firms, and the SEC's deadline for compliance. Company and audit firm representatives were unanimous in asserting that cost reductions were achievable during the second year due to (a) the carry-forward of Year One documentation and (b) the commitment of all constituencies to implementing a risk-based approach to drive the compliance process. Other themes emerging from the roundtable are noted below: The Year One approach gave equal weighting and emphasis to high risk and low risk areas. Many commenters observed that management doesn't have any direct guidance as to the company's assessment process and must look, by default, to the standards written for the auditor. Many company representatives were of the view that the auditors drove them to perform work they did not believe was warranted. Although a risk-based approach is provided for in AS2, many commenters asserted, and some of the audit firm representatives present at the roundtable acknowledged, that such an approach was not really applied. Instead, an approach described as "quantitative" and "conservative" was applied, resulting in excessive scopes, documentation and testing. A risk-based approach is needed. The audit firms acknowledged a need to adopt a risk-based approach in Year Two and to more effectively integrate the audits on internal control over financial reporting and the financial statements. The firms pointed out they had limited time to execute an integrated audit because of the timing of AS2 (issued in March 2004), the execution of their AS2-related training programs and the issuance of their AS2-related guidance materials. As a result, the integrated audit was a goal in Year One, but it didn't really happen. The opportunity in Year Two is to use judgments based on the Year One fact base and drive a risk-based approach during Year Two. The PCAOB was asked by several commenters to revisit (a) its requirement to test every key control every year and (b) the "more than inconsequential" threshold for determining significant deficiencies. It was also noted that the PCAOB's inspection tone could profoundly affect audit firm behavior going forward. Best practice examples are needed. Many noted there was significant variability in practice. Best practice examples and case studies are needed to increase consistency in the scoping process and in documenting and evaluating internal control over financial reporting. Several commenters suggested that there be further structured dialogue among companies, auditors and the regulators to develop best practices. Not all material weaknesses are created equal. Several commenters pointed out that companies need clarity around the assessment, aggregation and classification of control deficiencies. With respect to material weaknesses, representatives from the user community requested more uniformity in the disclosures around the nature of material weaknesses so they can evaluate the severity of such weaknesses. They also requested regular interim updates on the status of the company's remediation efforts. There was a general theme relating to the impact of the application of the accounting and auditing rules on business in general. For example, there was widespread concern among panel participants over the impact of the independence rules on client-auditor dialogue and the related impact on the ability to execute business transactions that management may be reluctant to initiate without full and accurate knowledge of the accounting ramifications. The controls evaluation process was also cited as impacting corporate behavior in terms of the cycle for implementing new IT systems and the timing of acquisitions. Small and mid-sized companies are going to experience a disproportionate cost in complying with Section 404 unless further guidance is provided. The Committee of Sponsoring Organizations (COSO) is currently studying this problem and is issuing proposed guidance this summer for public comment. The Commission has delayed compliance by non-accelerated filers until fiscal years ended after July 15, 2006. Many commenters suggested a "freeze" on the final phase-in of the accelerated filing requirements. Currently, the Commission has temporarily postponed, for one year, the final phase-in period for acceleration of periodic report deadlines that apply to so-called "accelerated filers." Under the amended rules, the filing deadline for accelerated filers remains at 75 days after year-end for annual reports and at 40 days after quarter-end for quarterly reports. The final phase-in would accelerate the annual report filing deadline by 15 days and the quarterly filing deadline by five days. The SEC staff indicated a willingness to listen to the concerns expressed. There were other points raised during the roundtable which could signal more discussion and increased focus in the future. For example, different commenters asserted a need for: More reliance by auditors on the work of others More attention on the adequacy of internal auditing Greater clarity regarding the evaluation of IT general and application controls More focus on evaluating the effectiveness of entity-level controls A broader focus on the business model, including a broader focus on risk assessment and on implementing enterprise risk management While there were no clear signals from the SEC Commissioners and staff as to the direction they might take from these proceedings, PCAOB Chairman McDonough indicated the Board would have a "very severe conversation" with the senior leadership of any audit firm the Board concludes is performing excessive auditing of their clients' internal controls. The SEC Commissioners and staff pointed out that many of the roundtable themes noted above are addressed in the existing standards and rules, and continuously requested input during the panel discussions as to what was needed from a regulatory standpoint. The challenge facing the SEC and PCAOB is to address how to bring the spirit both agencies intend to the reality of behavior in the marketplace. For the meeting agenda, the meeting briefing paper and other meeting materials, please refer to http://www.sec.gov/spotlight/soxcomp.htm.
