Compliance Blog

No not Donald Trump, Chairman Donaldson of the SEC. What was Deloitte thinking? The Big Four still do not get it that they are regulated. They cannot just say and do whatever they want to. Those days are over.

An excerpt of the exchange here:
"SEC Demands Revision of Deloitte Statement
Washington (April 29, 2005) - The Securities and Exchange Commission strongly objected to a statement by Big Four firm Deloitte & Touche regarding settlements the audit firm entered into with the commission to resolve charges related to two of Deloitte's former audit clients.
The SEC asked the firm to revise a press release that it had issued Tuesday, Deloitte spokeswoman Deb Harrington confirmed.
"They [the SEC staff] objected to our characterization of how we described the case and we agreed to defer to their description of the case," Harrington told WebCPA"
For the complete article, click here.

For help in performing your Section 404 Compliance Simply and affordably, see www.issuescentral.com or call (800) 410-6681 to learn more about Sarbanes-Oxley Compliance Playbook(tm).

Two censures/fines for Deloitte in one day by the SEC. Wow! Unfortunately, in the case of Just for Feet, Deloitte's own Risk Management Practice had designated Just for Feet as high risk and according to the SEC.

• One problem with the now bankrupt Just for Feet, based in Birmingham, AL. Click here for the complete notice.
• The other for their audit of Adelphia. Click here for the complete notice.

The issue for the Big Four is becoming huge on liability and fines. The concern is that soon, who is going to want to audit anymore? There is more money in Sarbanes-Oxley work and less liability because you are not verifying the work only performing the work for non-audit clients. There may be big problems on the horizon with access to audits. And if you are a small cap firm that is somewhat risky, forget about a Big Four audit.

For more information how your mid to emerging firm can simplify your compliance, learn more about the Sarbanes-Oxley Compliance Playbook(tm) at www.issuescentral.com or call 800.410.6681 ext 112.

Very interesting news from the SEC. First a few weeks ago, an honest openness about working to provide guidance and help to companies small and large on compliance with Section 404, now reaching out to the EU. This is good news. This bodes well for the future of US leadership in financial markets and standards.

An excerpt from an article here:
"U.S., E.C. Eye 'Roadmap' to Convergence
Foreign public issuers that follow international financial reporting standards would not be required to reconcile to U.S. GAAP.
Stephen Taub, CFO.com
April 25, 2005
The United States and Europe are moving much closer toward recognizing each other's accounting rules, which would remove heavy burdens on companies that want to list on exchanges outside their home continent.
William Donaldson, chairman of the Securities and Exchange Commission has discussed a "roadmap" with Charles McCreevy, the European Union Internal Market Commissioner that would eventually permit foreign public issuers not to reconcile to U.S. GAAP, provided that they follow international financial reporting standards, according to the SEC."

For information on how your company can decrease cost and increase effectiveness with your Section 404 compliance, see www.issuescentral.com to learn more about Sarbanes-Oxley Compliance Playbook(tm) or call 800.410.6681 ext 112.

Makes sense. The more you involve people in a process in any organization, the better it works and the greater the results. So the Aberdeen Group finds with SOX 404 Reviews.

See here for an excerpt:
Limit C-level Management in Sarbanes-Oxley Reviews, Says AberdeenGroup
Aberdeen Group - April 19, 2005 As pressure to comply with Sarbanes-Oxley regulations mounts, a new benchmark report by AberdeenGroup demonstrates that companies that involve much of the organization in their SOX review process are experiencing lower costs and increased profits. By contrast, companies who limit SOX reviews to a small group of senior management have the worst performance records.
AberdeenGroup's report, "Automating SOX Compliance Benchmark Report", found that companies can achieve greater results from their SOX review process by using a combination of business process analysis, project management, and changes to technology to go beyond the minimum requirements imposed by SOX to significantly improve operating results while introducing continuous business improvements. Click here for the complete article.

To learn how to increase effectiveness and decrease cost with your Section 404/302 review, click www.issuescentral.com to see how the Sarbanes-Oxley Compliance Playbook(tm) can cut your mid to emerging company's cost and time to become compliant. Or call (800) 410 6681 ext 112.

Washington, DC – April 14, 2005: Issues Central staff attend SEC Internal Control Roundtable Meetings – Meeting Highlights and Commentary

Management of Issues Central, Inc., developers of the Sarbanes-Oxley Compliance Playbook™, attended two critical meetings of the Securities and Exchange Commission (SEC) in Washington on April 12 and April 13, 2005.


SEC Advisory Committee on Small Business - Meeting # 1
(April 12, 2005 – Washington – SEC HQ - William O. Douglas Room)

This was the first organizational meeting for the Small Business advisory committee. The SEC established this committee to examine the impact of the Sarbanes-Oxley Act and other aspects of the federal securities laws on smaller companies.

Observations arising from this meeting:

The committee mandate is very broad covering not only internal control issues (i.e. – Section 404 of the Sarbanes-Oxley Act of 2002), but also capital formation, securities matters and accounting treatment for smaller companies.
A very strong group of committee members with a thirteen (13) month agenda must formulate key recommendations within six (6) months for review and potential implementation.
Mention was made of not only the US markets, but also of issuers on the Canadian exchanges. The Canadian context was related to barriers to entry with respect to capital formation and securities laws.
The SEC is concerned with the impact of recent compliance regulations on smaller business as the feeling is that these same enterprises are the engine of the economy and costs of compliance will be excessive for smaller companies.
Four major subcommittees were formed and the number one item on each agenda was the definition of “smaller” as this designation may form the basis for differential treatment with respect to various pieces of SEC activities.
A common complaint from issuers and financiers was that they are not able to engage the Big 4 audit firms because of perceived risks and excessive demand for their services from larger firms. As an observation, Big 4 accounting firm attendance at this meeting was minimal.
Mentioned in the meeting was work underway by The Committee of Sponsoring Organizations of the Treadway Commission (COSO) with respect to an internal control framework for smaller firms. This will be published for comments during the summer of 2005.
Various discussions focused around the excessive costs of Section 404 compliance and the challenges that will be faced by smaller filers over the coming year.
The committee will be holding meetings every two months over the next year and will be soliciting public opinion on its recommendations.
All participants were committed to finding effective ways to ensure that smaller companies could meet legislated objectives but in a more cost effective and efficient manner.
Stay tuned to the SEC website for developments with respect to the work of this committee (http://www.sec.gov/).

Issue Central, Inc. – Our Preliminary Conclusions: The SEC is open to ways to help smaller companies but no one should expect any legislation changes with respect to Section 404 of SOA. However, it would be reasonable to anticipate some rule changes or clarifications with respect to how internal controls might be better implemented at lower cost. Some initial thoughts include recommendations that internal controls may be more risk-based and testing examples might be developed to facilitate greater economy without sacrificing audit quality.


SEC Roundtable on the Implementation of Internal Control Reporting Provisions
(April 13, 2005 – SEC HQ – William O. Douglas Room)

This meeting drew a large crowd and was held to review the experience to-date from larger “issuers”, auditors and regulators with respect to the implementation of Section 404 (Internal Controls) of the Sarbanes-Oxley Act of 2002 (SOA).

Participants in this meeting included the SEC; the Public Accounting Oversight Board (PCAOB); major audit firms; large to mid size public filers; large and small investors; various associations; other government authorities; as well as media from all around the world.
Lineups started early for the Roundtable


Observations arising from the Roundtable were:

· Major topics covered during the roundtable were: Experiences from Year 1; Reporting to the Public; Planning and Design; Documentation and Testing of Internal Controls; The use of Judgement in Communications and Conclusions; and, Next Steps.
· The larger investors (i.e. – CALPERS) had a strong sense that Section 404 has already begun to provide more significant benefits to the markets as investors are more confident in financial reporting. This type of confidence will be a contributing factor to lower cost of capital for issuers.
· Management teams observed that generally improvements had been made to their financial reporting that would not have occurred without SOA and Section 404.
· Underlining the difficult circumstances faced by issuers was that while the PCAOB had provided the PCAOB Audit Standard # 2 (AS2) rule to the auditing community with respect to documentation and testing of internal controls. In these rules, judgement in the areas of reliance on management’s documentation and testing was allowed, but not implemented in general by external auditors. Panel members mentioned that this may have been driven by fear of litigation, as well as “revenue enhancement”.
· Issuers on the other have not enjoyed similar rules from the SEC. There was not a consensus from issuers or the SEC as to whether additional rules would be helpful. Issuers were then held to an ultra-conservative interpretation of the AS 2 Standard. This has led to what one Panel member described as Duplication – not Attestation, and the associated increase in external auditing costs.
· To underline the extremely conservative approach with respect to their interpretation of AS2, it was mentioned by several large filers that there auditors had moved their reviews to cover the documentation and testing of 96%-97% of balance sheet and income statement accounts.
· The general consensus was that a risk-based approach for review during Year 2 and beyond would be more appropriate and cost-effective.
· Too much time in Year 1 was spent by large filers on low risk, mundane transactions and processes, instead of high-risk processes and entity-level controls.
· Considerable time was spent discussing “material weaknesses”. It was concluded that not all material weaknesses were created equal.
· The SEC reached a conclusion that there were no problems with the rules related to Section 404, but that implementation issues were driving up costs.
· The PCAOB committed to providing more clarity for AS 2 by May 16th.
· It was acknowledged by most roundtable members that increased tension and distance in the relationship between an issuer and their external auditor had dramatically increased compliance costs. A negative consequence of this is that complex accounting transactions, where advice of external auditors is required, is not available at all or on a timely basis, protracting transaction closings and increasing the complexity in getting the best methods to handle transactions. This is especially true in mergers and acquisitions where transactions may be complex and the best and brightest minds are needed to complete the transaction.
· There was some thought that second year experiences will be more instructive for everyone since the steep learning curve of year 1 will be over. The panel members observed that this “settling in” would help naturally sort out many of the year 1 costs. There were quotes that external audit costs might decrease by as much as 46% in year 2 of the implementation of Section 404.
· There was a representative from the UK from the Turnbull Commission. This is the UK’s internal control framework. The framework is principle-based and is no more than fifteen pages. It is judgment based and is much different from the Section 404 rules based approach. The UK is currently reviewing their framework. There is not much chance that the UK will adopt more of a rules-based approach. The two camps are very far apart on approach. This leads to much discomfort in Europe over standards in the US which are very prescriptive rather than principle based.
· A representative from the American Electronics Association, who represents smaller manufacturers, estimated that Section 404 costs may run 2.5% of revenue versus .1% of revenue for companies exceeding $5 billion. This was cited to lend credence to the concern about changes to rules and/or guidance for smaller companies.
· A key observation of the panel was the sense that many audit firms do not have the depth to be able to deal effectively with IT Controls, both at a general level and application specific level. In addition, several issuers felt that stable IT systems should not be the subject of detailed examination and testing and that the associated audit costs was money poorly spent.
· The overall costs and benefits were reviewed and discussed in depth. It was generally concluded that the benefits of Section 404 are significant, but more clarity for external auditors around the implementation of auditing internal controls would drive the costs down more appropriately.
· External audit firms said they were going to work on relying more on internal audit and management’s documentation and testing in year 2 as well as try to integrate the Section 404 and Section 302 audits. This should cut cost and decrease disruption to issuers.
· Many panelists indicated that not enough time was spent properly scoping their projects and setting standards prior to diving in. This increased the cost and amount of time spent in accomplishing their projects. Most accelerated filers did not purchase technology to assist their projects but now are purchasing technology to assist in managing documentation, testing and tracking deficiencies.
· A major highlight for many attendees were comments made by the Chairman of the PCAOB relating to upcoming PCAOB inspections of audit firm activities with respect to AS2 interpretation, etc. William McDonough foresees a "severe conversation" with accountants who engage in too much testing of their clients' internal-controls reports. It was noted and hoped that the outcome of this process and related guidance to external audit firms would lead to reduced audit costs, greater reliance on the work of management and internal audit, and improved overall communication.
· For more information on the activities of the SEC’s Roundtable on the Implementation of Internal Control Reporting Provisions please go to http://www.sec.gov/ .

Issue Central, Inc. – Our Preliminary Conclusions: Smaller issuers can learn from the experiences of the larger filers as follows: 1) Put more time into early planning of your Year 1 404 project and don’t procrastinate; 2) Scope your Year 1 project carefully as this will influence time and cost, and 3) Get agreement from your external auditor on a risk-based approach so that low risk areas are not over documented and over tested, and 4) Don’t be surprised if your external auditor is more formal and circumspect in dealing with your internal control activities. Additional decisions and trends to look forward to by June 30, 2005 include: 1) clarification from the PCAOB on how external auditors are performing 404/302 reviews and 2) potential recommendations that greater reliance by the external auditor be placed on internal audit and management’s assessment of internal control.



Additional information:

For more information on the observations and perspectives of the Issues Central team please call Charley Best, Vice President at 416.977.1496 ext 112, or e-mail: charleybest@issuescentral.com .

For more information on Issues Central, Inc. and the Sarbanes-Oxley Compliance Playbook™, geared to the compliance efforts of mid to emerging public filers, please call 1.800.410.6681 or go to http://www.issuescentral.com/ .

My business partner and I attended the first public meeting for the SEC's round table for the Advisory Committee on Smaller Public Companies.

The first thing they have to do is to agree on the definition of a small company. This is not as easy as it sounds. Market capitalization alone is not enough. Other measures under consideration are: equity or debt raised, employees, revenue etc.

The SEC has a concern that Section 404 might stifle competition and innovation. This advisory committee is an effort to assure this does not happen. The group is made up of regulators, business people from all sectors. It is a pretty impressive group. They seem like they are in touch with the issues and want to solve them.

Main message so far is this: expect some rule changes from the SEC, if anything is adopted. But do not expect legislation changes that have to go through congress. Stay tuned for more.

For the announcement on this roundtable, click here.

To learn more about how your company can simply your Sarbanes-Oxley Compliance effort, see www.issuescentral.com to learn more about Sarbanes-Oxley Compliance Playbook(tm).

Subject: File No. 4-497
From: Catherine Connally
Affiliation: President, Issues Central Inc.

To Mr. Jonathan Katz Secretary, Securities and Exchange Commission
Subject: Feedback on Implementation of Sarbanes-Oxley Internal Control Provisions
Dear Sir:
We welcome this opportunity to share our perspective with the Commission.
Our organization has worked with many small and mid cap companies to help them effectively and efficiently implement their Sarbanes-Oxley Section 404 internal control review projects. We feel that there are some first principles that need to be reinforced by all involved in this forum:
Principle 1 - Investor trust is priceless.
Principle 2 - American financial markets are responsible for safeguarding the largest percentage of the worlds investments, therefore,
Principle 3 - Only the highest standards in business practices and financial stewardship should be on the table for discussion.
Most people would agree that in all activities involving significant change, the normal human reaction is resistance, fear, chronic complaining and often times foot dragging. The Sarbanes-Oxley Act of 2002 is all about long overdue change, so it is not surprising that there are mixed opinions on the value of the legislation and strong feelings with respect to Section 404 in particular.
Given this we would like to share a few observations from the markets initial adoption of Section 404:
Observation 1 - If effective internal controls were not institutionalized in an organization prior to the introduction of the Sarbanes-Oxley Act, then it is almost guaranteed that there will be issues with respect to poorly designed processes and reliability may be questionable.
Observation 2 - The high degree of implementation of technology over the last twenty years has led to large numbers of segregation of duties issues. In some critical function, one person today is doing the work of e.g. three people two decades earlier. The focus has been on productivity, not control.
Observation 3 - Many processes are fragile because they have evolved from immediate need but not by design. This is like building a house without a plan.
Observation 4 - People cannot spend their way into compliance, they need to take active ownership and participation at a detailed level. Control cant be bought, but it can be earned and embedded into the company way.
Observation 5 - The transition to the buck stops with us not with our auditors is a work-in-progress. Those companies that genuinely embrace good controls will find that this is good work not busy work.
Observation 6 - The CFOs who have been most actively involved in the initial 404 efforts have learned enormous amounts about their own processes and have been able to make positive and necessary changes.
Observation 7 - 404 efforts for small companies in most cases should be easier, not harder, than for larger firms. Generally in smaller organizations there is less administrative inertia, fewer layers of management and patchwork systems, etc. The challenge is for smaller firms to deal with the initial ramp-up to building effective internal controls and then ongoing maintenance.
Observation 8 - The excessive costs that have been discussed/surveyed concerning 404 will be dealt with by the law of supply and demand. Today the demand exceeds supply but not for long. The cost of compliance will come down as specialized expertise and better practices become more commonplace.
For your consideration we would like to make the following suggestions for the benefit of small to mid sized companies with respect to Section 404:
Suggestion 1 - Do not procrastinate. Start now. Leaving the initial 404 work too late will cause you to become overly dependent on costly outside resources. This will undermine quality and longer-term ownership over effective internal controls, and drive up the cost of compliance.
Suggestion 2 - Develop a 404 playbook by planning and scoping your project completely and thoroughly before getting into the details and undertaking testing. The old adage of Measure twice, Cut once applies and will help you create a strong foundation for subsequent years.
Suggestion 3 - Involvement of your staff is critical. As a management team you are the overall process owners. By building effective internal controls in-line with your processes you will build a more prosperous enterprise for shareholders, customers and employees.
Suggestion 4 - Expect imperfection and plan accordingly. If you give yourself time you will be able to remediate and have a clean audit opinion and just as importantly a solid set of business practices.
Suggestion 5 - Your 404 effort is a golden opportunity to improve bad processes. Simplify and strengthen wherever possible. Automating bad processes masks many problems.
Suggestion 6 - Effective internal controls are not just issues for publicly traded firms. Given that trust is paramount when conducting business and transactions between people and organizations, do not be surprised to see similarly legislated requirements for non profits, governments, etc. Good controls arent a burden; they are part of running a good operation.
We know that the SEC is under constant fire for this legislation, but would encourage the Commission to stay the course, as Ronald Reagan would have said.
JFK said, To whom much is given, much is expected.
We know that investors in our markets feel the same way.
This is the price of leadership and the job of management.
Sincerely,
Catherine Connally President Issues Central, Inc. 1.800.410.6681

Just when smaller companies were hoping for Section 404 to be rolled back or weakened comes a Standard released for public comment from the PCAOB. It would allow a voluntary engagement by a company who reported a material weakness, to get help to determine if that weakness had really been eliminated. The thought is that you can say it has been fixed, but is this internal control review process really working.

Wow, this could be seen very positively if a company is so committed to transparency and governance that they will undergo this type of review. It will help smooth the process. Sounds like more work for auditors.


Excerpt from PCAOB Comment Request:
Board Proposes Standard on Reporting on the Elimination of a Material Weakness
Washington, DC, March 31, 2005 - The Public Company Accounting Oversight Board today voted unanimously to propose for public comment a standard that would apply when auditors report on the elimination of a material weakness in a company's internal control over financial reporting. The proposed standard would establish a voluntary engagement that would be performed at the election of the company" For the complete article, click here.

To get your Sarbanes-Oxley project started and finished with the best results and the least cost, see www.issuescentral.com and learn more about the Sarbanes-Oxley Compliance Playbook(tm).