Internal Controls: The Highest Sarbanes-Oxley Hurdle

Transcription

1 SECURITIES LAW October 2004 Internal Controls: The Highest Sarbanes-Oxley Hurdle * * * The following article discusses the Sarbanes-Oxley Section 404 internal control requirements applicable to public companies. Here is a short checklist of some of the actions your company will need to take: SECTION 404 CHECKLIST Audit committee adopts resolutions specifically pre-approving engagement of independent auditor to provide internal control-related services, including internal control audit auditor engaged for internal control audit must be same auditor that audits financial statements Management adopts specific framework for evaluating effectiveness of company s internal control over financial reporting most likely will be COSO (Committee of Sponsoring Organizations of the Treadway Commission) framework Independent auditor conducts concurrent audits of financial statements and internal controls and audit reports included in Form 10-K/10-KSB includes assessment of effectiveness and independence of audit committee includes evaluation of management s assessment of effectiveness of internal controls Management conducts evaluation of effectiveness of company s internal controls over financial reporting as of end of fiscal year and includes report in Form 10-K/10-KSB management must be actively involved and cannot delegate responsibilities to auditor if management needs third-party assistance, must be provided by different auditing firm CEO and CFO Section 302 certifications for Forms 10-K/10-KSB and 10-Q/10-QSB revised to include internal control over financial reporting certifications Auditor s consent filed with Form 10-K/10-KSB regarding incorporation of its audit reports in registration statements (such as Form S-8) filed under the Securities Act of 1933 revised to include reference to audit of internal control over financial reporting as well as audit of financial statements Management evaluates internal controls as of end of each quarter and discloses in Forms 10-Q/10-QSB and 10-K/ 10-KSB any changes that materially affect, or are reasonably likely to materially affect, the company s internal control over financial reporting * * * If yours is one of the larger SEC reporting companies (one with a public float of at least $75 million), in the next few months you will be filing your first Form 10-K Annual Report to comply with new internal control requirements required under the Sarbanes-Oxley Act of The remaining public companies still have time to get ready, Page 1 of 6

2 because your initial compliance will be required in the first Form 10-K/10-KSB filed for a fiscal year ending on or after July 15, Complying with the Sarbanes-Oxley internal control requirements is widely considered to be the most difficult, time-consuming, and expensive burden imposed by the legislation. It is estimated that as many as 10 to 20 percent or more -- of companies will have internal control weaknesses and will not receive clean audit reports. Although some of the ramifications of the new internal control requirements are still uncertain, there are two certainties for public companies: much more of management s and board member s time will be spent dealing with internal control issues and the process will be expensive. The primary burdens of complying with the new internal control requirements fall on a company s senior management, the audit committee of the company s board of directors and the public auditors engaged by the company. What are Internal Controls? In 1977, the federal securities laws began requiring public companies to develop and maintain systems of internal accounting controls that, among other requirements, would be sufficient to permit the preparation of financial statements that conform to generally accepted accounting principles (GAAP). The Sarbanes-Oxley Act of 2002 mandates the implementation of a new, comprehensive internal control scheme for financial reporting. Section 404 of the Sarbanes-Oxley Act directs the SEC to prescribe rules requiring that each annual report filed by a public company contain an internal control report that: states management s responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and contains an assessment, as of the end of the company s most recent fiscal year, of the effectiveness of the company s internal control structure and procedures for financial reporting. In formulating the Section 404 rules, the SEC adopted the term internal control over financial reporting and defined it as the process for preparing financial statements that includes a company s policies and procedures for: maintaining records that accurately, fairly and in reasonable detail reflect transactions and dispositions of assets; providing reasonable assurance that transactions are recorded as necessary to permit the preparation of financial statements in accordance with GAAP and that receipts and expenditures are made only in accordance with management and director authorization; and providing reasonable assurance regarding the prevention or timely detection of unauthorized acquisition, use or disposition of the company s assets that could have a material effect on the financial statements. As this definition indicates, the Section 404 internal control provisions are limited to financial reporting. They do not extend to other areas that commonly have been included under the term internal controls, such as the effectiveness and efficiency of operations and compliance with applicable laws. How Do Internal Controls Differ From Disclosure Controls? Sections 302 and 906 of Sarbanes-Oxley require a public company s CEO and CFO to make certain certifications in each annual report on Form 10-K/10-KSB and quarterly report on Form 10-Q/10-QSB that the company files. In addition to requiring certifications regarding the company s internal control over financial reporting and the accuracy of the information and fair presentation of financial information in the report, the CEO and CFO also must make certifications about the company s disclosure controls and procedures. Page 2 of 6

3 In adopting Sarbanes-Oxley mandated rules for the implementation of CEO and CFO certification requirements, the SEC also adopted broader rules requiring public companies to maintain disclosure controls and procedures. The SEC rules define disclosure controls and procedures as those designed to assure that a company records, processes, summarizes and reports on a timely basis both the non-financial and financial information required to be disclosed in the periodic reports the company files with the SEC. Although there is substantial overlap between a company s disclosure controls and procedures and its internal control over financial reporting, the SEC has pointed out that there are both some elements of disclosure controls and procedures that are not subsumed by internal control over financial reporting and some elements of internal control that are not subsumed by the definition of disclosure controls and procedures. A main distinction between the two is that disclosure controls and procedures cover non-financial information as well as financial information. Who Is Affected By the New Internal Control Requirements? Your company s senior management, the audit committee of your company s board of directors and the public auditors engaged by your company bear the primary burden of complying with the new internal control requirements. In addition to requiring that a company s management establish and maintain adequate internal controls for financial reporting and report on internal control in each annual report, Section 404 of Sarbanes-Oxley imposes requirements on the public accounting firm that audits the company s financial statements. The internal control standard adopted by the Public Company Accounting Oversight Board (PCAOB), which is the accounting entity created as a result of the Sarbanes-Oxley Act, requires a public company s auditor to conduct a separate audit of the effectiveness of the company s internal control over financial reporting and management s assessment of such effectiveness, and to issue a report on those matters. The standard also requires the auditor to consider the effectiveness of the company s audit committee in evaluating the effectiveness of the company s internal control. What Is Required of Senior Management? As part of their internal control responsibilities, your company s principal executive and financial officers are responsible for designing (or overseeing the design of) the process for providing reasonable assurance of the reliability of the company s financial reporting and that the company s financial statements for external purposes are prepared in accordance with GAAP. Your management must adopt procedures suited to the needs of your company to evaluate the design of internal control over financial reporting and test its effectiveness. Your management must decide on a framework to evaluate the effectiveness of internal control over financial reporting. SEC rules require that the framework be a suitable, recognized control framework that has been established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment. Although other frameworks may comply with SEC criteria, the SEC has specifically stated that the framework in the 1992 report of the Committee of Sponsoring Organizations of the Treadway Commission satisfies the criteria. Management s Annual Internal Control Report Management must prepare an annual report assessing the company s internal control over financial reporting and include the report in the company s annual report on Form 10-K/10-KSB. The internal control report must include the following: a statement that management is responsible for establishing and maintaining adequate internal control over financial reporting for the company; identification of the framework management has used to evaluate the effectiveness of the company s internal control over financial reporting; Page 3 of 6

4 management s assessment of the effectiveness of the company s internal control over financial reporting as of the end of the company s most recent fiscal year, including disclosure of any material weaknesses in internal control over financial reporting that management has identified; and a statement that the accounting firm that audited the financial statements included in the annual report has issued an attestation report on management s assessment of the company s internal control over financial reporting. If during its assessment, your management identifies one or more material weaknesses in your company s internal control over financial reporting, management is not allowed to determine that the company s internal control over financial reporting is effective. The definition of material weakness is the same as that used under generally accepted auditing and attestation standards: a material weakness is a significant deficiency that, by itself or in combination with other significant deficiencies, results in more than a remote likelihood that a material misstatement in the financial statements will not be prevented or detected. A significant deficiency is defined as one or more control deficiencies that adversely affect a company s ability to initiate, authorize, record, process or report external financial data reliably in accordance with GAAP with more than a remote likelihood that a more than inconsequential misstatement of the financial statements will not be prevented or detected. Management s Quarterly Updates In adopting the rules to implement Section 404, the SEC added a requirement that a company s management evaluate on a quarterly basis any change in the company s internal control over financial reporting that has materially affected (or is reasonably likely to materially affect) the company s internal control over financial reporting. The evaluation must be made as of the end of each fiscal quarter, and the CEO and CFO are required to participate in the evaluation. The results of the evaluation for each fiscal quarter are disclosed in the Form 10-K/10-KSB or 10-Q/10- QSB filed for that quarter. Working with the Auditors The new internal control requirements also will require the company s senior management to devote more time to audit matters. In addition to the audit of the financial statements, the auditors will now conduct an audit of the effectiveness of the company s internal control over financial reporting and of management s assessment of that effectiveness. Your company s senior management will be required to spend more time communicating and interacting with the outside auditors as they carry out these new responsibilities. Although your company s auditors may assist management in documenting internal controls, the PCAOB standard and the SEC s auditor independence rules severely restrict the amount of assistance that is permitted. The PCAOB standard provides that management must be actively involved and must not delegate to the auditor management s responsibility to assess the company s internal control over financial reporting. The SEC staff made a point of reminding companies of that requirement in the release adopting the internal control rules. If you seek assistance from a third party in conducting the internal control review, that assistance will need to be provided by someone other than your company s current auditor. What Is the Role of the Audit Committee? The Sarbanes-Oxley Act imposes additional responsibilities on the audit committees of companies that have shares listed on Nasdaq or an exchange. SEC Rule 10A-3 requires the audit committee to be directly responsible for the appointment, compensation, retention and oversight of the work of any registered public accounting firm that the company engages to prepare or issue an audit report or perform other audit, review or attest services for the company. The rule also requires that the accounting firm providing those services report directly to the audit committee. The role of the audit committee is certain to expand and change significantly in response to the PCAOB standard. Under the PCAOB internal control standard, an auditor may not accept an engagement to provide internal control- Page 4 of 6

5 related services unless the company s audit committee has specifically pre-approved the provision of such services. The PCAOB s adoption of this requirement results in a modification of the SEC rules regarding audit committee approval of services to be provided by an audit firm, since the SEC rules would allow such services to be approved as part of a category of services. One of the most controversial requirements of the PCAOB internal control standard is that your auditor must assess the effectiveness of the company s audit committee in monitoring the company s external financial reporting and internal control over financial reporting. If your company does not have an audit committee, the standard requires the auditor to evaluate the effectiveness of the entire board of directors. The standard requires the auditor to focus on these factors in the evaluation of the audit committee: the independence of the audit committee members from management; the clarity with which the audit committee s responsibilities are articulated in the audit committee charter or elsewhere; and how well the audit committee and management understand the responsibilities of the audit committee. The most controversial aspects of the auditor s evaluation relate to factors that the standard suggests an auditor might consider in evaluating the effectiveness of the audit committee: the audit committee s involvement and interaction with the independent auditor, internal auditors, and key members of financial management; whether the audit committee raises the right questions with management and the auditor; and the audit committee s responsiveness to the issues raised by the auditor. Thus, the audit committee is put in the position of being responsible for the hiring, compensation, and oversight of auditors, who, once hired, will be responsible for assessing the effectiveness of the audit committee. What Is Required of the Auditor? The auditor s role is greatly expanded under the new internal control rules and standard. The most significant change is the requirement of an audit of a company s internal control over financial reporting in addition to the audit of the company s financial statements. The auditor is required to prepare an annual attestation report assessing the company s internal control over financial reporting. The attestation report must be included in the company s annual report on Form 10-K/10-KSB. Although the report the auditor is to prepare is called an attestation report, the PCAOB has made it clear that the attestation engagement is for an audit and not for some lesser undertaking. The auditor s attestation of management s assessment is the result of that audit. In the attestation report, the auditor must express opinions both on management s assessment of the effectiveness of the company s internal control over financial reporting and on the auditor s own view on the effectiveness of the company s internal control over financial reporting. To issue unqualified opinions, the auditor must find that management s assessment is fairly stated and that the company s internal control over financial reporting is effective in all material respects and there must have not been limitations on the scope of the auditor s engagement. The auditor also has the new role of assessing the effectiveness of the audit committee. If the auditor concludes in its evaluation of a company s audit committee that the audit committee s oversight is ineffective, the PCAOB standard requires that this be considered at least a significant deficiency and a strong indicator that a material weakness in internal control over financial reporting exists. Page 5 of 6

6 Thus, as a result of the new internal control rules and standard, instead of rendering a single opinion, the auditor now will be rendering three opinions: an opinion on management s assessment of effectiveness of the company s internal control over financial reporting; an opinion, based on the auditor s assessment, on the effectiveness of the company s internal control over financial statements; and What to Expect? an opinion on the company s financial statements. The relationships among a company s senior executive and financial officers, the audit committee, and the independent auditors will evolve as the new internal control requirements are put into practice. Some ramifications of the new internal control requirements are uncertain at this time. However, one thing is certain: you should be planning for additional management and board member time and company expense to deal with internal control issues. * * * This Barnes & Thornburg LLP publication should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own lawyer concerning your situation and any specific legal questions you may have or address any questions concerning the foregoing to: Indianapolis Catherine L. Bridge Eric R. Moy Stephen J. Dutton Jan Neuenschwander Curt W. Hidde Julie A. Russell Richard M. Leagre Claudia V. Swhier Thomas M. Maxwell Steven W. Thornton David B. Millard Andrea D. Unzicker South Bend Chicago Alan B. Feldbaum Larry D. Blust Brian J. Lake Kathryn R. Howell Brian A. Casey David Edwards John C. Smarrella Fort Wayne Elkhart Daniel B. Starr J. Scott Troeger Rand W. Nilsson Washington, D.C. Grand Rapids Randolph J. Stayin R. Paul Guerre Kimberly L. Thomas Page 6 of 6