Sarbanes-Oxley Act of Prof. Dr. Thomas Nösberger

Transcription

1

2 Learning Objectives 1. Background 2. Overview Sarbanes-Oxley Act 3. The new governance structure in the US 4. The Public Company Accounting Oversight Board 5. SOX Internal control system Page 1

3 Background Reasons for the Sarbanes-Oxley Act 1 Reporting Scandals Political Pressure I m deeply concerned There is a need for renewed corporate responsibility in America. (George W. Bush commenting on Worldcom, one month before signing the Sarbanes-Oxley Act) Danger for the entire system? Page 2

4 Background: What went wrong? 1 Board of Directors Investment banks Regulators Auditors Financial analysts Management Investors Lawyers, Actuaries & other experts Credit-Rating Agencies Information chain Media Page 3

5 Overview Sarbanes-Oxley Act 2 Titles Title I: Title II: Title III: Title IV: Title V: Title VI: Title VII: Title VIII: Title IX: Title X: Title XI: Public Company Accounting Oversight Board (PCAOB) Auditor Independence Corporate Responsibility Enhanced Financial Disclosure Analyst Conflicts of Interest Commission Resources and Authority Studies and Reports Corporate and Criminal Fraud Accountability White Collar Crime Penalty Enhancements Corporate Tax Returns Corporate Fraud and Accountability Page 4

6 Overview Sarbanes-Oxley Act Title 1: PCAOB 2 Title I establishes the Public Company Accounting Oversight Board (PCAOB), to provide independent oversight to public accounting firms providing audit services. The PCAOB is tasked with registering auditors, defining the specific processes and procedures for compliance audits, inspecting and policing conduct and quality control, and enforcing compliance with the specific mandates of SOX. Page 5

7 Overview Sarbanes-Oxley Act Title 2: Auditor Independence 2 Title II, which consists of nine sections, establishes standards for external auditor independence, to limit conflicts of interest. It also addresses new auditor approval requirements, audit partner rotation policy, conflict of interest issues and auditor reporting requirements. Section 201 of this title restricts auditing companies from providing certain services to audit clients. Page 6

8 Overview Sarbanes-Oxley Act Title 3: Corporate Responsibility 2 Title III mandates that senior executives take individual responsibility for the accuracy and completeness of corporate financial reports. It defines the interaction of external auditors and corporate audit committees, and specifies the responsibility of corporate officers for the accuracy and validity of corporate financial reports. It enumerates specific limits on the behaviors of corporate officers and describes specific forfeitures of benefits and civil penalties for noncompliance. Page 7

9 Overview Sarbanes-Oxley Act Title 4: Enhanced Financial Disclosure 2 Title IV describes enhanced reporting requirements for financial transactions, including off-balance sheet transactions, pro-forma figures and stock transactions of corporate officers. It requires internal controls for assuring the accuracy of financial reports and disclosures, and mandates both audits and reports on those controls. It also requires timely reporting of material changes in financial conditions and specific enhanced reviews by the SEC or its agents of corporate reports. Page 8

10 Overview Sarbanes-Oxley Act Title 5: Analyst Conflicts of Interest 2 Title V includes measures designed to help restore investor confidence in the reporting of securities analysts. It defines the codes of conduct for securities analysts and requires disclosure of known conflicts of interest. Page 9

11 Overview Sarbanes-Oxley Act Title 6: Commission Resources and Authority 2 Title VI defines practices to restore investor confidence in securities analysts. It also defines the SEC s authority to censure or bar securities professionals from practice and defines conditions under which a person can be barred from practicing as a broker, adviser or dealer. Page 10

12 Overview Sarbanes-Oxley Act Title 7: Studies and Reports 2 Title VII consists of five sections. These sections (701 to 705) are concerned with conducting research for enforcing actions against violations by the SEC registrants (companies) and auditors. Studies and reports include the effects of consolidation of public accounting firms, the role of credit rating agencies in the operation of securities markets, securities violations and enforcement actions, and whether investment banks assisted Enron, Global Crossing and others to manipulate earnings and obscure true financial conditions. Page 11

13 Overview Sarbanes-Oxley Act Title 8: Corporate and Criminal Fraud Accountability 2 Title VIII also referred to as the Corporate and Criminal Fraud Act of It describes specific criminal penalties for fraud by manipulation, destruction or alteration of financial records or other interference with investigations, while providing certain protections for whistle-blowers. Page 12

14 Overview Sarbanes-Oxley Act: Title 9: White Collar Crime Penalty Enhancements 2 Title IX increases the criminal penalties associated with white-collar crimes and conspiracies. It recommends stronger sentencing guidelines and specifically adds failure to certify corporate financial reports as a criminal offense. Page 13

15 Overview Sarbanes-Oxley Act : Title 10: Corporate Tax Returns 2 Title X consists of one section. Section 1001 states that the Chief Executive Officer should sign the company tax return. Page 14

16 Overview Sarbanes-Oxley Act: Title 11: Corporate Fraud and Accountability 2 Title XI s Section 1101 recommends a name for this title as Corporate Fraud Accountability Act of It identifies corporate fraud and records tampering as criminal offenses and joins those offenses to specific penalties. It also revises sentencing guidelines and strengthens their penalties. This enables the SEC to temporarily freeze large or unusual payments. Page 15

17 The new governance structure in the US 3 Quality control before Sarbanes-Oxley, Act 2002 Prior to passage of the SOX Act, the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) established auditing standards for private and public companies. In 1978 the AICPA established the Quality Control Standards Committee. For an audit firm, quality control comprises the methods used to ensure that the firm meets its professional responsibilities. A firm must ensure that auditing standards are followed in every audit. Quality controls are established for the entire firm. The relevant QCS is SAS 25 (AU 161). Page 16

18 The new governance structure in the US 3 Quality control before Sarbanes-Oxley, Act 2002 Elements of quality controls are: Independence, integrity, objectivity and competence. Personal management (allocation, delegation and supervision, consultation). Engagement performance. Acceptance and continuation of clients and engagements. Monitoring of the system (at the level of the firm and engagements). Page 17

19 The new governance structure in the US 3 External Quality Control before Sarbanes-Oxley Act CPA firms that were members of the SEC Practice Section or Private Companies Practice Sections (of the AICPA) had to be reviewed at least once every three years. Typically, the Peer review was a review for CPA firm compliance, by a CPA firm selected by the firm being reviewed. The AICPA set up also a special committee (Professional Oversight Board) for the regulation of the SEC Practice Section. AICPA member firms who where not members of these two sections were also required to have peer reviews performed every three years, (but typically less extensive). Page 18

20 The new governance structure in the US 3 External Monitoring of the Audit Profession after the SOX Act The establishment of the Public Accounting Oversight Board (PCAOB) to monitor the profession is a core element of the SOX Act. The Act required that auditors of U.S. companies be subject to external and independent oversight for the first time in history. Previously, the profession was self-regulated. Page 19

21 The Public Company Accounting Oversight Board 4 The PCAOB is a private-sector, nonprofit corporation created by the Sarbanes-Oxley Act. The Securities Exchange Commission (SEC) has oversight authority over the PCAOB, including the approval of the Board s rules, standards and budget. The PCAOB activities are funded through annual fees assessed on public companies in proportion to their market capitalization. Page 20

22 The Public Company Accounting Oversight Board 4 The Act gives the PCAOB four primary responsibilities: 1. registration of accounting firms that audit public companies trading in U.S. securities markets; 2. inspections of registered public accounting firms; 3. establishment of auditing and related attestation, quality control, ethics, and independence standards for registered public accounting firms; 4. and investigation and discipline of registered public accounting firms and their associated persons for violations of specified laws or professional standards. Page 21

23 The Public Company Accounting Oversight Board Registration of accounting firms 4 The Sarbanes-Oxley Act requires accounting firms to register with the PCAOB in order to prepare, issue, or participate in audit reports of issuers. Non-U.S. accounting (!) firms that furnish, prepare, or play a substantial role in preparing an audit report for any issuer also are subject to PCAOB rules. The public accounting firms disclose to the PCAOB: 1. Names of public clients; 2. Fees received for audit services, other accounting services and non-audit services; 3. Statement of quality control policies; 4. List of all accountants; 5. Any penalties pending against the firm or individuals, and; 6. Copies of client issuer disclosures of accounting disagreements. è Public record! (see example) Page 22

24 The Public Company Accounting Oversight Board Registration of accounting firms 4 Page 23

25 The Public Company Accounting Oversight Board Inspection of registered firms 4 PCAOB inspects registered public accounting firms to assess compliance with the Sarbanes-Oxley Act, the rules of the Board, the rules of the Securities and Exchange Commission, and professional standards, in connection with the firm s performance of audits, issuance of audit reports, and related matters involving U.S. companies and other issuers. As required by the Act, the PCAOB prepares a written report on each inspection and provides it, in appropriate detail, to the SEC and to certain state regulatory authorities. The Board also makes portions of the reports available to the public; however, certain information is restricted from public disclosure, or its disclosure is delayed, as required by the Act. Page 24

26 The Public Company Accounting Oversight Board Inspection of registered firms 4 Two aspects of the review: Review of audit engagements Audit deficiencies Proper documentation Review of quality control system Management structure and processes (including tone at the top) practices for partner management, including allocation of partner resources and partner evaluation, compensation, admission, and disciplinary actions; policies and procedures for accepting and retaining clients, processes related to the firm's use of audit work that the firm's foreign affiliates perform on the foreign operations of the firm's U.S. issuer audit clients the Firm's processes for monitoring audit performance, including processes for identifying and assessing indicators of deficiencies in audit performance, independence policies Page 25

27 The Public Company Accounting Oversight Board Inspection of registered firms 4 Examples of PCAOB reports: 2011 Inspection of Ernst & Young AG 2014 Inspection of Ernst & Young LLP 2006 Inspection of Aaron Stein 2008 Inspection of Aaron Stein Page 26

28 The Public Company Accounting Oversight Board Establishment of standards 4 The PCAOB adopted in a frist place the existing standards from the AICPA and is now replacing the adopted standards by own standards. Auditors refer to the PCAOB standards in their audit opinion. The standards from the AICPA will stay relevant for the audits of non public companies. Page 27

29 The Public Company Accounting Oversight Board Establishment of standards 4 Page 28

30 The Public Company Accounting Oversight Board Enforcement 4 The PCAOB has authority to investigate and discipline registered public accounting firms and persons associated with those firms for noncompliance with the, the rules of the PCAOB and the Securities and Exchange Commission, and other laws, rules, and professional standards governing the audits of public companies. Sanctions imposed by the PCAOB may include suspension or revocation of a firm's registration, suspension or bar of an individual from associating with a registered public accounting firm, and civil money penalties. The Board may also require improvements in a firm s quality control, training, independent monitoring of the audit work of a firm or individual, or other remedial measures. è PCAOB Release: EY LLP Page 29

31 SOX The two-paragraph Section 404 law but Page 30

32 SOX 404 Internal control system 5 How to achieve compliance? The SEC identifies the COSO framework by name as a methodology for achieving compliance. The COSO framework defines five components of internal control. COSO Committee of the Sponsoring Organizations of the Treadway Commission COSO is, globally, the most used basic model for the definition of an internal control system Page 31

33 Internal control system 6 What is the purpose of an Internal Control System? Achieving strategic business objectives Compliance with laws and regulations Protection of the business assets Prevention of reduction and identification of errors and irregularities Confidence in the reliability and completeness of record keeping/bookkeeping Timely and reliable financial reporting Effective and efficient management Page 32

34 Internal control system 6 The basic model CONTROL ENVIRONMENT RISK ASSESSMENT F U N C T I O N S BU SI NE SS UN I TS CONTROL ACTIVITIES INFORMATION & COMMUNICATION MONITORING Page 33

35 Internal control system 6 Internal control at the entity level Area Control environment Risk assessment Control activities Considering factors Key executive integrity, ethics and behavior Control consciousness and operating style Commitment to competence Board/Audit Committee governance and oversight Organizational structure, authority and responsibility HR policies and procedures Risk assessment process Mechanisms to anticipate, identify, and react to significant events Process and Procedures to identify changes in GAAP, business practices and internal control Existence of necessary policies and procedures Clear financial objectives with active monitoring Logic segregation of duties Periodic comparisons of book to actual Adequate safeguards of documents, records and assets Access controls in place Information & Communication Adequate performance reports produced Connected with business strategy Commitment of HR and finance to develop, test and monitor IT systems and programs Business continuity/disaster plan for IT Monitoring Periodic evaluations of internal controls Implementation of improvement recommendations Internal audit function established to monitor activities Page 34

36 Thank you for your attention Questions Page 35