By James Hamilton, J.D., LL.M.
The SEC has approved the PCAOB's new audit standard on internal controls and the key components are in place to reform the internal control mandates of Section 404 of Sarbanes-Oxley. Only time will tell if the joint SEC-PCAOB actions, the SEC concomitantly issued management guidance, will reduce the costs of compliance while preserving investor protection and the accuracy of corporate financial statements.
SEC Chairman Cox has noted that Section 404 has posed the single biggest challenge to companies under the entire Act. Without question, it has imposed the greatest costs, he noted, but it has also contributed significantly to more reliable financial reporting as companies improved their internal controls to meet the statutory requirements
With Congress closely watching, the SEC and PCAOB worked together to create a new risk-based, principles-based regime for reporting on the effectiveness of internal control over financial reporting. Section 404 remains unchanged, but the rules, guidance, and standards promulgated pursuant to the statute have been reformed in response to concerns that internal controls compliance was overly costly and harmful to the competitiveness of U.S. financial markets. The reforms build on the guidance issued by the SEC and PCAOB in May of 2005.
The SEC issued management guidance and amended a number of internal controls rule. For its part, the PCAOB adopted a new Auditing Standard No. 5 on the audit of internal control over financial reporting, to replace Auditing Standard No. 2, and adopted a rule requiring audit committee pre-approval of non-audit internal control services.
Chairman Cox has pledged to analyze real-world information to determine that the costs and benefits of implementing section 404 are in line with SEC expectations. In addition, through SEC oversight of the PCAOB's inspection program, the Commission will monitor whether audit firms are implementing Auditing Standard No. 5 in a manner designed to achieve the intended results of audit efficiency and cost reduction and whether the PCAOB is inspecting audit firms in a manner consistent with expectations.
New AS5 will become effective for audits of fiscal years ended on or after November 15, 2007. However, it is important to note that the SEC allows early adoption of the new standard. In fact, the SEC staff encourages early adoption by auditors so that issuers and investors can begin to benefit from the improvements that have been made relative to effectiveness and efficiency in the conduct of internal control audits.
The Commission’s recent amendments to Regulation S-X become effective on August, 2007 and the SEC will begin accepting the single auditor’s attestation report on the effectiveness of internal control over financial reporting prescribed in Auditing Standard No. 5 in timely filings received starting on that date.
The SEC and the PCAOB really tried to get on the same page with this reform, and I think they succeeded in doing so. For example, the definition of significant deficiency adoped the SEC is the same as that in AS5.