Citing the beneficial effect of PCAOB Audit Standard No. 5, global audit firms have urged the SEC not to recommend extending the exemption from Sarbanes-Oxley Section 404(b) auditor attestation of internal controls to companies with market capitalization between $75 and $250 million. While recognizing that there is a cost to conducting an audit of a company's internal controls, the audit firms believe that both issuers and investors have benefited from the auditor's involvement in reporting on internal controls. In letters to the SEC, they also noted that the cost of auditing internal controls has declined dramatically since the PCAOB’s adoption of AS 5, the Board’s guidance on audits of smaller companies, and the issuance of SEC guidance for companies conducting assessment of their internal controls. The Center for Audit Quality cautioned that permanently exempting another tier of companies from 404(b) beyond the Dodd-Frank $75 million float exemption could confuse investors and may even undermine their confidence in the quality of financial reporting.
Sarbanes-Oxley Section 404(a) requires companies to include in their annual reports management's assessment of the company's internal controls; Section 404(b) requires the company's auditor to attest to, and report on, management's assessment of the effectiveness of the internal controls. Section 989G of Dodd-Frank exempts companies with a public float of less than $75 million from 404(b) and requires the SEC to conduct a study and report to Congress on how the Commission can reduce the burden of complying with the auditor attestation requirement of 404(b) for companies whose public float is between $75 million and $250 million, while maintaining investor protections for such companies. The study must specifically determine if an expanded exemption would encourage companies doing an IPO to list on a US exchange.
In letters to the SEC, Ernst & Young and Deloitte & Touche said that reporting under Section 404 provides investors with meaningful information regarding a company's internal control over financial reporting. They also noted that the required independent audit of management's assessment of the effectiveness of ICFR has been integral to the achievement of the intended objectives of internal reporting under Sarbanes-Oxley. Deloitte cautioned that it would not be prudent to roll back existing internal control requirements for a population of issuers that are currently complying with Section 404(b).
The audit firms also observed that AS 5, which replaced the more prescriptive AS 2, has improved the audit of internal controls by better enabling auditors to focus their efforts on those areas that were critical to a company's internal controls, utilize their judgment in the design and performance of audit procedures, and tailor the audit to a company's particular facts and circumstances. In addition, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued guidance related to the application of its internal control framework in smaller public companies. E&Y noted that investors have benefited from the auditor's involvement at companies with market capitalization between $75 and $250 million, which is particularly meaningful given that smaller public companies are typically more susceptible to financial reporting fraud.
Addressing congressional concerns about the impact of 404(b) on IPOs, Grant Thornton noted that any intention to increase IPOs in the U.S. by reducing the initial requirements for auditor attestation would negate the original intent and spirit of Section 404. In fact, continued GT, financial reporting crises often result in a debilitating impact on public listings on exchanges that are not grounded in sound and transparent financial reporting and governance standards.
In its letter to the SEC, the Center for Audit Quality (CAQ) spoke of the benefits and cost trends of Section 404(b), as well as concerns related to the Section 404(b) exemptions and recommendations to reduce the compliance burden. Grant Thornton fully supports the views expressed by CAQ that it would not be prudent to roll back existing internal control requirements that are currently being complied with by smaller public companies.
Section 404 says that management should be in a position to tell investors that it is responsible for internal control over financial reporting, and perform reasonable procedures to evaluate the effectiveness of those controls. It further indicates that independent auditors should be able to perform reasonable audit procedures to tell investors that, in their opinion, management’s assertions are accurate. In GT’s vierw, eliminating those reasonable expectations are not in the best interest of investors or companies. All companies that use the public’s money should give investors the confidence in their financial reporting systems that they demand and deserve. In this regard, GT strongly believes that the benefits of 404(B) outweigh the costs.
There was also a consensus among the audit firm community that a further benefit of 404(b) has been improvements to corporate governance. For example, CAQ noted that auditors are required to communicate to the audit committee all significant deficiencies and material weaknesses in internal controls that have been identified during the audit. PCAOB AS 5 enhances the ability of auditors to detect weaknesses and therefore have a basis to make such communications, specifically regarding significant deficiencies.
According to CAQ, rhis communication fosters important discussions about internal controls among management, the audit committee, and the auditor including any remediation efforts. In turn, these discussions enhance the audit committee’s oversight of the internal controls process, which fosters improvements to the quality of a company’s financial reporting.
Beyond AS 5 and existing Board guidance, the commenters set forth recommendations for further improvement. Ernst & Young noted that as a result of its inspections of 2007 audits, the PCAOB issued a report in 2009 related to its observations on the first year implementation of AS 5. As that report was focused only on the first year of implementation, E&Y urged the PCAOB to publish observations on how the implementation in 2008 and 2009 has progressed relative to its expectations when AS 5 was issued. Such information might enable auditors to continue to adjust their internal controls procedures to further improve the effectiveness and efficiency of the audit of internal controls.
CAQ urged the PCAOB to develop best practices on the auditing of internal controls. The Board is in a unique position where its inspection teams might identify efficient audit approaches that could be vetted with its standards-setting staff to identify best practices for AS 5 audits. If the PCAOB were to identify any best practices that both the standard-setting and inspection staffs agreed were in accordance with AS 5, said CAQ, auditors could make appropriate adjustments and refinements to their internal controls procedures.
Section 989G of Dodd-Frank was co-authored by Rep. Scott Garrett (R-NJ), the incoming Chair of the House Capital Markets Subcommittee. Rep. Garrett has expressed concern that the compliance burdens of Section 404(b) may be chilling IPOs on US exchanges.