he Sarbanes-Oxley Act of 2002 has ushered in the most sweeping changes in the accounting profession since the Securities Acts of 1933 and 1934. In order to gain insight into how this act will affect external auditors and corporate managers, we interviewed 10 people from public accounting, corporate management, the National Association of State Boards of Accountancy (NASBA) and the AICPA. They expressed their opinions on management’s and the auditor’s assessment of internal controls; requiring management to certify the financial statements; the setting of auditing standards; the “cascade” effect; the implications of audit committees’ hiring CPA firms, CEOs’ certifying reports, the systematization of Sarbanes-Oxley regulations and the act’s impact on financial reporting and on the accounting profession.

ASSESSMENT OF INTERNAL CONTROLS
Section 404 of the Sarbanes-Oxley Act requires each issuer’s annual report to include an “internal control report which shall…contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting.” In addition, section 404 requires each issuer’s auditor to attest to and report on management’s internal control assessment.

When asked about management’s requirement to assess internal controls, the interviewees were unanimous in agreeing this was a good idea. They believed this requirement would increase management’s knowledge and concern about the quality of its internal control structure, thus sending significant signals that management takes such controls very seriously.

Although most of the CPAs we interviewed reported that large companies already had internal controls in place to comply with the new reporting requirements, those controls “will require a lot more work and testing than we’ve ever performed before,” said Peterson, and “clients will need a lot more documentation than they’ve ever had before to support their assertions.”

Several interviewees questioned the cost-benefit of these documentation costs. “Additional procedures have to be performed that are not value-added,” said Michael Keane, senior vice-president and CFO of UNOVA Inc., Everett, Washington, “and they scream out bureaucracy and added costs. It will be a lot of time and effort to prove what we’ve already been doing.”

The interviewees were in agreement that management’s assessment of internal controls and the auditor’s attestation of them were positive requirements for all companies, large and small, because these requirements help protect investors. However, these new internal control mandates, initially, will be a hardship on small, publicly listed companies. For example, Ed Drosdick, partner in charge of SEC practice and high-technology practice at Moss Adams LLP, Seattle, said: “Very large companies will have the resources to deal with Sarbanes-Oxley requirements. Smaller companies will have a great deal of trouble being compliant because the cost is very large. Sarbanes-Oxley does not allow for size differences; all SEC registrants will be measured by the same yardstick.”

The group generally believed many small companies did not have the internal controls in place to comply with the new reporting requirements. In addition, they said it might not be economically feasible for some of those small companies to come into compliance. Kris Kaland, partner and director of assurance services at Clifton Gunderson LLP, Milwaukee, asked: “Does a small publicly listed company have the resources to comply with Sarbanes-Oxley? For example, does it have an audit committee? Does it have a code of ethics? Can it meet the internal control documentation requirements?” The only alternative for some small companies may be to delist. However, Kaland warned, “It takes resources to delist, too.”

CPAs who have audited small, publicly listed companies voiced concern about those for which the auditor develops audit evidence primarily through substantive testing. This approach often is used for small clients and is supported by GAAS. “Smaller companies won’t have robust internal control systems in place, yet you can sign off on the financial statements,” Drosdick said. These CPAs were concerned that section 404’s internal control requirements would call into question this audit strategy. In other words, it is possible for a client to receive a clean audit opinion while “failing” its internal control attestation. How will the marketplace interpret this?

Another small-company issue is whether a company even should go public. “Sarbanes-Oxley is going to raise the bar on access to public markets,” said Michelle Collins, chairperson of the audit committee of CDW Corp., Vernon Hills, Illinois. “It may be harder to go public, but the real challenge to smaller companies will be the costs, which will be incredibly prohibitive. The company is going to have to be a certain size and really want to go public. New companies that come out are probably going to be a lot bigger.”

Fogarty, concerned with the mechanics of an internal control attestation, said: “Although we have the COSO framework (Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control—Integrated Framework) to use as criteria in determining whether control deficiencies are significant or material weaknesses, we lack a body of experience for making these determinations comparable to what we have for making accounting decisions. It will take time to gain and interpret this experience to fill in many of the details needed to consistently make determinations about the severity of control deficiencies.”

Some interviewees were concerned that if they made a mistake in complying with the many details Sarbanes-Oxley required it would be used against them. “People don’t know what will happen to them if they violate the law,” said Bill England, partner and U.S. leader for consumer and industrial products practice and client service vice-chairman of PricewaterhouseCoopers, Chicago. “My major concern is not about our ability to comply with Sarbanes-Oxley given our company’s currently existing strong internal control systems,” Keane added. “I just hope there will not be some small regulation we’ve overlooked that will be used as a club against us.”

“CASCADE” EFFECT
The “cascade” effect is the possibility that state legislators and regulators might apply all or some portions of the act to all companies and their auditors. The AICPA responded quickly to this possible threat by forming the Special Committee on State Regulation. Working closely with state CPA societies, this high-level volunteer committee was charged with providing guidance to states that were faced with state legislative or regulatory accounting reform proposals as a result of the Sarbanes-Oxley Act. The special committee identified three overarching themes: The profession should advocate for a reasoned approach to reform at the state level, uniformity of state laws is essential to protecting the public interest and the complexity of the issues needs to be articulated and communicated. In January 2003 the committee released a compendium of white papers and issue briefs called A Reasoned Approach to Reform. A second edition was released in October 2003. During 2003 many states, faced with state legislative and regulatory reform proposals, made reference to A Reasoned Approach, which allowed the profession a seat at the negotiation table.

Another facet, said David Costello, president and CEO of NASBA, is audit partner rotation, which “is tempting for states to adopt, but would be devastating for smaller CPA firms.” Of course, the cost of applying Sarbanes-Oxley to nonpublic companies would be prohibitive for most small companies and their accountants, not to mention the disruption it could cause to the operation of many businesses. “There are potentially high costs to small and medium-sized businesses. Protecting the public interest will be expensive,” said Costello. For many nonpublic companies that regularly rely on their outside accountants for many nonaudit services, the effect could be even more severe.

“States should not overreact to the emotional issue of the day. The temptation for state government is to act quickly without regard necessarily to what other states are doing,” Costello said. “They needed a reasonable response to Sarbanes-Oxley, which NASBA developed and issued as ‘Answering the SOX Challenge: Guidelines for State Boards of Accountancy.’ NASBA task forces, comprising state board of accountancy representatives, researched, studied and developed a consensus approach to applying Sarbanes-Oxley principles at the state level. It would be easy to take Sarbanes-Oxley and apply it to all companies, but one size does not necessarily fit all. We might very well end up with 54 different approaches to this topic. We need more uniformity, not less.” Fogarty expressed concern that states would adopt dissimilar rules and companies and their auditors would have to determine which state’s rules would apply. For example, “California and New York have added to the Sarbanes-Oxley documentation requirements. There is a proliferation of rules. People are making more rules on top or rules that have not yet been implemented,” he said.

AUDIT COMMITTEE HIRES CPA FIRM
Section 301 of the Sarbanes-Oxley Act requires the audit committee of each issuer to be directly responsible for the appointment, compensation and oversight of the external auditor. The interviewees were much in favor of this requirement. They said the audit committee would be concerned that a quality audit be performed. Accordingly, they thought the audit committee’s hiring the external auditor might relieve some of the pressure on audit fees. “Having the audit committee hire the auditors is good for audit quality,” Peterson said,” because it helps prevent management from inadvertently restricting the audit scope in a desire to control costs.” Ken Zika, retired controller of Caterpillar Inc., Peoria, Illinois, added: “It is hard to measure the value of good internal controls and good financial statements. Thus, there can be pressure to perform these activities with a ‘least cost’ mind-set. So I believe that turning the hiring and firing of the external auditor and negotiation of its fees over to the audit committee is probably a good thing.” England added: “Audit committees are highly motivated to get audit risks covered and have an audit scope sufficient to cover those risks. Therefore, they are willing to pay for high-quality audit services.” However, Fogarty cautioned: “Many audit committees currently do not have complete control over directing the scope of the audit. Audit committees will need to keep moving toward this control even though they may come into conflict with management’s objectives.”

FEAR OF THE ROUTINE
Several in the group expressed concern that internal control and financial reporting structures would become systematized within a few years and render the whole process routine. “As people get accustomed to requirements, they often become complacent and lulled into comfort,” Collins said. “Regulators’ focus on internal controls may atrophy,” Fogarty added. “They need to keep these rules in the forefront and emphasize them in rhetoric and actions.”

The interviewees also believed the legislation has painted all accountants with the same broad brush. In other words several thought many were unfairly tainted by the actions of a few bad auditors. “I’m paying the price for the sins of those who were lax or who were abusing their controls,” Keane said. Zika added: “Congress has underestimated the relationship between most companies and their auditors. It has underestimated the independence that exists. In many situations there are very positive, professional relationships between companies and their auditors.” Thus, many accountants believe Sarbanes-Oxley has called into question the character of the entire accounting profession when, in fact, only a small minority of accountants may have acted unethically. Furthermore, Zika said: “The act may not go far enough in holding other people accountable. What roles have investment bankers, financial analysts, lawyers, audit committee members and boards of directors played in recent accounting scandals? They also should be held more accountable.”

Costello aptly summed up Sarbanes-Oxley’s impact: “The profession has suffered unfairly, but we must work with regulators, make Sarbanes-Oxley work and regain the public trust. We have an outstanding auditing and accounting profession in this country—the message is not getting out. Let’s fix our problems and move forward.”

WILL FINANCIAL REPORTING IMPROVE?
The interviewees unanimously agreed the legislation has many good aspects. Specifically mentioned as a good idea was the part of section 302 requiring top management to certify it had reviewed each quarterly and annual report. Furthermore, requiring management to certify that the financial statements—and other financial information included in the reports—fairly present the issuer’s financial condition, as well as the results of operations, will force management to become more engaged in the financial reporting process. Drosdick said: “The dumb CEO is no excuse any more. There will be zero tolerance. Companies must find CEOs who understand financial statements.” Keane added, “Some companies will improve their reporting, and some of their disclosures will be clearer.” In addition, the CEO and CFO must report their conclusions about the effectiveness of the internal controls in their company. The majority of interviewees believed the potential for increased discussions on the company’s internal controls by top management and the audit committee could have a positive impact on financial reporting. The independence of audit committee members and the increased involvement of the audit committee in company affairs also were cited as positive results of the legislation.

When asked whether the legislation was a panacea for improving financial reporting, the majority of interviewees said it was too early to tell. “Sarbanes-Oxley won’t eliminate all fraud,” Drosdick said. “Time will tell how much ‘good’ will come from it.” While all thought the legislation would improve the financial reporting process, several were quick to point out that financial statement fraud wouldn’t disappear. It comes down to the ethics of the people running corporations, they said. Morality and ethical behavior cannot be imposed by law. Some people will always try to do illegal things. Fogarty expressed the consensus of opinion on the Sarbanes-Oxley legislation: “The act will help. It has a good system of checks and balances. However, ‘tone at the top’ is what counts.”