EXECUTIVE SUMMARY

BEGINNING IN 2004, MANY PUBLICLY traded companies must comply with SEC rules by reporting on the effectiveness of their internal controls in the annual report. The content should contain A statement of management’s responsibilities for establishing and maintaining an adequate system. The identification of the framework used to evaluate the internal controls. A statement as to whether or not the internal control system is effective as of yearend. The disclosure of any material weaknesses in the system. A statement that the company’s auditors have issued an audit report on management’s assessment. AS COMPANIES EVALUATE THEIR internal control systems, senior management, with input from CPAs, must determine whether there are any material weaknesses and if so, what they should report. MANAGEMENT MUST REPORTON ITS system’s effectiveness as of a point in time rather than over a span of time, raising the question of what to disclose when a material weakness had been identified and corrected prior to yearend. Management will judge what is a “sufficient period of time” to prove corrections or new procedures are effective. New controls must be tested and the evidence sufficient for management to reach a conclusion.

MICHAEL RAMOS is the author of How to Comply with Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control, published by John Wiley & Sons in January 2004. And he has written numerous articles for the AICPA on Sarbanes-Oxley section 404, including “SOX 404 Consulting: Where to Begin,” available on the AICPA private companies practice section Web site, www.pcps.org; “SOX 404 Compliance: A Structured Approach,” published in the January 2004 issue of the Practicing CPA and available at www.aicpa.org; and “Evaluate the Control Environment,” published in the May issue of the Journal of Accountancy. Mr. Ramos’ e-mail address is michaeljramos@mac.com.

eginning in 2004, many publicly traded companies must comply with new SEC rules issued under section 404 of the Sarbanes-Oxley Act and include in their annual reports (Forms 10–K or 10-KSB) a discussion of the effectiveness of their internal control over financial reporting. (The November 15, 2004, effective date applies to “accelerated filers,” which generally are companies whose market value exceeds $75 million. Nonaccelerated filers and foreign private issuers have until July 15, 2005, to file their first internal control report.) Management should include this report near the section on management’s discussion and analysis or immediately preceding the financial statements.

Management will find preparing the internal control report a challenge, particularly when there are internal control deficiencies. Whether they are part of senior management that signs the internal control report, or act as advisers, cpas—in roles other than auditor—still are critical to assessing the reporting implications of such deficiencies. This article provides guidance to help CPAs effectively fulfill this role.

The SEC rules (www.sec.gov/rules/final.shtml, release no. 33-8238) require that the report a company files annually on its internal control systems contain the following elements:

A statement of management’s responsibilities for establishing and maintaining an adequate system.

The identification of the framework used to evaluate the internal controls.

A statement as to whether the internal control system is effective as of yearend.

The disclosure of any material weaknesses in the internal control system.

A statement that the company’s external auditors have issued an audit report on management’s assessment of its internal controls.

The SEC rules do not prescribe specific language for these reports. Rather, the intent is that management will craft its report in a way that is most appropriate for the company’s unique circumstances. Exhibit 1 is a sample management report that contains the SEC-required elements. Exhibit 2 provides language that may be used when management has identified material weaknesses. As shown in exhibit 2, when a material weakness exists as of yearend, management is precluded from stating that internal control is effective.

Significantly, the SEC rules do not provide a definition of “material weakness.” Rather, they state that they cross-reference their rules to the definition that is provided in the auditing standards, as set by the Public Company Accounting Oversight Board (PCAOB). For this reason, CPAs working with senior management should have a working knowledge of the auditing standards if they are to be successful in helping to evaluate and report on internal control.

INTERNAL CONTROL DEFICIENCIES
As entities document and test their internal controls, deficiencies in the system are bound to be identified. As these deficiencies come to light, CPAs need to be informed of them as quickly as possible so they can assess the magnitude of the deficiency and take appropriate corrective action. When evaluating internal control deficiencies, two significant issues are most likely to surface:

Does the deficiency—or the aggregation of deficiencies—rise to the level of a “material weakness” that must be disclosed and which will preclude the company from issuing a “clean” internal control report?

What should a company report when it has identified and corrected a material weakness prior to yearend?

A company’s financial reporting process must enable it to capture, record, process, summarize and report financial data. An internal control deficiency is a flaw in either the design or operation of a control policy or procedure that has a negative effect on this process.

It is relatively easy to reach a consensus on deficiencies that lie toward either end of the spectrum (see “Internal Control Deficiencies”). For example, suppose a company had no procedures for counting its inventory of office supplies at yearend. Most people involved in the financial reporting process probably would agree this lack of a control procedure, which could result in a misstatement of office expenses, lies toward the far left—that is, inconsequential—of the continuum. On the other hand, suppose inventory is a significant financial statement line item but there are no policies or procedures to conduct a physical inventory count—ever. The company never has counted its inventory of goods available for sale. Again, it should be fairly easy to reach a consensus that this deficiency in procedures is toward the far right—material—of the continuum. Therefore, it is in the middle of the spectrum where borderline problems arise, giving rise to the question: At what point does a deficiency cross the line from inconsequential to significant and from there to material weakness?

CPAs can help senior management answer this question by breaking it down into its component parts, namely:

What would be the significance if, for example, a company’s office supply expenses were misstated?

What are the chances that, for example, the deficiency would result in failure to detect a financial statement error, taking into account any “compensating controls” designed to achieve the same control objective?

Ultimately, the determination of the severity of an internal control flaw is based on the answers to both questions.

As stated previously, it is the auditing literature that defines material weakness and describes its component parts. Exhibit 3 summarizes this guidance. As shown in the exhibit, a material weakness is a deficiency in which there is a likelihood (more than remote) that a significant (material) financial statement misstatement will not be prevented or detected on a timely basis.

Exhibit 3: Evaluating Internal Control Deficiencies

As shown in this diagram, internal control deficiencies must be evaluated along two dimensions to determine their relative significance. Those two dimensions are likelihood and significance, depicted here along the horizontal and vertical axes, respectively. If there is more than a remote chance (likelihood) that a material error (significance) could result from the deficiency, then it is considered a material weakness, which must be reported. PCAOB Auditing Standard no. 2 changes the criteria for determining the relative significance of an internal control deficiency, as summarized above. Both company management and its external auditors should use this new definition to assess identified control deficiencies. The new definition does not change the significance factor, but it does alter the threshold for assessing the likelihood of the misstatement.

CHANGES MADE BY THE NEW AUDITING RULES
PCAOB Auditing Standard no. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements, made a subtle but significant change to the previously established definition of material weakness. Under the new standard, a material weakness exists if the likelihood of a material error is “more than remote.” Under the previous standard, the threshold was defined as “greater than a relatively low risk.”

Additionally, the new standard lists several circumstances, each of which is a strong indicator that a material weakness exists (see exhibit 4 for this list). Previous standards included no such list.

During the exposure period for the new standard, many CPAs expressed concern that the definition would require companies to designate and report more internal control weaknesses as material than they would have under the previous standard. As companies begin to file their internal control reports, it remains to be seen whether this concern will be realized.

WHAT TO DISCLOSE
In the event that a company determines a material weakness exists at yearend, it must disclose this fact. Historically, in these situations, a company’s annual report has included

The fact that management has identified a material weakness in its internal control over financial reporting.

A definition of, or reference to the definition of, “material weakness.”

The actions taken by company management to correct the deficiency.

The SEC reporting rules under Sarbanes-Oxley do not prescribe any different format or other requirements.

REPORTING AFTER MATERIAL WEAKNESS CORRECTIONS
The SEC requires management to report on the effectiveness of its internal control system as of a point in time rather than for a span of time. This “as of” reporting requirement raises the question of what management should conclude about internal control effectiveness at yearend when earlier it had identified a material weakness and corrected it prior to yearend. Would it be appropriate for management to conclude that controls were effective at yearend, even though a material weakness had been identified earlier?

The answer is “yes,” assuming the material weakness has been corrected and the new policy or procedure has been in place for a sufficient period of time and is operating effectively at yearend. Determining what constitutes a “sufficient period of time” will require the exercise of professional judgment. Matters to be considered when making this determination include the following.

Nature of the control objective. Some control objectives are transaction-oriented and narrowly focused, and have a direct effect on the financial statements—for example, a bank reconciliation and the matching of vendor invoices to an approved vendor list. Other control objectives are control-environment-oriented, affect the entity broadly and have only an indirect effect on the financial statements—for example, management’s philosophy and operating style and the entity’s hiring practices.

In general, because of their indirect effect on the financial statements and their ability to influence the effectiveness of other controls, corrections to the control environment should be in place and demonstrating they are operating effectively for a much longer period of time than corrections to controls that are more transaction-oriented.

Nature of the correction. Some corrections may be programmed into the information-processing system to remedy a control deficiency. The company programs its system to generate an exception report. Assuming the entity has effective computer general controls, the computer performs the same task consistently for an indefinite period of time. Thus, the reprogrammed application may need to be operational for only a relatively short period of time before management can draw a reliable conclusion about its effectiveness.

However, when a correction cannot be programmed but instead depends on the continued involvement of one or more persons, it should operate effectively for a longer period of time before management can reach a reliable conclusion. Unlike a computer application, the performance of a person might vary and must be proven to be correct over a longer period of time.

Frequency. Some control procedures are performed frequently—for example, the authentication of credit card information for all online customers who purchase goods. Other procedures are performed less frequently—for example, the review of period-end journal entries. When control procedures are performed frequently, it takes less time to have enough sample transactions to draw a reliable conclusion. For credit card authorization, the control procedure may be performed thousands of times in just a few days. On the other hand, if management’s review of journal entries is performed only once a month, the procedure may need to be in place for several months before there is enough evidence to assess its effectiveness.

Ultimately, taking steps to correct a control deficiency and then waiting a certain amount of time are not sufficient for management to conclude a problem no longer exists. New controls must be tested and the evidence from these tests must be sufficient to enable management to reach a conclusion about their effectiveness.

PRACTICAL TIPS TO REMEMBER

Obtain a good, working definition of material weakness. When designing your tests of internal control, make sure they are sufficient to detect a material weakness. Test internal controls as far in advance of yearend as possible, and correct any identified weaknesses quickly. If you take action early, you may be able to avoid disclosing a material weakness in your annual report. Draft the internal control report in a way that reflects the unique circumstances at the company.

GET STARTED EARLY
The “as of” reporting requirements under Sarbanes-Oxley provide an important incentive for company management to identify and correct internal control weaknesses on a timely basis. CPAs with a significant stake in the internal control evaluation, testing and reporting process should impress upon senior management the benefits of getting a quick, substantial start to Sarbanes-Oxley section 404 compliance projects.