In Full Bloom
Conference Fleshes Out Section 404

By Jay Dismukes

The Securities and Exchange Commission has no plans to create a separate guidance for company managements and boards to supplement the PCAOB’s Auditing Standard No. 2 on internal control attestations, even though some view the standard as a “half step” away from exceeding the board’s regulatory authority.

The SEC is not “looking toward additional rulemaking or guidance in that area,” said the Commission’s Deputy Chief Accountant Andrew D. Bailey in late April. Bailey was a guest speaker at the Foundation for Accounting Education’s April 26 Section 404 Conference and a participant in a panel discussion during which the issue arose.

The Public Company Accounting Oversight Board, which has no jurisdiction over public companies, created the internal control standard for auditors; however, as discussed at the conference, the provisions of the standard must also be met by companies’ boards and managements. But instead of an additional set of rules, Bailey indicated that it will be management’s responsibility to determine and provide the information that external auditors will need to meet Auditing Standard No. 2, “An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements.”

Management will also have to determine what it needs to do to satisfy itself that the internal controls are sufficient, which, Bailey said, could be an even higher threshold than is required by the external auditor under the SEC regulations on Section 404.

Public company executives sitting on the panel also felt that management is in the best position to make these determinations and to assess the adequacy of their internal controls.

Still, the perception that the standard could appear to extend beyond its authority is not lost on members of the PCAOB. Panel member Laura J. Phillips, assistant chief auditor for the PCAOB, noted that the board is aware that the standard is “just a half step away from indirectly setting guidance for management to an auditing standard,” and is working to ensure that this does not happen.

Caution: Winding Road Ahead

Though Bailey doesn’t foresee more rules to guide company management on documenting and testing internal controls, he said the SEC is “worried” about the independence complications that could result from the provision of Section 404 consulting services by auditing firms to nonaudit clients. Bailey cautioned company management to avoid restricting itself to one auditor by having too many other firms provide prohibitive services to the company. According to Bailey, firms that furnish prohibitive services, such as Section 404 consulting, to a company would not be considered independent and would not be able to serve as the company’s external auditor until at least one business cycle had passed.

“There is a real concern generally here to be very careful that you’re not precluding yourself from looking for another auditor because you’ve used all the others in some prohibitive way,” Bailey said.

The panel discussion continued to address other aspects of Section 404, including what will constitute a material weakness in a company’s internal controls. Phillips told the audience that Auditing Standard No. 2 includes a list of eight circumstances that are strong indicators—as opposed to presumptions—of a material weakness. One of these situations, she said, would include a material misstatement of a financial statement first identified by the outside auditor.

Given this approach, Phillips said the PCAOB recognizes that there is going to be some “stickiness” associated with these circumstances, such as when the auditor brings a material weakness to the attention of management only to be informed that the problem is already being corrected or would have been discovered had the controls been given enough time to function. If this happens, “There is a possibility in the auditor’s judgment for the auditor to conclude that it’s only a significant deficiency, not a material weakness,” Phillips said. There is not a public disclosure requirement for a significant deficiency.

The panel discussion also touched on the external auditor’s ability to use SAS 70 reports that are issued by firms not registered with the PCAOB. SAS 70 provides guidance to companies that outsource accounting tasks to service organizations and includes guidelines to auditors engaged by the service organizations to report on the internal control policies and procedures and their effectiveness.

Though this issue is unresolved and may require further staff guidance or rulings, Bailey said that the SEC currently is accepting filings from registered firms that might include materials from a nonregistered firm as long as such material falls beneath the 20 percent threshold, which takes into account total assets, revenues, fees and hours to determine whether the firm played a “substantial role” in the audit report.

The NYSSCPA’s Accounting and Auditing Oversight Committee, chaired by Robert E. Sohr, sponsored the Section 404 Conference, held in midtown Manhattan. Paul D. Warner, vice chair of the committee and head of the Accounting, Taxation and Legal Studies in Business Department of Hofstra University, chaired the conference.