SEC and PCAOB Issue SOX 404 Action Plans

By:  Cydney Posner

Right on the heels of the SOX 404 roundtable, the SEC today announced its  next steps for implementation of SOX 404. The intended actions involve SEC guidance for companies, revisions by the PCAOB of AS2, SEC inspections of PCAOB oversight efforts (i.e., inspections of the inspectors--your government at work) and another very brief postponement of the compliance date for small public companies to fiscal years beginning on or after December 16, 2006. The SEC was clear that "ultimately all public companies will be required to comply with the internal control reporting requirements of Section 404." At the same time, the PCAOB also announced a  plan to improve auditors’ implementation of SOX 404. Most of the steps planned are specifically responsive to comments from panelists at the SOX 404 roundtable (See my posting 5/12/06.).

SEC

More specifically, the SEC's next steps include:

• Guidance for Companies. The SEC intends to provide guidance to management on implementation of SOX 404, including:
  • Concept Release and Opportunity for Public Comment. The first step will be a Concept Release, which will be submitted for public comment, covering issues that might be the subject of SEC guidance for management. The SEC will also seek input on the "appropriate role of outside auditors...to assist in our consideration of possible alternatives to the current approach." (Query whether the SEC intends to consider elimination of the AS2 requirement that auditors "audit" internal controls and not just provide an attestation on management's assessment, as required by SOX 404(b)?)
  • Consideration of Additional Guidance from COSO. The SEC anticipates that COSO's forthcoming guidance addressing the needs of smaller companies will help organizations of all sizes to better understand and apply the control framework. In developing its guidance, the SEC will also consider the extent to which the additional guidance that COSO provides is useful to smaller public companies in completing their SOX 404(a) assessments.
  • Issuance of Guidance. The SEC plans to issue guidance to management to assist in its performance of a top-down, risk-based assessment of internal control that is intended to be scalable and responsive to the individual circumstances of smaller public companies. Presumably in response the comment from several panelists at the recent SOX 404 roundtable that the SEC should make as few changes as possible, the SEC notes that the guidance will also be "sensitive to the fact that many companies have already invested substantial resources to establish and document programs and procedures to perform their assessments over the last few years." The SEC has not yet determined the precise form of the guidance.
• Revisions to Auditing Standard No. 2. The SEC will work closely with the PCAOB to ensure that the proposed revisions to AS2 are "in the public interest and consistent with the protection of investors." The proposed revisions to AS2, which would be subject to SEC approval, would:
  • Seek to ensure that auditors focus during integrated audits on areas that pose higher risk of fraud or material error;
  • Incorporate key concepts contained in the PCAOB's May 2005 guidance (see my email of 5/17/05); and
  • Revisit and clarify the role, if any, of the auditor in evaluating the company's process of assessing internal control effectiveness.
• SEC Oversight of PCAOB Inspection Program. As the PCAOB previously announced, it intends to focus its 2006 audits on audit efficiencies and compliance with its May and November guidance. (See my email of 5/2/06.) Among other things, upon completion of the PCAOB's 2006 inspections, the SEC will examine the effectiveness of the PCAOB inspections in encouraging implementation of the May guidance.
• Extension of Compliance Date for Non-Accelerated Filers. To allow non-accelerated filers to be able to evaluate and implement all of these changes, the SEC expects to issue a short postponement of the SOX 404 implementation date for non-accelerated filers. The SEC anticipates that the postponement would require all filers to comply with the management assessment required by SOX 404(a) for fiscal years beginning on or after Dec. 16, 2006. (Note that SOX 404(a) requires the management report, not the auditors' attestation.)

Meanwhile, the PCAOB announced a four-point plan to improve auditors’ implementation of SOX 404, including:

• Amend Auditing Standard No. 2. AS2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with An Audit of Financial Statements," establishes the professional standards for auditors when conducting an audit of internal control over financial reporting. The PCAOB intends to maintain the general principles of AS2, but plans to consider amendments that would ensure that auditors’ primary focus is on areas involving higher risk of fraud or material error and that incorporate key concepts contained in the May guidance (designed to reinforce the PCAOB's expectations of efficiency in the audit process). The PCAOB also plans to "revisit and clarify the auditor's role, if any, with respect to evaluation of the process that a company uses to reach its own conclusion about the effectiveness of company controls." (Emphasis added.)

Additional amendments to AS2 under consideration include:

• Clarifying the definitions of "significant deficiency" and "material weakness";
• Reconsidering the "strong indicators of a material weakness" to allow the exercise of more judgment;
• Guiding auditors to increase their use of the work of others where appropriate;
• Clarifying materiality and scoping decisions;
• Emphasizing the integration of the audit of internal control with the audit of the financial statements; and
• Allowing for and promoting auditors’ use of experience gained in previous years’ audits to focus and make most efficient the work in subsequent years. (Is this the end of "each year must stand on its own"? Would this change allow rotational testing?)

The PCAOB confirmed that the effective date for any amendments will minimize unnecessary disruption to ongoing audits.

• Reinforce auditor efficiency through PCAOB inspections. As the PCAOB previously stated in May 2006, the PCAOB’s 2006 inspections of registered public accounting firms will focus on the firms’ efficiency in conducting internal control audits. The PCAOB notes that it "welcomes" the SEC’s plan "to inspect its inspectors’ implementation" of the May 2006 statement.
• Guidance and Education for Auditors of Small Companies. The PCAOB plans to develop or facilitate development of "implementation guidance" and to facilitate opportunities for training of auditors of smaller public companies.
• Continue PCAOB Forums on Auditing in the Small Business Environment. The PCAOB will hold eight forums during 2006 for auditors, directors and financial officers of smaller public companies, designed to provide general education and to allow the PCAOB to monitor reaction to internal control implementation changes.