Internal Control over Financial Reporting - An Investor Resource: Dec. 2004

[배원기]

Internal Control

over Financial Reporting

An Investor Resource

December 2004

Deloitte & Touche LLP

Ernst & Young LLP

KPMG LLP

PricewaterhouseCoopers LLP

“Good internal control is one of the most

effective deterrents to fraud, and therefore

we expect our standard to help protect investors

from the kinds of financial reporting scandals

that the [Sarbanes-Oxley Act] seeks to prevent.”

William McDonough

Chairman

Public Company Accounting Oversight Board

June 24, 2004

“There is no way to measure how many reporting

failures will be averted and how many investment

dollars will be saved because of the increased

attention to effective internal control systems.

Strong controls are vital to high-quality financial

reporting and essential to timely analysis. To achieve

the goals of Section 404 [of the Sarbanes-Oxley

Act], all participants in the financial reporting

process — investors, management, audit

committees, auditors, lawyers, and regulators —

must make the development of and adherence

to these systems a priority in our daily work.”

Donald T. Nicolaisen

Chief Accountant

1 Internal Control over Financial Reporting

UNDER THE SARBANES-OXLEY ACT OF 2002, U.S. public companies are now subject to new requirements for management and independent auditors to report on the effectiveness of internal control over financial reporting. Effective internal controls are fundamental to investor confidence in financial reporting because they help to deter fraud and to prevent inaccurate financial statements. With more than half of U.S. households investing in the capital markets, either directly or through retirement funds, these new requirements are expected to have a significant beneficial impact on the capital markets. One of the most visible changes that investors will notice is the new reports by management and the independent auditor on a company’s internal control over financial reporting. A primary purpose of this publication is to help investors and other financial market participants better understand and interpret these new reports, which will be provided in addition to the independent auditor’s report on the company’s external financial statements.

Effective Internal Control over Financial Reporting

Internal control over financial reporting is a process designed and maintained by a company’s management to provide reasonable assurance about the reliability of financial reporting.

Effective internal control over financial reporting is vital to the proper recording of transactions and the preparation of reliable financial reports. An effective internal control process is comprehensive and involves people at all levels throughout a company, including those who keep accounting records, prepare and disseminate policies, and monitor systems, as well as people in a variety of operating roles. In addition, the process is influenced by a company’s board of directors and its audit committee, which has responsibility for oversight of the financial reporting process. Under Section 404, a company’s management must assess the effectiveness of internal control over financial reporting as of the company’s fiscal year-end. The independent auditor will then report on management’s assessment, and on the effectiveness of the company’s internal control over financial reporting.

Why Now?

In response to the series of business failures and corporate scandals that began with Enron in 2001, Congress enacted the Sarbanes-Oxley Act of 2002, which introduced many corporate governance reforms intended to increase investor confidence in the capital markets. In June 2003, the U.S. Securities and Exchange Commission (SEC) approved rules implementing Section 404 of the Act and requiring management and the independent auditors of public companies to eval‎uate and report on the effectiveness of the company’s internal control over financial reporting. A year later, the Public Company Accounting Oversight Board (PCAOB) issued a standard that

described the related auditor attestation requirements.

Investors will see financial reports from calendar year-end companies that reflect these new requirements as early as February 2005. Compliance is required for large U.S. public companies, known as accelerated filers, in SEC annual reports on Form 10-K for fiscal periods ending on or after November 15, 2004. For other public companies, including foreign private issuers that report on Form 20-F, Section 404 is effective for fiscal years ending on or after July 15, 2005.

2 Internal Control over Financial Reporting

The SEC has recently issued a temporary exemption applicable to accelerated filers with less than $700 million in public float at the end of their 2004 second quarter, for fiscal year-ends between November 15, 2004, and February 28, 2005. These companies will have an additional 45 days beyond their Form 10-K deadline to file the new management’s assessment of internal control over financial reporting and the related auditor’s report on internal control over financial reporting. All other information required in the annual report on Form 10-K, including audited financial statements, must be filed by the original due date.

The New Reports

Section 404 institutes a new reporting model that will require management’s assessment of internal control over financial reporting and the related auditor’s report on internal control over financial reporting to be included in a company’s annual report on Form 10-K filed with the SEC. The SEC strongly encourages registrants to include the internal control reports in annual reports to shareholders as well, and has indicated that there will be rulemaking in this area. The new reports that investors will see are the following:

• Management’s report. Management will state its responsibility for maintaining adequate internal control over financial reporting and give its assessment of whether or not internal control over financial reporting is effective. According to the rules, management cannot state that internal control over financial reporting is effective if even one material weakness exists at year-end.

• Auditor’s report. The independent auditor will eval‎uate and report on the fairness of management’s assessment. The auditor also will perform an independent audit of internal control over financial reporting and will issue an opinion on whether internal control is operating effectively as of the assessment date (i.e., the company’s fiscal year-end). If one or more material weaknesses exist at the company’s fiscal year-end, the auditor cannot conclude that internal control over financial reporting is effective.

As in the past, the independent auditor will also issue an opinion on whether the company’s published financial statements are presented fairly in all material respects in accordance with generally accepted accounting principles. This report may be combined with the auditor’s report on internal control over financial reporting, or it may be presented separately.

Benefits of the New Internal Control Reporting

The new requirements will enhance companies’ internal control over financial reporting by enabling more timely identification and remediation of weaknesses. Many believe that through the creation of an ongoing management requirement, companies will learn from their eval‎uation process and remediate identified deficiencies on an ongoing basis, which should result in more reliable financial reporting and greater investor confidence.

3 Internal Control over Financial Reporting

Even with these new requirements in place, it is possible that management fraud or errors will occur and not be detected. Internal control over financial reporting is intended to provide reasonable assurance about the reliability of financial reporting. This is a high level of assurance, but it is not absolute. As the PCAOB standard recognizes, no system of internal control is absolutely safe from human error or from manipulation and collusion. Even effective internal control over financial reporting cannot offer absolute assurance that a company is free of fraud or that misstatements in financial reporting will always be prevented or detected on a timely basis. Investors and other financial statement users should also understand that the reports on internal control over financial reporting issued by management and the independent auditor do not provide any form of assurance on the soundness of a company’s business strategies or its ability to achieve financial goals.

Control Deficiencies and What They Mean

When an internal control deficiency is identified, management and the independent auditor will eval‎uate its significance and determine whether it constitutes a control deficiency, a significant deficiency, or a material weakness. Deficiencies that are less serious than a material weakness (i.e., control deficiencies and significant deficiencies) are required to be disclosed to the audit committee and/or management, and management and the independent auditor must eval‎uate less serious weaknesses to determine whether, when taken together, they result in a material weakness. All identified material weaknesses that exist at the company’s fiscal year-end must be disclosed in the public reports issued by management and the auditor. Although not required by Section 404, some companies may also choose to disclose significant deficiencies. If one or more material weaknesses exist at the company’s fiscal year-end, management and the auditor must conclude that internal control over financial reporting is not effective. The PCAOB has defined a material weakness as a “significant control deficiency, or combination of deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected.” A material weakness does not mean that a material misstatement has occurred or will occur, but that it could occur. Although the law and rules require that management disclose material weaknesses, they provide no specific guidance about the content of those disclosures. However, both the SEC chief accountant and the PCAOB chairman have stated publicly that they expect management’s report to disclose the nature of any material weakness, in sufficient detail to enable investors and other financial statement users to understand the weakness and eval‎uate the circumstances underlying it. The PCAOB standard also requires that the independent auditor’s report provide specific information about the nature of any material weakness and the actual and potential effect on the company’s financial statements. Investors and other financial statement users should eval‎uate each material weakness to understand the nature, cause, and potential implications of the weakness.

4 Internal Control over Financial Reporting

SEC Chief Accountant Donald T. Nicolaisen has publicly commented that preliminary reactions from investor groups indicate that not all material weaknesses will be viewed as equally significant: “Some material weaknesses may have a greater or lesser impact on an investor’s decision-making process. In many cases, this decision will likely be influenced by the fullness of management’s disclosure, the underlying causes of the material weakness, and management’s actions to address the material weakness. This is intended to be an open process whereby investors can eval‎uate both the weakness as well as management’s actions to improve controls.”

Can a Company Have a Reported Material Weakness in Internal Control over Financial Reporting with a “Clean” Financial Statement Opinion?

A company can report a material weakness in internal control over financial reporting and still receive an unqualified, or “clean,” financial statement opinion from the independent auditor. Whether management or the auditor identifies a material weakness, management continues to be responsible for the preparation of complete and accurate financial statements. Therefore, management should take whatever steps are necessary to compensate for the material weakness in the financial statement preparation process. By expanding the scope of testing of account balances or altering the audit approach in the area of weakness, the auditor may be able to conclude that the company’s financial statements are fairly stated and thus issue an unqualified opinion.

Effect on a Company’s Stock Price and Other Market Determinants

Internal control reporting provides additional information to the marketplace. The expectation is that underwriters, analysts, rating agencies, lenders, and other market participants will consider internal control reporting in their analysis and eval‎uation processes.

For More Information

Deloitte & Touche LLP: www.deloitte.com Ernst & Young LLP: www.ey.com KPMG LLP: www.kpmg.com PricewaterhouseCoopers LLP: www.pwc.com For additional details on the new Section 404 reports on internal control over financial reporting and further discussion of their meaning and implications, see also http://www.s-oxinternalcontrolinfo.com for a companion guide published by the Firms, “Perspectives on Internal Control Reporting: A Resource for Financial Market Participants.”

Roles and Responsibilities – Internal Control over Financial Reporting

Management.

Designs and implements the system of internal control over financial reporting; eval‎uates the effectiveness of the company’s internal control over financial reporting and provides a public report on that assessment; prepares the financial statements.

Audit Committee. Has responsibility for oversight of the company’s financial reporting process.

Independent Auditor. Performs an audit of internal control over financial reporting and issues a report on management’s assessment of internal control over financial reporting and on the effectiveness of internal control over financial reporting; also performs an audit of the company’s financial statements.

What Management’s Report Will Include

Under the SEC rules, management’s report on internal control over financial reporting should include the following information:

• Statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting.

• Statement identifying the framework used by management to eval‎uate the effectiveness

of internal control over financial reporting.

• Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year, including an explicit statement as to whether that control is effective and disclosing any material weakness identified by management in that control.

• Statement that the registered public accounting firm that audited the financial statements included in the annual report has issued an attestation report on management’s internal control assessment.

The Independent Auditor’s Opinion

The content of the auditor’s report is prescribed by the PCAOB standard, and there are many nuances to the auditor’s reporting. The most common opinions on the effectiveness of internal control over financial reporting will be:

• Unqualified Opinion. An opinion that internal control over financial reporting is effective: no material weaknesses in internal control over financial reporting exist as of the fiscal year-end assessment date.

• Adverse Opinion. An opinion that internal control over financial reporting is not effective: one or more material weaknesses exist as of the fiscal year-end assessment date.

• Disclaimer of Opinion. A report stating that restrictions on the scope of the auditor’s work prevent the auditor from expressing an opinion on the company’s internal control over financial reporting. Intern

Internal Control over Financial Reporting

An Investor Resource

December 2004

Deloitte & Touche LLP

Ernst & Young LLP

KPMG LLP

PricewaterhouseCoopers LLP

Copyright © 2004 by Deloitte & Touche LLP, Ernst & Young LLP, KPMG LLP, and PricewaterhouseCoopers LLP.

These materials may be freely distributed provided that this copyright statement and any other similar attribution contained herein are included in their entirety. This publication is furnished for informational purposes only. Its content has been derived from many sources, both within the Firms and external to them. However, it does not provide any authoritative guidance nor should it form the basis for any investment decision.  Recipients of this publication should not rely on it as a complete explanation of the law or rules governing this area or as legal advice. This publication speaks only as of the date of its release (December 21, 2004), and the information included herein is subject to change without notice.