|
Internal Control
over Financial Reporting
An Investor Resource
December 2004
Deloitte & Touche LLP
Ernst & Young LLP
KPMG LLP
PricewaterhouseCoopers LLP
“Good internal control is one of the most
effective deterrents to fraud, and therefore
we expect our standard to help protect investors
from the kinds of financial reporting scandals
that the [Sarbanes-Oxley Act] seeks to prevent.”
William McDonough
Chairman
Public Company Accounting Oversight Board
June 24, 2004
“There is no way to measure how many reporting
failures will be averted and how many investment
dollars will be saved because of the increased
attention to effective internal control systems.
Strong controls are vital to high-quality financial
reporting and essential to timely analysis. To achieve
the goals of Section 404 [of the Sarbanes-Oxley
Act], all participants in the financial reporting
process — investors, management, audit
committees, auditors, lawyers, and regulators —
must make the development of and adherence
to these systems a priority in our daily work.”
Donald T. Nicolaisen
Chief Accountant
1 Internal Control over Financial Reporting
UNDER THE SARBANES-OXLEY ACT OF 2002,
Effective Internal Control over Financial Reporting
Internal control over financial reporting is a process designed and maintained by a company’s management to provide reasonable assurance about the reliability of financial reporting.
Effective internal control over financial reporting is vital to the proper recording of transactions and the preparation of reliable financial reports. An effective internal control process is comprehensive and involves people at all levels throughout a company, including those who keep accounting records, prepare and disseminate policies, and monitor systems, as well as people in a variety of operating roles. In addition, the process is influenced by a company’s board of directors and its audit committee, which has responsibility for oversight of the financial reporting process. Under Section 404, a company’s management must assess the effectiveness of internal control over financial reporting as of the company’s fiscal year-end. The independent auditor will then report on management’s assessment, and on the effectiveness of the company’s internal control over financial reporting.
Why Now?
In response to the series of business failures and corporate scandals that began with Enron in 2001, Congress enacted the Sarbanes-Oxley Act of 2002, which introduced many corporate governance reforms intended to increase investor confidence in the capital markets. In June 2003, the U.S. Securities and Exchange Commission (SEC) approved rules implementing Section 404 of the Act and requiring management and the independent auditors of public companies to evaluate and report on the effectiveness of the company’s internal control over financial reporting. A year later, the Public Company Accounting Oversight Board (PCAOB) issued a standard that
described the related auditor attestation requirements.
Investors will see financial reports from calendar year-end companies that reflect these new requirements as early as February 2005. Compliance is required for large U.S. public companies, known as accelerated filers, in SEC annual reports on Form 10-K for fiscal periods ending on or after November 15, 2004. For other public companies, including foreign private issuers that report on Form 20-F, Section 404 is effective for fiscal years ending on or after July 15, 2005.
2 Internal Control over Financial Reporting
The SEC has recently issued a temporary exemption applicable to accelerated filers with less than $700 million in public float at the end of their 2004 second quarter, for fiscal year-ends between November 15, 2004, and February 28, 2005. These companies will have an additional 45 days beyond their Form 10-K deadline to file the new management’s assessment of internal control over financial reporting and the related auditor’s report on internal control over financial reporting. All other information required in the annual report on Form 10-K, including audited financial statements, must be filed by the original due date.
The New Reports
Section 404 institutes a new reporting model that will require management’s assessment of internal control over financial reporting and the related auditor’s report on internal control over financial reporting to be included in a company’s annual report on Form 10-K filed with the SEC. The SEC strongly encourages registrants to include the internal control reports in annual reports to shareholders as well, and has indicated that there will be rulemaking in this area. The new reports that investors will see are the following:
• Management’s report. Management will state its responsibility for maintaining adequate internal control over financial reporting and give its assessment of whether or not internal control over financial reporting is effective. According to the rules, management cannot state that internal control over financial reporting is effective if even one material weakness exists at year-end.
• Auditor’s report. The independent auditor will evaluate and report on the fairness of management’s assessment. The auditor also will perform an independent audit of internal control over financial reporting and will issue an opinion on whether internal control is operating effectively as of the assessment date (i.e., the company’s fiscal year-end). If one or more material weaknesses exist at the company’s fiscal year-end, the auditor cannot conclude that internal control over financial reporting is effective.
As in the past, the independent auditor will also issue an opinion on whether the company’s published financial statements are presented fairly in all material respects in accordance with generally accepted accounting principles. This report may be combined with the auditor’s report on internal control over financial reporting, or it may be presented separately.
Benefits of the New Internal Control Reporting
The new requirements will enhance companies’ internal control over financial reporting by enabling more timely identification and remediation of weaknesses. Many believe that through the creation of an ongoing management requirement, companies will learn from their evaluation process and remediate identified deficiencies on an ongoing basis, which should result in more reliable financial reporting and greater investor confidence.
3 Internal Control over Financial Reporting
Even with these new requirements in place, it is possible that management fraud or errors will occur and not be detected. Internal control over financial reporting is intended to provide reasonable assurance about the reliability of financial reporting. This is a high level of assurance, but it is not absolute. As the PCAOB standard recognizes, no system of internal control is absolutely safe from human error or from manipulation and collusion. Even effective internal control over financial reporting cannot offer absolute assurance that a company is free of fraud or that misstatements in financial reporting will always be prevented or detected on a timely basis. Investors and other financial statement users should also understand that the reports on internal control over financial reporting issued by management and the independent auditor do not provide any form of assurance on the soundness of a company’s business strategies or its ability to achieve financial goals.
Control Deficiencies and What They Mean
When an internal control deficiency is identified, management and the independent auditor will evaluate its significance and determine whether it constitutes a control deficiency, a significant deficiency, or a material weakness. Deficiencies that are less serious than a material weakness (i.e., control deficiencies and significant deficiencies) are required to be disclosed to the audit committee and/or management, and management and the independent auditor must evaluate less serious weaknesses to determine whether, when taken together, they result in a material weakness. All identified material weaknesses that exist at the company’s fiscal year-end must be disclosed in the public reports issued by management and the auditor. Although not required by Section 404, some companies may also choose to disclose significant deficiencies. If one or more material weaknesses exist at the company’s fiscal year-end, management and the auditor must conclude that internal control over financial reporting is not effective. The PCAOB has defined a material weakness as a “significant control deficiency, or combination of deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected.” A material weakness does not mean that a material misstatement has occurred or will occur, but that it could occur. Although the law and rules require that management disclose material weaknesses, they provide no specific guidance about the content of those disclosures. However, both the SEC chief accountant and the PCAOB chairman have stated publicly that they expect management’s report to disclose the nature of any material weakness, in sufficient detail to enable investors and other financial statement users to understand the weakness and evaluate the circumstances underlying it. The PCAOB standard also requires that the independent auditor’s report provide specific information about the nature of any material weakness and the actual and potential effect on the company’s financial statements. Investors and other financial statement users should evaluate each material weakness to understand the nature, cause, and potential implications of the weakness.
4 Internal Control over Financial Reporting
SEC Chief Accountant Donald T. Nicolaisen has publicly commented that preliminary reactions from investor groups indicate that not all material weaknesses will be viewed as equally significant: “Some material weaknesses may have a greater or lesser impact on an investor’s decision-making process. In many cases, this decision will likely be influenced by the fullness of management’s disclosure, the underlying causes of the material weakness, and management’s actions to address the material weakness. This is intended to be an open process whereby investors can evaluate both the weakness as well as management’s actions to improve controls.”
Can a Company Have a Reported Material Weakness in Internal Control over Financial Reporting with a “Clean” Financial Statement Opinion?
A company can report a material weakness in internal control over financial reporting and still receive an unqualified, or “clean,” financial statement opinion from the independent auditor. Whether management or the auditor identifies a material weakness, management continues to be responsible for the preparation of complete and accurate financial statements. Therefore, management should take whatever steps are necessary to compensate for the material weakness in the financial statement preparation process. By expanding the scope of testing of account balances or altering the audit approach in the area of weakness, the auditor may be able to conclude that the company’s financial statements are fairly stated and thus issue an unqualified opinion.
Effect on a Company’s Stock Price and Other Market Determinants
Internal control reporting provides additional information to the marketplace. The expectation is that underwriters, analysts, rating agencies, lenders, and other market participants will consider internal control reporting in their analysis and evaluation processes.
For More Information
Deloitte & Touche LLP: www.deloitte.com Ernst & Young LLP: www.ey.com KPMG LLP: www.kpmg.com PricewaterhouseCoopers LLP: www.pwc.com For additional details on the new Section 404 reports on internal control over financial reporting and further discussion of their meaning and implications, see also http://www.s-oxinternalcontrolinfo.com for a companion guide published by the Firms, “Perspectives on Internal Control Reporting: A Resource for Financial Market Participants.”
Roles and Responsibilities – Internal Control over Financial Reporting
Management.
Designs and implements the system of internal control over financial reporting; evaluates the effectiveness of the company’s internal control over financial reporting and provides a public report on that assessment; prepares the financial statements.
Audit Committee. Has responsibility for oversight of the company’s financial reporting process.
Independent Auditor. Performs an audit of internal control over financial reporting and issues a report on management’s assessment of internal control over financial reporting and on the effectiveness of internal control over financial reporting; also performs an audit of the company’s financial statements.
What Management’s Report Will Include
Under the SEC rules, management’s report on internal control over financial reporting should include the following information:
• Statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting.
• Statement identifying the framework used by management to evaluate the effectiveness
of internal control over financial reporting.
• Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year, including an explicit statement as to whether that control is effective and disclosing any material weakness identified by management in that control.
• Statement that the registered public accounting firm that audited the financial statements included in the annual report has issued an attestation report on management’s internal control assessment.
The Independent Auditor’s Opinion
The content of the auditor’s report is prescribed by the PCAOB standard, and there are many nuances to the auditor’s reporting. The most common opinions on the effectiveness of internal control over financial reporting will be:
• Unqualified Opinion. An opinion that internal control over financial reporting is effective: no material weaknesses in internal control over financial reporting exist as of the fiscal year-end assessment date.
• Adverse Opinion. An opinion that internal control over financial reporting is not effective: one or more material weaknesses exist as of the fiscal year-end assessment date.
• Disclaimer of Opinion. A report stating that restrictions on the scope of the auditor’s work prevent the auditor from expressing an opinion on the company’s internal control over financial reporting. Intern
Internal Control over Financial Reporting
An Investor Resource
December 2004
Deloitte & Touche LLP
Ernst & Young LLP
KPMG LLP
PricewaterhouseCoopers LLP
Copyright © 2004 by Deloitte & Touche LLP, Ernst & Young LLP, KPMG LLP, and PricewaterhouseCoopers LLP.
These materials may be freely distributed provided that this copyright statement and any other similar attribution contained herein are included in their entirety. This publication is furnished for informational purposes only. Its content has been derived from many sources, both within the Firms and external to them. However, it does not provide any authoritative guidance nor should it form the basis for any investment decision. Recipients of this publication should not rely on it as a complete explanation of the law or rules governing this area or as legal advice. This publication speaks only as of the date of its release (December 21, 2004), and the information included herein is subject to change without notice.