Speech by SEC Staff:
Keynote Speech at 11th Annual Midwestern Financial Reporting Symposium
by
Donald T. Nicolaisen
Chief Accountant
U.S. Securities and Exchange Commission
Chicago, IL
October 7, 2004
Thank you, David Landsittel, for organizing this symposium. It's a real privilege for me to be here today, and a tall order to follow Katherine Schipper, Jim Leisenring, Tom Ray and Jane Adams - all of whom are leaders in our profession whom I deeply respect. I also look forward to the upcoming panel discussion. Given the list of panel participants, I would be surprised if this wasn't a very lively discussion.
I hope that I don't disappoint anyone but, rather than provide a broad overview of SEC issues, the focus of my comments today will be directed primarily to what I consider to be the most urgent financial reporting challenge facing a large share of corporate America and the audit profession between now and year end. And that is the requirement for management and a company's auditor to report on the existence and effectiveness of internal controls over financial reporting.
But before I get into specifics, I'd like to make a few comments about what underlies my actions as Chief Accountant of the SEC. With over half of all U.S. households investing in our markets directly or through retirement funds, my job is to help ensure that these millions of investors - young and old - can make investment decisions on the basis of timely, relevant, reliable and unbiased information that is presented in an understandable manner. This underlying principle - investor advocacy - forms the bedrock of all decisions that I make, including issues around the implementation and auditing of internal control over financial reporting. And it is from that perspective that I speak today, namely "what is good for the investor."
Many of you know that my job requires that I give a disclaimer whenever I speak at events such as this one. Accordingly, the remarks I make today are my own and do not necessarily represent the views of the Commission or its staff.
Those of you who know me, know that I repeatedly stress certain themes. I've spoken many times about the need for management to communicate in plain English with investors. And that I continue to endorse the use of cash flow statements using the direct method because it provides investors with more useful information than does the short-cut indirect method used by most companies. I also believe that given the current accounting model, which relies on a mixture of historical and fair values, MD&A provides the vital communication link between management and investors. Unfortunately the MD&A sections of too many companies' reports have consistently relied on boilerplate language at the expense of what are likely to be more important and relevant disclosures for investors. I commend the management of those companies who do a great job in their MD&A by helping investors understand the company, its operating performance, and business risk. And I encourage others to do likewise.
The Sarbanes Oxley Act required major reform in many areas in response to the financial failures of recent years. The crisis was real, and I believe the Act sets the right perspective and establishes an appropriate foundation upon which to improve financial reporting. This drive to improve financial reporting was one of the main reasons I joined the Commission staff. Among other reforms, the Act called for strengthened corporate governance, it created the PCAOB's oversight authority over the profession, it required CEOs and CFOs to certify the fairness of their financial statements and, in Section 404, it required that both management and the company's auditors report on the existence and effectiveness of internal controls over financial reporting. And, as promised, I will focus the remainder of my comments on Section 404 of the Act.
Reporting on internal control over financial reporting has been a topic often discussed and debated since I joined the profession some 37 years ago - and probably long before.
Now it's a reality.
In June 2003, the Commission approved rules implementing Section 404 and requiring management and auditors to evaluate and report on the effectiveness of each company's internal controls over financial reporting. A year later the Commission approved the PCAOB Standard 2 on audits of company internal control over financial reporting. The PCAOB standard is a breakthrough that requires an integrated approach to the audit process. The requirement to provide management's assessment of the effectiveness of internal control over financial reporting and the accompanying auditor attestation under the PCAOB's standard will be effective for the first time for fiscal years ending after November 15, 2004 for accelerated filers and for fiscal years ending after July 15, 2005 for smaller issuers and foreign private issuers. This is a major change in practice and with such change will come additional costs.
On August 11th of this year, Financial Executives International (FEI) released the results of its second survey on Section 404 costs. The second survey performed in July included 224 public companies with average revenues of $2.5 billion. The results indicate that the total cost of compliance per company is estimated at just over $3 million, which is a 62% increase in estimated cost from FEI's earlier survey in January 2004. Though I've not studied the methodology underlying FEI's survey, the results - that significant cost and effort is required - appear relatively consistent with other survey results and with what I hear from registrants and auditors. These are significant numbers, and it may very well be that to date the amount of work required to prepare management and auditor reports has been largely underestimated, not overestimated.
So, will this be worth the cost?
I suspect that the costs are not easy to estimate, but I know that it is even tougher to quantify the benefits. However, given the massive financial scandals, decline in market capitalization and resulting loss of investor confidence in our markets, I believe that, of all of the recent reforms, the internal control requirements have the greatest potential to improve the reliability of financial reporting. Our capital markets run on faith and trust that the vast majority of companies present reliable and complete financial data for investment and policy decision-making. Representing to the world that a company has in place an appropriate control system, free of material weaknesses, that gathers, consolidates, and presents financial information strengthens public confidence in our markets and encourages investment in our nation's industries. If that's the case, then it's worth it, and it is absolutely critical that we get the internal control requirements right.
That being said, I have encouraged the private sector to develop internal control guidance designed specifically to address the needs of small, medium and less sophisticated businesses. I strongly support such an initiative, and would urge the public sector to complete a project by the spring of 2005 so that it can be utilized by small business filers. Small business plays a vital role and has long been a growth engine for our economy. A majority of new jobs are created in the small business sector. During the Commission's Sarbanes-Oxley rulemaking initiatives, we received many comments focusing on the increased burden that the proposed rules would place on smaller-sized public companies. As a general matter, I believe that all companies who access our public markets should be expected to adhere to the same standards to the extent that they have like transactions. However, the burden to smaller companies may be disproportionately higher and needs to be appropriately weighed as we determine the best ways to protect investors. This balancing act is something that I will continue to monitor closely, and it is also an important consideration for the PCAOB and for the FASB. Clearly we all need to strike the right balance.
In many cases the new internal control requirements are not only a major financial but also a significant cultural endeavor for our registrants in the U.S. and abroad. Recently, at a conference in Paris, the Accounting and Internal Control Director of a major foreign private issuer expressed concern that this may become merely a check the box exercise. I share his concern, and I will encourage the PCAOB, as part of its inspection process next year, to review and evaluate the results of the first year's auditor internal control reports. The PCAOB is in the unique position to compare efforts across a wide range of companies and audit firms of all sizes. Their contribution to investor confidence in our system is enormous. After the first reports are complete, I would also encourage registrants and auditors to share with us what they've learned. What worked? What didn't work? Can our rules be improved? Have we achieved an appropriate balance?
I can assure you that where changes in our rules are needed, I will support such change.
Finally, I have heard widely differing predictions about the number of registrants who will report material weaknesses in internal controls. These predictions vary from a few percent to 10 percent, 20 percent or even more. I personally think it's too early to predict. However, I can tell you that I am closely monitoring the situation and I would also remind everyone that there is still time - but the clock is ticking - to evaluate, test, document and correct control deficiencies prior to year end. It's also important to remember that even if material weaknesses have been identified resulting in an adverse opinion, the auditor may still be able to issue a clean opinion on the financial statements.
For those companies who do disclose material weaknesses, it will be important that they do so in a manner that enables investors and other market participants to carefully evaluate the circumstances underlying the material weakness. I have met with many investor groups and have encouraged them to consider issuing timely guidance on what impact the following scenarios may have on their investment decisions:
- Management fails to complete the work necessary to issue its report on a timely basis.
- The auditor fails to complete the work necessary to issue its report on a timely basis.
- The work is completed and the reports are issued timely, but they identify one or more material weaknesses.
The preliminary reactions that I have heard to date vary somewhat, but they do seem to be generally consistent in that not all material weaknesses are likely to be viewed as equally significant. Said another way, some material weaknesses may have a greater or lesser impact on an investor's decision making process. In many cases this decision will likely be influenced by the fullness of management's disclosure, the underlying causes of the material weakness, and management's actions to address the material weakness. This is intended to be an open process whereby investors can evaluate both the weakness as well as management's actions to improve controls.
I was encouraged to learn during a recent meeting with Moody's that they are considering these issues and are tentatively considering grouping material weaknesses into different categories. One category, for example, might include a material weakness whose effects are limited to a single account balance that an auditor could address by expanding audit procedures. Another category might include an ineffective control environment, such as the tone at the top, an ineffective audit committee or an ineffective financial reporting process. In these cases it may be more difficult for the auditor to audit around the problem. Moody's tentatively does not expect to take any rating action for some categories of material weaknesses whereas it may for other categories.
While I am not endorsing Moody's or anyone else's categorization of material weaknesses, I do think that it is critically important that market participants consider the importance of reporting under Section 404.
As with the start of any new journey, there are bound to be some bumps. Though I can't tell you how many, I do expect that in the coming months a number of companies will announce that they have material weaknesses in their controls. For this initial pass, that finding generally should not be surprising. Nor should it, by itself, necessarily be motivation for immediate or severe regulatory or investor reactions. What's important is that material weaknesses are fully disclosed and that management corrects weaknesses in their systems. The goal should be continual improvement in controls over financial reporting and increased investor information and confidence.
There is no way to measure how many reporting failures will be averted and how many investment dollars will be saved because of the increased attention to effective internal control systems. But it may very well be significant. As has been recognized for longer than I have been around, however, strong controls are vital to high quality financial reporting and essential to timely analysis. To achieve the goals of section 404, all participants in the financial reporting process - investors, management, audit committees, auditors, lawyers, and regulators - must make the development of and adherence to these systems a priority in our daily work.
** ** **
In closing I can't stress enough the urgency or importance - especially for those accelerated filers with a November or December year end - to use the limited time available to complete their assessment and testing. It is likely to be a sprint to the finish.
Thank you. I look forward to the upcoming question and answer session.
http://www.sec.gov/news/speech/spch100704dtn.htm
