February 26, 2007
My comments focus on the proposed changes to Regulation S-X concerning the accountant's report on internal control. I believe that the proposed changes should not be made. The reasons for my view are indicated in the comments I sent to the Public Company Accounting Oversight Board today on its related proposal regarding the audit of internal control. I stated the following:
I have the following comments on the proposed standard on the audit of internal control.
The PCAOB deserves credit and appreciation for dealing with the challenge of reducing the time and costs involved in reporting on internal control, and in simplifying the guidance for auditors.
One area the PCAOB has properly chosen to address, and the focus of my comments, is the requirement for dual auditor opinions on internal control - one on management's assessment and the other on internal control effectiveness. The proposal would eliminate the opinion on management's assessment, with the result that auditors will give an opinion on whether internal control is effective. But I believe the PCAOB should have opted for the other choice - reporting only on management's assessment.
Management's assessment as stated in its report is a management assertion. Reporting on a management assertion is a fundamental and common objective of auditing. When auditors report on financial statements, they report on whether management's assertions as expressed in the financial statements are fairly stated. But, if auditors state whether internal control is effective, the auditor is making the assertion (along with management).
This distinction may be considered a nuance, but it is not trivial.
The auditor's reporting on internal control should parallel the reporting on financial statements. That is, the auditor should report simply on whether management's assessment of internal control is fairly stated, just as it reports on whether the financial statements, a management assertion, are fairly stated.
The proposal states, in section II.B (page 14), that it would eliminate the requirement to evaluate the process management used to evaluate its internal control, which it indicates is an unnecessary procedure. The idea is that it is not necessary if the auditor directly evaluates and reports on internal control. But the proposal also calls for the auditor to understand management's assessment process. It says the quality of management's process is inherently linked to the amount of work the auditor will need to do.
I do not know to what extent reporting only on management's assessment would reduce audit time in relation to that required to report on internal control effectiveness. But I do believe that any reduction in total audit time is likely to be optimized where the objective of the reporting is on management's assessment.
The primary responsibility for maintaining adequate internal control rests with the company, and management. There is no compelling need for the auditor to take on part of that responsibility, which would result from a requirement for the auditor to report on internal control effectiveness. The concern by management that auditors have been dictating the nature of internal controls will continue.
If the auditor in fact or in effect shares responsibility with management, there is a question as to whether the auditor can be considered independent.
Section 404(b) of the Sarbanes-Oxley Act requires that the auditor attest to, and report on, the assessment made by management. There has been no demonstration of a need to go beyond that requirement.
Section 103(a) of the Sarbanes-Oxley Act requires that the auditor's report present an evaluation of whether the internal control structure meets specific objectives, which are the same as those specified in Section 13 (b)(2) of the Exchange Act. The PCAOB stated in Paragraph E16 of Release 2004-001 (AS 2) that the Board also interpreted Section 103 to provide further support that the intent of Congress was to require an opinion on the effectiveness of internal control over financial reporting. This interpretation is questionable, however, because it is inconsistent with the wording of Section 404.
The PCAOB also concluded in AS 2 that the degree of work required in either reporting situation would be the same. That is a questionable premise. It is one thing to test effectiveness of internal control directly, and quite another to test the testing performed by someone else.
What this boils down to is how much assurance investors are willing to pay for. That issue is or particular importance for smaller public companies.
I appreciate your consideration of my comments.
Sincerely,
Robert F. Richter, CPA