Dennis M. Stevens
March 24, 2003
Julie Anne Dilley
Re: Proposed Statement on Auditing Standards - Reporting on a Entity's Internal Control Over Financial Reporting in Conjunction with the Financial Statement Audit
Dear Ms. Dilley:
I believe the requirements of this Proposed Statement far exceed the intent of Congress. Further, the Statement appears internally inconsistent, contrary to the public good and self-serving.
Section 404 of Sarbanes-Oxley requires that a public accounting firm attest to and report on an assessment of internal control made by management. Taken in context, it would appear that the intent of Congress was to provide some comfort that management's work serves as a reasonable basis for its assessment. Consistent with that intent, one would expect the public accounting firm to review documentation prepared by management, conclude as to whether management's work appears reasonably comprehensive, conclude as to whether, in the course of their review, anything came to the attention of the public accounting firm that might merit further disclosure, and report accordingly.
The Proposed Statement goes far beyond that reasonable expectation. The focus of the Statement is clearly not on a review of management's assessment. Instead in paragraph 1 there is the immediate presumption that the public accountant has been engaged to audit internal controls directly. In paragraphs 5, 6, 7, 8 and 9 the focus grows to expressing an opinion on internal controls. In paragraph 14 we learn that "the auditor's engagement to express an opinion on the financial statements and to express an opinion on internal control is an integrated activity that consists of an audit of the financial statements and an audit of internal control."
After all this discussion about expressing an opinion on internal control, the reader anticipates that the public accountant will express a qualitative judgement to the effect that internal controls are "reasonable" or "adequate" or something similar. But where is that qualitative judgement communicated to the public? There is no opinion on internal control in Appendix A for example, only an indication that management's assertion is fairly stated. The Proposed Statement requires all the work necessary to support an opinion on internal control, then reverts to a focus on management's assertion in the opinion offered to the public. I believe this inconsistency is introduced to avoid the potential liability that might be associated with a qualitative judgement.
While the Proposed Statement suggests public documents focus on management's assertions, it contains little, if any, discussion of the auditor's review of management's work. While Section 302 of Sarbanes-Oxley in effect requires management to document, assess and report on internal controls every quarter, the Auditing Standards Board evidently believes this is not enough. There is the presumption that management's review is either inconsequential or the public is better served by five internal control reviews instead of four. There is no suggestion that this fifth internal control review would add significant value and, as recently described by an ad hoc task force of the AICPA Business & Industry Team, it "will most likely require significantly more work than what the auditor was doing previously" and accordingly "it is possible that audit fees will increase significantly".
Congress asked the public accounting profession to review work performed by management, but the Auditing Standards Board ignores that request and substitutes a direct, redundant, and expensive review of internal controls performed by external auditors. While requiring American business to incur substantially more expense than might have been contemplated by Congress, it offers the investing public no additional assurance - the focus of public reporting is to remain on management's assertions. There appears to be no justification for this approach other than that clearly implied: the approach offers public accounting firms substantially increased fees while attempting to avoid substantially increased liability.
We in industry already enjoy increased workloads and expenses due in part to the failures of a once noble public accounting profession. That profession now presumes our work is irrelevant and proposes that those who contributed to the problem should profit handsomely from its solution. I can only hope the SEC and the PCAOB do a better job of attending to the public trust.