The Government Accountability Office recommended in a new report that the Securities and Exchange Commission should consider requiring public companies where applicable to explicitly disclose whether they obtained an auditor attestation of their internal controls.
The SEC responded that investors could determine the attestation status from the available information. But without a clear disclosure, the GAO contended that investors may misinterpret a company's status, and therefore, this warrants the SEC’s further consideration.
Section 404(b) of the Sarbanes-Oxley Act requires a public company to have its independent auditor attest to and report on management’s internal control over financial reporting. This is known as the auditor attestation requirement. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act exempted companies with less than $75 million in public float from the auditor attestation requirement.
However, the Dodd-Frank Act mandated that the GAO should examine the impact of the permanent exemption on the quality of financial reporting by small public companies and on investors. The report, released Wednesday, discusses how the number of financial statement restatements compares between exempt and nonexempt companies (i.e., those with $75 million or more in public float), the costs and benefits of complying with the attestation requirement, and what is known about the extent to which investor confidence is affected by compliance with the auditor attestation requirement.
For the report, the GAO analyzed financial restatements and audit fees data; surveyed 746 public companies with a response rate of 25 percent; interviewed regulatory officials and others; and reviewed laws, surveys and studies.
Since the implementation of the auditor attestation requirement of the Sarbanes-Oxley Act of 2002, companies exempt from the internal controls requirement of Section 404 have had more financial restatements than nonexempt companies, the report found, and the percentage of exempt companies restating generally has exceeded that of nonexempt companies. Exempt and nonexempt companies restated their financial statements for similar reasons, such as revenue recognition and expenses, and the majority of these restatements produced a negative effect on the companies’ financial statements, the GAO noted.
“Views on the costs and benefits of auditor attestation vary among companies and others,” said the report. “Although companies and others reported that the costs associated with compliance can be significant, especially for smaller companies, GAO’s and others’ analyses show that these costs have declined for companies of all sizes since 2004. Companies and others reported benefits of compliance, such as improved internal controls and reliability of financial reports. However, measuring whether auditor attestation compliance costs outweigh the benefits is difficult, and views among companies and others were mixed as to whether the costs exceeded the benefits of compliance.”
A majority of the empirical studies that the GAO reviewed for its report suggested that compliance with the auditor attestation requirement has a positive impact on investor confidence in the quality of financial reports. Some interviewees said the independent scrutiny of a company's internal controls is an important investor protection safeguard.
The SEC does not require exempt companies to disclose in their annual report whether they voluntarily obtained an auditor attestation. SEC officials said it is not common for the SEC to require a company to disclose voluntary compliance with requirements from which it is exempt. However, federal securities laws require companies to disclose relevant information to investors to aid in their investment decisions. “Although information on auditor attestation status is available to investors, requiring a company to explicitly state whether it has obtained an auditor attestation on internal controls could increase transparency and investor protection,” said the GAO.
In response to the report, SEC officials pointed out that investors are able to determine a company’s attestation status from information in the annual report, but it left open the door to eventually requiring disclosures of attestation status.
“The draft report correctly identifies that a non-accelerated filer that does not voluntarily include in its annual report an attestation report from its auditor on ICFR [internal controls over financial reporting] is not required to disclose this fact explicitly,” wrote SEC chief accountant Paul Beswick and Division of Corporate Finance acting director Lona Nallengara. “We believe that this fact can be easily determined by investors from information that is already disclosed in the annual report. An issuer is required to indicate its filing status on the cover of its annual report, clearly disclosing whether the issuer is a non-accelerated filer and, therefore, exempt from the auditor attestation requirement. Further, SEC rules require any issuer that includes an auditor’s attestation report on ICFR in its annual report, whether the attestation report is voluntary or required, to include a statement that the attestation report is included in the annual report. As a result, non-accelerated filers that voluntarily provide an attestation report are readily identified.”
Beswick and Nallengara pointed out that investors can also find information on the existence of an opinion on ICFR by looking at the audit report in the issuer’s filing. But they noted that the Public Company Accounting Oversight Board is in the process of changing the auditor’s reporting model, which may require an explicit statement on whether or not there is an opinion on internal controls.
“If the auditor chooses to issue a separate attestation report on ICFR, PCAOB standards require an explicit statement that the issuer’s ICFR has been audited,” Beswick and Nallengara wrote. “In the case of either combined or separate reports, the fact that the auditor clearly opined on ICFR is clearly disclosed in the auditor’s report on the financial statements. When the auditor is engaged to opine on ICFR, PCAOB standards permit the auditor to also include in its report on the financial statements an explicit statement of this fact and that the auditor does not express an opinion on ICFR. The PCAOB has announced that, as part of its standard-setting agenda, it plans to propose changes to the auditor’s reporting model later in 2013. As part of this project, we understand that the PCAOB staff intends to recommend that the PCAOB seek specific feedback on requiring, as opposed to permitting, these explicit statements. We remain dedicated to continuously evaluating and improving our disclosure requirements and to making sure that investors have the information they need to make informed investment decisions.”