by Ken Rankin
Washington — The Public Company Accounting Oversight Board gave a thumbs up to a controversial new auditing standard that requires auditors to review and attest to the effectiveness of corporate internal control over financial reporting — a mandate that some boardroom execs fear may sharply increase the cost and complexity of external audits.
The standard — which now must be approved by the Securities and Exchange Commission before taking effect — not only requires auditors to attest to the accuracy of management’s assessment of internal controls, but also details the work that accountants will have to perform as part of these
audits.
In approving the new standard, PCAOB officials conceded that audit fees will climb as a result of these new requirements, but insisted that the benefits will outweigh the costs.
“As we heard from many public companies, these requirements are tough and they will require extra work and expense,” board chair William McDonough said during a recent public meeting at which the standards were adopted. But he maintained that these costs are justified because “the goal is to obtain the best possible assurance that a company’s financial statements are reliable.”
But while they acknowledged that the expense of internal control audits figures to be high for “large, complex, multinational companies” that are likely to need “extensive and sophisticated internal control systems,” PCAOB officials suggested that smaller corporations may be able to avoid high compliance costs because top management at these companies may be more intimately involved with operations.
“In smaller companies, or in companies with less complex operations, the ethical behavior and core values of a senior management group directly involved in daily interactions with both internal and external parties might reduce the need for elaborate internal control systems,” board staffers reasoned.
The standards, which were originally proposed late last year, drew nearly 200 comments, including many from corporate officials who complained that the board exceeded the requirements of the Sarbanes-Oxley Act by calling for a “detailed audit” of each client’s internal controls.
That law directs the PCAOB to develop rules that require accounting firms to “attest to, and report on, the assessment made by management” concerning the effectiveness of audit clients’ internal controls.
The clear intent of Congress was that “public accounting firms should attest to the assessment made by management, not perform a detailed audit of internal controls,” Kimball International executive vice president Robert F. Schneider said in written comments to the board.
The distinction between an audit and an attestation is “very important,” because “a detailed audit of internal controls each year is extremely costly to American business and its competitiveness,” he said.
In outlining the final version of the proposed standards, however, PCAOB staffers shrugged off such arguments, maintaining that attempts to draw any substantive distinction between an “audit” and an “attestation” are “erroneous.”
“An attestation engagement to examine management’s assessment of internal control requires the same level of work as an audit of internal control over financial reporting,” they said.
“An auditing process restricted to evaluating what management has done would not provide the auditor with a sufficiently high level of assurance that management’s conclusion is correct,” PCAOB officials added. The investing public expects “the independent auditor to test whether the company’s internal control over financial reporting is effective, and Auditing Standard No. 2 requires the auditor to do so.”
Messing with SOX?
In contrast to the staff’s delicately worded analysis, some members of the board were openly critical of corporate officials who they accused of attempting to water down key provisions implementing SOX.
Responding to the complaints lodged by a number of corporate execs, PCAOB board member Kayla Gillan said that “many public companies that commented on the original proposal seem to expect the auditors to use a minimalist approach to the new responsibilities mandated by Sarbanes-Oxley. They seem to want a simple rubber stamp on management’s assessment of the effectiveness of these controls.”
Despite dismissing corporate pressure for a softer standard, the board did agree to a number of modifications to the original plan that PCAOB officials said should make internal control auditing more affordable to small and midsized companies.
One key change from the original version loosens proposed restrictions on the ability of independent auditors to rely on the work of “others” (i.e. internal auditors) in assessing the client’s internal controls.
“We found that internal audit programs that are highly competent and independent from company management represent a valuable long-term tool for increasing financial reporting reliability,” Gillan explained.
If companies strengthen their internal auditing program, “the auditor should be able to rely more readily and extensively on these internal experts, thus reducing the external auditor’s fee,” she reasoned.
Significantly, however, board officials made it clear that the newly liberalized standard does not give outside accountants a green light to turn internal control audits over to in-house accountants.
While auditors will have “significant flexibility in using the relevant work of highly competent and objective personnel,” they stressed that the new standard will require auditors to obtain “a meaningful portion of the evidence that supports the auditor’s opinions” through “his or her own auditing procedures.”
For her part, Gillan served notice on the accounting profession that the PCAOB will be on the lookout for attempts by accounting firms to blame the new standards for excessive increases in audit fees.
“The work that auditors must now perform with respect to internal controls is not an excuse to price gouge,” Gillan said bluntly. “I urge any company that believes its auditor is overcharging for this work to contact us.”
PCAOB staffers made that point a bit more tactfully in a briefing paper outlining the details of the final proposed standard. In that document, officials at the board said that they expect auditors to “exercise reasonable professional judgment in determining the extent of the audit of internal control and perform only those tests that are necessary to ascertain the effectiveness of the company’s internal controls.”
