Noting that the impact of Section 404 of the Sarbanes-Oxley Act on companies, auditors and investors has been huge, one Big Four chief executive says that the changes "all are positive."
Calling 404 -- the section of SOX that addresses internal controls over financial reporting -- "the glue that holds the act together," PricewaterhouseCoopers LLP chairman Dennis Nally said that as a result, he believes that, "Over time, we'll see fewer major restatements, fewer Securities and Exchange Commission financial reporting cases and, ultimately, fewer incidents involving accounting fraud."
Addressing recent proposals by critics of 404 to either repeal it or make compliance voluntary, Nally, in remarks at the National Press Club on April 28, called both ideas "ill-conceived."
"Could 404 be improved? Yes. Are we expecting 404 to deliver value? Absolutely," Nally said. "But the understandable reaction to the Enron and WorldCom meltdowns should not be replaced with a knee-jerk reaction to roll back the laws designed to keep them from happening in the future."
Noting that implementation is "hardly ever smooth in the beginning," Nally continued, "It would be foolhardy for all of the stakeholders not to ride out the bumps, address the areas where improvement is called for, and give the law time to work."
"Section 404 is fundamentally sound and does not require legislative change," Nally told NPC members. "I suggest that we exercise patience, and compare the 2005 reports with reports in 2006 and 2007. If we don't see the number of deficiencies plummet over the next two years, if major restatements are not way down, if there are not fewer accounting surprises, only then will we know that 404 has not accomplished its intended objectives."
He noted the need for a balance between "a detailed regulatory framework and the professional judgment that auditors bring to the decision-making process." "We need to ensure that there's balance between regulation and strong internal controls -- and smart risk-taking," he said.
As a result of Sarbanes-Oxley, the PwC chairman said, "Better corporate governance has been put in place in many, if not most, public companies. Audit committees and boards of directors are more engaged in their responsibilities related to financial reporting. There's a new, stronger relationship between the auditor and the audit committee. The need to build good controls is front and center. ... Audit firms have enhanced their audit approach to focus on the evaluation of internal controls, and to integrate the controls work with the performance of the financial statement audit."
Noting that many of the costs associated with first-year implementation are nonrecurring, Nally said that 404 should, over time, "be able to stand the scrutiny of a cost/benefit analysis."
In an analysis of 225 registrants, PwC estimates more than 40 percent remediated or newly implemented over 25 percent of their key internal controls this first year. According to the Big Four firm, companies spent, on average, 25 percent of their total 404 resource time documenting internal controls, and an average of 15 percent of their time on correcting control deficiencies. Nally noted that that work won't have to be repeated.
However, Nally warned that there is an expectation gap between what Section 404 can "realistically deliver and the belief that 404 can eliminate fraud." He cautioned, "404 is not a silver bullet. ... There's no 100 percent guarantee that 404 will prevent another major financial scandal."
