Print this issue
 View as PPT
Send us your comments

SOX PRIMER

SOX Primer
Selected History

• A Continuum of Financial Reporting Regulation & Guidance
  • 1934 - The Securities Exchange Act
    • Requires issuers to file 10 K’s & 10 Q’s
    • Requires adequate books & records and internal controls
  • 1977 – Foreign Corrupt Practices Act
    • Requires internal accounting controls for financial reporting
  • 1987 – The Treadway Commission
    • Recommended steps to reduce fraudulent financial reporting
  • 1991- The Federal Deposit Insurance Corporation Improvement Act (“FDICIA”)
    • Recommended management’s assessments and assurances over a bank’s internal controls.
  • 1992 – The COSO Report
    • Recommended framework to identify risks and design internal controls
    • Framework embraced by SEC and PCAOB
  • 2002 – Sarbanes Oxley Act
    • Extension of the Securities Exchange Act of ‘34
    • Requires an opinion from management and the external public accounting firm over controls for financial reporting
  • 2003 to 2008 – SEC Extends Multiple Deadlines
  • 2009 – New Political Climate Makes Further Extensions Unlikely
    • New SEC Appointee, Mary Schapiro “ It’s time that we bring uniformity to the system”

SOX Primer
Who Must Comply

• All SEC Registrants:
  • S-1 filers must comply with SOX
  • Accelerated filers:
    • Market cap > $75 million
    • Year ends after November 15, 2004
  • Non-accelerated filers:
    • Market cap < $75 million
    • Year ends after December 15, 2009

SOX Primer
Main 404 Elements

• Formalized, Annual, Two-Step Process:
  • Section 404(a) – Management’s Assessment of Internal Controls:
    • Document and test internal controls
    • Assert that controls are adequate (or not) for the preparation of reliable financial statements
  • Section 404(b) – Requires an External Audit of Internal Control:
    • Independently review management’s basis for Assertion
    • Independently test controls
    • Attest that management’s system of controls is adequate (or not) for the generation of reliable financial statements

SOX Primer
Other Elements

SOX Primer
Auditing Standard No. 5

• July 25, 2007 - SEC approved PCAOB’s AS #5
  • Replaced Auditing Standard No. 2
  • Provides interpretive guidance for external auditors
  • Goal = improving the efficiency and effectiveness of their SOX 404 efforts
  • Key Features:
    • Less prescriptive than AS #2
    • Provides audit scalability – matching size & complexity of client
    • Requires a risk-based approach to focus to eliminate unnecessary procedures
    • Provides principles-based approach for reliance upon work of others

SOX Primer
Classifications of Deficiencies

• Under AS-5:
  • Significant Deficiency:
    • “A significant deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of a registrant’s financial reporting”
  • Material Weakness:
    • “A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis”

SOX Primer
PCAOB Guidance - Small Public Companies

• January 2009 - PCAOB published guidance for Auditors of Small Public Companies
• External auditor & management collaboration required:
  • Highlight Tone at the Top
  • Use a Top Down Approach to identify key controls
  • Concentrate on Areas of Risk
  • Evaluate and understand the risk of management override
  • Understand the significance of having informal documentation
  • Address Segregation of Duty (SOD) issues
  • Understand Information Technology Controls
  • Prepare for a financial reporting skills evaluation

NON-ACCELERATED CONSIDERATIONS

Non-Accelerated Considerations
Internal Control Defined

• Policies & procedures to ensure the achievement of an objective:
  • Documentation
  • Performing reconciliations
  • Security
  • Organizational design

Non-Accelerated Considerations
Common Control Deficiencies

Non-Accelerated Considerations
Inherent Challenges

• Internal Control – Inherent Challenges:
  • Lack of accounting resources for effective segregation of duties
  • IT staff with dual responsibilities – production & development
  • Ability of senior executives to override controls
  • Ability to recruit & retain sophisticated GAAP and IT talent

PRACTICAL APPROACH

Practical Approach
Lessons From Accelerated Filers

• What went right
  • Top-down approach – risk-driven scoping
  • Started project early
  • Honest evaluation of problems
  • Held key individuals accountable
• What went wrong
  • Late start
  • Limited collaboration with external auditors
  • Underestimated amount of work required
  • Attempted to self-test
  • Did not effectively involve business process owners
  • Did not take into account Information Technology
  • Staff project with people who had “day jobs”

Practical Approach
Optimizing AS5

Practical Approach
Optimized AS5 – Key Controls

Practical Approach
Phased Predictable Process

Practical Approach
Success Factors

• Don’t Delay
• Educate yourself - Rules & Guidance
• Create sustainable, top-down, risk-based approach
• Build “Entity-level” controls
• Limit reliance upon “Process-level” controls
• Learn from Lessons past
• Objective Assessment of Financial Statement Risk
• Constant collaboration with External Auditor
• Timely remediation of Control Deficiencies
• Balance internal resources with external experts

Practical Approach
Control Deficiencies

• SOX = perfection not mandated
• “Living with” certain deficiencies = Management / Board choice:
  • Material Weakness - 10-K disclosure required
    • Disclose reasoning for accepting material weakness
    • Shareholders, prospective investors, lenders – ultimate judges
  • Significant Deficiencies – no disclosure required

Practical Approach
Cost & Scope Factors

• Cost for Management Assertion & Auditor Attestation impacted by:
  • Nature & complexity of operations and financial reporting
  • Extent of documentation supporting ICFR and Management testing
  • Nature, timing and adequacy of management testing
• For single-location, non-accelerated entities:
  • Typical cost = $30,000 to $75,000 for first year
  • Requires 300 to 750 hours of client effort
  • Unknown is remediation of control deficiencies

WRAP-UP

Wrap Up
Continuous ICFR Process

• Internal Control for Financial Reporting (“ICFR”):
  • Focus on continuous process:
    • “Once a year” event insufficient likely creating inefficiencies
  • Ongoing Monitoring:
    • Control deficiency remediation
    • Process changes requiring documentation updates
    • Efficiency opportunities
  • Rolling Risk Assessment:
    • Continuously update risk assessment, for old & new risks
  • Establish a Control Culture:
    • Embracing control culture
    • Reduces surprises & fire drills

Wrap Up
The Amper Advantage

• Amper’s “SOX-in-a-Box” Service:
  • Fixed Price Range – typically $25,000 to $60,000
  • Scope of effort determined within first week
  • Transparent scheduling and assignment of duties:
    • Amper duties
    • Client duties
  • Industry-specific templates easily adapted to your company
  • Experience rivaling any other provider:
    • No one beats us in practical non-accelerated experience
  • Over100 dedicated SEC compliance specialists near you

Contacts

Pete Bible
Leader, Public Company Practice
732-287-1000
E-mail

Andy Barfuss
Leader, Business & Risk Advisory Services
732-287-1000
E-mail