Breaking News—SEC and PCAOB finalize Sarbanes-Oxley Guidance

May 24, 2007—This week, the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB) finalized guidance for management's assessment and the external auditors' attestation on internal controls over financial reporting (ICFR).

As anticipated, the SEC did not extend the filing deadlines for non-accelerated filers like many had hoped. They did, however, remove the requirement for an external auditor to opine on management's assessment of ICFR, which should lead to significant savings on external audit fees.

Per the compliance schedule previously finalized by the SEC, non-accelerated filers must provide management's assessment on ICFR with its annual report for the first fiscal year ending on or after December 15, 2007 and an auditor's attestation report on ICFR with its annual report for the first fiscal year ending on or after December 15, 2008.

The PCAOB finalized the much anticipated Auditing Standard 5 (AS5) to clarify external audit requirements for ICFR. The new standard provides management and external auditors with greater flexibility to focus only on those areas of high risk based on each company's facts and circumstances. AS5 also presents opportunities to develop efficiencies in compliance programs by providing guidance to allow external auditors to place more reliance on the work of others and allowing the use of knowledge gained in prior year audits.

Our Take

The SEC and PCAOB developments illustrate the intentions to maintain Section 404 requirements, but at the same time reduce the costs associated with compliance efforts at public companies. AS5 attempts to reduce the number of redundant activities previously required under AS2. Since the inception of SOX, many companies used an all inclusive approach and planned the compliance initiative based on quantitative measures, such as total account coverage. This practice led to companies expending resources on areas that did not truly present a financial statement risk. The new guidance suggests that Sarbanes-Oxley compliance programs should be properly scoped on both quantitative and qualitative risk factors to focus on only those areas that could lead to financial statement misstatement. A properly scoped compliance initiative will "right-size" the number of company key controls, keep compliance costs at a minimum, and provide the framework for a sustainable compliance initiative. Within the scoping phase, the identification and reliance on entity level controls can eliminate excessive costs attributable to time consuming, low-risk, and highly transactional processes.

AS5 provides greater flexibility for auditors to accept the work of others in assessments of internal controls. With this change, auditors are permitted to rely on the work of others if it is done objectively and with competence. The increased auditor reliance on others' work and the elimination of the auditors' attestation on management's assessment of ICFR should lead to significant savings in external audit fees. With the new guidance, the SEC and PCAOB believe that compliance costs can be controlled while remaining true to the spirit of the Sarbanes-Oxley Act of 2002.

How SC&H Consulting Can Help

SC&H has utilized a methodology that incorporates many of the changes detailed in the SEC's and PCAOB's new guidance prior to their issuance. This proven methodology has assisted our clients in significantly reducing compliance costs through extensive external audit coordination and the elimination of unnecessary procedures. Our team of experts that specialize in Sarbanes-Oxley consulting, internal audits, and risk management can assist with your compliance needs. If you have any questions about these changes or are interested in our services, please email or phone Brian Davis at (410) 403-1500.

Forward to a Friend

Click here to unsubscribe from SC&H Consulting Emails