The Hindu Business Line : One-size-fits-all approach may not fit

WHAT tops the headlines posted on www.sec.gov, the site of the US Securities and Exchange Commission, is `Statement on Implementation of Internal Control Reporting Requirements' dated May 16. It discusses issues that arose during "the first year of experience with the implementation of Section 404 of the Sarbanes-Oxley Act of 2002."

Section 404 of SOX, as the legislation is abbreviated, is about `Management Assessment of Internal Controls.' Accordingly, annual report should contain an `internal control report' stating the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and containing an assessment, as of the end of the issuer's fiscal year, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. And, the auditor has to attest to, and report on, the management's assessment.

Not something new to us because we had the good old MAOCARO or the Manufacturing and Other Companies Auditors' Report Order that sought the auditor to answer many questions including one on the subject in focus: "Is there an adequate internal control procedure commensurate with the size of the company and the nature of its business, for the purchase of stores, raw materials, including components, plant and machinery, equipment and other assets, and for the sale of goods?" Which is why the Indian accounting profession appeared smug when asked to react to SOX. Such a lacuna as faced by the US was not found here, it was argued. A different type of 404! A significant additional question, post-Enron, through CARO 2003 was "Whether there is a continuing failure to correct major weaknesses in internal control." After further amendment in 2004, CARO emphasises internal control system rather than mere internal control procedure, opines V. M. V. Subba Rao on http://caalley.com, a site with useful content for accounting professionals.

Reverting to the first anniversary of SOX implementation, it is heartening to learn that the SEC convened a roundtable discussion about a month ago, specifically on the implementation of the internal control reporting provisions, drawing together representatives from domestic and foreign companies, auditors, investors, lawyers, and the PCAOB (Public Company Accounting Oversight Board).

"Two messages came through clearly," states the Commission on the outcomes of the discussion, both positive and negative. Thus, the good news is that compliance with Section 404 is producing benefits, including a heightened focus on internal controls at the top levels of public companies, so SEC hopes the focus will help produce better financial reporting. But the negative finding is that the implementation in the first year has resulted in significant costs. "While a portion of the costs likely reflect start-up expenses from this new requirement, it also appears that some non-trivial costs may have been unnecessary, due to excessive, duplicative or mis-focussed efforts," concedes the SEC.

What's at flaw can be the `mechanical, and even overly cautious, way' in which rules and standards have been applied, states the SEC, advising both the management and external auditors to adopt reasoned judgment and a top-down, risk-based approach to the 404 compliance process. "A one-size fits all, bottom-up, check-the-box approach that treats all controls equally is less likely to improve internal controls and financial reporting than reasoned, good faith exercise of professional judgment focused on reasonable, as opposed to absolute, assurance," is a practical insight for auditors elsewhere too.

Internal and external audits are separate tasks, but the outside auditor does review internal audit and internal controls as mandated by CARO and also as required by the Institute's pronouncements. As a result, there are good savings for companies, one realises when reading about US companies cribbing about costs of Section 404. To help them, the SEC expresses the wish that internal control audit be better integrated with the audit of a company's financial statements.

Talk to each other more, says the SEC, encouraging "frequent and frank dialogue among management, auditors and audit committees with the goal of improving internal controls." Management should not fear that a discussion of internal controls with, or a request for assistance or clarification from, the auditor will, itself, be deemed a deficiency in internal control, explains the Commission, administering a kindergarten lesson in communication. "Both common sense and sound policy dictate that communications must be ongoing and open in order to create the best environment for producing high quality financial reporting and auditing; communications must not be so restricted or formalised that their value is lost."

Also worth reading this week would be "Staff Statement on Management's Report on Internal Control Over Financial Reporting," posted on www.sec.gov. Don't miss the policy statement on www.pcaobus.org, which concludes by noting that the first year's implementation of Section 404 required a tremendous effort on the part of management and auditors, as well as the commitment of substantial corporate resources.

But they're not giving up, as evident in this punch line from the SEC: "Section 404 is too important not to get right, but getting it right requires both effective and efficient implementation."

For us, the SEC's approach to the issue is a guidance that is too important not to take note of.

AccountSpeak@TheHindu.co.in

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
No small dilemma

Spectrum allocation — Disturbing the CDMA-GSM wavelength?

The curious rise of US trade deficit

NPAs in the shopping cart

One-size-fits-all approach may not fit

Get prepared to be impaired

Ignorantia juris non excusat

Listless lessons on corporate governance thru listing norms

Three cheers for the rebel

Stamp duty issues