May 25, 2007
At a meeting held on May 23, 2007, the Securities and Exchange Commission (“SEC”) adopted interpretive guidance for management to use in conducting the annual evaluation of internal control over financial reporting that is required under Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”). In addition, at a meeting held on May 24, 2007, the Public Company Accounting Oversight Board (“PCAOB”) adopted a new auditing standard, Auditing Standard No. 5 (“AS-5”) for the audits of internal control over financial reporting under Section 404 of Sarbanes-Oxley. The PCAOB AS-5 can be found at http://www.pcaobus.org/Rules/Docket_021/2007-05-24_Release_No_2007-005.pdf.
A summary of the SEC’s interpretive guidance and related rules and proposals, as well as a summary of AS-5, is set forth below. The portions of this summary relating to SEC developments are based on information provided at the SEC open meeting, and therefore may not reflect nuances that will appear in the interpretive, proposing and adopting releases, which are expected to be issued shortly.
Section 404 – Internal Control Over Financial Reporting
Interpretive Guidance on Conducting Management’s Evaluation of Internal Control Over Financial Reporting
The SEC adopted, substantially as proposed, interpretive guidance for management to use in conducting its annual evaluation of a company’s internal control over financial reporting, as required under Section 404(a) of Sarbanes-Oxley. In adopting this interpretive guidance, several Commissioners noted that the guidance is intended to make the Section 404 evaluation process more effective and cost-efficient. The Commissioners and the SEC Staff emphasized that they believe the interpretive guidance is scalable and can be applied by companies of all sizes and complexities. The guidance is described as “principles-based” and is premised on a “top-down, risk-based” approach to evaluation. The interpretive guidance covers four key areas:
In addition, the SEC Staff emphasized that the interpretive guidance is not intended to disrupt or change what companies already have done in terms of implementing Section 404. Rather, the SEC intends that companies that have already complied with the Section 404 requirements can determine whether to use any aspects of the guidance to make their own evaluation process more efficient. Thus, for companies that have already complied with the Section 404 requirements, the guidance is optional, not prescriptive. Also, the interpretive guidance will confirm that management can rely on this guidance, and not PCAOB AS-5, for purposes of conducting an appropriate evaluation of the company’s internal control over financial reporting. The SEC Staff also noted that while the proposed guidance does not include discussion that is tailored specifically toward the types of issues that foreign private issuers are confronting in implementing Section 404, the SEC intends to release a list of Frequently Asked Questions in an attempt to address some of these issues.
Rule Amendments Relating to Management’s Evaluation of Internal Control Over Financial Reporting
To complement the interpretive guidance, the SEC also adopted several rule amendments and proposed a rule regarding the definition of the term “significant deficiency”:
The SEC also declined to further postpone the application of the Section 404 rules for non-accelerated filers. The effective date of the interpretive guidance and rules described above will be 30 days from their publication in the Federal Register. Although not specified at the open meeting, we anticipate that comments on the SEC’s proposed rule on the definition of the term “significant deficiency” will be due 60 days from its publication in the Federal Register.
In light of the SEC’s new interpretive guidance, management should evaluate the guidance and assess whether implementing the new guidance immediately, in advance of management’s next Section 404 evaluation, is prudent for the company. In this regard, management should proactively seek input from its auditor as to its options for implementing the new guidance, and should be prepared to advise the audit committee regarding these options as soon as possible.
New PCAOB Auditing Standard for Internal Control Over Financial Reporting
The PCAOB adopted a new auditing standard for the audits of issuers’ internal control over financial reporting under Section 404 of Sarbanes-Oxley. If approved by the SEC, AS-5 (An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements) will supersede the PCAOB’s Auditing Standard No. 2 (“AS-2”). According to statements made at the PCAOB’s open meeting, AS-5 is intended to better align the costs and benefits of the internal control audit by focusing auditors on the matters most important to internal control, eliminating unnecessary procedures, scaling the audit for smaller companies and simplifying auditing requirements.
AS-5 will differ from AS-2 in a number of respects. For example, AS-5 will focus auditors on the areas that pose the greatest risk that internal controls will fail to protect against material misstatements. It will do so by using a principles-based, top-town approach that emphasizes the importance of auditing higher risk areas that can have a pervasive affect on internal control over financial reporting, such as the financial statement close process and controls designed to prevent management fraud. At the same time, AS-5 will encourage auditors to consider a range of possible combinations of procedures to obtain the evidence necessary according to the assessed level of risk. Additionally, AS-5 will clarify that an auditor is not required to evaluate management’s own evaluation process or express an opinion on the adequacy of management’s evaluation process. Moreover, AS-5 will provide commentary throughout the standard on how to tailor an internal control audit to the size and complexity of the company being audited.
In addition, AS-5 will provide clarification regarding the appropriate materiality standard to apply in the context of internal audits. Specifically, AS-5 will provide that, “in planning the audit of internal control over financial reporting, the auditor should use the same materiality considerations he or she would use in planning the audit of the company’s annual financial statements.”
The PCAOB also made a number of changes to AS-5 in response to comments received through the public comment process. Among the changes are the following:
In conjunction with the new auditing standard, the PCAOB also adopted proposed Rule 3525, which relates to pre-approval of internal control-related services provided by the auditor. This rule provides that auditors are required to follow certain documentation and other procedures when requesting pre-approval from the audit committee of internal control-related services.
Auditors will be required to use AS-5 for audits of internal control for fiscal years ending on or after November 15, 2007, assuming the SEC approves AS-5 as adopted by the PCAOB. Early compliance with AS-5 is permitted immediately following SEC approval of AS-5. Auditors choosing not to comply early (in other words, auditors who continue to use AS-2 after the SEC approves AS-5, but before AS-5 becomes mandatory) will nonetheless be required to apply the definition of “material weakness” as that term is defined in AS-5.
* * * * *
Gibson, Dunn & Crutcher lawyers are available to assist in addressing questions you may have regarding these issues. Please contact the Gibson Dunn attorney with whom you work, or
John F. Olson (202-955-8522, email@example.com),
Brian J. Lane (202-887-3646, firstname.lastname@example.org),
Ronald O. Mueller (202-955-8671, email@example.com),
Amy L. Goodman (202-955-8653, firstname.lastname@example.org),
Michael Scanlon (202-887-3668, email@example.com),
Elizabeth Ising (202-955-8287, firstname.lastname@example.org) or
Susan Wilson (202-887-3675, email@example.com).
© 2007 Gibson, Dunn & Crutcher LLP