pricewaterhousecoopers society of utility and regulatory financial analysis (surfa) april 21, 2005...

Society of Utility and Regulatory Financial Analysis (SURFA)

PricewaterhouseCoopers

April 21, 2005Georgetown University Conference CenterWashington, DC

37th Financial Forum of the Society of Utility and Regulatory Financial Analysis (SURFA)

Securities Regulation:Risks and Realities in the

Era of Sarbanes-Oxley

Lessons Learned and Moving Forward

Sar

bane

s-O

xley

rou

ndta

ble

disc

ussi

on

Section 404 – Lessons Learned and Moving Forward



First year 404 results

What percentage of accelerated filers with November 30, 2004 or December 31, 2004 year-ends will report ineffective internal control over financial reporting?

• Less than 1%

• Between 1% and 5%



• More than 15%




8.6%2112,458

PercentageAdverse ReportsTotal 404 Reports

Preliminary Results



Note – The above information is through April 4, 2005 and includes companies with a November 30, 2004 or a December 31, 2004 year-end. It does not reflect final results as some companies used the SEC’s 45 day exemptive order. Accordingly, the number of adverse reports is expected to increase through April 30, 2005.




• Most material weaknesses have related to AS 2.139 or AS 2.140 circumstances – (e.g., restatements or material audit adjustments)

• Most frequent areas of material weaknesses:- Accounting for income taxes- Misapplications of generally accepted accounting principles- Insufficient accounting resources- System access at the application level- Revenue recognition





• Market reaction to material weaknesses has been moderate – slightly negative

• Investors appear to be reacting differently to the type of material weakness:- Relationship between material weaknesses and the risk of future

financial statement restatements- More process specific material weaknesses appear to be of less

concern to investors versus those that are pervasive- Less pervasive material weaknesses should be easier to remediate




First year 404 costs

• Level of effort required:- Significant task for both management and the auditor- Many companies more than doubled their original estimates; some

more than tripled their original estimates- Some large companies spent more than 100,000 hours of internal time

• Why was such a large effort required:- Deferred maintenance – Documenting and evaluating the design of

internal control over financial reporting had not been done in recent years

- Limited management guidance- Steep learning curve- Remediation of deficiencies was more extensive and time consuming

than expected




Lessons learned

• The need for strong controls over the selection and application of accounting policies as well as a periodic review of the appropriateness of those policies

• Information technology general controls and automated application controls

• Over-emphasis on routine controls and under-emphasis on softer components of internal control




Lessons learned

• Evaluating the significance of control deficiencies:- Complex and time consuming process given the relatively large

number of control deficiencies- Not unusual to see companies with hundreds and sometimes

thousands of deficiencies- Point in time concept allowed companies to remediate existing

material weaknesses

• Framework for evaluating control exceptions and deficiencies was a useful tool:- Still required significant judgment by management and the auditor- Consideration of compensating controls was difficult- Additional practical experience will be helpful




Lessons learned

• Strong controls over the selection and application of accounting policies, including periodic review, are critical

• Accounting policies have become increasingly complex and results show many companies have not kept controls up to date (“deferred maintenance”)

• Design may be ineffective as accounting personnel may not have commensurate GAAP knowledge to perform the control




Lessons learned

• Evaluating ITGC control deficiencies was complex

• Testing of automated application controls when ITGC are ineffective

• Controls related to ERP systems have not been fully implemented

• Opportunity for increased reliance on automated application controls versus manual controls



Moving forward

• SEC roundtable on implementation of Section 404 held on April 13:- Six panel discussions chaired by SEC staff- All major constituencies will be represented- Costs and benefits of 404 will be a major focus.

• Potential areas of clarification to AS 2:- Risk-based approach – vary nature, timing and extent of testing from

year to year- Use of management’s self-assessment testing- Reliance on ITGC to reduce testing of automated application controls- Measuring potential impact of control deficiencies on interim materiality

•




Moving forward

• PCAOB recently issued a proposed auditing standard on reporting on the elimination of a material weakness

- Establishes a stand-alone engagement that is entirely voluntary- Engagement could be undertaken at any time during the year- Reporting is limited to the elimination of the material weaknesses

identified in an annual assessment process- Auditor's report based on management's assertion that the material

weakness has been eliminated- This type of engagement may not be appropriate for all material

weaknesses



Sar

bane

s-O

xley

rou

ndta

ble

disc

ussi

on

Section 404 – Deficiencies, Common Problem Areas & Reporting



Total Deficiences

0

100

200

300

400

500

600

700

800

$1B - $5B $5B - $25B > $25B

Nu

mb

er

of

De

fic

ien

ce

s

Not Remediated

Remediated


Sox 404 Year-end Survey Results of 250 PwC client results




Survey Results – Significant Deficiencies and Material Weaknesses

0

2

4

6

8

10

12

$1B - $5B $5B - $25B > $25B

Not Remediated Significant Deficiency Mat'l Weakness




Survey Results – Significant Deficiencies and Material Weaknesses

• Systems (25%)

• Models and Spreadsheets (15%)

• Period-end Financial Reporting (15%)

• Application of GAAP (15%)

• Reconciliations (10%)

• Taxes (10%)

• Entity Wide (0%)

• Other (20%) - Primarily estimation controls (Valuation, FAS 91)




Compliance Week Data

Registration results• Total 2,335• Adverse Opinions 131 (6%)• Extensions 348 (13%, 19% combined)

Types of Material Weaknesses• Systems (9%)• Review, Monitoring, Documentation (16%)• Period-end Financial Reporting (2%) • Application of GAAP/Accounting Personnel (23%)• Reconciliations (1%)• Taxes (6%)• Entity Wide (13%)• Other (30%) – Primarily specific process breakdowns (Revenue, AP,

Accruals, Leases, etc.)



Deficiency monitoring and disclosures

• Timely disclosure of “known” material weaknesses- Disclosure may be needed prior to filing a Form 10-Q or

Form 10-K

• Significant deficiencies that remain uncorrected after some reasonable period of time should be regarded as a strong indicator that a material weakness in internal control over financial reporting exists

Overall Year 2 Considerations



Polling Question

Which of the following “change events” may warrant disclosure under Section 302?

a. Remediation of a material weaknessb. New systemc. Acquisitiond. Business or management reorganizatione. Termination/resignation of CFOf. Fraudg. All of the above




Deficiency monitoring and disclosures

• Change events (“material changes”) under Section 302 may need to be disclosed – whether good or bad changes

• PCAOB proposed new auditing standard – Reporting on the Elimination of a Material Weakness


Steps to a sustainable Sarbanescompliance program

Identify required

improvements

Design compliance

program elements

Identify technology

enabler

Operate

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

With on-going compliance, the emphasis shifts from documentation of controls and initial testing to:- Regular evaluation and testing- Resolution of exceptions- Keeping up with changes in people,

process, and technology- Improving the control

environment to minimize exceptions

On-going compliance also means identifying and replacing “band-aid” remediation fixes to minimize potential future control breakdowns, especially for those controls tagged as significant deficiencies or material weaknesses.

Formalize SOX program office

Assess year one process &

output

Implement

Beyond 404: Recognizing and Building Value

pricewaterhousecoopers society of utility and regulatory financial analysis (surfa) april 21, 2005...

Documents

financial reporting

financial forum

oxley lessons

pervasive material weaknesses

expected section

helpful section

large companies

design of internal control