Auditor's Report Changes Dramatically Under New Rules

By James Gentry
July 18, 2005 06:56 PM

If you cover a large public company, you've probably noticed that the once-simple auditor's report has taken on a much more complex appearance.

 

As a result of the Sarbanes-Oxley Act of 2002, audits of public companies are now far more extensive (and expensive). The new audits also are more likely to give reporters material for stories.

 

To review, before this year, the job of the auditor was to determine whether the financial statements were "presented fairly, in all material respects, in accordance with Generally Accepted Accounting Procedures (GAAP)." The vast majority of audits resulted in a report, several sentences long, where the auditor basically said:

 

·          We looked at these statements.

·          They're management's responsibility -- we're just here to express our opinion.

·          We followed the rules in our audits, and here's what an audit involves.

·          In our opinion, the statements fairly present the company's position.

 

Under that model, the vast majority of companies received a "clean" opinion, meaning that the statements fairly presented the company's position and the auditors didn't foresee major issues. On occasion, a company received a "qualified" opinion, particularly if the auditors thought the company had failed to follow GAAP or that it had a major contingency that raised questions about the company's ability to continue as a "going concern" (or a fully operating entity)

 

The new auditor's report combines the old report with regulators' demand that companies demonstrate much greater "internal control" over financial reporting. Internal control refers to issues such as training for staff members who handle financial data, more stringent rules, proper documentation for all transactions, etc.

 

The new auditor's report has four components and, whereas the old report was one fat paragraph, the new reports can cover several pages. The required four points are:

 

1.       Company management must provide an assessment of whether it has effectively maintained internal control over financial reporting. This statement is typically headlined something like, "Management's Report on Internal Control Over Financial Reporting," and is signed by the CEO and CFO. This new statement accompanies the auditor's report.

 

If the company believes it has maintained effective control, its statement can be as short as several sentences, such as the statement by General Electric CEO Jeffrey Immelt and CFO Keith Sherin in the firm's 2004 annual report. By contrast, the statement can be several pages long, such as the two full pages Eastman Kodak uses to describe its internal controls problems in its 2004 annual report.

 

2.       The auditor must state whether it agrees with company management's conclusion regarding whether it has maintained effective internal control over financial reporting.

 

3.       The auditor must provide its own opinion on how effective the company has been regarding maintaining internal control over financial reporting.

 

4.       The auditor must provide its opinion on the financial statements themselves -- in effect, what the old auditor's opinion entailed.

 

Points 2, 3 and 4 are often found in a section headlined something like "Report of Independent Registered Public Accounting Firm." Internal control might also be covered in a section headed "Report of Independent Registered Public Accounting Firm on Internal Control Over Financial Reporting." These statements typically appear with "Management's Report on Internal Control Over Financial Reporting."

 

For more details on the new auditor statements and the reporting options, see the accompanying graphic at the end of this article from the report, "Perspectives on Internal Control Reporting," prepared by the Big Four accounting firms. The graphic below shows the kinds of opinions the auditor can give for each of the four steps above.

 

If a company is found to have inadequate internal controls, it must develop and submit a remediation plan as part of the management statement that accompanies the auditor's report. Then the company is required to provide in its quarterly statements an update on its progress toward fixing the problem(s). And even if a company believes it has solved its internal control problems during the middle of the year, it can't receive a clean opinion until the company undergoes its next end-of-fiscal-year audit.

 

Another new development is that the statements that auditors now provide can differ significantly from audit firm to audit firm. Previously, the fat paragraph statement was essentially uniform across audit firms.

 

This year, the expanded audit report applies only to annual reports filed by large companies or what are called "accelerated filers," meaning firms with a market capitalization of more than $75 million. Other companies ("non-accelerated filers") must implement the new audit report by July 15, 2006.

 

Mid-sized and small public companies are expected to have much more trouble complying with the internal control standards, reports the corporate governance newsletter Compliance Week, because, "small companies usually lack robust finance departments, (and) because their controls are typically less mature than large organizations." The Securities and Exchange Commission, however, is not expected to ease the requirements for mid-sized and small companies.

 

A June 18 report by Compliance Week and Raisch Financial Information Services, which the former has also acquired, indicated that almost 10 percent of the 1,968 companies filing 10-Ks this year failed the auditor disclosure statement on whether a company had a material weakness in its internal controls over financial reporting. Compliance Week has reported that the failure rate for mid-sized and small companies is expected to be significantly higher.

 

Interestingly, a study by research firm AuditAnalytics.com indicates that smaller accounting firms BDO Seidman and Grant Thornton found a much higher percentage of material weaknesses in the companies it audited than the Big Four firms did. Seidman and Thornton handle a large percentage of non-accelerated filers, which could be bad news for those types of companies.

 

Furthermore, a study by Glass Lewis & Co., a proxy advisory firm, found that although companies have been complaining that Sarbanes-Oxley has made it difficult for them to file their financial data on time, the reality is that fewer than half of firms that file late cited internal control issues as the reason for their delay.

 

Other Accounting News

 

The number of companies changing their audit firms jumped almost 80 percent in 2004 to more than 1,600, according to Glass Lewis & Co. Over two years, 2,500 companies, or more than one-fourth of publicly listed companies, changed auditors. Small companies changed auditors most frequently.

 

As a result of the increasing costs of compliance with the Sarbanes-Oxley Act, many smaller companies are considering selling or merging, according to a study by the law firm of Foley & Lardner. Compliance costs increased approximately 33 percent in 2004 for public companies that report less than $1 billion in revenue.

 

Other studies also have looked at the costs. For a nice overview, see "How Much Is It Really Costing to Comply With Sarbanes Oxley?" by Carl Bialik in the June 16 issue of The Wall Street Journal Online.

 

If you have questions concerning the new auditor's statement, feel free to contact me.

 

 

Please enter your friend's e-mail address

Please enter your e-mail address

If you would like to include a message, please add it here:

Copyright © 2008 Donald W. Reynolds National Center for Business Journalism