In June 2003, the Securities and Exchange Commission (SEC) implemented Section 404 of the Sarbanes-Oxley Act of 2002, by adopting rules requiring issuers to include in their annual reports an assessment of the company's internal control over financial reporting as well as an auditor's report on that assessment.

Soon after, as required by Sections 404(b) and 103 of the Act, the Public Company Accounting Oversight Board (PCAOB) adopted Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements (AS No. 2), to apply to the newly required audits.

The SEC approved AS No. 2 on June 17, 2004. Since enactment, Section 404 has had a threatened existence. While companies reluctantly complied with the rigorous provisions, they did complain about the huge costs they had to incur and the effectiveness of these costs to decipher internal control weaknesses.

After the completion of two cycles of Section 404 audits wherein the focus was on documentation and more documentation the PCAOB has decided to lighten the effect of Section 404. There have been murmurs of protest that the Act itself is too harsh, burdening companies with additional costs that were needless.

The PCAOB is also considering a relaxation for firms that need to register, by proposing that foreign companies with 5 per cent or less of their trading volume could deregister. Companies seem reluctant to seek listing on US bourses owing to the rigorous procedures needed by the Act.

Principles based

The proposed new standard on internal control is principles-based , designed to focus the auditor on the most important matters, increasing the likelihood that material weaknesses will be found before they cause material misstatement of the financial statements. The proposed standard also eliminates audit requirements that are not needed to achieve the intended benefits, provides direction on how to scale the audit for a smaller and less complex company, and simplifies and significantly shortens the text of the standard.

In addition to the proposed internal control standard, the Board also proposes a new auditing standard on considering and using the work performed by internal auditors, the management and others in an integrated audit of financial statements and internal control, or in an audit of financial statements only.

This proposed standard is intended to further clarify how and to what extent an independent auditor may use that work to reduce the work the auditor otherwise would have to perform.

Among other things, the proposed standard would direct the auditor to the most important controls and emphasise the importance of risk assessment, revise the definitions of significant deficiency and material weakness, as well as the "strong indicators" of a material weakness, clarify the role of materiality, including interim materiality, in the audit, remove the requirement to evaluate management's process, permit consideration of knowledge obtained during previous audits, direct the auditor to tailor the audit to reflect the attributes of smaller and less complex companies, refocus the multi-location testing requirements on risk rather than coverage and recalibrate the walkthrough requirement.

Companies will benefit

The fact that the PCAOB has decided to reduce complexities in the Act would be welcomed by most companies. There have been incidents of companies restating financial statements due to genuine errors, facing a PCAOB/SEC investigation and ending up losing their CFO as well as the market capitalisation on the Nasdaq. Regulators in the US should also be hoping that there would be no more Enron-type scandals forcing them to consider strict regulation only to ease it after a couple of years. In the end, it could be said that all Sarbox has achieved till date is create a fear-factor among companies and force companies and auditors to document everything relentlessly.

Mohan R. Lavi
(The author is a Hyderabad-based chartered accountant.)