A Tough Act to Follow

Offered choices on how to fix 404, about 70 percent say they would like to see regulators raise the bar for "material deficiency." Close to half want the attestation of internal controls performed once every three years, rather than annually.

This Is Only Attest
Certainly, many CFOs say they would like auditors to take a more sensible approach to testing. Rich Goudis, CFO of Herbalife International of America Inc., a Los Angeles–based weight-management company, wants auditors to abandon the checklist approach that forces clients to put the same level of effort into mending each risk. Instead, Goudis believes public filers should be able to proceed on the basis of "risk-based assessments."

The major flashpoint of the argument is the way auditors attack 404. Some finance chiefs feel that the Public Company Accounting Oversight Board (PCAOB) has taken a heavy-handed approach to Auditing Standard No. 2, which instructs engagement partners on how to check their clients' internal-controls reviews. As a result, CFOs say auditors test and retest internal controls to ensure their sign-offs are beyond question. Finance managers contend the prospect of auditor nit-picking forces clients into indiscriminate documentation of internal controls.

The PCAOB appears to be aware of the situation. In a November 2005 report on the initial implementation of AS2, the board criticized auditors who "did not alter the nature, timing, and extent of their testing to reflect the level of risk."

By taking a one-size-fits-all approach to their testing, accountants apparently ignored the risk profiles of individual companies. "As a result, some auditors appeared to have expended more effort than was necessary in lower-risk areas," the board stated, noting that "in some cases, a higher-risk area should have received more audit attention than it did."

Robert Daleo, CFO of Stamford, Connecticut-based Thomson Corp., would like to see a little more specificity coming from the PCAOB. He believes the board should spell out "where the real pain points of cost and errors are." Daleo notes, for example, that the PCAOB has stated that external auditors may rely on the work of internal auditors and others rather than retracing steps. But Daleo maintains that the board should say that auditors must rely on the work of others. By taking discretion out of auditors' hands, he argues, the board would also relieve engagement partners of the temptation to test everything.

Other finance managers echo that sentiment. Indeed, 6 out of 10 respondents to the CFO survey said an auditor should be allowed to rely on the work of a client's internal-audit staff when assessing internal controls. And close to half of the polled executives indicated they would alter AS2 to allow for greater input from independent auditors before the attestation phase. Says Donna de Winter, CFO of Waltham, Massachusetts-based Geac Computer Corp.: "We have to get to a practical position where [auditors] can provide you with advice without losing independence on all the numbers you represent."

You Make the Call
That's not likely to happen soon. Robert Kueppers, deputy chief executive of Deloitte & Touche USA LLP, counsels engagement partners to work with clients on technical issues but to stop just shy of providing them with the answers. The principle is simple, Kueppers says: while there should be "a robust discussion of the alternatives," clients must arrive at their own conclusions.

The concept is spelled out in Section 103 and Section 201, which limits the types of services an external auditor can provide. That provision was intended, in part, to eliminate the type of clubbiness that led to problems at Enron and WorldCom, et al. But as CFO reported in "Fractured Fraternity" (September 2005), finance managers say external auditors even shy away from offering advice on topics that aren't restricted by Sarbox, things like mergers and acquisitions and tax issues.

In practice, many finance executives miss their auditors' advice. Two years ago, for instance, David Koeninger, CFO of Radiation Therapy Services Inc., in Fort Myers, Florida, sought information from his company's auditor about how to calculate and report the sales of a minority interest in a business. To his surprise, Koeninger says he found the accountant suddenly tongue-tied. "Make your decision," the auditor purportedly told the finance chief, "and we'll tell you whether it's right or wrong."

Koeninger would like a more collaborative relationship. He believes independent auditors should be allowed to review a company's work and offer their observations on it, rather than providing a certified opinion. If you just "require them to attest to completeness and accuracy," the CFO adds, "you don't get your money's worth."

What's more, failure to get an external auditor's imprimatur on internal controls can prove disastrous for a company's shareholders. In mid-January, management at Take-Two Interactive Software Inc. announced that the company's external auditor was going to issue an adverse opinion on the game maker's internal controls. Within days of the announcement, the share price of the maker of "Grand Theft Auto" dropped more than 20 percent — from around $19 to less than $15 — and has not made up much ground since.

• « previous
• 1
• 2
• 3
• next »