404 Makes an IPO: Mission Impossible

Among other changes, Leone also promotes replacing the "as-of date" requirement of the attestation with a "for-the-period-ended" requirement because internal controls should be functioning continuously, and "auditing to a specific date has created a logjam of work to provide comfort over the effectiveness of internal control as close as possible to the 'as-of' date."

Along with supporting his colleague's positions, Brian Ferguson, finance chief of Calgary's Encana Corp. would like to see "rotational testing" of controls. The concept is to require only periodic testing, possibly every three years, for medium- and low-risk controls that don't have a track record of problems. The oil and gas company with the $44 billion market cap is listed on the New York Stock Exchange.

The risk-based approach and the elimination of auditor attestations is also cited in William Sheridan's comment letter. Sheridan is the CFO of Sotheby's Holdings, the $2-billion (market cap) auction house company. He also prescribes rescinding the auditor walkthrough requirement because it's "duplicative." The rule mandates that external accountants examine systems and processes that may not be "key," as defined by management. According to Sheridan, less critical controls are already tested by management as part of the key controls assessment.

In line with the recommendations of other financial executives, Stephen Dickins, controller and chief accounting officer of Media General Inc. also calls for "additional clarity on materiality thresholds. Specifically, he urges the Public Company Accounting Oversight Board to provide guidance for what constitutes a significant deficiency and a material weakness, rather than continue to rely on the "rule of thumb" percentage of net income limits that are now used, notes his comment letter about second year experiences.

Dickins writes that external auditors usually apply the 1 percent and 5 percent net income thresholds to significant deficiencies and material weaknesses, respectively. "Given the large degree of subjectivity around controls exception evaluations, such thresholds "unfairly and severely penalize companies in low net income or negative net income situations."

In addition to using a risk approach to determine the scope of a controls audit, Michael Keane, CFO of Computer Sciences Corp., contends that a materiality measure may be another way to achieve controls testing efficiencies. In his comment letter, submitted with CSC's Corporate Vice President Leon Level, the executives suggest allowing "tolerable errors" that represent 5 percent of before tax earnings, rather than the more aggressive 2 percent to 2.5 percent thresholds currently used by auditors. Tolerable errors are self-correcting or ones that don't reoccur.

Keane also notes that using SAS 70's "baselining" approach to test information technology controls would also improve 404 efficiency. Essentially, once satisfactorily tested, companies would only have to test IT system changes.

Further, Keane asserts that an undocumented process should not automatically classify attendant controls as ineffective, as is the common practice among auditors. In certain cases, the results of a test should be enough to determine whether a control is effective.

• « previous
• 1
• 2