CFO Blog: Commentary and Opinion

I predicted last week that auditors would take it in the neck during today's panels. To my surprise, the first shot at auditors was leveled (inadvertently, I'm sure) by PriceWaterhouseCoopersWC's Samuel A. DiPiazza, Jr, who notes "The whole process of 404 highlights the difficulty that our profession is having with the shift from an unregulated to a regulated profession."

Meanwhile, Lynn Turner, former SEC Chief Accountant, addressed the benefits to investors, noting that 750 companies reported problems to date. "The good news," he says" is not only are investors able to determine where those risks lie, but they were also provided with disclosures in a number of cases that said companies have dealt with those problems." He added, "We are finding the impact on stock price is very much company by company. There's no general trend."

The New York Stock Exchange's John A Thain notes that he has input from many of the 2700 issuers listed on the NYSE. He opened his comments by praising the necessity of Sarbanes-Oxley and the resulting independence of boards, improvements of documentation, and organizational 'tone at the top.' "I broadly think confidence in the financial markets has been improved."

On the negative side, he said, there's no doubt the costs were more than companies anticipated. "There are many companies that would say they don't think the benefits achieved have been worth the cost." His take on the purpose of the days panel, then, was: What can be done to reduce the costs?

Exploring the relationships of auditors and audit committees, Alan Beller of the SEC's Corporate Finance division posed questions to Mary Bush and Michael Cook, both audit committee chairmen.

Mary Bush noted that formalizing the reporting of auditors to audit committee members was a "very good thing."

The benefits of 404, she said, vary by company. "I have seen some companies where this was really needed. Even though there were no financial problems, their controls were not up to par." For other companies, she notes, 404 was not that difficult, because controls were already so good.

"It has certainly changed with audit committees do," responded Cook. "There has been a takeover--I wouldn't say it was hostile--but a takeover [by audit committees of the controls process]. That has been good. At the same time, it has taken time away from other issues that have been important and I don't think that can continue. The majority of audit committees have spent a majority of their time on 404 and that's OK, but it can't continue."

He also added that they have had many heated, spirited discussions about fees--more than he has ever experienced before. "I don't think anyone is happy with the outcome. Certainly not the companies writing the checks. [Nor he said, were the auditors.] The best we can hope for is that everyone is unhappy about it--that's the standard we aspire to." That got plenty of laughs.

I'm not surprised to see the first panel is already revealing the cost and relationship with auditors as a recurring theme.

Bush, in fact, just added that she has heard several internal audit staffs at various companies complain that the relationship with external auditor has really changed. "That they don't feel as free to consult about accounting treatment. This I think is not good. Management and companies finance staffs has relied on that in the past and something needs to be done so those relationships can be freed up again."

Beller asked Bush how audit committees can refocus their efforts. It will depend, she said, on "how the regulators intervene with comments about what is important." Accounting Standard #2, she said, says controls have to be revisited every year, and that she says, is going to cause companies to repeat 404 in detail every year. I expect this will be a recurring theme as well.

OK, here we go. We have our first fight:

Since this [404 certification by management] is supposed to reflect management's assessment of internal controls," asked Commissioner Glassman, "is there a difference in what management sees as sufficient and what the auditors have been requiring to comfort themselves?" Her question, quite obviously, was aimed at the auditor's attestation of the reasonableness of management's certification of internal controls, which Glassman, based on her public comments, probably thinks is unnecessary and duplicative.

NYSE's John Thain responsed that of course, the "answer is yes." Many companies he said, have commented there is not enough reliance on what management and internal audit does. "Even though AS2 does allow reliance on management and internal audit, the response from companies has been that auditors were unwilling to do that."

Lynn Turner responded that in 87% of the cases where companies failed their 404 audits, their management said it was fine, "while the auditors saw it differently and found a material weakness. When we did into these, I must say, in most of those situations, we thought the auditors were absolutely right on in their conclusions. In answer to your question, there is clearly a difference, but we think the auditors have it right."

Samual DiPiazza of PriceWaterhouseCoopers responded, "This was a very difficult year and by anyone's description the process could be improved." But, he added, companies have never focused on controls like this before--a "level of deferred maintenance," he said that went on for years. "Now, I absolutely respect fellow panelists who say maybe judgment took control testing down too far." But, he noted, they checked into employee records and found terminated employees were in some cases able to access company systems for months after being terminated--including for purposes of making cash wire transfers. "An average of 275 deficiencies per company had to be fixed, from the best company down to the worst company. The learning experience, he said, is not going to be duplicated. "There were some judgments we could improve on. Costs were spent because auditors were testing things companies had just tested. That was because this was happening in real time." The standard, he said, allows judgment and does not need to be changed.

Commissioner Goldschmid, reacting, he said, to "the tension I just heard on the panel," noted "Internal control requirements have been on the books since 1977. We all know that was not followed. We left it to management from 1977 on, and I take I no one here would defend the quality of internal controls during that time."

Donaldson then weighed in, asking "How do we get out of the anecdotal phase and into the measurement phase. What is the analytical methodology that can truly measure the effectiveness of all this?"

Uh-oh. I'd read into that question some skepticism on Donaldson's part that a lot of these complaints from companies are "anecdotal."