PCAOB releases long-awaited AS5 revising implementation of SOX 404

It's been a busy day. In addition to the NYSE and Euronext merger (see here), and the Thai market falling through the floor (see here), the Public Company Accounting Oversight Board today released a revision to its vilified Audit Standard 2 with a new Audit Standard 5. The proposals are designed to take much of the sting out of how Section 404 of the Sarbanes-Oxley Act is implemented. A copy of the proposed AS5 can be found on the PCAOB's website here.

SOX 404, of course, is a provision of the Sarbanes-Oxley Act that mandates that the management of public companies not just provide investors with a statement about the strength of the company's internal controls (the systems the company uses to track how the company is spending its money and make sure managers are stealing it), but that the company's independent auditor attest to this management statement. Following the collapse of the accounting firm Arthur Andersen, auditors have been extremely reluctant to make such attestations without thorough (and expensive) testing of company internal controls.

The new AS5 (which has been in the works for some time -- see here) has two components. The first is a complete revision of AS2 that:

• Directs the auditor to the most important controls and emphasize the importance of risk assessment;


• Revise the definitions of significant deficiency and material weakness, as well as the "strong indicators" of a material weakness;


• Clarify the role of materiality, including interim materiality, in the audit;


• Remove the requirement to evaluate management's process;


• Permit consideration of knowledge obtained during previous audits;


• Direct the auditor to tailor the audit to reflect the attributes of smaller and less complex companies;


• Refocus the multi-location testing requirements on risk rather than coverage; and


• Recalibrate the walkthrough requirement.

In addition, the PCAOB is revising certain provisions of AS2 regarding when an audit firm can rely on the work of others when assessing a company's internal controls. According to the PCAOB, the new provisions would:

• Allow the auditor to use the work of others, and not just internal audit, for both the internal control audit and the financial statement audit, eliminating a barrier to integration of the two audits;


• Encourage greater use of the work of others by requiring auditors to evaluate whether and how to use the work of others to reduce their testing;


• Require the auditor to understand the relevant activities of others and determine how the results of that work may affect the audit;


• Provide a single framework for using the work of others based on the auditor's evaluation of the combined competence and objectivity of others and the subject matter being tested; and


• Eliminate the principal evidence provision previously included in AS No. 2.

The PCAOB's press release announcing the proposal can be read here. The various PCAOB board members' statements (as well as the briefing paper I'm cribbing all this from) can be read here.

Despite what some had urged, the new AS5 does not exclude small companies from having to have auditors attest to their internal controls, but it does try to make the internal controls testing "scalable," so that audit firms will not have to apply exactly the same standards to small companies as they might for large issuers. This actually follows the (somewhat surprising) recommendations of the Committee for Capital Markets Regulation (see here).

The new AS5 proposal comes less than a week after the SEC also released "management guidance" designed to provide companies with cover should they not do everything audit firms would like them to in testing their internal controls. (See this post here. The SEC management guidance can be read here.)

The SEC also published a press release praising the PCAOB for its work, which you can read here.

PCAOB’s Niemeier defends Sarbanes-Oxley as Audit Standard 2 is reconsidered

Last week, Public Company Accounting Oversight Board member Charles D. Niemeier spoke at The Atlantic’s “Ideas Tour,” which has been billed as a convention of “great thinkers and prominent members of the public for live dialogue, debate, and discussion around the celebration of ideas.” Niemeier spoke on “American Competitiveness in International Capital Markets.”

Niemeier’s remarks come just as the PCAOB is in the middle of a complete revision of Audit Standard 2 (which, rumor has it, will be renamed Audit Standard 5). AS2 is the PCAOB’s rule that specifies how independent audit firms should audit a public company’s internal controls as part of the dreaded Section 404 of the Sarbanes-Oxley Act. Its detailed specifications have permitted audit firms (who were burned so badly following Enron that one of their largest, Arthur Andersen, collapsed) to force issuers to pay large sums to ensure that their internal controls are strong enough that another Enron or Worldcom doesn’t happen again. However, critics accuse AS2 of focusing on such picayune matters that the costs involved do not justify the additional safety to investors. (In reality, when companies complain about Sarbanes-Oxley, they mean Section 404. The costs created by the rest of the act are minor.)

Niemeier’s speech offers a defense of high U.S. regulatory standards and against the charge that the Sarbanes-Oxley Act is driving foreign issuers away from the U.S. market. In doing this, he makes several interesting points:

1. Individual investors enhacne the competitiveness of companies listed in the United States by offering low-cost, long-run funding at a level unparalleled in any other country. These investors are able to do this because of the degree of investor protection found in the U.S. market. Niemeier cites data showing that the cost of capital for foreign firms cross-listed on their home markets and in the U.S. is significantly lower (from 7 percent lower for Japanese companies, to 25 percent lower for Egyptian firms).
2. Not every company wants to pay the price that comes with this low-cost capital. In particular, companies with powerful insider may not wish to list in the U.S. becuase their abilities to extract private benefits from the companies they control are limited in the United States because of U.S. laws protecting minority shareholders.
3. Over time, as more and more foreign markets adopt stronger securities regulations and shareholder protection laws, these markets also become attractive places to invest. U.S. markets now face more competition because of this.
4. The decline in the U.S. share of world IPOs long predates Sarbanes-Oxley and is likely related to other polistical and economic factors. Niemeier cites data showing that the U.S. portion of world IPOs has been decreasing since 1996, and has actually recently seen a 15 percent uptick. Part of this is due to low interest rates around the world, which has made private equity and leveraged finance firms more attractive vis-a-vis equity issuances. In addition (and as I have noted here), a large number of recent IPOs by privatized state-owned enterprises (particularly in France and China) has boosted foreign markets, notwithstanding the significant valuation premium the IPOs might have gotten had they listed in New York. (SEC Chairman Cox made a similar observation in a speech he made in China just prior to the China Construction Bank IPO in Hong Kong.)
5. Niemeier notes that the number of U.S. companies having IPOs has dropped dramatically since the collapse of the dot.com bubble. He also takes a swipe at the UK, noting that the London Stock Exchange's Alternative Investment Market (AIM), which advertizes itself as a low-regulation market for new companies, is really looked at more as an alternative to private financing than having an IPO on the U.S. market.
6. Niemeier also states that he expects changes to SEC and PCAOB rules to help address the costs associated with Section 404.

Niemeier's remarks, complete with charts and data, are a direct response to criticism of Sarbanes-Oxley, from both abroad, and from domestic groups such as the Committee on Capital Markets Regulation. (It's just too bad the PCAOB likes to bury these speeches so deep in its website.) Interestingly, the proposed changes to AS2 are barely referenced, which may indicate Niemeier is not yet completely on board with the extent of the proposed changes. (It is also possible that the PCAOB hasn't completely agreed on the extent of the changes itself, but given the pressure the PCAOB is facing from both Congress and the SEC, anything less than a drastic change seems unlikely.)