Newsletters - Partner's Report for CPA Firm Owners |
|
June 2005
SOX Opportunities to Consider Now
You or another partner in your firm have probably already benefited from Sarbanes-Oxley, if only indirectly. How? Many engagements have changed hands because of independence or conflict-of-interest rules, and as a result of the Big Four and other firms altering the focus of their practices.
While the well-publicized trickle-down of work may not have reached all small firms, partners in even solo-practitioner firms have had the chance to participate in handling pieces of engagements related to SOX that they otherwise would have been unable to experience.
Now that many public companies have completed the first round of reporting under Section 404, will there be less SOX-related work? Will there be less work for CPA firm partners because smaller companies have yet to file their first SOX reports? What changes should partners expect to see in SOX-related work?
There is likely to be SOX work for CPA firm owners and their firms for some time to come. Despite complaints from the business community about the onerous nature—and price tag—of compliance, and some minor SEC adjustments in the form of extended deadlines for smaller public companies and foreign companies, it seems that SOX is here to stay (as well as various upcoming provisions with which your clients will need assistance).
The irony of SOX. Although many saw Sarbanes-Oxley as Congress’s intent to "punish" CPA firms for "permitting" clients such as Enron to violate the law, the Act has undeniably provided more work for CPA firms. When audit rules change, auditors are required to help ensure that companies comply. CPA firms have stepped in and helped their public company clients to prepare for and implement SOX provisions. The redistribution of work among large regional, local, and small independent firms and the various alliances among such firms have been benefits for CPA firms.
The largest firms—and their partners—have probably garnered the greatest benefit from SOX. Its compliance engagements are a leading niche now among the Top 100 firms, according to Accounting Today’s Top 100 analysis. Arranged by revenue, the Top 100 reported that only business valuations (89% of firms offer these services) topped SOX compliance (77%) in niches.
"Sticker shock" and other client concerns. Although research into the exact costs of preparing for and implementing Sections 404 (internal controls) and 302 (executive certification of financial information) provides varied numbers, it is clear that compliance costs more than clients estimated—and they’re distressed about it. A sample of the research:
Public companies continue to support the law—at least outwardly—despite their unhappiness with the price tag. The SEC has been collecting input from public companies about the costs, and may take action following a spring meeting at the SEC with public-company representatives. The action is more likely to be palliative than to retract any provisions of the law.
Public-company executives told the SEC at the meeting that they want specific implementation changes, according to reporter Jonathan Glater in the New York Times (www.nytimes.com) article, "Here It Comes: The Sarbanes-Oxley Backlash."
They also feel auditors are too conservative, requiring disclosure of "everything," and are testing controls that could have no material effect on financial reports because the auditors fear regulators and potential lawsuits. Other complaints: Section 404 compliance takes time from other activities, and small companies, in particular, suffer as a result.
Of the 2,500 companies that filed internal controls reports pursuant to Section 404 by the end of March, about 8% found material weaknesses, SEC chair William Donaldson noted at the meeting. The executives countered that complying with Section 404 has been more expensive than first anticipated and questioned whether the benefit, which they said has yet to be quantified, is worth the cost. William McDonough, chair of the Public Company Accounting Oversight Board, said at the meeting that the SEC would consider ways to provide "more guidance" on Section 404 requirements.
The SEC has already provided some relief to smaller public companies by extending the time for those and foreign companies to file reports on internal financial controls under Section 404—an additional year, from July 15, 2005 until July 15, 2006. Note: Small companies are defined under the guidelines as U.S. firms with market capitalization of less than $75 million. Large U.S. companies have been required to comply with Section 404 for their first fiscal years ending on or after Nov. 15, 2004.
The fees forecast. A number of researchers, as well as the Big Four, believe SOX costs will be lower now that the first round of reporting for large companies is over. For example, a letter sent to the SEC by KPMG, Deloitte, PricewaterhouseCoopers, and Ernst & Young said that the cost of compliance associated with Section 404 may drop as much as 46% for some Fortune 1000 companies. The reason for this anticipated cost reduction is the prevalence of one-time costs during the first year, when clients had to prepare for compliance, which included costs for initial documentation and remediation of key controls, adjusting to complex new reporting requirements, and uncertainties about the extent of activity required under the law.
Their report looked at 90 Fortune 1000 audit clients with average revenues of $8.1 billion. Among these companies, 404 compliance costs were about 0.1% of total company revenue. The companies spent an average $7.8 million on Section 404 compliance in 2004. Section 404 audit fees averaged about $1.9 million—or about 0.2% of the companies’ total revenue—and accounted for a fourth of total Section 404 costs in 2004.
In addition to lower costs after the start-up compliance year, efficiencies may be available from the use of technology and from staffing changes within public companies. According to a report from AberdeenGroup, The Automating SOX Compliance Benchmark Report, a combination of business process analysis, project management, and technology changes can help companies comply with SOX requirements. Companies that have a Chief Risk or Chief Compliance Officer are ahead of others in addressing these issues, the report found.
SOX work to come. Although clients won’t have the start-up costs for Sections 404 and 302, they will still have to comply with the extensive reporting on a regular basis. There are other compliance areas that can offer SOX-related engagements for partners. The accompanying figure, "Sarbanes-Oxley Implementation Timeline: Ernst & Young Develops 36-Month Project Blueprint," provides a list and suggestions for when this work will be most important to the lifecycle of the public client. The value you provide to your clients. As with any service, emphasizing value is key to keeping and expanding your work with public-company clients in SOX-related services. This may help to ease the pain of your clients’ costs associated with SOX. In dealing with clients’ cost concerns, it may also help to share information about the benefits of SOX. Forty-nine percent of the nearly 200 respondents to the 2005 Financial Executive Report, conducted by Oversight Systems (Atlanta; www.oversightsystems.com/survey.html), report that SOX compliance resulted in reduced risk of fraud and errors; 48% said they now have more efficient financial operations; and 31% see a decline in error rates. However, the participating companies noted that keeping up employee morale under the pressures of compliance and controlling compliance costs are key issues. Research by the Institute of Internal Auditors (IIA; Altamonte Springs, Fla.) among 171 of its members finds a belief that improvements are coming from SOX. IIA members expect controls to improve somewhat for some accounting processes as a result of SOX, despite the fact that the costs to obtain those improvements far exceed the benefits in the first year. Furthermore, they said compliance benefits in accounting are roughly equivalent to costs in subsequent years—which may be the best news for ongoing SOX engagements for CPA firms.
And a cost/benefit analysis of Sarbanes Oxley and Sections 404 and 302 finds value in SOX—once companies get through the full compliance process. However, the survey of 220 businesses by Revenue Recognition.com and IDC notes the existence of a "compliance chasm"—companies that cross this chasm achieve more effective results at less cost. That survey asked respondents to rate the cost of six major SOX compliance tasks and their effectiveness for improving risk management. The costs and effectiveness ratings were almost equal for activities such as documenting accounting policies, certification and sign-off on internal controls, certification of financial statements, and response to external audit attestation processes.
Two exceptions: The cost of documenting internal controls was rated substantially higher than effectiveness for improving risk management. Also, the cost of fixing discovered weaknesses was rated substantially lower than its effectiveness for improving risk management.
"Sarbanes-Oxley compliance is a major undertaking," said Kathleen Wilhide, compliance research director at IDC. "2004 was a baseline year for organizations to understand and execute on Sarbox Section 404. Companies will now shift into sustainability mode, looking to optimize Sarbox processes through the use of technology and with an eye toward broader performance and risk management goals. While Sarbox 404 has been costly, the fact that organizations perceive real value in these efforts as they identify and remediate weaknesses is key."
Effect on private companies and nonprofits. Private companies and nonprofits are not required to comply with SOX provisions, although some state laws have been enacted requiring compliance with similar rules. Nonetheless, many are choosing to adopt some SOX provisions and practices voluntarily, according to research from the law firm Foley & Lardner LLP (www.foley.com). Private companies and nonprofits are choosing relatively less expensive public-company governance steps, including certification of financial reports by CEOs or CFOs, election of independent directors, development of ethical codes, and approval of non-audit services by the board of directors. The research also found that:
Possible changes to SOX to watch for. The PCAOB has proposed a voluntary internal controls standard that would permit an engagement to assess whether public companies have repaired previously identified internal control weaknesses identified to comply with Sections 404 and 302. The standard would establish a voluntary, stand-alone engagement performed only at the request of the issuer at any time during the calendar or fiscal year. This standard would be narrower in scope than the PCAOB’s Auditing Standard Number 2, according to PCAOB chair William McDonough. The goal is a voluntary means of showing the public that the issuer has corrected disclosed weaknesses. Whether public-company clients would welcome the additional expense of a check-up engagement is unclear, especially since so many clients are reeling from the bills they received for the first year’s compliance work. In addition to watching for other changes from the SEC and the PCAOB, CPA firms must continue to monitor state-level legislation for SOX-like provisions that could affect their practice.
Planning for your future. CPA firms are concerned that they may lack the staff to do the required SOX work. This is a concern that reaches far beyond SOX engagements. Alliances with other firms and outsourcing pieces of SOX engagements have been important ways to handle the first-year rush of work. It remains to be seen whether alliances will be the answer to the ongoing opportunities of SOX, but the good news is that CPA firm owners and their firms are demonstrating tremendous flexibility and resources in meeting the needs of clients in compliance with the law.
|