Canadian 404
While debate over Sarbanes-Oxley Section 404 rages in the US, Canadian companies are preparing for their own version of internal controls certification. But Canadian regulators have looked at some of the most contentious issues in the US and followed a different path, explains KPMG’s Rob Brouwer.
‘In the US, public companies over a certain size that are already subject to Section 404 have to certify their internal controls’ effectiveness and design,’ Brouwer explains.‘In Canada, regulators are looking at a delayed timetable, broken into two stages.The first stage is relevant to the current yearsoapbox end reporting.C alendar-year companies will be required to include CEO and CFO certification of the design of their internal controls. A year later, in December 2007, that certification goes on to address both the design and the effectiveness of internal controls.So companies have another year to test the effectiveness of internal controls.’
Another key difference for Canadian companies is the way regulators have dealt with internal controls auditing. Unlike their US counterparts, Canadian rule-makers have decidednot to require independent auditor attestation.
‘The issue this creates for management and directors is the lack of a due diligence defense that might be represented by independent auditor review,’ Brouwer explains.‘Giv en that the certifications are required to be included in the MD&A,which is now subject to civil liability for directors and officers, directors and officers in many companies are struggling with the extent of work and documentary evidence they need for management to support their certifications and for audit committees and directors to demonstrate their oversight of that process.’
If the US example is any indicator, IROs should prepare to explain any problems with internal controls.‘IROs must be ready to address the issue and put the markets at ease with regard to any deficiencies.R egulators have also encouraged companies to voluntarily consider having third-party audits of their internal controls, so IROs need to be able to answer questions about whether their companies have or are intending
to retain third-party audits.’
Auditor turnover accelerates
Grant Thornton’s Cono Fusco has seen his sector evolve since the demise of Arthur Andersen made an already small number of very large accounting firms even smaller.‘At the same time there was what seemed like a never-ending stream of accounting scandals, most of which involved one of the big four auditing firms, tarnishing their images,’ Fusco recalls.
The demand for more audit firms went up just as the number of firms available went down, and the amount of auditing work has risen thanks to requirements like Sox 404.
‘In response to rising demand, auditors began to deploy their resources to their largest and most profitable clients, with the result that they began to exit certain clients,’ says Fusco.‘In addition, Sox mandated that audit committees hire, compensate and fire auditors.This ruptured the relationship between auditors and management, leading to a more independent audit committee.’
Smaller global players like Grant Thornton have been winning clients away from the big four amidst the turnover.Stil l, the size of a company is one of the primary factors in determining which end of the auditor spectrum it ends up at, and many mega caps can often only use one of the big four.
‘One area that’s a little opaque is the 8K rules on auditor changes, which were originally designed in the 1970s to impede companies from changing auditors,’ Fusco says.‘E ven today the only time you have to disclose a reason for a change in auditor is if there is a ‘disagreement’ or ‘reportable event’. But whenever there is a change everyone assumes there is a problem, even though thousands of companies change auditors and have no problems, so the 8K rules need to be updated to provide more transparency.In the meantime, companies can –and should – voluntarily disclose more information.’
Narrative reporting
‘One of the key accounting developments having an impact on IR is the current focus on narrative reporting,’ says Janice Lingwood of PricewaterhouseCoopers.‘ This can be partially explained by the increasing complexity of financial statements. In the UK, for example, the average increase in the number of pages in the most recent annual reports was just over 50 percent.’
As the complexity of financial statements rises, Lingwood says, companies are seeking to provide better narrative reporting.They ’re trying to put complex financial statements in context and provide a broader view of corporate performance for the investment community.
‘The challenge for IROs is to provide a joined-up view relating to a number of building blocks of information,’ Lingwood continues.‘ These include a description of their markets, strategies for competing within these markets, the key risks, resources and relationships that are managed to deliver on these strategies, and ultimately, performance outcomes.’
For narrative reporting to gain credibility with investors, companies must provide a number of critical inputs in their reports. For example, companies should provide the information they use to manage the business.To accomplish this, narrative reporting can articulate the risks that keep management ‘awake at night’ and the key performance indicators management uses to assess progress against stated objectives and strategies.
‘We anticipate that over the next twelve months we will continue to see investors focusing on this type of information in recognition of the fact that financial statements alone do not provide a comprehensive picture of a company’s corporate performance,’ says Lingwood.
Small company burden
Neal Godt, a partner at Amper, Politziner & Mattia, which audits or provides services to over 100 US companies, sees a number of trends for small and mid-sized firms. Not surprisingly, Sox 404 is behind much of what he sees happening today.
‘One of the biggest ongoing trends is the increased burden of resources and infrastructure related to 404 and the complexities of new accounting rules for small and mid-sized companies,’ Godt says.
Small and mid-sized companies face a budget crunch as they ramp up resources and infrastructure.They don’t have the budgets that larger companies have to deal with accounting and disclosure issues.So far, the SEC has indicated it will not allow smaller companies to forgo Section 404 compliance.
‘Smaller companies are really facing a difficult environment from an accounting resource standpoint,’ Godt says.‘ They have to deal with an accounting profession that is continuously changing.These companies have been running lean and mean in terms of accounting staff, but the level of work has risen.’
The trend toward a greater burden of cost and resources is one that Godt does not see easing.‘ When you see companies that don’t file reports on a timely basis and they are filing for extensions, that is an indicator that they don’t have as strong an infrastructure in place as we’d like to see.It is a sign that they need additional resources.’
Crunch time for small caps
For smaller companies trying to read the tea leaves to predict the SEC’s intentions for Section 404, BDO Seidman’s Leland Graul says now is the time to act, despite the uncertainty.
‘My feeling is the SEC is going to have to provide some further deferral or phase-in for smaller companies beyond that which they’ve indicated,’ he says.‘If all of the smaller public companies phase in for 2007, it is going to shut down the auditing industry.Ther e aren’t enough of us to go around.’
As smaller companies look for guidance, the only model that currently exists is one-size-fits-all and is not necessarily appropriate in situations where a large cap is being compared to a small cap.So while auditors have more experience after preparing with their larger clients, that type of detailed reporting does not necessarily make good sense for many small companies.
‘The only guidance was really from the auditors’ perspective, and it was overly detailed. A smaller company with one location is not going to have 200 controls, for example,’ Graul points out.‘ As a result, is that model going to be deficient? Theoretically, yes.The major control a small company has is the day-to-day involvement of the people who majority-own the stock – the people who founded the company. Hopefully a new model will emerge that will allow us to look at higherlevel controls for smaller companies as opposed to the more detailed controls we’ve been reviewing for larger, more dispersed companies.’
To date, the SEC has indicated it will not give exemptions, but Graul believes it also hasn’t completely turned away from the idea of further tweaks to the model to help alleviate the cost for smaller firms.Still, small companies should not play wait-and-see. ‘If they wait too long, they aren’t going to find resources to help them – and they can’t do it internally, as they lack those resources,’ says Graul.‘Expect the worst and hope for the best.’
