attestation

Small company 404 costs higher than study's estimate

Tue, 05 Feb 2008 06:59:59 -0500

The Lord & Benoit study on small company 404 costs generated a lot of media--that was the point. But now cfo.com reports that some think the study's average total cost of compliance, including management assessment of controls and audit fees, of $78,457 seems to be low. Other consultants seem to think the costs will be at least double, especially if you have to do some hiring. But Lord & Benoit says costs can be kept under control via savvy management, which includes following guidance from the SEC and COSO. The controversy underscores the need for careful planning, ahead of the auditor's attestation portion, which will not kick in for another year.

For more:
- here's the cfo.com article

Another unintended consequence of Sarbanes Oxley

Tue, 15 Jan 2008 06:59:59 -0500

The Lord & Benoit report noted above makes much of what it calls "The Unintended Paradox." Sarbanes Oxley of course was meant to instill confidence in the financial reports of public companies. It has largely succeeded at the large company level. As for smaller companies, the critical Section 404 requirements, notably the requirement for auditor attestation of internal controls, has been repeatedly delayed. Meanwhile, nonpublic companies are now required by the AICPA to have auditors "evaluate the design of controls relevant to the financial statements and determine whether or not the control has been implemented." 404-like to say the least. So for the moment, the control standards for nonpublic small companies are more rigorous than for public companies. Imagine that.

For more:
- see the report (reg. req.)

More AS5 tips for small companies

Tue, 11 Sep 2007 06:59:59 -0400

The fact that AS5 does not require management "attestation" about management's controls until the second year of actual compliance may be leading some small companies into complacency. Of course, that would be a mistake, albeit not one as big assuming another delay will be granted. So you need to be gearing up. Now! Laurie Scofield, head of risk management for RSM McGladrey, offers some tips regarding, among other things, what to expect in year one, entity-level controls, the importance of IT, and importantly the "work of others." The last one is tricky. She offers an interesting bit of advice: Testing by employees or a consultant will likely be viewed more favorably if the results are reported directly to the audit committee, not management. Makes sense.

For more:
- here are the tips

Related articles:
- Will AS5 really make compliance easier?
- Can AS5 really be enforced?
- What exactly is material from a Sarbox perspective?

Time to really implement continuous auditing?

Mon, 21 May 2007 20:01:39 -0400

We've noted that the enterprise risk management has become one of those often-heard, little-understood corporate buzzwords recently. A recent study by PricewaterhouseCoopers suggests that the concept is still largely an abstraction. Yes, there is a lot of interest in ERM. But very few companies update the internal risk assessment continuously. About 65 percent do little or nothing between annual assessments. This suggests that there is still a lot of dissatisfaction with the process. Too many assessments are undertaken piecemeal with the various parts not always acting in concert. The study suggests that audit committees are still vexed by multiple assessments that come to different conclusions. Everyone agrees that management needs to address this. But how? At smaller companies, this will be a huge issue as they finally have to start attestation. Companies that take a coordinated hyper-organized approach will likely fare better. But that's easier said than done. It means a lot of planning, and a lot of cross leveraging of work and assets, specialists and previous work. Good luck.

For more:
- here's the release
- access the report here

Small company compliance timeline issues heat up

Mon, 30 Apr 2007 20:01:39 -0400

More than 6,000 small companies are awaiting word on when they'll have to start complying with 404 internal control and attestation requirements. Recall that they've won a series of deadline extensions. As of now, non-accelerated filers, in their 10-Ks for fiscal years that end on or after Dec. 15, 2007, must meet the management assessment requirement. The auditors' attestation reports aren't due until reports are filed for fiscal years after Dec. 15, 2008. The issue now is whether the deadlines will be pushed back again. Some clues have emerged. Chris Cox, chairman of the SEC, has noted that another delay is not the agency's Plan A. He notes that another extension would mean that the first 404 audit reports for small businesses wouldn't be filed until three years from now, in March 2010. He's sticking to the current plans. Which means that small companies should really pay attention to how the current guidance shapes up.

For more:
- here's a brief from accountingweb

Another 404 delay for small companies coming

Mon, 05 Mar 2007 19:01:39 -0500

If there is one area where people across the political spectrum have rallied, it is in the area of small company compliance. Let's face it, for those opposing Sarbanes-Oxley-like regulations, the stars have aligned pretty well--for example, the rise of AIM in London, the Democrats' need to support entrepreneurial tech companies and the overall competitiveness focus. All this has worked well. So for small-cap companies, the 404 compliance deadline has already been pushed back; companies don't have to comply until they report for fiscal years ending on or after December 15 and, for auditors' attestation, for years ending after December 15, 2008. This has been a godsend. Now, two politicians, Senators John Kerry and Olympia Snowe, have called for another extension. So you have to wonder: in this climate, it may be that compliance for small-caps might be delayed repeatedly and watered down significantly. But you have to think that some sort of Sarbox-like rules would be worth it. For one thing, it might cut back on restatements and reported material weaknesses, which are still rising for small cap companies, while falling for Sarbox-compliant companies. This is a tricky issue.

For more:
- here's an article from cfo.com