SOX 404 Compliance

In an effort to reduce overall SOX compliance costs, companies must find a way to reduce external audit fees by increasing the amount of reliance the auditors place on management’s testing of its control environment.  In a 2006 comment letter to the SEC/PCAOB, a group of controllers and CFOs made several recommendations including the following:

53% of companies (*see attribution below) indicate that auditor reliance on management testing is their primary discussion issue with their external auditors. We believe that auditors should have more flexibility to rely on management’s work, including process owners, for areas that are not considered to be at high risk. For example, automated transaction controls or controls over routine processes involve lower risk and can be tested by process owners. It is important that process owners are accountable for effective controls, but auditors believe that AS2 prevents them from relying on process owner assessments. This causes duplicate testing and is disruptive to operations.  Auditors should be allowed to rely on the quality of managements’ overall compliance approach, including the presence of a robust compliance environment and entity- level controls, rather than focusing on individual assessor independence.      

We are therefore recommending that external auditors be required to rely on management’s work in testing (irrespective of entity performing the testing) for a mutually-agreed upon universe of low-risk controls.”

Submission of Comments to the SEC/PCAOB Roundtable, May 10 2006

- *Corporate Executive Board research; http://www.executiveboard.com

AS5 addressed this concern by specifically directing auditors to rely more on the work of others.  However, more than 40% of the 257 companies, which participated in a September 2007 poll taken by the Institute of Internal Auditors, indicated their external auditors relied on less than 25% of the testing work performed by management.  Clearly, gains can be made - but what can be done to change the minds of auditors?  The first, and perhaps most important, step is for management to demonstrate an understanding of its environment via a robust assessment of the risks to accurate financial reporting.

Whether the assessment is the traditional “likelihood and impact” approach for each of the identified risks, or management chooses to utilize the risk factors identified by the PCAOB/SEC, or some other method entirely, the point of the exercise is to give external auditors a view into management’s evaluation of what could go wrong.  Ranking the relative risk of the resulting misstatements, and the controls that mitigate those risks, then provides a tool for framing the “reliance” discussion.  In year one, auditors may then be more comfortable relying on management’s testing of those controls that mitigate low level risks.  As time progresses and the risk discussion matures, management and auditors may achieve a balance of reperformance and reliance resulting in reduced cost of compliance.