THE ACCOUNTING PROFESSIONALS INTERVIEWED for this article were positive about some Sarbanes-Oxley requirements, saying management's reporting on and the external auditor's attestation to the internal controls are good ideas. They advocated audit committees' hiring CPAs because it could reduce the pressure on audit fees and lead to better-quality audits. All agreed that having top management certify it had reviewed the quarterly and annual reports would force it to become more engaged in the financial reporting process. All believed the legislation would have a positive impact, but would not be a panacea. Their concerns included
* DOCUMENTATION COSTS AND ATTESTATION FEES, which will be substantial. There was apprehension about preparing internal control attestation reports; no widely recognized standards to do so currently exist.
* FEARS THAT SMALL, PUBLICLY LISTED COMPANIES might not meet internal control reporting requirements without substantial additional expense; some may have to delist because of it. It could mean only larger companies will go public.
* AUDITORS' QUALMS ABOUT POSSIBLE MARKETPLACE reaction to their small, publicly listed clients whose financial statements can be "signed off on" based on substantive testing, but which had adverse attestations on their internal control structure.
* THE "CASCADE" EFFECT, which might mean having as many as 54 different sets of laws for nonlisted companies.
* THE ACCOUNTING PROFESSION'S IMAGE, which has suffered unjustly because of the wrongdoings of a few.
The Sarbanes-Oxley Act of 2002 has ushered in the most sweeping changes in the accounting profession since the Securities Acts of 1933 and 1934. In order to gain insight into how this act will affect external auditors and corporate managers, we interviewed 10 people from public accounting, corporate management, the National Association of State Boards of Accountancy (NASBA) and the AICPA. They expressed their opinions on management's and the auditor's assessment of internal controls; requiring management to certify the financial statements; the setting of auditing standards; the "cascade" effect; the implications of audit committees' hiring CPA firms, CEOs' certifying reports, the systematization of Sarbanes-Oxley regulations and the act's impact on financial reporting and on the accounting profession.
ASSESSMENT OF INTERNAL CONTROLS
Section 404 of the Sarbanes-Oxley Act requires each issuer's annual report to include an "internal control report which shall ... contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting." In addition, section 404 requires each issuer's auditor to attest to and report on management's internal control assessment.
When asked about management's requirement to assess internal controls, the interviewees were unanimous in agreeing this was a good idea. They believed this requirement would increase management's knowledge and concern about the quality of its internal control structure, thus sending significant signals that management takes such controls very seriously.
All interviewees believed the new internal control reporting requirement would cause significant increases in external auditing costs. Such expenses would result from the requirement that external auditors must attest to and report on the internal control assessment made by the management of the issuer. Ken Peterson, partner and professional practice director for the Lake Michigan area office of Ernst & Young LLP, said, "The consideration of internal controls has been a tool used in planning the audit, but now internal controls will be an objective of the audit." John Fogarty, partner and director of auditing policies, procedures and methodologies in the United States and globally of Deloitte & Touche, member of the AICPA auditing standards board and technical adviser on the international auditing and assurance standards board, said: "The internal control report will be very expensive. It is a significant extension of auditing responsibilities." Interviewees estimated this additional attestation fee would range from 25% to more than 100% of current audit fees.
Although most of the CPAs we interviewed reported that large companies already had internal controls in place to comply with the new reporting requirements, those controls "will...