Who does what to whom? closing the expectation gap of section 404.

• Author: Sayther, Colleen A.
• Position: President's Page - Management Assessment of Internal Controls

Issues surrounding the various facets of Sarbanes-Oxley continue to emerge, challenging us as financial executives. Perhaps one of the thorniest areas of debate is Section 404 on Management Assessment of Internal Controls, which requires corporate managers to evaluate and report on the effectiveness of internal controls over financial reporting, identifying any "material weaknesses" they find. Further, the act requires a public company's outside auditors to attest to management's assessment of those internal controls.

And at that point, interpretations diverge. There is an ongoing debate between issuers and public accounting firms over how deeply auditors should delve. Preparers contend--and FEI agrees--that auditors should attest only to management's assessment and evaluation of internal controls. Audit firms, on the other hand, believe that auditors must attest to the actual internal control environment itself. They believe that they cannot attest to management's assessment without doing substantial work to conclude that the actual internal control environment is effective.

On July 29, I participated in a roundtable discussion held by the Public Company Accounting Oversight Board (PCAOB) to solicit views on this divisive issue--from auditors, investors, public companies, regulators and other stakeholders. I can tell you that feelings run very high on both sides of the debate.

In weighing the merits of both interpretations, it is important to remember one essential point: The internal control environment is ultimately the responsibility of management. It should not be delegated to the auditors. To do so would represent an abrogation of fiscal responsibility on the part of management and an inappropriate assumption of that responsibility by the public accounting firms.

FEI believes that the clear intent of Sarbanes-Oxley regulation in this area was to ensure that management took the necessary and appropriate responsibility for not only creating an effective internal control system, but also reviewing it on an ongoing basis. Further, we believe that Sarbanes-Oxley recognizes that independent auditors have a responsibility to understand the internal controls so that they can plan their audit. By having the independent auditor attest to management's assertion, we believe the intent of Congress--to have the independent auditors fulfill this responsibility in a manner more transparent to investors--is satisfied.

The material failures in...