Transcription
Sarbanes-Oxley Act:Section 404Practical Guidancefor Management*July 2004*connectedthinking
This monograph is designed to assist management in its efforts to satisfy its responsibilities established by thePublic Company Accounting Reform and Investor Protection Act of 2002. The monograph is based on rule-makingand guidance available as of July 2, 2004; accordingly, as new rules or modifications or interpretations to existing rulesemerge, certain aspects of this monograph may become obsolete. Because interpreting this guidance is proving to be anevolutionary process, preparers and users are cautioned to carefully evaluate and monitor further implementation guidancefrom the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB).PricewaterhouseCoopers will continue to monitor regulatory activities, company interpretations, and evolving practices;we will update our policies and will issue updated perspectives as warranted. In providing the information contained inthis monograph, PricewaterhouseCoopers is not engaged in rendering legal, or other professional advice and services.As such, this monograph should not be used as a substitute for consultation with professional, legal, or other competentadvisors.
pwcTo Our Clients and Friends:The Public Company Accounting Reform and Investor Protection Act of 2002 (the Act or the Sarbanes-OxleyAct) requires public companies to develop new practices involving corporate governance and financialreporting with the objective of restoring the public trust in the capital markets. One of the most challengingaspects of the Act’s requirements involves a company’s responsibilities for internal controls.Entitled Management Assessment of Internal Controls, Section 404 of the Act (Section 404) stipulates thatpublic companies must take responsibility for maintaining an effective system of internal control, in addition toreporting on the system’s effectiveness. The Act requires most public companies (i.e., accelerated filers thatmeet certain market capitalization requirements) to report annually on the company’s internal control overfinancial reporting for fiscal years ended on or after November 15, 2004. The majority of the remaining publiccompanies, including foreign private issuers, will be required to comply with these requirements for fiscal yearsended on or after July 15, 2005.While Section 404 poses numerous challenges for preparers, users, and external auditors – both inimplementing the mandate and understanding its implications – this monograph is primarily designed toaddress the challenges facing preparers.We fully recognize that implementation, particularly in the critical first year, will present preparers with manychallenges, complexities, and new costs. However, for the benefits of Section 404 to be realized by all of theparticipants in the capital markets, a substantial effort will be needed. A thorough assessment and evaluationof internal control over financial reporting will go a long way to achieving a fundamental objective of Section404: restoring investor confidence in financial reporting. This monograph is presented to you in that spirit.The monograph is one in a series of publications1 that we have issued in relation to the Sarbanes-Oxley Act.This monograph describes the key activities integral to a successful Section 404 assessment processincluding, among others, scoping, documenting, testing, evaluating, and reporting. It reflects the insights andperspectives we have gained by working with our clients and obtaining input from the manyPricewaterhouseCoopers’ partners and staff who have concentrated significant amounts of time onunderstanding this new reporting model. We provide our observations and analysis, note the lessons we havelearned from recent experiences with clients, and offer examples that illustrate specific aspects of Section 404.We are pleased to share our experiences with you.1Our previously issued white papers are entitled: The Sarbanes-Oxley Act of 2002: Strategies for Meeting New Internal ControlReporting Challenges; The Sarbanes-Oxley Act of 2002 and Current Proposals by NYSE, Amex, and NASDAQ: Board and AuditCommittee Roles in the Era of Corporate Reform; and The Sarbanes-Oxley Act of 2002: Understanding the Auditor's Role in BuildingPublic Trust. We have also issued a DataLine entitled, Management’s Responsibility for Assessing the Effectiveness of Internal ControlOver Financial Reporting Under Section 404 of the Sarbanes-Oxley Act.
PwcMany companies have made significant progress in their efforts to comply with Section 404. For thosecompanies this monograph should (i) provide useful perspectives on evaluating and testing the design andoperational effectiveness of control over financial reporting that will be conducted in the future and (ii) affirm orinitiate a reassessment of established work plans or processes. For other companies that are early in theprocess, this monograph should provide useful information in developing their overall strategy for implementingSection 404. It is worth noting that interpreting these new rules has proven to be an evolutionary process.Additional future interpretative guidance may be issued by the SEC for registrants and by the PCAOB forexternal auditors. Such guidance could impact views expressed in this publication.Raymond BromarkAmericas Theater LeaderProfessional, Technical, Risk and QualityRaymond BeierLeaderNational Technical Services
Table of ContentsSECTION I: Executive Summary .1The Most Significant Financial Legislation in Nearly 70 Years –Why the Sarbanes-Oxley Act Was Issued .1The Benefits of Effective Internal Control over Financial Reporting .1Implications of Section 404 .1SECTION II: Getting Started Project Initiation .3Project Oversight .3Project Management.6SECTION III: Scoping and Planning The Beginning of an Effective Project .8Identify the Significant Accounts, Disclosures, and Business Processes/Cycles .10Determine Multiple-Location Coverage.16The Five Components of Internal Control .26Control Environment .26Risk Assessment.28Control Activities .29Information and Communication .30Monitoring .31Other Considerations .32Period-End Reporting Process.32Accounting Estimates and Judgments .34General Computer Controls .35Company-Level Controls.36SECTION IV: Use of Service Organizations .38The Steps for Evaluating the Procedures to Perform Over Service Organizations .40Determine If a Service Organization Is Being Used .40Determine If the Outsourced Activities, Processes, and Functions AreSignificant to the Company’s Internal Control over Financial Reporting .40Determine If a Type II SAS 70 Report Exists and Is Sufficient in Scope.41If a Type II SAS 70 Report Does Not Exist, Determine Alternative Procedures.43pwc
SECTION V: Documentation – Evidence of Effective Internal Control .46Step 1: Determine Scope of Documentation.47Step 2: Develop Process Documentation .47Step 3: Develop Control Documentation .48Step 4: Assess the Design of Controls .52SECTION VI: Testing – Determining the Operating Effectiveness of Internal Control.56Identify the Controls to Be Tested.57Identify Who Will Perform the Testing.58Develop and Execute the Test Plans.59Evaluate the Test Results .67SECTION VII: Evaluation of Internal Control Deficiencies and Reporting .69Significance of Internal Control Deficiencies .69The Process for Identifying, Assessing, and Classifying Internal Control Deficiencies.70Reporting – Management .74Auditor’s Evaluation of Management’s Report.75SECTION VIII: Communication – Important Observations .76Required Communications by Management.76Written Representations from Management to the Auditor.76Required Communications by the Auditors.77SECTION IX: Mergers and Acquisitions – Impact of the Sarbanes-Oxley Act.78Definition of Key Terms.82Appendices.92Index of Frequently Asked Questions.144Index of Lessons Learned.146pwc
SECTION I: Executive SummaryThe Most Significant Financial Legislation in Nearly 70 Years – Why the Sarbanes–Oxley Act Was IssuedThe Public Company Accounting Reform and Investor Protection Act of 2002 (the Sarbanes–Oxley Act or theAct) was enacted in July 2002 largely in response to major corporate and accounting scandals involvingseveral prominent companies in the United States. These scandals resulted in an unprecedented lack ofconfidence in the financial markets and a loss of public trust in corporate accounting and reporting practices.The Act has brought about the most extensive reform that the U.S. financial markets have seen since theenactment of the Securities Act of 1933 and the Securities Exchange Act of 1934.The impact of the Act has been felt throughout the financial markets; every industry and service sector hasbeen, and will continue to be, impacted. Section 404 of the Act, Management Assessment of Internal Controls(Section 404), which may be the most challenging aspect of the Act, requires most publicly registeredcompanies and their external auditors to report on the effectiveness of the company’s internal control overfinancial reporting. The obvious question is: How will companies implement Section 404?This monograph explains the specifics of Section 404, delivers practical guidance on compliance, and providesrealistic examples of the implementation issues that companies are facing. We also offer our perspective onmany key issues.The Benefits of Effective Internal Control over Financial ReportingWhile some in the marketplace view the effort to comply with Section 404 as largely an administrative andcompliance exercise; we encourage companies to consider this an opportunity to improve the effectiveness oftheir business processes. Key benefits of improved internal control over financial reporting include: improved effectiveness and efficiency of internal control processes better information for investors enhanced investor confidenceWe acknowledge that these benefits do not come witho
the need for board of director and audit committee oversight of management’s process, findings, and remediation efforts as management scopes and executes its Section 404 plan Preparing for management’s assessment and the external audit of internal control over financial reporting
