The Newsletter of the ABA Section of Business Law Committee on Federal Regulation of Securities

Transcription

1 THE SECURITIES REPORTER The Newsletter of the ABA Section of Business Law Committee on Federal Regulation of Securities Volume 11, Issue 1 Spring 2006 REMEDIATION A TIMELY DEVELOPMENT BY RICHARD A. STEINWURTZEL, VASILIKI B. TSAGANOS & ANITA J. FINKELSTEIN* The Securities and Exchange Commission (the SEC ) recently approved without change a new auditing standard permitting a public company to retain its auditor to review and report on the assertion by management that a previously reported material internal control weakness no longer exists. 1 Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist ( Auditing Standard No. 4 or the Standard ), 2 was adopted by the Public Company Accounting Oversight Board (the PCAOB ) last summer to provide a framework under which an issuer that previously had reported a material weakness in internal control over financial reporting could elect, during the course of the year and prior to its next annual audit, to engage its auditor to assess and report on whether (or not) the weakness continued to exist. 3 Auditing Standard No. 4 is a timely development, as it provides issuers with a prompt and orderly process for formal remediation of material internal control weaknesses, auditors with a formal approach to review of internal control remediation outside of the annual audit, and shareholders and other constituencies with a vehicle for receipt of timely, independent reports on the existence and effectiveness of internal control remediation. Importantly, if an issuer that previously reported a material internal control weakness is contemplating a capital markets transaction or must comply with a covenant related to or affected by its internal controls imposed by a lender or other third party, there is now in place a mechanism through which the issuer may resolve, independently and prophylactically, what otherwise could have developed into a significant corporate problem. Significant Need Section 404 of the Sarbanes-Oxley Act of 2002 ( Section 404 of Sarbanes-Oxley ) 4 requires that each public company provide annually, as part of its annual report on Form 10- K under the Securities Exchange Act of 1934 (the Exchange Act ), an internal control report which, among other things, must contain an assessment, as of fiscal year end, of the effectiveness of the company s internal control structure and procedures for financial reporting. 5 Item 308(a) of Regulation S-K 6 elaborates on this requirement, providing that the report must disclose any material weaknesses 7 in internal control over financial reporting 8 identified by management. Under Item 308(b), management s annual assessment of internal control over financial reporting is subject to review by the company s auditor, and the auditor s opinion is a required element of the company s Form 10-K. 9 Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements, governs the auditor s opinion and related management report under Item In addition to an annual assessment and related disclosure, Item 308(c) of Regulation S-K requires Form 10-K or Form 10-Q disclosure (as appropriate) of any change (whether to the good or the bad) 11 in a company s internal control over financial reporting that occurred during the prior quarter, was identified in connection with management s quarterly internal control evaluation, 12 and materially affected, or is reasonably likely to affect materially, the company s internal control over financial reporting. 13 Management s quarterly evaluation and related disclosure pursuant to Item 308(c) are subject to review as part of the auditor s normal quarterly procedures. However, neither management s quarterly evaluation nor the related disclosure is subject to a required auditor s opinion or other report. 14 Prior to adoption of the Standard, this reporting regime posed a potentially significant corporate problem for an issuer that previously had reported a material internal control weakness Page 1

2 because, other than as part of the annual reporting process, it does not provide a means for the auditor to assess and report on the remediation of an internal control weakness. Absent Auditing Standard No. 4, a full year ordinarily would elapse between the time a company disclosed a material internal control weakness in a management report subject to auditor review under Item 308 and the time the auditor again could consider management s internal control assessment and issue a new opinion (in each case presumably reflecting remediation of the previously reported weakness). In the interim, if the company wished to remediate the material weakness voluntarily, either as part of the sensible operation of its business or because it was facing a financing, merger and acquisition event, or possible default under a bank covenant or other third party obligation, it could, as a substantive matter, correct the weakness and provide management assurances that it had done so, but it could not provide its auditor s independent assurance of such correction. Therefore, while the company would have been able to disclose remediation, such disclosure would have reflected only management s judgment, which would have remained subject to after-the-fact reevaluation by the company s auditor in connection with its year-end audit, rather than management s judgment already reviewed by the company s auditor. The corporate problem posited above and the adoption of Auditing Standard No. 4 as a response to that problem are, of course, both irrelevant if few companies report material internal control weaknesses in the first instance. However, the universe of companies reporting weaknesses is both meaningful and worrisome through May 15, 2005 approximately percent of the public companies that were accelerated filers 15 reported one or more material internal control weaknesses. 16 It would seem safe to assume that even if the rate of incidence of material internal control weaknesses remains constant, the absolute number of companies reporting such weaknesses will increase when the requirements of Section 404 become applicable to non-accelerated filers during 2007 and And, at least in the short run, the rate of incidence will almost certainly increase as smaller issuers, which generally have fewer resources and less robust internal control infrastructures, begin to comply with Section 404. Therefore, the type of engagement contemplated by Auditing Standard No. 4 should become a useful and permanent part of the auditing and disclosure landscape. Objective and Scope The PCAOB s purpose in promulgating Accounting Standard No. 4, as noted, was to assist reporting companies and financial statement users in dealing more promptly with the resolution of previously reported internal control weaknesses. The Standard therefore is subject to two significant threshold limitations: Previously Reported Weaknesses Only: The Standard is applicable only to remediation of material internal control weaknesses previously disclosed in an annual report. Therefore, it does not permit auditors to pass on the existence (or lack) of material internal control weaknesses that both arise and are remediated within the same fiscal year. 18 Nature of Opinion: The auditor s report (if one is issued and is not a disclaimer) may only state that one or more previously reported material internal control weaknesses either do or do not exist. 19 Investors submitting comments following publication of the Proposed Standard in March 2005 sought expansion of its application to internal control weaknesses that are both identified and remediated on an interim basis, while a majority of the auditors who submitted comments were opposed to any such expansion. In declining to expand the scope of the Standard, the PCAOB noted that the primary purpose of an engagement under the Auditing Standard No. 4 is to remove any perceived stain on a company s financial reporting due to an outstanding adverse audit opinion on internal control over financial reporting, but that there would be no audit report on, and therefore no stain from, a material weakness both identified and addressed within a single fiscal year. 20 An opinion under the Standard is limited in particular because of what it does not cover. First, both management and the auditor may appropriately assert that an internal control weakness does not exist if that weakness has been only partially remediated (and thereby reduced to a deficiency of lesser severity). 21 Page 2

3 Second, as noted above, the opinion may only address specific previously reported material internal control weaknesses. Third, although an auditor is obligated to report to the company s audit committee any newly identified material internal control weaknesses, as well as its conclusion that a material weakness in fact continues to exist, 22 the Standard does not require any additional or public disclosure of such new or continuing weaknesses by either the auditor or the issuer prior to the next annual assessment of internal controls. Finally, an opinion under the Standard is not designed to, and does not, address the overall effectiveness of internal control over financial reporting. 23 Therefore, although an issuer may seek and obtain an opinion as to the remediation of one or more material weaknesses in one area of its system of internal control over financial reporting, it also may elect not to address others on an interim basis, with the effect that material weaknesses in other areas or overall weakness of the system could remain unaddressed. Management s Role Discretionary Aspects There is no legal or regulatory requirement that a company address previously reported internal control weaknesses on an interim basis. Because Auditing Standard No. 4 is voluntary, 24 and because it was developed by the PCAOB at least in part in response to management concerns, it provides management with flexibility in the following areas: Nature of Opinion: The auditor s report (if one is issued and is not a disclaimer) may only state that one or more previously reported material internal control weaknesses either do or do not exist. 25 Whether, as a threshold matter, to address a previously reported material internal control weakness by engaging the company s auditor under the Standard; Whether to address some or all such weaknesses; 26 When previously reported material control weaknesses should be deemed fully remediated and the effectiveness of the controls designed to correct the weaknesses adequately assessed; 27 When to engage the auditor to perform the engagement; 28 and What to do, in the short run, in the event that the auditor does not concur in management s view that a particular material internal control weakness has, in fact, been remediated. When a company has previously reported more than one material internal control weakness, management will be faced with the choice of whether to address one, some, or all such weaknesses on an interim basis. 29 At the outset, management will need to consider whether a particular previously reported internal control weakness lends itself to treatment under Auditing Standard No. 4. The PCAOB has indicated that it expects that engagements under the Standard will be best suited and most cost effective for reporting on material weaknesses that are discrete problems with limited effect on a company s internal control over financial reporting, 30 but that a material internal control weakness that has a pervasive effect on the company s internal control over financial reporting is likely not to be suitable for an engagement under the Standard. 31 Management will also have to identify, from among those weaknesses that are suitable for treatment under the Standard, the ones that it wishes to address on an interim basis. While one can imagine circumstances in which cherry picking the material internal control weaknesses that it wishes to address under the Standard, either for financial or other reasons, might have some appeal, management will have to take into consideration possible adverse market reaction to, and implications of, an engagement to report on some, but not all, such weaknesses. In all events, it is reasonable to assume that the out-ofpocket costs of an engagement will be an element of any such decision. Management also will have two separate, but related, timing decisions in connection with an engagement under Auditing Standard No. 4. First, management will have to determine the date as of which it concludes that a particular material internal control weakness has been addressed and as of which the effectiveness of the controls designed to remediate that weakness has been adequately assessed. The date selected by management will become the effective date of the auditor s report relating to that weakness. Under the Standard, the selection of this effective date is entirely within the discretion of management. 32 Nonetheless, as a practical matter, management s choice of dates must be a rational, defensible one, as one element of the Page 3

4 auditor s engagement is to determine whether management has selected an appropriate date. 33 Therefore, management should consult its auditor in selecting the effective date. 34 Second, assuming that management has determined that a particular previously disclosed material internal control weakness has been remedied, it will have to determine when to engage the auditor to report on the matter. This decision will require consideration of the nature of the field work that the auditor will be required to perform and the ramifications, in terms of staff availability, disruption, and other matters, of having the auditor in house at any given time as part of the engagement. Management should also consider the timing of completion of an engagement under Auditing Standard No. 4 in the context of the company s schedule of quarterly filings, earnings releases, and other ongoing market communications, as well as planned transactions that could be affected by independent confirmation that a material internal control weakness has (or has not) been remediated. In addition to the flexibility afforded management in undertaking and structuring an engagement under the Standard, in the event that the auditor determines that a material internal control weakness continues to exist after the completion of the field work, management will be faced with one final decision. In such circumstances, management, in its discretion, may either: Elect to readdress the material internal control weakness, set a new effective date, and engage the auditor to opine as of this reset date; 35 or Decide to forego early remediation, leave to the auditor the decision as to next steps under the engagement (discussed below), and address the material weakness in the ordinary course, in advance of management s next annual assessment of the effectiveness of internal controls. This decision should generally involve the same substantive considerations as those implicated in the original decision to undertake an engagement under Auditing Standard No. 4. Management, however, will need to bear in mind that, to the extent the auditor determines that a material internal control weakness has not been remediated and continues to exist, it will be required to report this finding to the company s audit committee. In addition, management must be sensitive to the fact that, under the Standard, the auditor will be required to take into account the continuing existence of the material weakness in determining, pursuant to Auditing Standard No. 2, whether management s quarterly disclosure concerning internal control over financial reporting pursuant to Item 308(c) is or is not materially misleading. 36 Management s Role Mandatory Aspects Even though the decisions whether, and when, to retain a company s auditor to perform an engagement pursuant to Auditing Standard No. 4 are entirely within the discretion of management, having made the decision to undertake early remediation, management must take certain actions before the company s auditor can perform an engagement under the Standard. At the outset, management must substantively address and remediate each relevant previously disclosed material internal control weakness and, once implemented, evaluate the remedial (and other related) controls related to each such weakness. In doing so, management must: Identify the specific control objective(s) 37 which, if achieved, would result in the material weakness no longer existing; 38 Identify all new, modified, or preexisting controls necessary to achieve the identified control objective; 39 Develop and implement one or more remedial controls (and/or modifications to existing controls) designed to meet the relevant control objective(s) and thereby address the previously disclosed material internal control weakness; Evaluate the effectiveness of the identified control(s) using (i) the same control criteria used for the company s most recent annual assessment of internal control over financial reporting and (ii) the company s stated control objective(s); 40 and Develop evidence to support the proposition that the remedial controls are effective in meeting the control objective. 41 One of the documents central to the auditor s work under the Standard is a written report from management, the required content of which is prescribed by Auditing Standard Page 4

5 No. 4, 42 and which will accompany and be referred to in the auditor s report. While the Standard does not flatly prohibit management from including additional information in the management report, 43 it does require that the auditor disclaim an opinion on any such additional information. 44 The management report is a prerequisite to issuance of an auditor s opinion under Auditing Standard No. 4. Therefore, if management declines to provide the report for any reason, the auditor cannot complete the engagement. 45 Apart from the management report, management must also provide a set of detailed representations in the course of the auditor s field work. 46 These representations must be in writing and signed by those members of management with overall responsibility for the company s internal control over financial reporting whom the auditor believes are responsible for and knowledgeable about (directly or indirectly) the matters covered by the representations (generally the chief executive officer and chief financial officer). 47 Unlike the management report, the management representations need not accompany and are not referred to in the auditor s report under Auditing Standard No. 4. The failure to provide the required representations, however, constitutes a scope limitation which, in turn, necessitates either a disclaimed opinion or that the auditor withdraw from the engagement entirely. In addition, under the Standard the auditor must consider management s failure to provide the required representations in evaluating its ability to rely on other management representations, including those made in connection with the audit or the company s financial statements. 48 The Auditor s Role The auditor s objective in an engagement pursuant to Auditing Standard No. 4 is an understandably narrow one to obtain reasonable assurance about whether a specified previously reported internal control weakness (or multiple weaknesses, should management so decide) continues to exist as of a date specified by management, and to express an opinion on that matter. 49 This limited objective generally can be expected to limit the scope of the auditor s work in an engagement under the Standard. Thus, while the auditor must in all events obtain the requisite level of overall understanding of the company s internal control over financial reporting, 50 the scope of planning is limited by the scope of the engagement, and the auditor s testing and evaluation are limited to the design and effectiveness of the controls specifically identified by management as necessary to achieve its stated control objective(s). 51 Before an auditor can perform an engagement under the Standard, it must have sufficient knowledge of the company and its internal control over financial reporting. 52 An auditor who has audited the company s internal control over financial reporting for the most recently completed fiscal year is, under the Standard, presumed to have the required level of knowledge. 53 A successor auditor who did not perform the prior year s audit of internal control over financial reporting also may be deemed competent to perform an engagement under Auditing Standard No. 4, subject to certain requirements set out in the Standard. 54 Although the engagement must be undertaken by the regular or an appropriately qualified successor auditor, that auditor is permitted, consistent with the terms of Auditing Standard No. 2, to use the work of others to alter the nature, timing, or extent of the work that it otherwise would have to perform under the Standard. 55 The individuals whose work an auditor may use include internal auditors, other company personnel, and third parties working under the direction of management or the audit committee. 56 This should allow auditors to shift portions of the field work, consistent with Auditing Standard No. 2, where doing so would improve efficiency and help to control the cost of the engagement. The Standard prescribes the areas that the auditor must test and evaluate. 57 Each of these is a function of decisions made and implemented by management in the course of remediating each material internal control weakness subject to the engagement. Therefore, it is prudent for management to consult with the company s auditor before finalizing any of these matters. For purposes of evaluating remediation of material weaknesses in internal control, the Standard directs that the auditor use a standard of materiality 58 at the financial statement level, rather than the individual account balance level, 59 and that such materiality be measured as of the effective date selected by management, rather than as of the end of the fiscal year as to Page 5

6 which the weakness initially was reported. 60 While the PCAOB concluded that logic and internal consistency mandated use of the effective date as the reference date for materiality, it also has acknowledged that, as a consequence, a formerly material internal control weakness could cease to be material because, subsequent to fiscal year end the company undertook acquisitions or other activities that resulted in a significant shift in the relative size of financial statement accounts, rather than because of any remedial efforts. Although the Standard does not prohibit the issuance of an opinion that a material internal control weakness does not exist in these circumstances, the PCAOB has urged caution, suggesting that in such a case changes in overall internal control could well be of sufficient magnitude to render an engagement under the Standard inappropriate and to require instead a full audit of internal control over financial reporting under Auditing Standard No Based on the PCAOB s cautionary language, it appears that an issuer that engages in significant acquisition activity may find it difficult to avail itself of the Standard. In any event, the PCAOB also noted in this context that if a material internal control weakness is not eliminated entirely, but rather is only reduced to a deficiency of less severity, failure of management to correct the deficiency within a reasonable period thereafter could itself be indicative of a material weakness. 62 The Audit Report Unlike an annual audit of financial control over financial reporting pursuant to Auditing Standard No. 2, where the auditor s choice, upon completion of the field work, is not whether to issue an opinion, but rather what kind of opinion to issue (unqualified, qualified, adverse, or disclaimer), 63 under Auditing Standard No. 4 the auditor is under no obligation to issue any opinion at all. 64 Therefore, under the Standard, in the first instance the auditor must decide whether to issue an opinion. If, after completing the field work prescribed by the Standard, the auditor concurs in management s conclusion that a material internal control weakness no longer exists, then the decision presumably would be an easy one, and the auditor would issue an opinion to that effect. 65 On the other hand, if the auditor is unable to concur in management s conclusion, it would face a different set of choices. In such an event the auditor may: Issue an audit opinion reflecting its determination that the material internal control weakness exists as of the effective date (absent any scope limitations); 66 Disclaim an opinion in the face of a scope limitation; 67 or Not issue an opinion and withdraw from the specific engagement (whether in the face of a scope limitation or otherwise). 68 The range of available opinion options under the Standard in these circumstances is narrower than that in other audit contexts. 69 Because of the very limited scope of an engagement under Auditing Standard No. 4, the PCAOB eliminated the possibility of a qualified opinion. If scope limitations are imposed, the auditor either must disclaim an opinion or withdraw from the engagement entirely. 70 Similarly, due to the voluntary nature of the engagement (and, concomitantly, the absence of a requirement that the auditor s report be made public), there is no concept of an adverse opinion under the 71, 72 Standard. Although an auditor is not required to issue an opinion under the Standard, withdrawal, without opinion, in the circumstance where the auditor does not concur in management s view that a previously reported material internal control weakness has been remediated is not without consequence. In the first instance, as discussed below, the auditor is required to communicate its disagreement with management s view, in writing, to the company s audit committee. 73 Such circumstances also could trigger disclosure as part of management s annual assessment of internal controls (and the auditor s report on that assessment) under Item 308(a) of Regulation S- K, or, on a quarterly basis, pursuant to paragraph (c) of that Item. Both the fact that the auditor did not issue an opinion in an engagement under Auditing Standard No. 4 and the underlying reasons for that decision, moreover, could require disclosure in a contemplated capital markets or merger and acquisition transaction, or could affect the company s position with respect to a lender or other third party whose rights are tied to the integrity of the company s financial statements. Finally, although far less likely, if the auditor s disagreement with management escalates beyond withdrawal from the specific engagement to the point where the auditor resigns or is dismissed as the company s Page 6

7 principal auditor, the company would be required to disclose these matters pursuant to Item 304 of Regulation S-K. 74 Auditor Communications with the Audit Committee Under the Standard, an auditor must communicate with the issuer s audit committee in writing in three discrete situations. Such written communications are required where: After completing the procedures required under the Standard, the auditor determines that a previously reported internal control weakness continues to exist and elects not to issue an opinion to such effect; 75 The auditor identifies one or more new material internal control weaknesses in the course of field work under the Standard; 76 or The auditor determines, after consultation with management, that there is a material misstatement in or omission from management s report. 77 Looking Forward The effectiveness of Auditing Standard No. 4 leaves open a number of questions. In this respect, the SEC Order directs the PCAOB to issue, by April 7, a clear and concise outline of the affirmative audit steps set forth in the [S]tandard. 79 Beyond the audit-related questions that will be addressed by the PCAOB s guidance in response to the SEC s direction, however, a number issues remain. Role of the Audit Committee. As discussed above, an auditor complying with the requirements of Auditing Standard No. 4 must provide written communications to the company s audit committee in three problematic situations. 80 Otherwise, the Standard does not contemplate a formal, defined role for the audit committee in the remediation process or in the auditor s engagement. Thus, it would seem that the audit committee will want to define its role with respect to the ongoing implementation and use of the Standard. Disclosure. Auditing Standard No. 4 provides no guidance as to how, if it elects to do so, a company should make public the fact that it has received an auditor s opinion in an engagement under the Standard. The SEC Order does not mandate disclosure, referring to disclosure relating to an engagement under the Standard as voluntary information, with the backdrop of such anti-fraud rules as Exchange Act Rules 12b-20 and 10b Instead, the SEC Order indicates that an issuer can use any Exchange Act form it believes appropriate, 82 that the SEC s rules do not specify the disclosure, and that general principles and requirements would apply. 83 This response raises other questions. For example, neither the Standard nor current SEC rules address the question of whether the auditor s opinion (and related management report) should be included in the Exchange Act report and, if so, whether these materials are to be filed or furnished. Nor has the SEC or the PCAOB provided guidance as to the circumstances in which an auditor is required to consent to the filing of its opinion. Apart from these threshold issues, an issuer will need to evaluate the effect of an engagement under Auditing Standard No. 4 (particularly engagements where the auditor ultimately does not concur in management s view that a material weakness has been remediated) on its disclosure pursuant to Items 307 and 308 of Regulation S- K. Separately, it remains to be seen whether, and to what extent, participants in capital markets, merger and acquisition, lending and other types of transactions will revise representations and warranties and other provisions of deal documents, and the scope and content of disclosure in offering documents, to take into account the existence and outcome of engagements under the Standard. Third Party Requirements. Questions remain as to whether, and in what circumstances, issuers will come to utilize engagements under Auditing Standard No. 4 because they are compelled to do so either implicitly because management believes that addressing an internal control weakness on an expedited basis under the Standard is preferable to maintaining the status quo until the company s next annual audit, or by explicit requirements of or obligations to capital markets participants, potential merger partners, lenders, or other third parties. To the extent that management of, or any party significant to, an issuer concludes that the issuer s internal control weaknesses are a source of material concerns, the Standard should serve as a useful and necessary safety valve, permitting the issuer to Page 7

8 remediate the weaknesses and assuage those concerns in a timely and authoritative manner. Market Acceptance. The most basic question may be whether public companies will, in fact, elect to use the Standard. On the one hand, two of the three Big Four accounting firms that commented on the matter indicated that they expect the Standard to be used infrequently or rarely. 84 On the other hand, Intel, the only issuer to provide comments on the Proposed Standard, was quite definite in its expectation that the use of these engagements will, as a practical matter, become mandatory, going so far as to state that the voluntary nature of the Standard is illusory. 85 Statements by the PCAOB itself, as well as by two of its members, emphasizing the voluntary nature of the Standard would seem to suggest lingering concerns that the Standard will become standard practice among issuers, notwithstanding the PCAOB s expressed intentions to the contrary. 86 * * * The significant number of companies that heretofore have disclosed material internal control weaknesses demonstrates that there was a need for guidance and process in addressing such weaknesses on an interim basis. Given the incentives for companies to consider seriously using Auditing Standard No. 4, it seems likely that use of the Standard will fall somewhere between Intel s expectation that it effectively will be mandatory and the expectations of the Big Four accounting firms that its use will be rare. While the cost of such engagements are a not insignificant disincentive to use of the Standard, issuers may find that such costs are offset, at least in part, by the moderating costs of compliance with Section Although the details of implementing Auditing Standard No. 4 remain to be worked out, at the present time the important policy observation, from the perspective of public companies, their shareholders, lenders, and other affected constituencies, is that the Standard provides a clear path for timely remediation of material internal control weaknesses. END NOTE Exchange Act Release No (Feb. 6, 2006), (the SEC Order ). The SEC issued a Notice of Filing and Request for Comments on December 21, 2005 with a comment period closing January 20, 2006 (Exchange Act Release No ), Auditing Standard No. 4 (PCAOB Release No ) (Jul. 26, 2005), (the AS 4 PCAOB Adopting Release ). The PCAOB s Standing Advisory Group first addressed the perceived need for the involvement of auditors in addressing interim remediation of internal control weaknesses at its meeting on November 17-18, See isory_group/meetings/2004/11-17/material_weakness.pdf. On March 31, 2005, the PCAOB issued for comment a proposed auditing standard, Reporting on the Elimination of a Material Weakness (PCAOB Release No ), (the Proposed Standard ). Following a comment period, the PCAOB issued the Standard on July 26, U.S.C.A See Memorandum to Our Friends and Clients Internal Controls and the Dog Days of Summer, R. Steinwurtzel, V. Tsaganos, B. Lucas (Fried, Frank, Harris, Shriver & Jacobson LLP) (Aug. 26, 2005), _summer.pdf. 17 C.F.R (a). SEC rules define material weakness by reference to the definitions contained in generally accepted auditing standards ( GAAS ) and the PCAOB s attestation standards. Note 73, Securities Act Release ; Exchange Act Release ; Investment Company Act Release IC (June 5, 2003). GAAS, in turn, defines material weakness in internal control as a deficiency in which the design or operation of one or more of the internal control components does not reduce to a relatively low level the risk that misstatements caused by error or fraud in amounts that would be material in relation to the financial statements may occur and not be detected within a timely period by employees in the normal course of performing their Page 8

9 assigned functions. Statement on Auditing Standards No. 60 (codified in Codification of Statements on Auditing Standards AU 325). Separately, the PCAOB defines a material weakness as a significant deficiency, or a combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. 10, Auditing Standard No. 2 (PCAOB Release No ), d/auditing_standard_2.pdf, effective pursuant to Exchange Act Release No (June 17, 2004), ( Auditing Standard No. 2 ). Exchange Act Rule 13a-15(f), 17 C.F.R a-15(f). Items 308(a) and 308(b) of Regulation S-K, 17 C.F.R (a) and (b), contain additional requirements as to management s annual control internal control assessment and the auditor s attestation thereon, respectively. See note 7 above. Question 9, Division of Corporation Finance and the Office of the Chief Accountant, Securities and Exchange Commission, Management s Report on Internal Control Over Financial Reporting and Certification or Disclosure in Exchange Act Periodic Reports Frequently Asked Questions (Oct. 6, 2004) (the SEC Q&A Release ). Exchange Act Rules 13a-15(d) and 15d-15(d), 17 C.F.R a-15(d), and d-15(d), generally require public company management, with the participation of the company s principal executive and principal financial officers, to evaluate any change in the company s internal control over financial reporting that occurred during the issuer's fiscal quarters that has materially affected, or is reasonably likely to materially affect, the issuer's internal control over financial reporting. 17 C.F.R (c) i. Has an aggregate worldwide market value of the voting and non-voting common equity held by its non-affiliates of $75 million or more; ii. Has been subject to the requirements of section 13(a) or 15(d) of the Act for a period of at least 12 calendar months; iii. Has filed at least one annual report pursuant to section 13(a) or 15(d) of Exchange the Act; and iv. Is not eligible to use Forms 10-KSB and 10- QSB for its annual and quarterly reports (to be a Small Business Issuer ). 17 C.F.R b-2. Out of 2,824 filers, 360 reported material weaknesses. Paul J. Martinek, Adjustments, Restatements Are Predictors of Weaknesses, Compliance Week (June 14, 2005), action=article.viewarticle&article_id=1829. More recent data compiled by Compliance Week indicates that out of 2,427 Forms 10-K filed by Russell 3000 companies (the 3,000 largest U.S. companies, based on market capitalization) between February 2, 2005 and January 17, 2006, 289, or 11.9%, reported material internal control weaknesses. (According to Compliance Week, this data was automatically generated from public company filings with the Securities and Exchange Commission. Compliance Week cannot warrant the accuracy or completeness of the information due to vagaries of language in the disclosures of public companies and their auditors.) In 2004, out of a broader universe, 582 companies reported material weaknesses or significant deficiencies. 582 Weakness, Deficiency Disclosures Made in 04, Compliance Week (Jan. 11, 2005). In September 2005, the SEC extended the deadline for compliance with Section 404 by non-accelerated filers until their first fiscal year ending on or after July 15, Securities Act Release No. 8618, Exchange Act Release No (Sept. 22, 2005) See Auditing Standard No. 2, Auditors are required only to undertake certain limited procedures with respect to management s quarterly certifications. Rule 12b-2 under the Exchange Act defines an accelerated filer (including a large accelerated filer ) as an issuer that: Auditing Standard No. 4, 1. AS 4 PCAOB Adopting Release, B12-B14. AS 4 PCAOB Adopting Release, 51.n. Auditing Standard No. 4, 42. When initially released for comment, the Proposed Standard was entitled Reporting on the Elimination of a Material Weakness. 21 The PCAOB received, and ultimately concurred in, a number of Page 9

10 comments to the effect that use of the terms such as eliminate and eliminated might be too definite and might mislead readers into believing that there were no remaining internal control weaknesses in the area related to a material internal control weakness reported upon, even though less severe deficiencies could continue so exist. Therefore, when adopted, the term eliminate and its correlatives were themselves eliminated from both the title and text of the Standard. PCAOB Release No (March 31, 2005), AS 4 PCAOB Adopting Release, B12. See discussion below at Role of the Auditor and Auditor Communication with the Audit Committee. AS 4 PCAOB Adopting Release at pp ; Auditing Standard No. 4, 4. Auditing Standard No. 4, 4. The voluntary nature of the Standard was the topic of a number of comments from parties concerned that Auditing Standard No. 4 engagements would become industry standard and, therefore, a de facto requirement. AS 4 PCAOB Adopting Release, B7-B9. Similarly, both of the PCAOB members who issued statements at the time of adoption of the Standard highlighted the fact that Auditing Standard No. 4 is not, in fact, mandatory. Statement of William J. McDonough, Statement of Daniel L. Goezler, AS 4 PCAOB Adopting Release, B12-B14. Management s discretion is, however, limited to those material internal control weaknesses that are sufficiently discrete to be addressed within the narrow parameters of Auditing Standard No. 4. AS 4 PCAOB Adopting Release at p. 9; Auditing Standard No. 4, 17 (and following Note). While management has great freedom in selecting the effective date for a report, assessment of the appropriateness of such date is one element of the auditor s work under the Standard. AS 4 PCAOB Adopting Release at p. 8, B15-B20; Auditing Standard No. 4, 5, 29, PCAOB Briefing Paper, Board Considers Adopting Auditing Standards on Reporting Whether a Previously Reported Material Weakness Continues to Exist (Jul. 26, 2005), In order to make management s discretion in this area meaningful, the Standard permits the auditor to cover all weaknesses subject to an engagement in a single report. Auditing Standard No. 4, 3, 53. AS 4 PCAOB Adopting Release at p. 6. AS 4 PCAOB Adopting Release at p. 9; Auditing Standard No. 4, 17 (and following Note). AS 4 PCAOB Adopting Release at p. 8; Auditing Standard No. 4, 5. Auditing Standard No. 4, 29. A variety of factors come into play. For example, weaknesses in controls that operate over the company s period-end financial processes can only be tested in connection with a period end. Auditing Standard No. 4, 29. In contrast, material internal control weaknesses that involve transaction-based controls may be susceptible to testing as of almost any date. AS 4 PCAOB Adopting Release, B18. AS No. 4 PCAOB Adopting Release at p. 8. AS No. 4 PCAOB Adopting Release, B80; Auditing Standard No. 4, 63. A control objective provides a specific target against which to evaluate the effectiveness of controls. It states a criterion for evaluating whether a company s control procedures in a specific area provide reasonable assurance that a misstatement to or omission in that relevant assertion is prevented or detected by controls on a timely basis. Auditing Standard No. 4, 11. Auditing Standard No. 4, AS 4 PCAOB Adopting Release B41, Auditing Standard No. 4, A stated control objectives in the context of remediation of a material internal control weakness is the specific control objective that, if achieved, would result in the material weakness no longer existing. Auditing Standard No. 4, 16. Auditing Standard No. 4, 7. Management s report must include: 28 AS 4 PCAOB Adopting Release, B-15. Page 10

11 A statement of management s responsibility for establishing and maintaining effective internal control over financial reporting; Assert that the identified material internal control weakness no longer exists as of the effective date; 43 A statement identifying the control criteria used by management to conduct its annual assessment of the effectiveness of internal control over financial reporting; An identification of each material weakness subject to the engagement that was identified by management as part of its annual assessment (or that was identified by the auditor in its report on annual assessment in the absence of an identification by management); An identification of the control objective(s) addressed by the specified controls and a statement that the specified controls achieved the stated objective as of the effective date selected by management; and A statement that each identified material weakness no longer exists as of the specified effective date because the specified controls address the specified weakness. Auditing Standard No. 4, 48. For example, management may wish to include forward-looking statements regarding the planned implementation of additional corrective actions State its belief that its assertions are supported by sufficient evidence; Describe any material fraud and any other fraud that, although not material, involves senior management or management or other employees who have a significant role in the company s internal control over financial reporting that has occurred or come to management s attention since the date of management s most recent annual assessment of internal control over financial reporting; and State whether there have been, subsequent to the effective date, any changes in internal control over financial reporting or other factors that might significantly affect the stated control objective(s) or indicated that the identified controls were not operating effectively as of, or subsequent to, the effective date. Auditing Standard No. 4, 44. Auditing Standard No. 4, 45. Auditing Standard No. 4, 46. Auditing Standard No. 4, 5. Auditing Standard No. 4, Auditing Standard No. 4, Auditing Standard No. 4, 25. Auditing Standard No. 4, 2, 25. A successor auditor who has been engaged to audit the financial statements and internal control over financial reporting in the current year, and who has performed specified procedures in order to ensure that it has sufficient knowledge of the company s business and internal control over financial reporting, as well as any additional procedures that the auditor deems necessary to obtain sufficient knowledge, meets the requirements of the Standard. Auditing Standard No. 4, 2, Auditing Standard No. 4, 59. If, however, it concludes that the additional information contains a material misstatement of fact, the auditor is directed to discuss the matter with management. If, after such discussion, the auditor concludes that a material misstatement remains, it is directed to so notify both management and the company s audit committee, in writing. Auditing Standard No. 4, 60. Auditing Standard No. 4, 7, 8, 48. In these representations, management must: Acknowledge its responsibility for establishing and maintaining effective internal control over financial reporting; Indicate that it has evaluated the effectiveness of the specified controls using the specified control criteria and management s control objectives; Auditing Standard No. 4, 36. Assert that the specified controls are effective in achieving the stated control objectives as of the effective date selected by management; Auditing Standard No. 4, 37. Under the Standard, the auditor must examine: Sufficiency of management s evidence (Auditing Standard No. 4, 28); Page 11

12 Appropriateness of the effective date selected by management (Auditing Standard No. 4, 29); Effectiveness, if operated as designed, of all controls specifically identified by management (Auditing Standard No. 4, 31); and Operating effectiveness of all such identified controls (Auditing Standard No. 4, 32). The SEC has stated that materiality in this area should be determined on the basis of the standard set out in TSC Industries, Inc. v. Northway, Inc., 426, U.S. 438 (1976) and Basic Inc. v. Levinson, 485 U.S. 224 (1988). See Question 9, SEC Q&A Release. AS 4 PCAOB Adopting Release, B43-B50; Auditing Standard No. 4, 23. Id. AS 4 PCAOB Adopting Release, B48. AS 4 PCAOB Adopting Release, B48. Auditing Standard No. 2, Auditing Standard No. 4, 42, 55, 62. If a company elects to engage its auditor to report on some, but not all, previously reported material internal control weaknesses, the audit report must: Identify where the auditor s report on the annual assessment containing the additional, unaddressed material internal control weaknesses is publicly available (or include a copy of the report as an attachment); and Contain specific language indicating that the auditor s (or predecessor auditor s) prior report on management s annual assessment of internal control identified material internal control weaknesses other than those identified in the current report, that the auditor is not reporting on such other material internal control weaknesses and, therefore, is expressing no opinion on whether such weaknesses exist after the effective date of the annual assessment. Auditing Standard No. 4, 56 Auditing Standard No. 4, 62. Auditing Standard No. 4, 55. As discussed below, if the auditor withdraws under these circumstances it is obligated to communicate to the company s audit committee, in writing, its conclusion that the material weakness continues to exist. Auditing Standard No. 4, 62. The content of an opinion issued under Auditing Standard No. 4 also underscores its narrow focus. Among other things, the opinion must, with respect to each material internal control weakness addressed, (a) describe the material weakness; (b) identify all of the specified controls that management asserts address the material weakness; and (c) identify the specific control objective achieved by these controls. The opinion also must state the scope of the engagement as set out in the Standard and that the auditor has not performed procedures sufficient to reach conclusions about, and is not passing on, either the effectiveness of any controls other than those specifically addressed or the overall effectiveness of internal control over financial reporting. Management s failure to provide the required representations constitutes a scope limitation under the Standard. Auditing Standard No. 4, 46. AS 4 PCAOB Adopting Release at p. 8, B82. The narrow range of options available under the Standard also becomes evident if the auditor determines that there exist subsequent events that adversely affect the effectiveness of the internal controls identified by management or the achievement of management s control objectives. In these circumstances, the auditor is directed to treat the matter as if it had determined that a material internal control weakness continued to exist and either issue an opinion to that effect or withdraw from the engagement. If the auditor is unable to determine the effect of the subsequent events, it is directed to disclaim an opinion. Auditing Standard No. 4, 57, 58, 61. Auditing Standard No. 4, 62. In these circumstances, reporting to the audit committee is the alternative to issuing a report indicating that the weakness continues to exist. 17 C.F.R Item 304 requires disclosure with respect to the dismissal or resignation (or indication that it has declined to stand for election) of an independent accountant who was previously engaged as the principal accountant to audit an issuer s financial statements. Therefore, withdrawal or resignation from a specific Auditing Standard No. 4 engagement would not trigger disclosure. Auditing Standard No. 4, 62. In these circumstances, reporting to the audit committee is the alternative to issuing a report indicating that Page 12