SEC Guidance On SOX Hailed By Insurers

"In other words, it is a quality vs. quantity issue, the agencies have said," Carson explains.

The new guidelines will allow external auditors to communicate directly with management and tailor audits to individual clients, explains Richard Whiting, executive director and general counsel for The Financial Services Roundtable, Washington. He says that external auditors also will be able to use the work of internal audit staff. "Further, the new guidelines will allow for an integrated audit of internal controls and financial statements," Whiting says.

"The guidance is a constructive step in providing greater clarity and focus on Sarbanes-Oxley requirements," Whiting adds. "The PCAOB clearly has heard the message that there are aspects of Section 404 that are not working."

The SEC staff statement explains that "an overarching principle of this guidance is the responsibility of management to determine the form and level of controls appropriate for each organization and to scope their assessment and testing accordingly. One size does not fit all and control effectiveness is affected by many factors."

Sarbanes-Oxley was designed to combat the corporate misdeeds that led to the Enron and WorldCom scandals.

Accelerated filers with the SEC were required to be in compliance with these new rules for the fiscal year ending November 15, 2004. The guidance follows the April 13 roundtable with industry, in which the agencies listened to comments from issuers on how the process worked in its first year of implementation.

"The feedback made clear that companies have realized improvements to their internal controls as a result of implementing the requirements and that the requirements have led to an improved focus on internal controls throughout the organization," the staff statement says. "However, the feedback also identified implementation areas that need further attention or clarification to reduce any unnecessary costs and other burdens without jeopardizing the benefits of the new requirements."

In its guidance, the statement noted that the SEC has decided not to issue a prescribed system for internal auditing specifically to allow companies to determine how to best monitor themselves.

"In adopting its rules implementing Section 404, the Commission expressly declined to prescribe the scope of assessment or the amount of testing and documentation required by management," the staff statement says. "The scope and process of the assessment should be reasonable, and the assessment [including testing] should be supported by a reasonable level of evidential matter. Each company also should use informed judgment in documenting and testing its controls to fit its own operations, risks and procedures. Management should use its own experience and informed judgment in designing an assessment process that fits the needs of that company. Management should not allow the goal and purpose of the internal control over financial reporting provisions–the production of reliable financial statements–to be overshadowed by the process."

The theme of ensuring the spirit of Sarbanes-Oxley rather than adherence to a specific set of guidelines also was apparent in the staff statement's view of how companies are monitoring themselves. Rather than examining themselves using a risk-based approach, the staff statement noted, many companies began using a "mechanistic, check-the-box" system.

"This was not the goal of the Section 404 rules, and a better way to view the exercise emphasizes the particular risks of individual companies," the statement says. "Indeed, an assessment of internal control that is too formulaic and/or so detailed as to not allow for a focus on risk may not fulfill the underlying purpose of the requirements. The desired approach should devote resources to the areas of greatest risk and avoid giving all significant accounts and related controls equal attention without regard to risk."