Sarbanes-Oxley Act: Section 404 Practical …

1 Sarbanes-Oxley Act: Section 404 Practical Guidance for Management* July 2004 *connectedthinking This monograph is designed to assist management in its efforts to satisfy its responsibilities established by the Public Company Accounting Reform and Investor Protection Act of 2002. The monograph is based on rule-making and guidance available as of July 2, 2004; accordingly, as new rules or modifications or interpretations to existing rules emerge, certain aspects of this monograph may become obsolete. Because interpreting this guidance is proving to be an evolutionary process, preparers and users are cautioned to carefully evaluate and monitor further implementation guidance from the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB). PricewaterhouseCoopers will continue to monitor regulatory activities, company interpretations, and evolving practices; we will update our policies and will issue updated perspectives as warranted.

2 In providing the information contained in this monograph, PricewaterhouseCoopers is not engaged in rendering legal, or other professional advice and services. As such, this monograph should not be used as a substitute for consultation with professional, legal, or other competent advisors. pwc To Our Clients and Friends: The Public Company Accounting Reform and Investor Protection Act of 2002 (the Act or the Sarbanes-Oxley Act) requires public companies to develop new practices involving corporate governance and financial reporting with the objective of restoring the public trust in the capital markets. One of the most challenging aspects of the Act s requirements involves a company s responsibilities for internal controls. Entitled Management Assessment of Internal Controls, Section 404 of the Act ( Section 404) stipulates that public companies must take responsibility for maintaining an effective system of internal control, in addition to reporting on the system s effectiveness.

3 The Act requires most public companies ( , accelerated filers that meet certain market capitalization requirements) to report annually on the company s internal control over financial reporting for fiscal years ended on or after November 15, 2004. The majority of the remaining public companies, including foreign private issuers, will be required to comply with these requirements for fiscal years ended on or after July 15, 2005. While Section 404 poses numerous challenges for preparers, users, and external auditors both in implementing the mandate and understanding its implications this monograph is primarily designed to address the challenges facing preparers. We fully recognize that implementation, particularly in the critical first year, will present preparers with many challenges, complexities, and new costs. However, for the benefits of Section 404 to be realized by all of the participants in the capital markets, a substantial effort will be needed.

4 A thorough assessment and evaluation of internal control over financial reporting will go a long way to achieving a fundamental objective of Section 404: restoring investor confidence in financial reporting. This monograph is presented to you in that spirit. The monograph is one in a series of publications1 that we have issued in relation to the Sarbanes-Oxley Act. This monograph describes the key activities integral to a successful Section 404 assessment process including, among others, scoping, documenting, testing, evaluating, and reporting. It reflects the insights and perspectives we have gained by working with our clients and obtaining input from the many PricewaterhouseCoopers partners and staff who have concentrated significant amounts of time on understanding this new reporting model. We provide our observations and analysis, note the lessons we have learned from recent experiences with clients, and offer examples that illustrate specific aspects of Section 404.

5 We are pleased to share our experiences with you. 1 Our previously issued white papers are entitled: The Sarbanes-Oxley Act of 2002: Strategies for Meeting New Internal Control Reporting Challenges; The Sarbanes-Oxley Act of 2002 and Current Proposals by NYSE, Amex, and NASDAQ: Board and Audit Committee Roles in the Era of Corporate Reform; and The Sarbanes-Oxley Act of 2002: Understanding the Auditor's Role in Building Public Trust. We have also issued a DataLine entitled, Management s Responsibility for Assessing the Effectiveness of Internal Control Over Financial Reporting Under Section 404 of the Sarbanes-Oxley Act. Pwc Many companies have made significant progress in their efforts to comply with Section 404. For those companies this monograph should (i) provide useful perspectives on evaluating and testing the design and operational effectiveness of control over financial reporting that will be conducted in the future and (ii) affirm or initiate a reassessment of established work plans or processes.

6 For other companies that are early in the process, this monograph should provide useful information in developing their overall strategy for implementing Section 404. It is worth noting that interpreting these new rules has proven to be an evolutionary process. Additional future interpretative guidance may be issued by the SEC for registrants and by the PCAOB for external auditors. Such guidance could impact views expressed in this publication. Raymond Bromark Raymond Beier Americas Theater Leader Leader Professional, Technical, Risk and Quality National Technical Services pwc Table of Contents Section I: Executive Summary ..1 The Most Significant Financial Legislation in Nearly 70 Years Why the Sarbanes-Oxley Act Was Issued ..1 The Benefits of Effective Internal Control over Financial Reporting .. 1 Implications of Section 404.

7 1 Section II: Getting Started Project Initiation ..3 Project Oversight .. 3 Project Management .. 6 Section III: Scoping and Planning The Beginning of an Effective Project ..8 Identify the Significant Accounts, Disclosures, and Business Processes/Cycles .. 10 Determine Multiple-Location 16 The Five Components of Internal Control .. 26 Control Environment .. 26 Risk 28 Control Activities .. 29 Information and Communication .. 30 Monitoring .. 31 Other Considerations .. 32 Period-End Reporting 32 Accounting Estimates and Judgments .. 34 General Computer Controls .. 35 Company-Level 36 Section IV: Use of Service Organizations ..38 The Steps for Evaluating the Procedures to Perform Over Service Organizations ..40 Determine If a Service Organization Is Being Used .. 40 Determine If the Outsourced Activities, Processes, and Functions Are Significant to the Company s Internal Control over Financial Reporting.

8 40 Determine If a Type II SAS 70 Report Exists and Is Sufficient in 41 If a Type II SAS 70 Report Does Not Exist, Determine Alternative 43 pwc Section V: Documentation Evidence of Effective Internal Control ..46 Step 1: Determine Scope of 47 Step 2: Develop Process Documentation .. 47 Step 3: Develop Control Documentation .. 48 Step 4: Assess the Design of Controls .. 52 Section VI: Testing Determining the Operating Effectiveness of Internal Identify the Controls to Be 57 Identify Who Will Perform the 58 Develop and Execute the Test Plans .. 59 Evaluate the Test Results .. 67 Section VII: Evaluation of Internal Control Deficiencies and Reporting ..69 Significance of Internal Control Deficiencies .. 69 The Process for Identifying, Assessing, and Classifying Internal Control 70 Reporting Management .. 74 Auditor s Evaluation of Management s Report.

9 75 Section VIII: Communication Important Observations ..76 Required Communications by Management .. 76 Written Representations from Management to the Auditor .. 76 Required Communications by the 77 Section IX: Mergers and Acquisitions Impact of the Sarbanes-Oxley Definition of Key Index of Frequently Asked Index of Lessons pwc Page 1 Section I: Executive Summary The Most Significant Financial Legislation in Nearly 70 Years Why the sarbanes oxley Act Was Issued The Public Company Accounting Reform and Investor Protection Act of 2002 (the sarbanes oxley Act or the Act) was enacted in July 2002 largely in response to major corporate and accounting scandals involving several prominent companies in the United States.

10 These scandals resulted in an unprecedented lack of confidence in the financial markets and a loss of public trust in corporate accounting and reporting practices. The Act has brought about the most extensive reform that the financial markets have seen since the enactment of the Securities Act of 1933 and the Securities Exchange Act of 1934. The impact of the Act has been felt throughout the financial markets; every industry and service sector has been, and will continue to be, impacted. Section 404 of the Act, Management Assessment of Internal Controls ( Section 404), which may be the most challenging aspect of the Act, requires most publicly registered companies and their external auditors to report on the effectiveness of the company s internal control over financial reporting. The obvious question is: How will companies implement Section 404?