What the Government tried to achieve w/Sox

1. What the Government tried to achieve w/Sox • Give the public, especially shareholders, faith back in the Financial Statements of public companies • Increase consequences for executives who perpetuate fraud • Enhance Internal Control Structures in companies, require monitoring of controls to ensure working as management intended • Prevent Financial Statement fraud How did they do?

2. Sarbanes Oxley Act of 2002 • Creates Public Company Accounting Oversight Board • 5 member board: two current/former CPAs, three not • SEC oversees • Register public accounting firms • Establish rules for auditing, independence, ethics, quality control, etc. (i.e. Auditing Standards)

3. Sarbanes Oxley Act of 2002 Requires Audit Partners to rotate clients every 5 years Requires second Audit Partner review of all audits Clients can not hire auditors for CEO, Controller, CFO, Chief Accounting Officer or equivalent position during the 1-year period preceding the audit. Why is this important to the PCAOB goals?

4. Sarbanes Oxley Act of 2002 • Prohibits Auditors from performing the following audit client services in most cases: • Bookkeeping or services related to financial statements • AIS design or implementation • Internal auditing • Management or HR functions • Legal or expert services unrelated to audit

5. Sarbanes Oxley Act of 2002 Services allowed if: - Pre-approved by the audit committee and Disclosed to stockholders - Amount of services is < 5% of total client revenues - A type of Tax service

6. Sarbanes Oxley Act of 2002 • Audit committee requirements • Must be independent directors • Responsible for appointment, compensation and oversight of “registered” public accounting firms working for the company • Oversee all complaints regarding accounting, controls and auditing • At least one “financial expert”

7. What is a financial expert? (McGladrey) • An understanding of financial statements and GAAP • An ability to assess application of GAAP for estimates, accruals and reserves • Experience preparing, auditing, analyzing or evaluating financial statements that represent a breadth and level of complexity of accounting issues for the registrant's financial statements, or experience actively supervising one or more persons engaged in such activities • An understanding of internal controls and procedures for financial reporting • An understanding of audit committee functions

8. Sarbanes Oxley Act of 2002 • Enhanced Management’s responsibility for external reporting • CEO and CFO must certify the “appropriateness of the financial statements and disclosures…fairly present…operations and financial position”—Section 302 • Restatements due to noncompliance with financial reporting requirements require disgorgement of profits by CEO and CFO

9. Sarbanes Oxley Act of 2002 • Miscellaneous additional requirements: • Reflect all correcting adjustments • Disclose off-balance sheet transactions • No personal loans to directors or executives • Certain designated transactions must be reported within 2 business days

10. SOX Section 404 (management assessment of IC) Each annual report includes an internal control report • State responsibility of mgmt • Assessment of effectiveness of IC structure and procedures • Auditor attests to management’s assessment’s adequacy (NOW N/A) Not a separate engagement

11. Section 404—some detail • Management must makes an assessment of IC design and effectiveness at least annually • Management must perform company Risk Assessment • Auditor must makes an assessment of IC design and effectiveness • Design—do the controls exist, for relevant assertions/risks and significant accounts • Effectiveness—do the controls work, for relevant assertions and significant accounts

12. Control Weakness Deficiencies can exist in design or effectiveness: • Design: • Control would not prevent or detect material misstatements in ordinary course of business if applied as designed • Assets are not sufficiently protected by control in place • Effectiveness: • Control in place is not being implemented as intended due to a) lack of training; b) lack of staff; c) turnover; d) inadequate monitoring e) inadequate system • Human error

13. IC deficiencies can vary in severity

14. Factors to consider Likelihood of misstatement: • Susceptibility to fraud • Cause and frequency of exceptions to IC • Nature of accounts • Interaction with other controls Magnitude of misstatement: • Financial statement amounts • Amount of transactions • Volume of transactions/activity

15. Indicators of potential material weakness • Weak control environment • Fraud of any magnitude in management • Identification of material misstatement caught by auditors, but not by company • Ineffective oversight by audit committee • Communicated deficiencies not corrected by management

16. Examples of potential material weakness • Financial close process—often related to staffing, training, timeliness • IT general controls—pervasive problems • Inventory cost process—particularly related to end-of period cut-off issues • Account reconciliations—all significant accounts are not analyzed and reconciled to the supporting schedules on a consistant basis

17. SOX sections recap Over Financial Reporting—404 • Relate to preparation of external reports, fairly presented in conformity with GAAP • Safeguarding assets • Address likelihood of fraud Over Disclosure Procedures—302 • Information required to be disclosed is recorded, processed, summarized, reported within prescribed time period • Ensure information is communicated to executive management timely for disclosure requirements

18. Management certifications requirements 302—CEO and CFO certify periodic SEC filings—fairness of FS and operating effectiveness of disclosure controls and procedures 404—Management’s assessment of IC–annual assessment and reporting by both mgmt and auditor on the effectiveness of IC over financial reporting 906—CEO and CFO: financial reporting certification and criminal penalties—all SEC reports with financials, fairness of FS and compliance with requirements of SEA of 1934