Testing time for Sarbanes-Oxley

Judgment day is fast approaching for US companies grappling with the most complex and expensive provisions in the Sarbanes-Oxley accounting and corporate governance legislation.

The Financial Times reports that up to 5,000 large and medium-sized public companies must give detailed summaries about the state of their internal controls in forthcoming annual reports. The reports must also include separate opinions by auditors on the effectiveness of those internal controls, which are designed to ensure good accounting and guard against fraud.

Many of the companies that must comply with the requirements of Section 404 of the Sarbanes-Oxley legislation had fiscal year-ends on 31 December 2004, the FT says, and under separate rules have to file their annual reports with US regulators by 15 March.

So over the next four weeks, auditors are meeting companies to tell them whether they think their internal controls have made the grade.

The FT says that the big four accounting firms – Deloitte, Ernst & Young, KPMG and PwC – suggest about 10 per cent of companies will reveal serious difficulties, although no one knows for sure. Either they will disclose "material weaknesses" in their controls that could cause inaccurate accounting, as required by Section 404, or say they have been unable to complete the assessment process on time.

The FT also says that some common problems are starting to emerge with internal controls at some companies:

  1. Multiple difficulties with information technology systems, including the basic need to ensure that only approved people have access to data
  2. Whether companies have adequate arrangements to detect fraud
  3. The quality of people and systems in the reporting process, notably on tax accounting

Such problems could amount to significant deficiencies in internal controls. The key question is whether such deficiencies in turn add up to material weaknesses at a company’s fiscal year-end.

Financial Times | Crunch time for Sarbanes-Oxley (paid subscription required)

Related NevOn posts: