Introductory Statement on the New Standard Concerning the Audit of Internal Control

This July will mark the fifth anniversary of the Sarbanes-Oxley Act, and much has happened since July 2002. When many people refer to Sarbanes-Oxley, they are in fact referring to Section 404, which set forth new provisions related to internal control over financial reporting for all U.S. public companies. As over 50 percent of U.S. households are now equity holders in one form or another, Congress mandated in Section 404 (a) that CEOs and CFOs of companies choosing to access U.S. public markets should have to disclose to investors whether their companies' internal control over financial reporting is effective. In Section 404 (b), Congress mandated an audit of internal control.

Even though Congress had acted in the area of internal control more than once before, the Act's requirement for quarterly management certifications, annual management assessments of controls, and independent auditor attestations of those assessments raised corporate responsibility for internal control over financial reporting to a higher level. On the heels of the corporate scandals that surged in 2000-2001, there was a broad-based sentiment that these enhanced requirements were necessary to restore integrity to, and confidence in, financial reporting.

The PCAOB has been focused on the implementation of the internal control audit for the past several years. Since adopting Auditing Standard No. 2 (An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements) in 2004, the Board has closely monitored its implementation. In May of last year, before I joined the Board, my Board colleagues, all of whom were here at the time, made a commitment to revisit AS 2, and we are here today — a year and one week since that commitment was made — to consider a new standard to replace it. [1]

The PCAOB's action today is a reflection of the Board's belief in the importance of internal control to reliable financial reporting. With so many investors in the United States and around the world invested in U.S. companies, we owe it to them to see that there is a quality audit over internal control within these companies. At the same time, investors and public companies alike benefit from regulatory balance. Therefore, the PCAOB has been driven by the need to identify changes that would preserve the important benefits of the standard, and meet the statutory objectives of the Act, without resulting in the performance of unnecessary audit procedures. In December, at our open meeting, I emphasized the need for a standard that would help bring about a better alignment between the costs and benefits of the internal control audit.

With regard to benefit, I am encouraged that many companies that are now subject to Section 404 requirements are starting to show the benefits of internal control over financial reporting (based on disclosures that are now available to the public). The first two years of their reporting on internal controls tell us a great deal about the progress made already, and findings — as of April 2007 — for year three appear to support a continuing, positive trend. While the costs of internal controls have seized attention, we should not lose sight of the visible benefits. An analysis of reporting data indicates encouraging trends:

• From the first year of compliance with Section 404 to the second, there was a decline in the overall number of opinions on ICFR that describe material weaknesses. The results as of April 1, 2007, indicate that this trend is continuing in year three. [2]
• Restatements are also declining for companies subject to Section 404, which is in contrast to the restatement rate for those not yet subject to its requirements. [3] This suggests that internal control over financial reporting is helping companies identify and fix problems in advance of having to restate.

These signs of benefits are encouraging. I am also encouraged by what I am hearing from corporate America. The consistent feedback that I get from corporate board members and CEOs of accelerated filers is that they are better companies due to internal control over financial reporting. But, they continue to express concern about unnecessary burden.

On December 19, 2006, the Board proposed for comment a new standard on auditing internal control that would replace Auditing Standard No. 2.[4] At that time, I encouraged auditors, investors, issuers and all others who rely on corporate financial statements to tell us whether the proposals clarified Board expectations, reduced unnecessary work, and retained the important benefits of an audit of internal control. The public comment process for a standard of this significance is tremendously important. The comments received — 175 in all — further informed our thinking. The standard, and related rule and amendments, that we are considering today reflect our careful consideration of the comments. We are grateful to the array of commenters who took the time to provide their analysis.

The Board asked staff to scrutinize the comments against the provisions of the proposed standard with the goal of eliminating unnecessary requirements for internal control reporting, while developing a standard that will require auditors to obtain sufficient evidence to provide an opinion on a company's internal control.

We have carefully studied the comments received so that the recommendations before us today reflect the full benefit of the comment period. We have also worked closely with counterparts at the SEC to ensure that the recommendations are consistent with the guidance provided by the Commission at its open meeting in April, which included the importance of appropriately coordinating the standard with the SEC's management guidance adopted at the SEC's open meeting yesterday. This alignment is important for auditors and issuers.

In a moment, Thomas Ray, our Chief Auditor and Director of Professional Standards, and his team will present to the Board the staff's recommendation for a final standard to replace AS 2, a related independence rule, and conforming amendments to the Board's auditing standards.

I commend Tom and the staff for their intellectual fortitude and old-fashioned hard work that has brought the standard and its related rule and amendments before the Board today. Staff has worked creatively to find solutions and been steadfast when it mattered most.

To present the staff's recommendation on this agenda item, I will now turn to Tom Ray.

---

[3] Data on financial restatements were compiled from Audit Analytics, for restatements filed as of December 31, 2006.

[4] See Proposed Auditing Standard: An Audit of Internal Control Over Financial Reporting That is Integrated with an Audit of Financial Statements and Related Other Proposals, PCAOB Release No. 2006-007 (Dec. 19, 2006).