Statement on the Adoption of a Revised Auditing Standard on Internal Control over Financial Reporting

The principal focus of the project to revise our standard on internal control has been to address concerns about costs. What sometimes gets lost, though, is that Sarbanes-Oxley's provisions on internal control reporting and auditing have been resoundingly beneficial to investors. Those benefits have been measured and documented, and they remain uncontroverted.

• Both companies and their investors have benefited from the reduced cost of capital researchers have measured at companies whose auditors attest that they have cleaned up internal control problems – on the order of a 150 basis point reduction. [1]
• The investing public has received important warnings that some companies' internal control might not detect or prevent a material misstatement. Perhaps the most spectacular example was Refco's disclosure in connection with it's IPO that it had two significant deficiencies in its internal control. Two months later, the company collapsed due to revelations about related party transactions designed to help it hide losses. Instead of learning about the problems only after the fall, this time investors learned there were risks ahead of time. [2]
• And we're also seeing unprecedented numbers of companies identify and fix problems in their controls as well as their actual reporting, in most cases before they turn into disasters like Refco . . . and Enron, Worldcom and so many others. Since the first year of internal control reporting and auditing, the percentage of companies reporting material weaknesses has dropped precipitously, from a highpoint of 16.9 percent the first year, to 10.5 percent in the second year. In the third year, as of April 2007 only 5.4 percent of third-year filers had reported material weaknesses.[3]

These benefits outweigh the associated costs, by any measure. Moreover there is encouraging evidence, based on corporate proxy reports, that costs have turned out to be less than some had feared and, quite naturally, have decreased since the first year of implementation. [4]

In evaluating the standard, I have focused on making certain that the core principles essential to an effective internal control audit are retained. I am satisfied that the revised standard does so. Ultimately, though, the success of a principles-based standard depends on how it is implemented in practice.

Maintaining the benefits I've described will require faithful application of the principles in the standard. This will also require consistent and balanced oversight of firms' implementation, and concern for more than just reducing costs. It's indisputable that internal control audits should avoid unnecessary costs, and I think the new standard helps auditors to do so. But what's most important to our capital markets is that investors have confidence in the accuracy and reliability of financial reporting. An effective audit does that, and in so doing contributes value far in excess of its cost.