Statement on the Adoption of a Revised Auditing Standard on Internal Control over Financial Reporting

The principal focus of the project to revise our standard on internal control has been to address concerns about costs. What sometimes gets lost, though, is that Sarbanes-Oxley's provisions on internal control reporting and auditing have been resoundingly beneficial to investors. Those benefits have been measured and documented, and they remain uncontroverted.

  • Both companies and their investors have benefited from the reduced cost of capital researchers have measured at companies whose auditors attest that they have cleaned up internal control problems – on the order of a 150 basis point reduction. [1]
  • The investing public has received important warnings that some companies' internal control might not detect or prevent a material misstatement. Perhaps the most spectacular example was Refco's disclosure in connection with it's IPO that it had two significant deficiencies in its internal control. Two months later, the company collapsed due to revelations about related party transactions designed to help it hide losses. Instead of learning about the problems only after the fall, this time investors learned there were risks ahead of time. [2]
  • And we're also seeing unprecedented numbers of companies identify and fix problems in their controls as well as their actual reporting, in most cases before they turn into disasters like Refco . . . and Enron, Worldcom and so many others. Since the first year of internal control reporting and auditing, the percentage of companies reporting material weaknesses has dropped precipitously, from a highpoint of 16.9 percent the first year, to 10.5 percent in the second year. In the third year, as of April 2007 only 5.4 percent of third-year filers had reported material weaknesses.[3]

These benefits outweigh the associated costs, by any measure. Moreover there is encouraging evidence, based on corporate proxy reports, that costs have turned out to be less than some had feared and, quite naturally, have decreased since the first year of implementation. [4]

In evaluating the standard, I have focused on making certain that the core principles essential to an effective internal control audit are retained. I am satisfied that the revised standard does so. Ultimately, though, the success of a principles-based standard depends on how it is implemented in practice.

Maintaining the benefits I've described will require faithful application of the principles in the standard. This will also require consistent and balanced oversight of firms' implementation, and concern for more than just reducing costs. It's indisputable that internal control audits should avoid unnecessary costs, and I think the new standard helps auditors to do so. But what's most important to our capital markets is that investors have confidence in the accuracy and reliability of financial reporting. An effective audit does that, and in so doing contributes value far in excess of its cost.

[1] See Ashbaugh-Skaife, Collins, Kinney and LaFond, The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity Capital (April 2006, updated February 2007). Specifically, the researchers found that when companies report they have corrected a previously reported material weakness in internal control, their cost of capital goes down on average 1.5 percent. Conversely, when companies report material weaknesses in audited financial reports after they had previously reported in unaudited statements that internal control was effective, their cost of capital goes up on average almost 1 percent (93 basis points).

[2] See Smith, E.G., "Accounting Experts: Refco Prospectus Offered Red Flags," USA Today (Oct. 17, 2006).

[3] See Audit Analytics, Second Year 404 Dashboard With Updates for Year Three, April 2007 Review ("Audit Analytics April 2007 Review"), at 1, available at .

[4] See Audit Analytics, Surprised by Audit Fees: A Comparison of Audit Fee Changes Experienced by Section 404 Filers and Non-filers (February 2007), available at . Audit Analytics examined corporate proxy disclosures on audit fees and concluded that, on average, the new internal control audits resulted in only a 25 percent increase in audit fees from 2003 to 2005, far short of anecdotal claims that Section 404 had doubled or tripled audit fees, and that overall this work made up only 15 percent of the total audit fees that companies subject to Section 404 paid last year.

Related Information