Internal Controls: SEC Should Consider Requiring Companies to Disclose Whether They Obtained an Auditor Attestation
Released: 2013-07-03T00:00:00

Letter

Background

Internal control generally serves as a first line of defense for public companies in safeguarding assets and preventing and detecting errors and fraud. Internal control is defined as a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of the following objectives: (1) effectiveness and efficiency of operations; (2) reliability of financial reporting; and (3) compliance with laws and regulations.

Internal control over financial reporting is further defined in the SEC regulations implementing Section 404 of the Sarbanes-Oxley Act.regulations define internal control over financial reporting as a means of providing reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements, including those policies and procedures that: pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in conformity with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

Regulators regard an effective internal control system as a foundation for high-quality financial reporting by companies. Title IV, Section 404 of the Sarbanes-Oxley Act, aims to help protect investors by, among other things, improving the accuracy, reliability, and transparency of corporate financial reporting and disclosures. Section 404 has the following two key sections:

Section 404(a) requires company management to state its responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting and assess the effectiveness of its internal control over financial reporting in each annual report filed with SEC. In 2007, SEC issued guidance for management regarding its report on internal control over financial reporting.

Section 404(b) requires the firms that serve as external auditors for public companies to provide an opinion on the internal control assessment made by the companies’ management regarding the effectiveness of the company’s internal control over financial reporting as of year-end. In 2007, PCAOB issued Auditing Standard No. 5, which contains the requirements that apply when an auditor is engaged to perform an audit of management’s assessment of the effectiveness of internal control over financial reporting.

While management is responsible for the implementation of an effective internal control process, the external auditor obtains reasonable assurance to provide an opinion on the effectiveness of a company’s internal control over financial reporting through an independent audit. Investors need to know that the financial statements on which they make investment decisions are reliable. The auditor attestation process involves the external auditor’s testing and evaluation of the company’s internal control over financial reporting and relevant documentation in order to provide an opinion on the effectiveness of the company’s internal control over financial reporting as of year-end; a company’s internal control over financial reporting cannot be considered effective if one or more material weaknesses exist.

Auditor attestation of the effectiveness of internal control over financial reporting has been required for public companies with a public float of $75 million or more (accelerated filers) since 2004. However, SEC delayed implementing the auditor attestation for public companies with less than $75 million in public float (nonaccelerated filers) several times from the original compliance date of April 15, 2005, to June 15, 2010, in response to concerns about compliance costs and management and auditor preparedness. On July 21, 2010, the Dodd-Frank Act permanently exempted nonaccelerated filers from the auditor attestation requirement. The Dodd-Frank Act did not exempt nonaccelerated filers from Section 404(a) of the Sarbanes-Oxley Act (management’s assessment of internal controls). See table 1 for final compliance dates for internal control over financial reporting by issuer filer status.

The number of exempt companies exceeded the number of nonexempt companies in each year from 2005 through 2011 (see table 2). According to our analysis of Audit Analytics data, the number of exempt companies fluctuated and ultimately declined from 6,333 in 2005 to 5,459 in 2011 (13.8 percent during that period). The number of nonexempt companies also fluctuated and ultimately declined from 4,256 in 2005 to 3,671 in 2011(13.7 percent).

SEC and PCAOB have issued regulations, standards, and guidance to implement the Sarbanes-Oxley Act. In 2007, in response to companies’ concerns about implementation costs, SEC provided implementation guidance to company management, and PCAOB issued a new auditing standard to external auditors to make the internal controls audit process more efficient and more cost-effective. SEC’s guidance for management in implementing Section 404(a) of Sarbanes-Oxley Act and PCAOB’s Auditing Standard No. 5 for external auditors in implementing Section 404(b) of Sarbanes-Oxley Act endorsed a “top-down, risk-based approach” that emphasizes preventing or detecting material misstatements in financial statements by focusing on those risks that are more likely to contribute to such misstatements. These changes were provided to create a more flexible environment where company management and external auditors can scale their internal controls evaluation based on the particular characteristics of a company to reduce costs and to align SEC and PCAOB requirements for evaluating the effectiveness of internal controls.

Both SEC regulations and PCAOB Auditing Standard No. 5 state that management is required to base its assessment of the effectiveness of the company’s internal control over financial reporting on a suitable, recognized control framework established by a body of experts that followed due process procedures. Both the SEC guidance and PCAOB’s auditing standard cite the Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework as an example of a suitable framework for purposes of Section 404 compliance. In 1992, COSO issued its “Internal Control—Integrated Framework” (the COSO framework) to help businesses and other entities assess and enhance their internal controls. Since that time, the COSO framework has been recognized by regulatory standard setters and others as a comprehensive framework for evaluating internal control, including internal control over financial reporting. The framework consists of five interrelated components: control environment, risk assessment, control activities, information and communication, and monitoring.PCAOB do not mandate the use of any particular framework.

The Percentage of Exempt Companies with Financial Restatements Was Generally Greater Than the Percentage of Nonexempt Companies from 2005 through 2011

Since the implementation of the Sarbanes-Oxley Act, the number and percentage of exempt companies restating their financial statements has generally exceeded the number and percentage of nonexempt companies restating. However, from 2005 through 2011, restatements by exempt companies were generally proportionate to their percentage of our total population. Specifically, on average, almost 64 percent of companies restating were exempt companies and exempt companies made up, on average, 60 percent of our total population. Exempt and nonexempt companies restated their financial statements for similar reasons, and the majority of these restatements produced a negative effect on the companies’ financial statements.

Exempt Companies Generally Have Had More Financial Restatements Than Nonexempt Companies

The number of financial statement restatements by exempt and nonexempt companies has generally declined since 2005. As illustrated in figure 1, the number of financial restatements peaked in 2006 for exempt companies and declined gradually until 2011, despite a slight uptick in 2010. The number of restatements peaked in 2005 for nonexempt companies, declined gradually until 2009, and then trended upward for the remaining 2 years of the review period. As we have previously reported, some industry observers noted the financial reporting requirements of the Sarbanes-Oxley Act and PCAOB inspections may have led to a higher than average number of restatements in 2005 and 2006. A 2010 Audit Analytics report noted that some observers attributed the subsequent decline in restatements to a belief that SEC relaxed standards in 2008 relating to materiality of errors and the need to file restatements.companies exceeded the number of financial restatements by nonexempt companies each year from 2005 through 2011. However, although the overall number of financial restatements from 2009 through 2011 remained lower than the prior period, the number of financial restatements by nonexempt companies increased about 23 percent from The number of financial restatements by exempt 2010 through 2011. The number of financial restatements by exempt companies declined almost 8 percent during the same period.

SEC officials and one market expert with whom we spoke indicated that there is no clear explanation for these restatement trends. They also said that a review of each individual financial restatement would be necessary to determine the reasons for the restatement trends, but they offered a few factors to consider when assessing the trends. In particular, a recent Audit Analytics report found that approximately 57 percent of restatements disclosed in 2011 were defined as revision restatements, the highest level since 2005 (the first full year of the disclosure requirement). According to the report, revision restatements generally do not undermine reliance on past financials and are less disruptive to the market. SEC officials noted that although restatements by nonexempt companies have increased, as illustrated in the Audit Analytics report, they may be less severe as a result of higher numbers of revision restatements, fewer issues per restatement, and a lower cumulative impact on the company’s net income. According to our analysis of Audit Analytics data, in 2011, the percentage of restatements that were revision restatements was approximately 62 percent for exempt companies compared to approximately 70 percent for nonexempt companies. SEC officials also suggested that the detection rate of financial restatements could affect restatement trends, especially when looking only at a one or two year period. The officials said that the lag time on detection and the likelihood of detection could be different between exempt and nonexempt companies. Finally, SEC officials said that it is important to consider the nature and severity of restatements.

Except for 2005, the percentage of exempt companies restating their financial statements exceeded the percentage of nonexempt companies restating. From 2006 through 2009, there was a decline in the percentage of restatements for both exempt companies and nonexempt companies. The percentage of exempt companies restating their financial statements rose in 2010 to 7.6 percent and remained constant in 2011 (see fig. 2). At the same time, starting in 2010, the percentage of nonexempt companies restating has been on the increase. In addition, from 2005 to 2011, on average, almost 64 percent of companies restating were exempt companies, which made up 60 percent of our total population.

Our analysis is generally consistent with a number of studies that have found that exempt companies restate their financial statements at a higher rate than nonexempt companies.having an auditor attest to the effectiveness of a company’s internal control over financial reporting generally reduces the likelihood of financial restatements. For example, in 2009, Audit Analytics found that for companies that did not obtain an auditor attestation and stated that These studies suggest that they had effective internal controls, their financial restatement rate was 46 percent higher than the restatement rate for companies that had obtained an auditor attestation and stated that they had effective internal controls.

Exempt Companies That Voluntarily Complied with Auditor Attestation Issued Fewer Restatements Than Exempt Companies That Did Not

Exempt companies that voluntarily complied with the auditor attestation requirement constitute a small percentage of exempt companies (see table 3). Prior to the passage of the Dodd-Frank Act in July 2010, the number of exempt companies voluntarily complying with the auditor attestation requirement grew 70 percent from 2008 through 2009. Although SEC deferred the requirement for nonaccelerated filers to comply until June 15, 2010, some exempt companies likely voluntarily complied in anticipation of SEC’s implementation of the requirement. Nonetheless, in 2009 during the peak compliance period for exempt companies that voluntarily complied, 6.9 percent (435) of a total population of 6,285 exempt companies voluntarily complied with the auditor attestation requirement. According to one academic study, exempt companies that voluntarily comply with the auditor’s attestation requirement are more likely than companies that do not comply to have evidence of the superior quality of their internal control over financial reporting and fewer restatements, among other factors.

As table 3 also shows, the percentage of financial restatements by exempt companies that voluntarily complied with the requirement is generally lower than that of exempt companies that did not voluntarily comply. From 2005 through 2011, on average, 7.5 percent of exempt companies that voluntarily complied restated their financial statements compared to 8.9 percent of restating exempt companies that did not voluntarily comply.

Reasons for Financial Restatement and Industry Trends Are Generally Consistent for Both Exempt and Nonexempt Companies

From 2005 through 2011, based on our analysis of Audit Analytics data, the majority of exempt and nonexempt companies that restated their financial statements did so as the result of an accounting rule misapplication. That is, a company revised previously issued public financial information that contained an accounting inaccuracy. To analyze the reasons for financial restatements, we used Audit Analytics’ 69 classifications to classify the type of financial restatements into six categories (see table 4): revenue recognition, core expenses, noncore expenses, reclassifications and disclosures, underlying events, and other.

Based on our classification, core expenses (i.e., ongoing operating expenses) were the most frequently identified category of restatement for both exempt and nonexempt companies. Specifically, core expenses accounted for 30.2 percent of disclosures by exempt companies and 28.5 percent of disclosures by nonexempt companies from 2005 through 2011 (see fig. 3). Core expenses include cost of sales, compensation expenses, lease and depreciation costs, selling, general and administrative expenses, and research and development costs. Noncore expenses (i.e., nonoperating expenses) were the second most frequently identified reason for restatement across exempt and nonexempt companies during this period. Each of the other reasons for restatements represented less than 20 percent of all restatements by exempt and nonexempt companies during the period.

From 2005 through 2011, the majority of financial restatements by exempt and nonexempt companies negatively impacted the company’s financial statements. Specifically, 87.6 percent of financial restatements by exempt companies resulted in a negative net effect on the financial statements—the income statement, the balance sheet, the statement of cash flows, or the statement of shareholder’s equity—of these companies. Similarly, 80.6 percent of financial restatements by nonexempt companies resulted in a negative net effect on the company’s financial statements.

The characteristics of exempt and nonexempt companies with financial restatements varied from 2005 through 2011. For example, in terms of industry characteristics, on average, most exempt companies restating were in the manufacturing sector (29.4 percent), followed by agriculture, construction, and mining (14.6 percent). On average, most of the nonexempt companies restating were in the manufacturing sector (29.3 percent), followed by the financial sector (16.6 percent). Further, in 2011, 91.4 percent of nonexempt companies restating compared to 35.3 percent of exempt companies were listed on an exchange. In addition, nonexempt companies had an average financial restatement period that was longer than that of exempt companies. Specifically, from 2005 through 2011, nonexempt companies had an average financial restatement period of 9 quarters compared to an average financial restatement period of almost 6 quarters for exempt companies.

Views on the Costs and Benefits of Auditor Attestation Vary among Companies and Others

Companies and others identified various costs of the auditor attestation requirement. A number of studies and surveys show that since the passage of the Sarbanes-Oxley Act, and especially since the 2007 reforms by SEC and PCAOB, audit costs have declined for companies of all sizes. These studies and surveys also show that these costs, as a percentage of revenues, affect smaller companies disproportionately compared to their larger counterparts. Companies and others also identified benefits of compliance, including stronger internal controls and more transparent and reliable financial reports. However, determining whether auditor attestation compliance costs outweigh the benefits is difficult because many costs and benefits cannot be readily quantified.

Auditor Attestation Costs Can Be Significant, Especially for Small Companies, but Costs Are Declining

A number of studies and surveys show that the estimated costs of obtaining an external auditor attestation on internal control over financial reporting are significant for companies of all sizes. Obtaining an auditor attestation incurs both direct and indirect costs, according to one study. Direct costs are expenses incurred to fulfill the auditor attestation requirement, such as the audit fees, external fees paid to outside contractors and vendors that help companies comply with the requirement, salaries of internal staff for hours spent preparing for auditor attestation compliance, and nonlabor expenses (e.g., technology, software, travel, and computers related to compliance). Indirect costs are those costs not directly linked to obtaining the auditor attestation. Two examples of indirect costs cited by one interviewee and one study are the time spent by management in preparing for and addressing auditors’ inquiries, which diverts their attention from strategic planning, and the diversion of funds from capital investments to auditor attestation-related expenses.

Audit fees are a significant direct cost of the auditor attestation requirement. Sarbanes-Oxley Act and PCAOB standards require that the financial statement audit and the auditor attestation audit be conducted on an integrated basis. As a result, the auditor attestation is included in the total audit fees—that is, the total amount companies pay to their external auditors to conduct the integrated audit. Audit fees are based on several factors, including but not limited to the scope of an audit, which is a function of a company’s complexity and risk; the total effort required by the external auditor to complete the audit; and the risk associated with performing the audit. However, according to SEC’s 2011 study and one interviewee, the costs incurred by a company to comply with the auditor attestation requirement generally decline after the initial year.

We analyzed total audit fees as a percentage of revenues from 2005 through 2011 for exempt and nonexempt companies. We found that exempt companies, which tend to be smaller, had higher average total audit costs, measured as a percentage of revenues, compared to nonexempt companies (see table 5). Among exempt companies, the data indicate that exempt companies that do not voluntarily comply with the auditor attestation requirement have (except for 2006) higher average total audit fees as a percentage of revenues than the exempt companies that voluntarily comply. While two academics we contacted about this trend could not provide a definitive explanation, there are many factors beside company size that can affect audit fees.

Our data analysis results are consistent with our previous work on audit fees. Specifically, in 2006, we reported that smaller public companies paid disproportionately higher audit fees compared to larger public companies. Smaller public companies noted that they incur higher audit fees and other costs, such as hiring more staff or paying outside consultants to comply with the internal control provisions of the Sarbanes- Oxley Act. One study noted that historically, these higher audit fees and other costs increased regulatory costs for smaller public companies because regulatory compliance, in general, involves a significant number of fixed costs regardless of the size of a company. Thus, smaller companies with lower revenues are forced to bear these fixed costs over a smaller revenue base compared to larger companies.

However, the auditor attestation is one element of the total audit fees. To gauge the amount spent on the auditor attestation, we asked respondents to our survey to provide us with the amount of total audit fees and the approximate amount attributable to complying with the auditor attestation requirement. Based on our survey results, we estimate that all companies with a market capitalization of less than $10 billion that obtained an auditor attestation in 2012 spent, on average, about $350,000 for auditor attestation fees, representing about 29 percent of their average total audit fees.

Although these costs remain significant for many companies, the cost of implementing the auditor attestation provision has been declining and varies by company size. For example, SEC’s 2009 study on internal control over financial reporting found that, among other things, the mean auditor attestation costs declined from about $821,000 to about $584,000 (approximately 29 percent) pre- and –post 2007 reforms for all companies that obtained an auditor attestation. Median costs declined from about $358,000 to $275,000 (approximately 23 percent) pre- and –post 2007 reforms. According to the study and an academic we interviewed, costs have been declining for a variety of reasons, including companies and auditors gaining experience in the auditor attestation environment and the 2007 SEC and PCAOB guidance. The academic further stated that in the early years of implementation of Section 404(b), initial costs were high for all companies, in part, because they had not previously implemented effective internal controls.

Companies and Others Also Identified Perceived Benefits of Compliance

There are two types of potential benefits or positive impacts—direct and indirect—that companies can receive from complying with the auditor attestation requirement according to one study. Direct benefits are those directly related to improvements in the company’s financial reporting process, such as the quality of the internal control structure, the audit committee’s confidence in the internal control structure, the quality of financial reporting, and the company’s ability to prevent and detect fraud. Indirect benefits are other dimensions that may be affected by changes in the quality of the financial reporting process, such as a company’s ability to raise capital, the liquidity of the common stock, and the confidence investors and other users of financial statements may have in the company.

Respondents to our survey identified a number of benefits or positive impacts stemming from compliance with the auditor attestation requirement, although fewer of them perceived indirect benefits compared to direct benefits. Many survey respondents noted that they experienced a number of direct benefits. For example, we estimate that:

80 percent of all companies view the quality of their company’s internal control structure as benefiting from the auditor attestation;

73 percent view their audit committee’s confidence in internal control over financial reporting as benefiting from the auditor attestation;

53 percent view their financial reporting as benefiting from the

46 percent view their ability to prevent and detect fraud as benefiting from the auditor attestation (see table 6).

Our findings are consistent with other surveys. In particular, Protiviti’s 2013 survey found that, among other things, 80 percent of respondents reported that their company’s internal control over financial reporting structure had improved since they began complying with the auditor attestation requirement.improved confidence in the financial reports of other Section 404(b) compliant companies, fewer companies’ perceived indirect benefits of the requirement. Specifically, based on our survey results, no more than 30 percent of all companies with less than $10 billion in market capitalization perceived any of the identified indirect benefits (see table 6) as stemming from the auditor attestation requirement.

Auditor Attestations Appear to Positively Affect Investor Confidence, and Disclosure of Compliance Status Could Enhance Investor Protection

Research suggests that auditor attestation generally has a positive effect on investor confidence. Although exempt companies are currently not required to disclose whether they voluntarily complied with the auditor attestation requirement in their annual reports, doing so would provide investors with important information that may influence their investment decisions.

Most Empirical Studies We Reviewed Suggest That Auditor Attestation Has a Positive Impact on Investor Confidence

Recent empirical studies we reviewed found that auditor attestation of internal controls generally has a positive impact on investor confidence. Investor confidence is considered an indirect benefit to companies that comply with the auditor attestation requirement. Specifically, an auditor attestation of internal controls helps to reduce information asymmetries between a company’s management and investors. With increased transparency and better financial reporting due to reliable third-party attestation, investors face a lower risk of losses from fraud. This lowered risk has a number of positive consequences for companies, such as enabling them to pay less for the capital as more confident investors require a lower rate of return on their money.

Because investor confidence is difficult to measure directly, empirical research has examined the impact of auditor attestation on other variables that are considered proxies for investor confidence, including the cost of equity and debt capital, stock performance, and liquidity.

As described below, such research has found that the auditor attestation increases investor confidence.

A 2012 study examined exempt and nonexempt companies with market capitalization between $25 million and $125 million. This study found that the market value of equity—as measured by the common stock price—is positively associated with the book value of equity—which is an element in financial statements—but that this relationship is stronger for nonexempt companies. In other words, investors appear to put greater trust on the book value of equity of companies that are subject to auditor attestation compared to those companies that are not. As a result, book value is more likely to have a positive effect on market value if the auditor attestation is present. These results are consistent with the notion that the auditor attestation provides useful and relevant information to investors.

A 2013 study found that exempt companies that voluntarily comply with the auditor attestation enjoy a lower cost of capital. Specifically, both the cost of equity and the cost of debt are significantly lower for companies that voluntarily comply with the requirement compared to those exempt companies that do not.

C. A. Cassell, L.A. Myers, and J. Zhou, “The Effects of Voluntary Internal Control Audits on the Cost of Capital,” Working paper, (Feb. 13, 2013).

75 million. The study found a negative market response to the exemption but less so for those companies that voluntarily complied before 2009. It also found that to reduce information asymmetry, companies that voluntarily comply use their compliance as a signal to the marketplace of the superior quality of their financial reporting—a signal that is credible because it is costly and difficult to imitate by companies with weak internal controls. Also, companies that voluntarily complied with auditor attestation had significant increases in liquidity.

Other research supports the view that auditor attestation of internal control effectiveness matters for investors and other market participants insofar as adverse auditor reports have negative consequences for companies. Such consequences include higher cost of debt (and possibly higher cost of equity), lower probability that lenders will extend lines of credit, stricter loan terms, and unfavorable stock recommendations.

While most research findings we reviewed suggest auditor attestation provides valuable information to investors and has a positive effect on confidence, a 2011 study questions the value of the auditor attestation for small companies. Looking at exempt and small nonexempt companies with market capitalization of $300 million or less, the study finds that small companies that became nonexempt, and therefore subject to the auditor attestation requirement, in 2004 experienced a statistically significant increase in their material weakness disclosure rate, but companies that remained exempt saw similar increases through their management reports under Section 404(a) of the Sarbanes-Oxley Act. The results suggest that auditor attestation provides little additional information to investors in terms of detecting material weaknesses because there is no statistically significant difference in the rate of disclosure of material weakness between the two types of companies.

Anecdotal Information Also Suggests Auditor Attestation Can Positively Impact Investor Confidence

The majority of academics and market participants we interviewed suggest that having auditor attestation positively impacts investor confidence. Specifically, they told us that the involvement of auditors in attesting to the effectiveness of internal controls improves the reliability of the financial reporting and serves to protect investors. As a result, they said, the exemption granted to small companies is likely to reduce investor confidence because these companies already have greater informational asymmetry. They said that according to academic and other studies, small companies are also more likely than large ones to have serious internal control problems. Furthermore, they commented that management’s report on internal controls alone is often uninformative because management often fails to detect internal control deficiencies or classifies them as less severe than they are. Some market participants also told us that any company accessing capital markets, regardless of size, should be required to comply with the auditor attestation requirement as investors in any company, large or small, are entitled to the same investor protection.

Our survey results also indicate that some companies view auditor attestation as contributing to investor confidence, which is similar to findings from others’ studies and surveys. Our survey results show that the majority of respondents are more confident in the financial reports of companies that comply with the auditor attestation requirement than companies that do not. In addition, we estimate that 30 percent of responding nonexempt and exempt companies that voluntarily comply thought that the requirement increased investor confidence in their own company, while 20 percent were not sure and the remaining 50 percent reported no impact. This perspective is consistent with the results from an in-depth 2009 telephone survey SEC conducted of a small group of financial statement users—such as lenders, securities analysts, credit rating agencies, and other investors—regarding their views on the benefits of auditor attestation. These SEC survey respondents indicated that the auditor’s attestation report provides additional benefits to users and other investors beyond the management’s report under Section 404(a) and that the requirement generally has a positive impact on their confidence in companies’ financial reports. Moreover, in response to a 2010 Center for Audit Quality (CAQ) survey of individual investors, almost two-thirds of investors said they were concerned about exempting companies with annual revenues of under $75 million from the independent auditor attestation requirement, suggesting that the requirement has a positive effect on individual investors’ confidence in the financial information generated by smaller companies. Similarly, in a 2012 survey of investors conducted by the PCAOB Investor Advisory Group on the role, relevance, and value of the audit, over 60 percent of respondents said that the auditor’s opinion on the effectiveness of internal controls is critical in making investment decisions. Further, in a 2012 survey of individual investors by CAQ, 70 percent of the respondents identified independent audits in general as the most effective means of protecting their interests.

Disclosure of Auditor Attestation Status Could Enhance Transparency

Explicit disclosure of auditor attestation status in exempt companies’ annual reports could quickly provide investors useful information that may influence their investment decisions. Currently, exempt companies are not required to disclose in their annual reports whether they have voluntarily obtained an auditor attestation on their internal controls. From 2005 through 2010, SEC granted small public companies multiple extensions from having to comply with the auditor attestation requirement. During this time of forbearance, SEC required exempt companies to include a general statement in their annual report that the company was not required to comply with the auditor attestation requirement because of SEC’s grant of temporary exemption status. According to SEC officials, the statement served to provide investors who may have been looking for the attestation an explanation of its absence. SEC granted its final temporary exemption to take effect on June 15, 2010, prior to the passage of the Dodd-Frank Act. SEC did not require exempt companies to include the disclosure statement when implementing the provision of the Dodd-Frank Act that created the permanent exemption.

SEC officials said that it is not common for the agency to require a company to disclose compliance status for requirements that are not applicable to the company—which, according to SEC officials, could potentially influence a company’s behavior. Further, SEC officials noted that information on the company’s filing status—and, therefore exemption status—can be found in the company’s annual reports and other documents, which are available to all investors.stated that such information allows investors to determine whether an attestation has been obtained. However, while this information is available, a company’s attestation status is not readily apparent without some knowledge or interpretation of the current reporting requirements. As noted earlier, SEC has previously required companies to provide additional clarity on their compliance with the auditor attestation requirement. Thus, requiring companies to explicitly disclose their auditor attestation status would be consistent with its past action.

Further, federal securities laws require public companies to disclose relevant information to investors to aid them in their investment decisions. Many market participants we interviewed consider the external auditor’s assessment of the effectiveness of a company’s internal control over financial reporting to be important information for investors. Thus, many market participants we interviewed and companies we surveyed noted that exempt companies should be required to explicitly disclose whether or not they obtained an auditor attestation to make the information more transparent for investors. In particular, according to the results of our survey, we estimate that 57 percent of all companies with less than $10 billion in market capitalization are in favor of requiring exempt companies to disclose whether they have voluntarily obtained an auditor attestation. A representative from one company said “I believe there is an assumption that SEC-listed companies are in compliance with 404. If companies are not, they should disclose such.” A representative from another company said that “If investors value the independent audit, then they should be made aware of situations where such audit has not been performed. Investors should not have to interpret the regulations to know if the audit is required.” Some companies we surveyed that were not in favor of such disclosure generally believed that investors can get the information from the audit opinion in the annual report. As of year-end 2011, approximately 300 exempt companies had voluntarily complied with the auditor attestation requirement. Although information on voluntary compliance with the auditor attestation requirement is determinable, having the information explicitly disclosed could benefit investors. Such disclosure would increase transparency and investor protection by making investors more aware of this important investment information.

Conclusions

Investors need accurate financial information with which to make informed investment decisions, and effective internal controls are necessary for accurate and reliable financial reporting. The attestation requirement is part of legislation aimed at helping to protect investors by, among other things, improving the quality of corporate financial reporting and disclosures. Perceptions of the costs and benefits of auditor attestation continue to vary among companies and others, but among other benefits, obtaining auditor attestation appears to have a positive impact on investor confidence. In addition, our analysis found that companies (both exempt and nonexempt) that obtained an auditor attestation generally had fewer financial restatements than those that did not, which suggests that knowing whether a company has obtained the auditor attestation may be useful for investors in gauging the reliability of a company’s financial reporting. However, because SEC regulations currently do not require explicit statements regarding the voluntary attainment of auditor attestation, investors may have to interpret reporting requirements and filings to determine whether exempt companies have obtained an auditor attestation. Previously, when certain companies were temporarily exempt from the auditor attestation requirement, SEC required explicit disclosure of exemption status in companies’ annual reports. However, SEC eliminated this requirement in 2010 when companies of certain sizes were permanently exempted. Federal securities laws require public companies to disclose relevant information to investors to aid them in their investment decisions. Although information on a company’s exempt status is available to investors, explicit disclosure would increase transparency and investor protection by making investors readily aware of whether a company has obtained an auditor attestation on internal controls. The disclosure could serve as an important indicator of the reliability of a company’s financial reporting, which may influence investors’ decisions.

Recommendation for Executive Action

To enhance transparency and investor protection, we recommend that SEC consider requiring public companies, where applicable, to explicitly disclose whether they obtained an auditor attestation of their internal controls.

Agency and Third- Party Comments and Our Evaluation

We provided a draft of the report to the SEC Chairman for her review and comment. SEC provided written comments that are summarized below and reprinted in appendix II. We also provided a draft of the report to PCAOB and relevant excerpts of the draft report to Audit Analytics for technical review. We received technical comments from SEC, PCAOB, and Audit Analytics that were incorporated as appropriate.

In its written comments, SEC did not comment on our recommendation that it consider requiring public companies to explicitly disclose whether they have obtained an internal control attestation. Rather, SEC confirmed, as described in the draft report, that a nonaccelerated filer (referred to as an exempt company in our report) does not have to explicitly disclose whether it obtained an auditor attestation report on its internal controls in its annual report. However, SEC stated that this fact can be easily determined by investors from information that is already disclosed in the annual report. In addition, SEC stated that investors can also find information regarding the existence of an opinion on internal controls by looking at the audit report in the company’s filing. SEC also noted that PCAOB standards permit an auditor that is not engaged to opine on internal controls to include a statement in its report on the financial statements indicating that it is not opining on the internal controls. In our report, we acknowledge that information needed to determine a company’s auditor attestation status is available. However, because an explicit statement on the company’s status is not required, investors must deduce the company’s status from the available information. Explicit disclosure could significantly decrease the potential for investors to misinterpret the information regarding a company’s audit attestation status. Such disclosure would increase transparency and investor protection by making investors readily aware of this important investment information. We therefore maintain that the disclosure warrants further consideration by SEC.

We are sending copies of this report to appropriate congressional committees, SEC, PCAOB, Audit Analytics and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-8678 or clowersa@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report discusses: (1) how the number of financial statement restatements compares between exempt and nonexempt companies; (2) the costs and benefits for nonexempt companies as well as exempt companies that voluntarily comply with the auditor attestation requirement; and (3) what is known about the extent to which investor confidence in the integrity of financial statements is affected by whether or not companies comply with the auditor attestation requirement. We define exempt companies as those with less than $75 million in public float (nonaccelerated filers) and nonexempt companies as those with $75 million or more in public float (accelerated filers). For the purposes of this report, we define exempt companies as those with less than $75 million in public float (nonaccelerated filers) and nonexempt companies as those with $75 million or more in public float (accelerated filers).

To address all three objectives, we reviewed and analyzed information from a variety of sources, including the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act), the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), relevant regulatory press releases and related public comment letters, and available research studies. We also interviewed officials from the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB), and we interviewed chief financial officers of small public companies, representatives of relevant trade associations (representing individual and institutional investors, accounting companies, financial analysts and investment professionals, and financial executives), a large pension fund, a credit rating agency, academics knowledgeable about accounting issues, and industry experts.

Comparison of Exempt and Nonexempt Financial Restatements

To determine the number of financial statement restatements (referred to as financial restatements) and trends, we analyzed data from the Audit Analytics database from 2005 through 2011. We used the Audit Analytics’ Auditor Opinion database to generate the population of exempt and nonexempt companies in each year from 2005 through 2011. Our analysis does not include 2012 data because 2012 small-company data was incomplete. According to Audit Analytics, the incomplete data was often due to the fact that small companies had not yet filed the relevant information with SEC. The sample we used to produce the population of exempt and nonexempt companies does not include subsidiaries of a public company, registered investment companies, or asset-backed securities issuers. Once we excluded these companies from the entire population, we grouped the remaining companies based on their filing status (i.e., nonaccelerated filer, smaller reporting company, accelerated filer, large accelerated filer, and filers that did not disclose their filing status). Exempt companies are nonaccelerated filers, including smaller reporting companies. For our purposes, we grouped companies that did not disclose their filing status but whose market capitalization was less than $75 million with exempt companies. We also identified for each year from 2005 through 2011 exempt companies that voluntarily complied with the integrated audit requirement as indicated in the data. Nonexempt companies are accelerated filers and large accelerated filers. For our purposes, we grouped companies that did not disclose their filing status but whose market capitalization was equal to or greater than $75 million with nonexempt companies. We excluded companies that did not disclose their filing status and did not have a reported market capitalization.

We then used Audit Analytics’ Restatement database, which contains company information (e.g., assets, revenues, restatements, market capitalization, location, and industry classification code) to identify the number of financial restatements from 2005 through 2011 based on our population of exempt companies, exempt companies that voluntarily complied, and nonexempt companies. Using this database, we identified 6,436 financial restatements by 4,536 public companies, 2,834 of which were exempt companies. We used Audit Analytics’ 69 classifications to classify the type of financial restatements into six categories: core expenses (i.e., ongoing operating expenses), noncore expenses (i.e., nonoperating or nonrecurring expenses), revenue recognition (i.e., improperly record revenues), reclassifications and disclosures, underlying events (i.e., accounting for mergers and acquisitions), and other. The majority of restatements we classified were the result of an accounting rule misapplication. To identify audit costs of compliance, we analyzed data from Audit Analytics’ Auditor Opinion database, which contains auditors’ report information such as audit fees, nonaudit fees, auditor name, audit opinions, revenues, and company size, among other information from 2005 through 2011. Our analyses of audit costs do not include 2012 data because 2012 small-company data was incomplete. The incomplete data was often due to the fact that small companies had not yet filed the relevant information with SEC. We tested a sample of the Audit Analytics database information and found it to be reliable for our purposes. For example, we cross-checked random samples from each of Audit Analytics’ databases with information on financial restatements, filing status, and internal controls from SEC’s Electronic Data Gathering, Analysis, and Retrieval system. We also spoke with other users of Audit Analytics data as well as Audit Analytics officials. In addition, we reviewed relevant research studies and papers on the impact of compliance with the internal control audits on financial restatements. We consider the information to be reliable for our purpose of determining financial statement restatement trends and audit fee calculations.

Costs and Benefits of Auditor Attestation Compliance

To examine the characteristics of publicly traded companies that complied, either voluntarily or because required, with the requirement to obtain an independent auditor attestation of their internal controls, we conducted a web-based survey of companies that had either voluntarily complied or were required to comply with the integrated audit requirement in any year between 2004 and 2011. Based on a list of publicly traded companies obtained from Audit Analytics, we identified 4,053 companies that had either voluntarily complied with the integrated audit requirement in any year from 2004 through 2011 or that were required to comply in 2011 as determined by their filing status. We stratified the population into three strata by first identifying the nonaccelerated voluntary filers. These are companies that voluntarily complied with the integrated audit requirement in any year from 2004 through 2011. Since our primary focus was on the nonaccelerated voluntary filers, we selected all 392 of these companies. From the remaining companies in the population, we created two additional strata based on 2011 filing status, and we took a random sample of companies from the remaining strata. The sample sizes for the remaining strata were determined to produce a proportion estimate within each stratum that would achieve a precision of plus or minus 10 percentage points or less, at the 95 percent confidence level. Finally, we increased the sample size based on the expected response rate of 40 percent. We submitted our survey to a total of 850 companies from the original population of 4,053.

We identified 104 companies in our sample that were closed, merged with another company, or improperly included in the sampling frame. We received valid responses from 195 out of the remaining 746 sampled companies (see table 7). The weighted response rate, which accounts for the differential sampling fractions within strata, is 25 percent.

We conducted this survey in a web-based format. The questionnaire was designed by a GAO survey specialist in collaboration with GAO staff with subject-matter expertise. The questionnaire was also reviewed by experts at SEC. We pretested drafts of our questionnaire with three public companies of different sizes to ensure that the questions and response categories were clear, that terminology was used correctly, and that the questions did not place an undue burden on the respondents. The pretests were conducted by telephone with company financial executives in Iowa, Virginia, and Washington, D.C. Pretests included GAO methodologists and GAO subject-matter experts. Based on the feedback received from the pretests, we made changes to the content and format of some survey questions. We directed our survey to the chief executive officer, chief financial officer, or chief accounting officer, whose names and email addresses we obtained from Nexis. We activated our web- based survey on December 17, 2012, and closed the survey on February 19, 2013. We sent follow-up emails on three occasions to remind respondents to complete the survey and conducted telephone follow-ups to increase the response rate.

Because our survey was based on a random sample of the population, it is subject to sampling errors. In addition, the practical difficulties of conducting any survey may introduce nonsampling errors. For example, difference in how a particular question is interpreted or the sources of information available to respondents may introduce errors. We took steps, such as those described above, to minimize such nonsampling errors in the development of the questionnaire and the data collection and data analysis stages as well. For example, because this was a web-based survey, respondents entered their responses directly into the database, reducing the possibility of data-entry error. Finally, when the data were analyzed, a second independent analyst reviewed all computer programs. We conducted an analysis of our survey results to identify potential sources of nonresponse bias using two methods. First, we examined the response propensity of the sampled companies by several demographic characteristics. These characteristics included market capitalization size categories, region, and sector. Our second method consisted of comparing weighted estimates from respondents and nonrespondents to known population values for total market capitalization. We conducted statistical tests of differences, at the 95 percent confidence level, between estimates and known population values, and between respondents and nonrespondents. We determined that there was significant bias induced by the largest companies (measured by market capitalization) not responding to the survey. In other words, we found that companies with market capitalization over $10 billion were underrepresented in our sample. However, we found no evidence of substantial nonresponse bias based on these characteristics when generalizing to the population of companies with market capitalization less than or equal to $10 billion. Therefore, we adjusted the scope of our survey to include only those companies with market capitalization of less than or equal to $10 billion (see table 8).

Because we found no evidence of substantial nonresponse bias when generalizing to the adjusted target population and the weighted response rate of 25 percent, we determined that weighted estimates generated from these survey results are generalizable to the population of in-scope companies. We generated weighted estimates and generalized the results to the estimated in-scope population of 3,432 companies (plus or minus 42 companies).

Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval. This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that each of the confidence intervals in this report includes the true values in the study population. All percentage estimates presented in this report have a margin of error of plus or minus 15 percentage points or fewer, and all estimates of averages have a relative margin of error of plus or minus 20 percent or less, unless otherwise noted.

To obtain information on the impact of obtaining an auditor attestation on a company’s cost of capital, we included questions in our web-based survey to large and small public companies of various industries about this matter, interviewed trade associations, industry experts, a large pension fund, and academics; and reviewed relevant academic and SEC research studies.

Investor Confidence and Integrity of Financial Statements

To examine the extent to which investor confidence in the integrity of financial statements is affected by companies’ compliance with the auditor attestation requirement, we reviewed relevant empirical literature written by academic researchers, as well as recent surveys, studies, reports, and articles by others. To identify these studies, we asked for recommendations from academics, SEC, PCAOB, and representatives of organizations that address issues related to the auditor attestation requirement. We reviewed bibliographies of papers we obtained to identify additional material. In addition, we conducted searches of online databases such as ProQuest and Nexis using keywords to link Section 404(b) of the Sarbanes-Oxley Act with investor confidence. We also conducted interviews with agencies and organizations, as well as academics and other knowledgeable individuals who focus on issues related to investor confidence and the auditor attestation requirement. Moreover, we interviewed small public companies exempt from auditor attestation but who nonetheless complied with the requirement. In addition, we reviewed surveys undertaken by various government agencies and organizations to gauge the impact of the auditor attestation on investor confidence. We conducted a focused review of the research related to Section 404(b) of the Sarbanes-Oxley Act and summarized the recent studies most relevant to our objective. The empirical research discussed may have limitations, such as accuracy of measures and proxies used. We reviewed published works by academic researchers, government agencies, and organizations with expertise in the field. We performed our searches from September 2012 through May 2013. We assessed the reliability of these studies for use as corroborating evidence and found them to be reliable for our purposes. We also included questions in our web-based survey to large and small public companies of various industries about this matter. Lastly, we reviewed relevant federal securities laws, the Securities Act of 1933 and the Securities Exchange Act of 1934.

We conducted this performance audit from May 2012 to July 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Securities and Exchange Commission

Appendix III: GAO Survey of Accelerated Filers and Nonaccelerated Filers

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Karen Tremba, (Assistant Director), James Ashley, Bethany Benitez, William Chatlos, Janet Eackloff, Joe Hunter, Cathy Hurley, Stuart Kaufman, Marc Molino, Lauren Nunnally, Jennifer Schwartz, and Seyda Wentworth made key contributions to this report.

Bibliography

Alexander, C. R., S. W. Bauguess, G. Bernile, Y. A. Lee, and J. Marietta- Westberg. “The Economic Effects of SOX Section 404 Compliance: A Corporate Insider Perspective.” Working paper. March 2010.

Asare, S. K., and A. Wright. “The Effect of Type of Internal Control Report on Users’ Confidence in the Accompanying Financial Statement Audit Report.” Contemporary Accounting Research, vol. 29, no. 1 (2012).

Ashbaugh-Skaife, H., D. Collins, W. Kinney, and R. LaFond. “The Effect of Internal Control Deficiencies on Firm Risk and Cost of Equity.” Journal of Accounting Research, vol. 47, no. 1 (2009).

Audit Analytics. “2011 Financial Restatements: An Eleven Year Comparison.” Sutton, Mass.: 2012.

Audit Analytics, “2009 Financial Restatements: A Nine Year Comparison.” (Sutton, Mass.: February 2010).

Audit Analytics. “Restatements Disclosed by the Two Types of SOX 404 Issuers: (1) Auditor Attestation Filers and (2) Management-Only Report Filers.” Sutton, Mass.: November 2009.

Brown, K., P. Pacharn, J. Li, E. Mohammad, F. A. Elayan, and F. Chu. “The Valuation Effect and Motivations of Voluntary Compliance with Auditor’s Attestation Under Sarbanes-Oxley Act Section 404 (B).” Working paper. January 15, 2012.

Cassell, C.A., L. A. Myers, and J. Zhou. “The Effects of Voluntary Internal Control Audits on the Cost of Capital.” Working paper. February 13, 2013.

Chief Financial Officers’ Council and the President’s Council on Integrity and Efficiency, Estimating the Costs and Benefits of Rendering an Opinion on Internal Control over Financial Reporting.

Coates IV, J. C. “The Goals and Promise of the Sarbanes-Oxley Act.” Journal of Economic Perspective, vol. 21, no. 1 (2007).

Crabtree, A., and J. J. Mahler. “Credit ratings, Cost of Debt, and Internal Control Disclosures: A Comparison of SOX 302 and SOX 404.” The Journal of Applied Business Research, vol. 28, no. 5 (2012).

Dhaliwal, D., C. Hogan, R. Trezevant, and M. Wilkins. “Internal Control Disclosures, Monitoring, and the Cost of Debt.” The Accounting Review, vol. 86, no. 4 (2011).

GAO. Community Banks and Credit Unions: Impact of the Dodd-Frank Act Depends Largely on Future Rule Makings. GAO-12-881. Washington, D.C.: September 13, 2012.

GAO. Financial Restatements: Update of Public Company Trends, Market Impacts, and Regulatory Enforcement Activities. GAO-06-678. Washington, D.C.: March 5, 2007.

GAO. Sarbanes-Oxley Act: Consideration of Key Principles Needed in Addressing Implementation for Smaller Public Companies. GAO-06-361. Washington, D.C.: April 13, 2006.

Holder, A. D., K. E. Karim, and A. Robin. “Was Dodd-Frank Justified in Exempting Small Firms from Section 404b Compliance?” Accounting Horizons, vol. 27, no. 1 (2013).

Iliev, P. “The Effect of SOX Section 404: Costs, Earnings Quality, and Stock Prices.” Journal of Finance, vol. 65, no. 3 (2010).

Kim, J. B., B. Y. Song, and L. Zhang. “The Internal Control Weakness and Bank Loan Contracting: Evidence from SOX Section 404 Disclosures.” The Accounting Review, vol. 86, no. 4 (2011).

Kinney, W. R., and M. L. Shepardson. “Do Control Effectiveness Disclosures Require SOX 404(b) Internal Control Audits?: A Natural Experiment with Small U.S. Public Companies.” Journal of Accounting Research, vol. 49, no. 2 (2011).

Krishnan, G.V., and W. Yu. “Do Small Firms Benefit from Auditor Attestation of Internal Control Effectiveness?” Auditing: A Journal of Practice and Theory, vol. 34, no. 4 (2012).

Nagy, A. L. “Section 404 Compliance and Financial Reporting Quality.” Accounting Horizons, vol. 24, no. 3 (2010).

Orcutt, J. L. “The Case Against Exempting Smaller Reporting Companies from Sarbanes-Oxley Section 404: Why Market-Based Solutions are Likely to Harm Ordinary Investors.” Fordham Journal of Corporate and Financial Law, vol. 14, no. 2 (2009).

Schneider, A., A. Gramling, D. R. Hermanson, and Z. Ye. “A Review of Academic Literature on Internal Control Reporting Under SOX.” Journal of Accounting Literature, vol. 28 (2009).

Schneider, A., and B. K. Church. “The Effect of Auditors’ Internal Control Opinions on Loan Decisions.” Journal of Accounting and Public Policy, vol. 27, no.1 (2008).

Scholz, Susan. The Changing Nature and Consequences of Public Company Financial Restatements: 1997-2006. A special report prepared at the request of the Department of the Treasury. April 2008.

U.S. Securities and Exchange Commission. Study and Recommendations on Section 404(b) of the Sarbanes-Oxley Act of 2002 For Issuers with Public Float Between $75 and $250 Million. Washington, D.C.: 2011.

U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control over Financial Reporting Requirements. Washington, D.C.: 2009.

Surveys

Center for Audit Quality. The CAQ’s Sixth Annual Main Street Investor Survey, September 2012.

Center for Audit Quality. The CAQ’s Fourth Annual Individual Investor, September 2010.

Financial Executives International and Financial Executives Research Foundation, 2012 Audit Fee Survey. Morristown, N.J.: 2012.

Financial Executives International and Financial Executives Research Foundation, Special Survey on Sarbanes-Oxley Section 404 Implementation. Morristown, N.J.: 2005.

PCAOB. 2012 SOX Compliance Survey: Role, Relevancy and Value of the Audit. 2012.

Protiviti, 2013 Sarbanes-Oxley Compliance Survey: Building Value in Your SOX Compliance Program. 2013.

Protiviti, 2012 Sarbanes-Oxley Compliance Survey: Where U.S.-Listed Companies Stand – Reviewing Cost, Time, Effort and Process. 2012.