Gap between public and private audit standards is narrowing
HAVE you heard of Sarbanes-Oxley? Did you think that it only affects Hawaii's publicly-traded companies?
Well, privately owned companies can soon include themselves in the group of companies subject to mandatory internal control evaluation as part of their financial statement audits, a part of Sarbanes-Oxley.
Prior to 2007, only public companies were subject to the Sarbanes Oxley Act of 2002. Now, thanks to new auditing standards issued by the Auditing Standards Board of the American Institute of Certified Public Accountants, private companies can also include themselves in this group.
While these standards are not as burdensome as the entire provisions of Sarbanes-Oxley, there are some similarities.
The main provisions of Sarbanes-Oxley include:
» Creation of the Public Accounting Oversight Board to regulate public accounting firms that serve public companies, as well as establish or adopt auditing, quality of control, ethics, independence or other standards relating to the preparation of audit reports for issuers.
» Establishment of more stringent independence rules for auditors, including restrictions on non-attest services and rotation of the primary audit partner every five years.
» Placement of greater responsibility on company boards of directors and audit committees.
» Enhanced financial disclosures, adding several disclosure requirements to filings, including managements' assessment of internal controls (section 404).
» Requirements relating to corporate and criminal fraud accountability and white-collar crime penalty enhancements.
Of the above provisions, Section 404's requirement for management's assessment of internal controls may have the greatest impact on the costs associated with being publicly traded. Public filers are required to include in their 10-K annual filing a report by management on the effectiveness of the company's internal controls over financial reporting. It also requires the auditor to issue an opinion these internal controls.
UNLIKE Sarbanes-Oxley, the new private-company standards do not require management to issue a report on internal controls over financial reporting and do not require auditors to express an opinion. However, these new standards do require an auditor to obtain an understanding of internal controls by evaluating their design and determining whether they have been implemented.
Evaluating the design of a control involves considering whether the control --individually or in combination with other controls -- is capable of effectively preventing or detecting and correcting material misstatements.
How should a private company in Hawaii react to these new standards and what should they expect?
Companies should start having conversations with their auditor early to gain an under- standing of the new standards.
Companies should plan on spending more time assessing their business risk and documenting and updating key controls, and companies should question their auditors' qualifications and experience in testing internal controls.
WHAT does the future hold? Will all of the burdensome provisions of Sarbanes-Oxley someday be applicable to privately held companies?
Time will tell, but clearly the gap between public and private audit standards is narrowing.
Dustin Verity is an assurance manager for the Honolulu Office of Grant Thornton LLP. He can be reached at firstname.lastname@example.org