Expanding The Club

And yet, despite it all, there is a sense that companies are rising to the challenge, taking the time and spending the money to get things right the first time. The process of making a final set of Section 404 standards is also moving forward, with the adoption last month of internal control regulations by the Public Company Accounting Oversight Board (PCAOB), the recently organized chief auditing watchdog. "The goal is to obtain the best possible assurance that a company's financial statements are reliable," PCAOB chairman William J. McDonough said at a recent public meeting. "The new PCAOB standard requires auditors to look at the internal controls themselves, even to the point of doing walkthroughs of important stages of certain controls. The auditors must be satisfied that the internal controls over financial reporting are designed and operating effectively." Of course, those rules are still subject to change by the time the Securities and Exchange Commission (SEC) gives its approval, and it may be well after that until many of the "gray areas" are fully tested to meet the general comfort level.

Any set of guidelines as far reaching as Sarbanes-Oxley has the potential to transform whole industries. One clear trend is that public and private companies are more frequently looking beyond the Big Four accounting firms for audit and non-audit advice, pretty much as the law envisioned. "Sarbanes-Oxley just opened a lot of opportunities for new specialties," observes Julie Lindy, editor of Bowman's Accounting Report. "Forward-thinking and progressive local and regional accounting firms are creating specialties that the Big Four aren't necessarily interested in." For instance, the Bonadio Group, a Pittsford, N.Y.-based audit and consulting firm, found a lucrative niche by teaming up with a technology partner to become a hotline for 1-800 "whistleblower" calls as mandated in Section 301 of the Act. Porter Keadle Moore LLP, an Atlanta-based CPA firm that specializes in banking industry services, is seeing benefits of its own. "We've been doing 404-like controls testing for the banking industry long before Sarbanes-Oxley and [now] we're getting some opportunities to bid on non-banking business as a result," says Phil Moore, managing partner at Porter Keadle Moore.

Even in bread-and-butter auditing services, the ground is shifting. According to a recent report by Auditor-Trak, an industry database service, in 2003 each of accounting's four 800-pound gorillas–PricewaterhouseCoopers, KPMG, Ernst & Young and Deloitte & Touche–lost more public company audit clients than they gained. Smaller national firms, such as Grant Thornton and BDO Seidman, gained on average 21% of the former Big Four clientele, while regional or local audit firms gained a surprising 34%.

Companies are finding advantages to branching out beyond the largest firms for audit and non-audit services, but industry experts say it is too early to predict any lasting trend away from the Big Four. Even now, many of the largest U.S. companies continue to give the vast bulk of their business to the Big Four, which have the deepest and most global staffs, and there is little evidence that is changing. According to a recent analysis by the Public Accounting Report, all but six Fortune 500 companies used one of the Big Four firms in 2003 as their main auditor. Smaller nationals and large regional firms are making inroads, however, especially among companies with annual revenues of $500 million and below, says Jonathan Hamilton, editor of the Public Accounting Report. "They're picking up clients at a rate we've never seen before," he says. "These smaller companies are looking at how much time and attention they're getting from the Big Four, and it's not that much considering what they're paying. They also see the scandals, and they're saying we don't need the Big Four stamp of approval."

The internal-external auditing split

Of course, the game of musical chairs between companies and their auditors has been influenced by the spate of regulatory mandates and the demise of Arthur Andersen, which for a time led the surviving Big Four to shed some smaller clients. Under Sarbanes-Oxley, there are now strict limits on the consulting services an auditor can provide its audit client, while according to the latest New York Stock Exchange requirements, a company can no longer outsource its internal audit function to its external auditor. It's only natural then, that companies would need to go beyond the Big Four to fill all their needs in both external and internal auditing. "The role of the external auditor has absolutely without question changed significantly in terms of their relationships with companies," says Robert Hirth, managing director and head of internal audit at risk consulting group Protiviti Inc. and a former partner at a Big Four firm. "There is no question that today the external auditors work for the audit committee and therefore they do not work for management anymore. That was not the way it was. You were hired by management, you worked with and you worked for management."

Where does all this leave the corporate executive? No doubt, with more than a few problems to sort out. What some companies have noticed is a change in their relationship with their external auditors that goes even beyond those mandated by the new regulations. "It used to be problems or issues were attacked collaboratively with the company and external auditors on things like accounting issues and application of new standards," says Steven McCann, CFO of Longs Drug Stores Corp., a $4.5 billion California-based retailer and pharmacy benefits manager. "Now, external auditors are more standoffish and are put in the position [of having] to opine. This is very different. It's unwieldy and not particularly helpful, but I understand the source of problems that got us to this point."

A separate difficulty Norman Marks of Solectron points to involves companies trying to get external auditors to commit on certain procedures, as a result of not having the final set of Section 404 guidelines. "I'm hearing that pretty much universally," he says. "[External auditors] are reluctant to make a commitment on many things until they get the rules. Companies are going to their external auditors and saying, 'Have a look and see what we're doing.'[The auditors] are saying, 'It looks okay, but we haven't got the rules yet,' which is natural."

"Sarbanes-Oxley has put the auditors much more in a checking situation," says Jay Lorsch, accounting professor at Harvard Business School and an advisor to several boards. "The most significant change is that the audit committee is taking charge [of the relationship with external auditors]. That's a huge shift in attitude and behavior. I know it's frustrating as hell to some people."

Many companies are putting more and more of their focus (and trust) in their internal audit function to guide them through. Outsourcing your internal audit function may seem like an unusual step, but it's one that more and more executives are exploring and finding offers real advantages. Soon after McCann became CFO at Longs four years ago, he replaced the company's 10-person internal audit department by outsourcing. Doing so allowed the company to sidestep the burden of having to keep staffing levels up, which was proving a struggle in the competitive labor market of Silicon Valley where the company is based.

But there were other reasons to go with outsiders. "It's difficult to afford all the competencies you need for internal audit," says McCann, who today uses consulting group Protiviti to provide the company's internal audit.

All companies, even large multinationals with hundreds of people in internal audit, are stepping back and reconsidering how the operation can best be utilized under the new heavy scrutiny environment. Richard Anderson, a partner and head of internal audit advisory services at PricewaterhouseCoopers in Chicago, sees a clear trend in the last three years toward corporate internal audit departments focusing more on hard core accounting, risk assessment and control work and acting less as in-house advisers for management. He still sees, however, significant variation in terms of quality and competency. "We've seen external auditors auditing companies for 2003 who have at least raised questions with management in some cases about the adequacy of their internal audit function, or at least challenging them to have a review of that function. If you've got an internal audit function that is for whatever reason viewed as deficient by the external auditor, you may have a systemic control problem."

The Cost of Being Correct

The importance of having a reliable internal audit department, whether operated in-house or from the outside, goes to the heart of some of the most controversial provisions of the new PCAOB guidelines. Specifically, to what extent can external auditors rely on the testing of internal auditors or others for their audit of a company's internal control over financial reporting as mandated under 404? The PCAOB has taken a hard line, ruling that the "auditor's own work must provide the principal evidence for the audit opinion." In addition, in order to support his or her own opinion, the auditor is required to evaluate all reports issued by internal audit about controls over financial reporting.

The bottom line of the mandate: Don't expect audit fees to plateau any time soon. In fact, the PCAOB suspects the work that goes into the external auditor's attestation efforts could send costs higher, at least in the first year.

One way to cut fees suggested by the PCAOB is for management to present a clear documentation of its internal controls over financial reporting. Some consultants have also suggested that the more independent and objective the work of the internal audit committee when it comes to testing and evaluating management's own controls, the more it can be relied upon by external auditors to help get their work done.

Another tricky area for executives involves reporting lines for internal audit departments. Traditionally, in the pre-Sarbanes-Oxley world, most companies used dual reporting lines, in which internal audit reported administratively to senior management, most often to the CFO, as well as to the audit committee. However, some companies are easing back from that model for fear that the perception of a conflict of interest may exist when the group charged with internal controls testing reports directly to the official in charge of preparing the financial statements. In some cases, companies are going to an extreme and having all reporting lines for internal audit go directly and solely to the audit committee.

Not all, however, agree with that approach. "We believe that the internal audit function should not be an exclusive tool for the audit committee," says Protiviti's Hirth. "Its role is way beyond simply financial reporting of the company. It can [include] compliance with laws and regulations, efficiency of operations, all kinds of things. To take that tool away from either of those groups is not efficient or effective."

The Institute of Internal Auditors (IIA), the professional association that sets many of the standards companies adhere to, recommends that a company's internal auditors should report directly to the audit committee of the board of directors, while on an administrative basis, there should be a "dotted-line reporting relationship to the CEO." The IIA, which has seen its membership swell to more than 90,000 today from just over 70,000 members three years ago, has issued a series of other guidelines for companies. They include: The internal audit activity should be independent, provided adequate resources and competently staffed by professionals who practice in accordance with IIA guidelines; the audit committee charter should adopt a definition of internal auditing; and companies should consider periodic rotation of the audit committee chairman position.

The March day his agency passed its final standards for internal control audits, PCAOB chairman McDonough referred to it as no less than "one of the most important days in the world of financial management." Now, it's up to the many thousands of company auditors, executives and other employees to make that day worthwhile.