April 3, 2006
In my experience implementing the Sarbanes-Oxley 404 requirements, materiality has a major bearing on the cost of controls. Due to its having a lower materiality threshold, a breakeven company with sizable revenue is now forced to spend more to meet 404 requirements than a profitable company with the same revenue. A lower materiality threshold requires more extensive and costly controls. This burden falls particularly hard on smaller, high-tech growth companies and should be addressed in the next set of rule revisions.
Although I think that removing the requirement for auditor control testing for smaller companies will greatly reduce the 404 aspect of audit costs, I'm concerned that because of the change, auditors might step up substantive transaction testing of more areas during the annual financial audit. This potentially could offset any savings from the change. To avoid this possibility I believe that the revised rules should allow for more auditor latitude in regards to their reliance on management's control testing -- still necessary in order for management to certify the statements under rules 302 and 404. Process owner testing now is viewed as inferior to third-party conducted control testing due to independance issues. Allowing more latitude concerning auditor reliance upon process owner testing deemed, in the judgement of the auditor, sufficient to validate proper controls should reduce company dependance on outside consultants so prevalent now. It also would hopefully reduce the amount of required substantive auditing.
I applaud the efforts of the ACSPC to reduce the cost of compliance with the Sarbanes-Oxley legislation. I hope these comments support that endeavor.