March 30, 2005
March 30, 2005
We are a local CPA firm helping several small issuers with their section 404 readiness. Contrary to our experiences with accelerated filers in 2004, these small companies are experiencing considerable difficulties with the whole process. Some of these companies are struggling for their very existence. Those that are not do not have the internal resources to address the COSO elements of control environment, information and communication, monitoring and to some extent risk assessment. Add to this the Audit Standard #2 requirements of audit committee effectiveness, IT controls, entity level controls, and anti fraud requirements, and the result is a state of confusion. Most of these companies are spending an inordinate amount of time trying to document application control activities in areas that have inadequate controls, and do not even understand the other COSO elements or AS #2 requirements mentioned above.
The original draft of AS #2 contained an appendix which contained samples of 404 considerations for a small or medium sized company. Comments received on the draft convinced the PCAOB to scrap this appendix, and defer to the brief comments found in the descriptions of each of the five COSO elements in the COSO document. These brief paragraphs in COSO really say nothing other than the fact that a smaller company might not need as an extensive set of controls as a larger company. However we have heard many off-the-record comments made by PCAOB staff and others that there is considerable concern over the smaller issuers due to the inherent risks associated with small accounting and finance departments of these small companies and the resulting lack of segregation of duties.
Both the aborted Appendix E of AS # 2, and the brief comments in COSO regarding small companies, suggest that senior management in these companies could and should have more direct involvement in detailed control activities and thereby achieve better controls. With all due respect, these suggestions seem to fly directly in the face of good segregation of duties and anti fraud procedures, and would allow more opportunity for corrupt upper management to perpetrate accounting fraud. And many of the provisions of AS #2 and particularly AICPA Audit Standard #99 go to great length to prevent upper management from direct involvement in control activities, since the well publicized accounting frauds of the past few years were largely caused by such involvement.
Its clear that there is a lack of direction and understanding of how the PCAOB and the SEC should address the problem of how to achieve good internal controls over financial reporting with small companies. We applaud the efforts of both bodies in having forums and roundtables on these issues, but it seems that the schedule of these activities are a little late in the game for these companies which should theoretically be well under way in their 404 work. We therefore applaud the recent decision to grant a one year extension for these small companies.
We do not believe one size fits all, and we think a total new approach to internal controls for small companies is in order. These companies are in a real Catch 22 situation. The cost and disruption to comply with 404 puts small issuers in a competitive disadvantage with private and foreign companies, but the cost of going private, according to securities lawyers with whom we have consulted, can be extremely expensive.
We understand that the total market capitalization of the non-accelerated filers is a very small percentage of total value of our public markets. However, its time that these small companies get some respect from the SEC and PCAOB. The fact that there is practically no representation on the PCAOB Standing Advisory Group of small companies or service providers to them is one of many indications that there has been little or no attention devoted to these issuers, and we hope that the various SEC initiated efforts to study this problem will result in a totally new approach to internal controls over financial reporting for small companies.
Sincerely,
Charlie Jones
Marshall, Jones & Co.
Certified Public Accountants
26 Lenox Pointe, N. E.
Atlanta, Georgia 30324
www.marshalljones.com
Charlie@marshalljones.com
404-231-2001 phone
404-231-0127 fax