Computer Sciences Corporation
November 29, 2002
Jonathan G. Katz, Secretary
U.S. Securities and Exchange Commission
450 Fifth Street, N.W.
Washington, DC 20549
Re: File No. S7-40-2
Dear Mr. Katz:
Thank you for the opportunity to comment on the Commission's "Proposed Rule: Disclosure Required by Sections 404, 406 and 407 of the Sarbanes-Oxley Act of 2002", Subject File No. S7-40-2 (the "Proposed Rule"). We have provided a summary of our more significant comments, concerns and suggestions in the following paragraphs and have included detailed responses to each "Request for Comment" from the Proposed Rule in the attached Exhibit.
Proposed Disclosure About Financial Experts Serving on a Company's Audit Committee (Section 407)
CSC agrees that effective corporate governance of public companies relies heavily on the service of competent, ethical directors, including independent, effective audit committee members. We also agree financial expertise is an essential ingredient in the effective performance of an audit committee, and we think at least one member of the committee should possess that expertise. We further agree independence is an absolute necessity, not only for an audit committee member serving as a "financial expert," but for the other members as well. However, we have several comments, concerns and suggestions regarding the proposed disclosure requirements, attributes of a "financial expert," experience requirements, other factors to be considered in evaluating a potential "financial expert" and transition provisions.
We think requiring the disclosure of the number of the audit committee member(s) designated as the "financial expert(s)" may weaken confidence in a company which has only one "financial expert". Given a company's circumstances (size, nature of the business, financial reporting issues, etc.), one may be sufficient. We also think disclosure of the name of a "financial expert" may focus unwarranted attention of the public and the media on the individual board member serving as the "financial expert". This may deter board members from serving in this capacity. The public also may attribute greater responsibility to this individual, contrary to the intent of the Sarbanes-Oxley Act of 2002 (the "Act"). Therefore, we strongly recommend companies be required to simply disclose whether the audit committee includes a member who meets the criteria of a "financial expert".
We are in agreement with the overall definition of the "financial expert" and enumerated attributes, provided the board of directors is permitted the discretion to make the assessment as to whether a candidate meets the requirements. However, we think the qualifying term "comparable" used in the description of the second and third attributes (Instruction 1(b) and (c) to Item 309 of Regulation S-K under the Proposed Rule) requires clarification. These attributes incorporate requirements for: (1) experience in applying " generally accepted accounting principles in connection with the accounting for estimates, accruals and reserves that are generally comparable to estimates, accruals and reserves, if any, used in the registrant's financial statements", and (2) experience in "preparing or auditing financial statements that present accounting issues that are generally comparable to those raised by the registrant's financial statements".
The critical issue here is the definition of what constitutes "comparable" experience. If experience in "comparable" circumstances means experience within the same industry group or, more importantly, with a company's competitors, there could be a number of potentially serious unintended consequences, including: 1) it may be difficult to obtain a "financial expert" as the available pool of qualified individuals may be quite limited depending on the size and demographics of the industry; 2) mandatory industry expertise may result in potential conflicts of interest; and 3) service on one or more audit committees may compromise proprietary information and/ or result in potential antitrust issues and code of conduct violations (by way of association with a competing company). Accordingly, we recommend for the purpose of the "financial expert" experience requirements "comparable" circumstances be defined to include experience with companies having similar complexity in financial accounting and reporting issues, reporting requirements, capital structure, and, if relevant, experience with multi-national and/or multi-industry companies.
We also suggest the Commission broaden the focus of the financial accounting matters comprehended by the experience requirement concerning the application of generally accepted accounting principles (Instruction 1(b) to Item 309 of Regulation S-K under the Proposed Rule). Such matters should encompass application of generally accepted accounting principles to a company's full complement of account balances, transaction classes, and disclosures, rather than limiting the focus to only "estimates, accruals and reserves". This broader focus would expand the scope of accounting matters addressed in the experience requirements to more clearly incorporate the full range of financial accounting and reporting issues. For example, the broader focus would include a company's critical accounting policies, such as revenue recognition, an area receiving significant attention and one which the Commission addressed in disclosure guidance, issued last January. Simply put, we do not understand the singular focus on these financial statement elements to the exclusion of other elements of equal, or greater, significance, and we recommend the criteria incorporate a more comprehensive perspective. Moreover, use of the term "reserves" has long been discouraged by the standard setting bodies.
Furthermore, we recommend the factors to be considered in evaluating potential "financial experts" incorporate an additional overall factor regarding their "breadth" of experience. Someone with extensive and varied industry experience would be equally adept, or perhaps even more adept, in recognizing and advising other audit committee members on critical accounting and reporting issues.
We concur with the proposal that a company's board of directors should be responsible for assessing qualifications of a "financial expert", for the reason that "one size does not fit all"; each company would need to select an individual with qualifications which complement the existing directors and audit committee members. We expect significant time may be required to identify, qualify and recruit a "financial expert" who meets all the requirements under the Proposed Rule. As a result, we recommend a transition period of at least one year beyond the adoption date of the final rules or, if later, until the next annual meeting.
Proposed Code of Ethics Disclosure (section 406)
CSC strongly supports the importance of companies maintaining guiding principles, management policies and business practices for conduct in the workplace that: result in ethical behavior, competent execution of fiduciary obligations, fair and responsible employment practices, ethical procurement practices, full, fair, accurate and timely disclosure practices, and compliance with laws and regulations; prohibit conflicts of interest; and contribute to profitability and return on shareholder equity . CSC has long established policies regarding these matters. However, we are concerned with the concept that ethics can be effectively legislated and monitored as a part of the reporting requirements under the Securities Act of 1933 and the Securities Exchange Act of 1934 (the "Securities Acts") by the SEC.
We think "ethics" is a broad concept which varies from one country to another, from one culture to another, from one social group to another. Ethics evolve over time. Ethics are not merely a set of management policies, but a part of the very fabric of an organization's culture. Even within a single company, organizational culture may vary from one business unit to another and even from one function to another within a particular business unit. As a consequence, ethics is as difficult to govern, as it is to define, across a global organization.
Ethical standards are fundamentally subjective. Most would agree, at a minimum, ethical standards presume compliance with applicable laws and regulations. However, other situations are not as clear. For example, the management of Company A may implicitly accept compromises in the quality of products or service delivery as a part of running a for-profit business, responsible to its shareholders. By comparison, the management of Company B, which may even operate in the same industry, geographic region and culture, may view the very same business practice as an unethical breach of their commitment to the customer. As one might expect, the disparities in ethical practices become even more dramatic within global organizations that span multiple geographic regions, countries with widely different political systems, languages, and cultures.
In view of the inherently subjective nature of ethical standards, practices and beliefs, we strongly urge the Commission in finalizing the Proposed Rule, to provide substantial latitude in defining ethical standards. We also believe the Commission should provide substantial safe harbor standards for governance in this area.
Management's Internal Controls and Procedures for Financial Reporting (Section 404)
We believe integrity in financial reporting is absolutely essential to the effective operation of capital markets and the efficient functioning of our economy. We also agree with the Commission that effective "internal controls and procedures for financial reporting" ("internal controls") and "disclosure control procedures" are of paramount importance in assuring the integrity of financial reporting and disclosure.
To preface our comments on this proposal, we reiterate our serious concerns with the quarterly management "certification" requirements under Rules 13a-14 and 15d-14 promulgated in conjunction with the implementation of Section 302 of the Act. We recognize that the Commission felt constrained by the language in the Act to characterize management's statements as "certifications" but we continue to strongly disagree with this nomenclature. Terms such as "certification" and "ensure" imply a much higher level of assurance than can reasonably be applied to financial information and internal controls. Internal controls provide a reasonable degree of assurance, but not absolute assurance, that financial reporting objectives will be met. Financial statements present fairly a company's financial position, results of operations and cash flows in accordance with generally accepted accounting principles. These are not absolute standards. "Management certification" is far too strong a characterization. Management representation would more appropriately convey the degree of assurance investors should attach to such statements.
Regarding the current proposal, we wholeheartedly support the Commission's proposed disclosure requiring management to include an internal control report (pursuant to amended Item 307 of Regulation S-K under the Proposed Rule) in a company's annual report on Form 10-K, consistent with the requirements established by the legislature under Section 404 of the Act. In fact, CSC has followed a long-standing practice of including management's report on the company's system of internal controls in the Annual Report to our shareholders. We agree the mandated observance of this reporting requirement by all registrant companies will unquestionably reinforce sound financial accounting and reporting practices, strengthen investor confidence in reporting practices and the integrity of corporate management and aid in restoring investor confidence in the U.S. capital markets.
Our primary concern with the proposed requirements relates to the prescribed frequency of the evaluation of a company's internal controls. We think requiring these evaluations to be conducted on a quarterly basis will present significant challenges to any registrant and, in many cases, may not be feasible. In addition, the requirement that the evaluation be performed as of the last day of the period being reported upon would exacerbate the onerous and burdensome nature of this requirement. Section 404 of the Act only requires management to evaluate and report on the company's internal controls on an annual basis and the company's external auditors to attest, and report on, management's assessment of such internal controls.
The Commission issued Rules 13a-14 and 15d-14 to implement quarterly management certification in accordance with Section 302 of the Act effective August 29, 2002. It is very likely the integrity of financial reporting and disclosure by registrant companies has now been raised to an appropriate level given the combined effects of the following requirements under these rules: 1) management's quarterly review of disclosure controls and procedures, 2) management "certifications" regarding the fair presentation of its financial statements and other financial information included in the company's quarterly and annual reports, and 3) the representations included in such "certifications" regarding internal controls and disclosure controls and procedures. In view of the relatively recent effective date of these "certification" requirements, we recommend that the Commission allow a reasonable period to assess the full benefit of such requirements before prematurely supplementing them with a further requirement for quarterly evaluations of internal controls, a requirement materially more burdensome than the annual evaluation specifically mandated under the Act.
Mature, multinational companies such as ours depend on a solid internal control environment. We note, however, "Internal controls, no matter how well designed and operated, can provide only reasonable assurance of achieving an entity's control objectives" (AU 319.21). Evaluating internal controls over financial reporting on a quarterly basis would provide only limited incremental assurance above that provided by the quarterly management "certifications."
Large, multinational companies often adapt internal controls to the requirements of their component business units and utilize complex information technology systems to process and summarize transactions and prepare operational and financial information necessary for the operation of the business and compliance with financial reporting requirements. As a consequence, an evaluation of the effectiveness of the design and operation of a company's internal controls often requires an extensive work effort. If companies are required to perform such evaluations on a quarterly basis, they would have to focus their resources on "compliance requirements", rather than applying resources to improving controls over financial reporting, due to the extent and frequency of work required. As a result, a quarterly evaluation is likely to dilute management's efforts to improve controls.
In response to the Commission's request for comment as to whether it is necessary to propose a definition of "internal controls and procedures for financial reporting", we think such controls are already encompassed within the existing definition, framework and precepts of internal controls. Further, we concur with the Commission that "internal controls and procedures for financial reporting" referred to within the Act are embodied in the definition of the term "internal controls" as set forth in the AICPA's Codification of Statements on Auditing Standards (AU) Section 319. We believe it is unnecessary to further define, or redefine, internal controls in conjunction with the implementation of the reporting requirements under the Act. We strongly believe the long-established concepts and principles remain applicable and, despite the malfeasance of a handful of companies, believe such concepts and principles have been effectively implemented in business practices, policies, procedures and controls by the vast majority of companies. These companies have gone to great lengths to establish and maintain effective internal controls, procedures, checks and balances for financial accounting and reporting.
We would also like to make the following suggestions in response to your specific requests for comment. These suggestions and comments are more fully described in the attached Exhibit.
- We suggest the Commission develop and provide disclosure criteria and standards, rather than the specific format, regarding management's report on internal controls.
- We recommend the Commission delay the implementation of the requirement regarding auditor attestation on management's report on internal controls until the PCAOB has established guidelines for the auditor's attestation.
- We suggest the Commission consider a minimum transition period for the auditor attestation requirement of at least two quarters following adoption of the Proposed Rule.
In conclusion, we respectfully request the Commission to implement the requirements regarding management's report on internal controls on an annual basis and allow a reasonable period to assess the combined effectiveness of this disclosure, taken together with the auditor attestation thereon and the previously implemented requirements for management "certification" of registrant quarterly and annual reports. If these collective reporting requirements fall short, then the Commission could consider a quarterly requirement for evaluating internal controls over financial reporting, as well as any other necessary measures.
Thank you for the opportunity to comment on this proposal and for your consideration of our suggestions and comments.
Sincerely,
Leon J. Level
Chief Financial Officer
Computer Sciences Corporation
Exhibit 1
Proposed Rule: Disclosure Required by Sections 404, 406 and 407 of the Sarbanes-Oxley Act of 2002", Subject File No. S7-40-2 (the "Proposed Rule")
Request for Comments
II. A. Proposed Disclosure About Financial Experts Serving on a Company's Audit Committee
1) Proposed Disclosure Requirements
- Would investors benefit from disclosure of the number of the financial experts serving on the company's audit committee? Or would it suffice to require disclosure only of whether at least one financial expert serves on the audit committee?
We do not think that disclosing the number of "financial experts" serving on an audit committee will benefit investors. Moreover, we think requiring such disclosure may weaken confidence in a company which has only one "financial expert". Given a company's circumstances (size, nature of the business, financial reporting issues, etc.), one may be sufficient. Therefore, we recommend companies be required to simply disclose whether the audit committee includes a member who meets the criteria of a "financial expert".
- Do investors need to know the names of the financial experts on the audit committee? Would disclosure of the names discourage people from serving as financial experts on an audit committee?
We recommend the name(s) of the financial expert(s) not be disclosed. We think disclosure of the name of a "financial expert" may focus unwarranted attention of the public and the media on the individual board member serving as the "financial expert". This may deter board members from serving in this capacity (particularly for larger companies). The public also may attribute greater responsibility to this individual, contrary to the intent of the Sarbanes-Oxley Act of 2002 (the "Act"). As such, we believe the "financial expert(s)" should not be singled out by disclosing their name(s). Therefore, we again recommend companies be required to simply disclose whether the audit committee includes a member who meets the criteria of a "financial expert".
- Should the Commission specifically address the issue of the degree of individual responsibility, obligation or liability under state or federal law of a person designated as a financial expert as a result of the designation? If the Commission should address this issue, how should it do so?
Yes, we suggest the Commission make it abundantly clear that the responsibility of the "financial expert" is no greater than any other member of the audit committee.
- Should we use a term other than "financial expert"? For example, would the term "audit committee financial expert" be a more appropriate title?
We recommend the term "audit committee financial expert" be used to refer to the "financial expert" so there will be no confusion, particularly with respect to the term "expert" as defined for the purposes of Section 11 of the Securities Act. We presume the Commission does not intend that serving as the "financial expert" would, in and of itself, preclude service on other committees of the board of directors and suggest that the proposed rule affirmatively confirm this understanding in the interest of clarity.
- Is there other relevant information about the financial expert or experts that a company should have to disclose? For example, should we expand the disclosure required under Item 401(e) of Regulations S-K and S-B, as it relates to directors that the company has determined to be financial experts? If so, how?
No, the disclosure requirement should be the same as for any other director.
- Should we require disclosure of whether the financial experts are independent, as proposed? If so, should we define "independent" in the same manner as the term is used in Section 10A(m)(3) of the Exchange Act?
No, this disclosure is not necessary since all audit committee members are required to be independent under the Act.
- Should we incorporate an independence requirement into the definition of "financial expert" so that any designated financial expert must be independent to qualify under the definition?
No, this disclosure is not necessary since all audit committee members are required to be independent under the Act.
2) Proposed Definition of "Financial Expert"
- Should we modify the definition of "financial expert" in any way? If so, how?
Generally, the definition of a "financial expert" seems appropriate. However, we think the qualifying term "comparable" used in the description of the second and third attributes (Instruction 1(b) and (c) to Item 309 of Regulation S-K under the Proposed Rule) requires clarification (see comment below).
- Should we require a financial expert to have direct experience preparing or auditing financial statements of reporting companies? Should experience reviewing or analyzing such financial statements suffice? If so, why?
Yes, we believe the "financial expert" should have direct experience in the preparation or auditing of financial statements for companies subject to the Securities Acts. The proposed rule would permit the registrant's board of directors to exercise discretion in selecting individuals with "similar expertise and experience". In this case, we think that the burden of proof as to circumstances constituting "similar expertise and experience" should rest with the registrant's board of directors.
- Should a financial expert have to possess all of the "attributes" listed in the proposed definition? Should we broaden the scope of individuals who may qualify as such an expert?
Generally, we agree with the proposed attributes. However, we think the qualifying term "comparable" used in the description of the second and third attributes (Instruction 1(b) and (c) to Item 309 of Regulation S-K under the Proposed Rule) requires clarification. If experience in "comparable" circumstances means experience within the same industry group or, more importantly, with a company's competitors, there could be a number of potentially serious unintended consequences, including: 1) it may be difficult to obtain a "financial expert" as the available pool of qualified individuals may be quite limited depending on the size and demographics of the industry; 2) mandatory industry expertise may result in potential conflicts of interest; and 3) service on one or more audit committees may compromise proprietary information and/ or result in potential antitrust issues and code of conduct violations (by way of association with a competing company). Accordingly, we recommend for the purpose of the "financial expert" experience requirements "comparable" circumstances be defined to include experience with companies having similar complexity in financial accounting and reporting issues, reporting requirements, capital structure, and, if relevant, experience with multi-national and/or multi-industry companies.
We also suggest the Commission broaden the focus of the financial accounting matters comprehended by the experience requirement concerning the application of generally accepted accounting principles (Instruction 1(b) to Item 309 of Regulation S-K under the Proposed Rule). Such matters should encompass application of generally accepted accounting principles to a company's full complement of account balances, transaction classes and disclosures, rather than limiting the focus to only "estimates, accruals and reserves". This broader focus would expand the scope of accounting matters addressed in the experience requirements to more clearly incorporate the full range of financial accounting and reporting issues. For example, the broader focus would include a company's critical accounting policies, such as revenue recognition, an area receiving significant attention and one which the Commission addressed in disclosure guidance, issued last January. Simply put, we do not understand the singular focus on these financial statement elements to the exclusion of other elements of equal, or greater, significance, and recommend the criteria incorporate a more comprehensive perspective. Moreover, the term "reserves" has long been discouraged by the standard setting bodies.
- Do the five attributes adequately describe the qualities that a financial expert should have? Should we add any attributes?
Generally, we agree with the five attributes for evaluating the suitability of a potential "financial expert", provided the registrant's board of directors is permitted the discretion to make the assessment as to whether candidates meet the requirements. We also suggest the Proposed Rule clearly indicate the attributes should be evaluated in the aggregate.
- Although we do not intend for the list of factors that a company should consider in assessing a potential financial expert's qualifications to be exhaustive, should we add any factors to the list? If so, what other factors should we include? Conversely, should we delete any proposed factors from the list? If so, which factors should we delete?
We also recommend the factors include a "breadth" of experience related to financial accounting and reporting with companies of similar complexity in financial accounting and reporting issues, reporting requirements, capital structure, and, if relevant, experience with multi-national and/ or multi-industry companies.
- Should the proposed rules provide for a different standard or methodology for assessing a financial expert's qualifications? If so, describe the preferred standard or methodology.
We think the proposed rules seem appropriate, except as otherwise noted herein.
3) Determination by the Board Of Directors of Who Is a Financial Expert
4) Impracticability of a "Bright -Line" Test
- Should we create a bright-line test for the definition of "financial expert"? If so, what should the test be?
No. See preceding responses.
5) Location of Disclosure
- Should we also require the proposed financial expert disclosure to appear in the company's proxy or information statement? Is this information relevant to a security holder's decision to vote for a particular director or to elect, approve or ratify the choice of an independent public accountant?
We think the disclosure as to whether the audit committee includes a member who meets the criteria for a "financial expert" should be included in the proxy statement in conjunction with existing disclosure requirements regarding officers and directors. We do not believe this information has any further relevance to the shareholders' decision to vote for directors. We do not think it is appropriate, or necessary, for the shareholders to ratify the selection of the company's independent public accountant, since the Act now requires the audit committee to make this decision.
- Should we require the company to also disclose this information in its quarterly reports?
No. Since quarterly filings are deemed to be read in conjunction with other filings, we suggest that the disclosure be made only in the proxy.
- Should we also require such disclosure in registration statements filed under the Securities Act?
We agree the disclosure should be included, or incorporated by reference, wherever disclosures concerning the board of directors, or committees of the board, are required.
- Should the company have to disclose specifically the arrival or departure of a financial expert promptly after the occurrence of the event? If so, should we modify our Form 8-K proposed item regarding the arrival and departure of a director to also require a company to disclose whether the departing director was, or arriving director will be, a financial expert serving on the company's audit committee? Should a company make appropriate disclosures if: a financial expert leaves the audit committee, but remains on the board of directors; or an existing director joins the audit committee as a financial expert? Should a company only have to file a Form 8-K if it previously disclosed in its annual report that it had a financial expert and now has none?
No, since, as stated previously, we recommend companies be required to simply disclose whether the audit committee includes a member that meets the requirements of a "financial expert".
- A company currently may not have an audit committee member who qualifies as a financial expert under the proposed definition but may intend to seek one. In such a case, the proposed rules would require a company to disclose that it does not have a financial expert on its audit committee. However, the company could explain that it is searching for a qualified individual to serve on its audit committee. Should we provide companies with a transition period to find such a person? If so, what would be an appropriate transition period?
We recommend the establishment of a transition period of at least one year beyond the adoption date of the final rules or, if later, until the next annual meeting.
II. B. Proposed Code of Ethics Disclosure
2) Description of the proposed Code of Ethics Disclosure Requirements
- Should the rules address whether a company has a code of ethics that applies to its principal executive officer, as proposed, or should the rules track the language of Section 406 of the Sarbanes-Oxley Act and require a company only to disclose whether it has a code of ethics that applies to its senior financial officers?
We recommend that the CEO and CFO be subject to the same code of ethics, as proposed. Since the CEO has pervasive influence and overriding responsibility for the conduct of the company's business, its business practices, operations and internal controls, we think standards of conduct and behavior applicable to the CFO should apply equally to the CEO.
- Should we expand the definition of "code of ethics," as proposed, or should the definition adhere to the language in Section 406(c) of the Sarbanes- Oxley -Act? Are there other ethical principles that should be included in the definition?
The definition seems appropriate.
- Should the rules cover a broader group of officers? If so, which group of officers should they cover? Should the general counsel be covered? Should all executives be covered?
Yes, we think all executive officers should be subject to the company's code of ethics.
- Should the proposed rules require a company to disclose whether it has a code of ethics that applies to its directors? Do most companies have a code of ethics that applies to the board of directors? Does the same code of ethics generally apply to the company's executive officers and its directors?
We think the code of ethics should also apply to the registrant's directors.
- Should we require the company to describe its procedures to ensure compliance with the code of ethics?
No.
- Should we require the company to describe its procedures for granting a waiver from a provision of its code of ethics?
No.
- Should we require the company to disclose the date of adoption of its code of ethics and the date of the most recent update or the company's frequency of review of the code?
No, we recommend the company simply be required to disclose whether it has adopted a code of ethics which meets the criteria of the Act and whether it is applicable to its executive officers and directors.
- Should the company have to file the code of ethics as an exhibit to its annual report as proposed? If not, should we also require the company to describe the principal topics that the code addresses?
As indicated above, we think the company should simply be required to disclose whether it has adopted a code of ethics which meets the criteria of the Act.
- Should we require disclosure regarding the existence of a code of ethics in our other reports and registration statements, including our Securities Act and Exchange Act registration statements?
We recommend the disclosure be included in the company's annual report on Form 10-K.
4) Types of Companies That Would Be Subject to the Proposed Code of Ethics Disclosure Requirements and Location of the Disclosure
5) Proposal for Form 8-K or Internet Disclosure Regarding Changes to, or Waivers from, the Code of Ethics
- Are there any privacy concerns that we should consider that would warrant narrowing the disclosure requirements regarding a grant of a waiver from the code?
Yes, we think there are potentially many circumstances where privacy concerns would warrant confidentiality of such waivers, both for the company and the individual officer or director. We think these matters are the direct and primary responsibility of the company's board of directors and that public disclosure cannot supplant, nor mitigate the failure of a company's board of directors to properly discharge, this responsibility.
- Is a "waiver" a sufficiently distinct and formal event that the obligation to disclose will not present any difficulties of interpretation? Should we modify the requirement to ensure that "de facto, post hoc" waivers of codes-granted or acceded to after the occurrence of the "violation" are reported?
We think that the circumstances constituting a waiver require no further clarification.
- Should companies that use the Internet for these disclosures also be required to have technology that allows investors to be notified by e-mail when new information is posted to the website?
As indicated above, we strongly disagree with the requirement that a company disclose information regarding waivers to the code of ethics for the reasons previously stated. However, if the final rules include such a requirement we recommend the dissemination of information be limited to the company's website. We think sending emails to shareholders would be excessively burdensome and would not be cost justified.
- Should we require the filing of a Form 8-K regardless of whether a company provides the proposed disclosure on its website? Do investors need access to this information for longer than 12 months? How can we permit Internet disclosure and maintain a lasting public record of the information?
No, as indicated above, we strongly disagree with the requirement that a company disclose information regarding waivers to the code of ethics for the reasons previously stated. However, if the final rules include such a requirement we think one mode of communication is sufficient. Communication via the website is the most convenient and accessible means of disseminating this information.
- Should we specify where and how this disclosure should appear on a company's website if the company opts for the website method of dissemination?
No.
- Are there other means of electronic dissemination that our proposed rules should permit?
No comment.
- Should we require a company choosing to disclose information about ethics code changes or waivers through its Internet website to provide advance notice in the company's annual report of its intent to satisfy the disclosure requirements in this manner, as proposed?
As indicated above, we strongly disagree with the requirement that a company disclose information regarding waivers to the company's code of ethics for the reasons previously stated.
- Should we require all Exchange Act reporting companies to disclose their website addresses? If so, should we specify the location of this disclosure? For example, should it have to appear on the front cover of all periodic and current reports, along with the company's street address? Should a company have to disclose its website address in, or on the front cover of, all of its Exchange reports? Proxy and information statements? Exchange Act registration statements? Securities Act registration statements?
As indicated above, we strongly disagree with the requirement that a company disclose information regarding waivers of the company's code of ethics for the reasons previously stated. However, generally we think disclosure of the company's web site address on the front cover would be useful and appropriate for many other purposes.
II. C. Management's Internal Controls and Procedures for Financial Reporting
1) Management Internal Control Report
Should we propose a definition of internal controls and procedures for financial reporting? If so, is the proposed definition appropriate?
No, we do not think yet another definition for "internal controls and procedures for financial reporting" is necessary. We think such controls are already encompassed within the existing definition, framework and precepts of internal controls. Further, we concur with the Commission that "internal controls and procedures for financial reporting" referred to within the Act are embodied in the definition of the term "internal controls" as set forth in the AICPA's Codification of Statements on Auditing Standards (AU) Section 319. We believe it is unnecessary to further define, or redefine, internal controls in conjunction with the implementation of the reporting requirements under the Act. We strongly believe the long-established concepts and principles remain applicable and, despite the malfeasance of a handful of companies, believe such concepts and principles have been effectively implemented in business practices, policies, procedures and controls by the vast majority of companies. These companies have gone to great lengths to establish and maintain effective internal controls, procedures, checks and balances for financial accounting and reporting.
- Should we define the term using AICPA's Codification of Statements on Auditing Standards Section 319 definition? If not, are there any other definitions we should use?
Yes. We concur with the Commission that "internal controls and procedures for financial reporting" referred to within the Act are embodied in the definition of the term "internal controls" as set forth in the AICPA's Codification of Statements on Auditing Standards (AU) Section 319.
- Should we propose specific disclosure criteria and standards for the management report? If so, what disclosure criteria and standards should we consider?
Yes, we suggest that the Commission develop and provide disclosure criteria and standards, rather than the specific format, regarding management's report on internal controls. As indicated previously, we strongly disagree with characterization of the quarterly management "certification" requirements under Rules 13a-14 and 15d-14 because terms such as "certification" convey a much higher level of assurance than can reasonably be applied to financial information and internal controls. Accordingly, we suggest any guidance be cognizant of this issue.
2) Attestation to, and Report on, Management's Internal Control Report by the Company's Auditor
- If we adopt the proposed amendments before the PCAOB is operational, should we delay effectiveness of the rules until such time as attestation engagements standards are issued or adopted by the PCAOB?
Yes. We recommend that the Commission delay the implementation of the requirement regarding auditor attestation on management's report on internal controls until the PCAOB has established guidance for the auditor's attestation.
- Should the company have to file the attestation report as part of the annual report? If so, should the report have to appear in a particular part of the annual report? Where?
Yes, we think the company should file the auditor's report. It should be included in proximity to management's report on internal controls.
3) Quarterly Evaluation of Internal Controls and Procedures for Financial Reporting
- Should we propose changes to Exchange Act Rules 13a-14, 13a-15, 15d-14 and 15d-15 to require periodic evaluations of both the company's disclosure controls and procedures and its internal controls and procedures for financial reporting?
We believe requiring these evaluations to be conducted on a quarterly basis will present significant challenges to any registrant and, in many cases, may not be feasible. In addition, the requirement that the evaluation be performed as of the last day of the period being reported upon would exacerbate the onerous and burdensome nature of this requirement. Section 404 of the Act only requires management to evaluate and report on the company's internal controls on an annual basis and the company's external auditors to attest, and report on, management's assessment of such internal controls.
The Commission issued Rules 13a-14 and 15d-14 to implement quarterly management "certification" in accordance with Section 302 of the Act effective August 29, 2002. It is very likely that the integrity of financial reporting and disclosure by registrant companies has now been raised to an appropriate level given the combined effects of the following requirements under these rules: 1) management's quarterly review of disclosure controls and procedures, 2) management "certifications" regarding the fair presentation of its financial statements and other financial information included in the company's quarterly and annual reports, and 3) the representations included in such "certifications" regarding internal controls and disclosure controls and procedures. In view of the relatively recent effective date of these "certification" requirements, we recommend that the Commission allow a reasonable period to assess the full benefit of such requirements before prematurely supplementing them with a further requirement for quarterly evaluations of internal controls, a requirement materially more burdensome than the annual evaluation specifically mandated under the Act.
Mature, multi-national companies, such as ours, depend on a solid internal control environment. We note, however, "Internal controls, no matter how well designed and operated, can provide only reasonable assurance of achieving an entity's control objectives" (AU 319.21). Evaluating internal controls over financial reporting on a quarterly basis would provide only limited incremental assurance above that provided by the quarterly management "certifications".
Large multi-national companies often adapt internal controls to the requirements of their component business units and utilize complex information technology systems to process and summarize transactions and prepare operational and financial information necessary for the operation of the business and compliance with financial reporting requirements. As a consequence, an evaluation of the effectiveness of the design and operation of a company's internal controls often requires an extensive work effort. If companies are required to perform such evaluations on a quarterly basis, they would have to focus their resources on "compliance requirements", rather than applying resources to improving controls over financial reporting, due to the extent and frequency of work required. As a result, a quarterly evaluation is likely to dilute management's efforts to improve controls.
6) Transition period for Compliance with Rules Regarding Evaluations of, and Reports and Attestations on, Internal Controls and Procedures for Financial Reporting
|