Response to Proposed Rule: Retention of Records Relevant to Audits and Reviews
Security and Exchange Commission
17 CFR Part 210 - File No. S7-46-02
December 27, 2002
Submitted by:
Lynette Downing, CRM
HLB Tautges Redpath, Ltd.
Certified Public Accountants and Consultants
4810 White Bear Parkway
White Bear Lake, MN 55110
Section II - Discussion of Proposed Rule
Q Are the "workpapers" and other documents that would be required to be retained under this proposed rule sufficiently described? If not, what changes should be made to provide for greater clarity? Are there alternative definitions that would better implement section 802?
A Yes, the definition is adequate for those in the accounting industry. Further clarification can be found through specific audit program requirements under GAAP, GAAS, SAS, etc.
Q Would auditors have to implement significant changes to their retention policies or internal control processes and procedures, as well as system upgrades, to ensure compliance with the proposed rule? If so, what types of changes most likely would be required? How can we minimize any required changes consistent with section 802?
A Yes, the changes could be significant depending upon whether or not the firm has a good records management program already in place. Records management programs outline internal control processes and procedures. Retention policies are only one portion of managing the record life cycle (creation through destruction). How a firm destroys records determines how a firm creates and manages the record to a large extent. Most organizations manage and destroy records based upon a record series, which is a group of records used together for a common purpose. In CPA firms, this translates into maintaining client files (whether paper or electronic) by engagement. For example, a financial audit for a specific entity for a specific time period would mean all records relating to that audit would be filed together to support the audit engagement. In order to apply the five-year retention provided for under section 802 (general audit workpapers) and the seven-year retention provided under section 103 (conclusive workpapers), firms will need to classify the workpapers and maintain them separately. Separate files or folders can be created whether paper or electronic format but unfortunately, this creates two places to find information instead of one. Two places to save documents may require a decision by staff which, even with training, could be arbitrary. To minimize changes and reduce arbitrary decisions, we recommend that the longer retention period of seven years apply to all audit workpapers and the distinction between five-year and seven-year requirements eliminated. Alternatively, firms can choose to retain all workpapers for seven years, thus meeting both the five and seven-year criteria.
Q Would auditors circumvent the proposed record retention requirements by, for example, replacing written communications with oral communications? If so, what additional measures should be taken?
A Yes. If having a written review note is potentially controversial, firms will obtain satisfaction through oral communication in many instances. Developing specific guidelines on what to document in writing are needed.
Q Section 103 of the Sarbanes-Oxley Act directs the Public Company Accounting Oversight Board to adopt an auditing standard that requires each registered public accounting firm to retain for a period of not less than seven years audit workpapers and other information that support the conclusions in the auditor's report. Should the retention period in the proposed rules be extended to seven years to coincide with the retention period in section 103? Why?
A Yes, both sections 103 and 802 should have the same retention period. Separating out one type of workpaper from another adds to administrative work for records management staff to keep track of information and adds to confusion for accounting staff when creating records and searching for them, especially when there may be overlapping retention requirements between the two groups. If a quality audit is performed, there should be little or no additional risk to keeping the more general workpapers the same time period as the conclusion-supporting workpapers. CPA firms should be destroying records consistently in the normal course of business. This is difficult enough to do without adding workpaper classifications into the mix.
Q Should the retention period be for some other appropriate period based on consideration of other factors, such as the utility of the records to investors, regulators or litigants, the cost of retaining the records, or the size of the accounting firm?
A Professional records managers take four factors into account when valuing records and determining records retention periods: fiscal, historical, legal, and administrative requirements. These factors help weigh the costs and risks of keeping records with the benefits and other compliance issues. While this proposed SEC rule may dictate a fiscal requirement, records managers in CPA firms should recognize there is an administrative (user) requirement to reference the audit documents as a unit to maintain the whole picture of the engagement, which necessitates the longer retention period of seven years.
The cost of retaining records should always be a consideration, but a good records management program is designed to reduce costs not only in storage but in process and procedure. Following two retention periods will increase process costs, not necessarily storage costs.
The size of the accounting firm should have nothing to do with this decision. All firms should employ good records management practices. As a general observation, the majority of organizations need to improve (or even establish) records management practices. That comes at a cost of investing time and money into a program that is considered in the accounting industry as administrative overhead. The problem lies in the attitude toward recognizing the value of records management to the CPA firm, not in the proposed retention requirements outlined in File No. S7-46-02. Smaller firms are no more immune to litigation and investigation than larger firms are and should, therefore, be held to the same degree of accountability.
Public confidence in the CPA profession will be better served by having less, not more, differentiators in the required standards that firms must adhere to.
Q Audits of the financial statements of many investment advisers and broker-dealers would not be subject to the proposed rules because they are not "issuers" of securities. Should the proposals be amended to apply the retention period to audits of the financial statements of these entities? Why?
A Yes, record retention rules should be applied consistently, and whether a broker-dealer is an "issuer" of securities should not make a difference. The underlying purpose of the Sarbanes-Oxley Act is to restore public confidence in investing in public securities. Including broker-dealers will enhance that trust. Additionally, such broker-dealers will generate different records regarding financial analysis that would be useful to potential investigators.
Q The proposed rules would incorporate the definition of "issuer" in new section 10A(f) of the Exchange Act? Should "issuer" be defined more broadly to include any issuer of securities with respect to which a registration statement or report is filed with the Commission? Why?
A Yes, consistency improves public confidence particularly for those who invest based on statements and disclosures filed with the Commission.
Q Should there be a document retention requirement for issuers as well as auditors? If yes, what would be the scope and nature of that requirement? For example, should issuers be required to retain records that the auditor reviewed but did not include in the audit workpapers? Should issuers be required to keep copies of all correspondence with the auditors and copies of documents provided to the auditors?
A Yes, as related to audits, there should be a similar document retention requirement for issuers as well as auditors, unless there is a longer retention period stated in the investment industry. The longer retention period would prevail.
Q Section 32(c) of the Investment Company Act of 1940 authorizes the Commission to adopt rules to require accountants and auditors to keep reports, work sheets, and other documents and papers relating to the registered investment companies for such periods as the Commission may prescribe, and to make these documents and papers available for inspection by the Commission and its staff. Should we use our authority under this section to extend proposed rule 2-06 by requiring that audit workpapers and other documents required to be retained with respect to the audit or review of investment company financial statements be made available for inspection by the Commission and its staff?
A Yes, investment companies are integral to the public's investment process; therefore, those records should also be available to the Commission.
Q The proposed rules would apply to foreign auditors. Are there statues, rules or standards in foreign jurisdictions that govern the retention of records by foreign auditors that are different from and potentially conflict with the requirements of the proposed rules? If so, how is the foreign law incompatible with the specific provisions of the proposed rules?
A Yes, there are going to be conflicting statues, rules and standards in foreign jurisdictions governing records retention, but they will vary according to the country in which the organization does business. A CPA firm's records management program should already be addressing these issues as it researches records retention laws and regulations while developing its records retention schedules. Records managers and legal counsel routinely address these issues, but the answers are often complex and varied. Records that a U.S. auditor relies upon in issuing an auditor's report should become part of that U.S. firm's workpapers and subject to the retention rules. Foreign auditors would need to recognize U.S. rules when retaining workpapers in a foreign country.
Q Does the "cast doubt on the final conclusions reached by the auditor" provision in the proposed rules adequately capture the scope of the retention requirements under the Sarbanes-Oxley Act? Should the scope be narrower or broader? Would a different test be more appropriate, such as "significant differences in professional judgment," or "differences of opinion on issues that are material to the issuer's financial statements or to the auditor's final conclusions regarding any audit or review"?
A Once the records have been committed to writing, the retention should be the same whether or not the workpapers contain differences in conclusion, judgment, or statement. This is a records creation (and professional ethics) issue that weights the costs/benefits of having such documentation on hand in the first place. While an extremely important issue, it should be addressed in detail in SAS 22 and 96. The language "differences of opinion on issues that are material to the issuer's financial statements or to the auditor's final conclusions regarding any audit or review" is more detailed and is preferred. The retention period of seven years is still recommended no matter if there are material differences of opinion or not. Seven years should be sufficient to identify these issues and, once identified, retention is automatically stopped until any proceedings are concluded. Seven years is beyond the statue of limitations in many cases.
Q Should the rules include other examples of materials that "cast doubt" on auditors' conclusions? If so, what examples should be included?
A Again, these issues should be outlined in SAS 22 and 96 or other appropriate interpretations.
Section V - Cost-Benefit Analysis
Q Are there any other costs or benefits that we have not identified? For example, would the cost of audits increase? Please describe any such costs and provide relevant data.
A For those CPA firms without established records management programs, there will be an increased cost as they are required to know what records they have (an inventory) and to document that they were destroyed according to the records retention requirements in the normal course of business (as evidenced by destruction lists indicating when records were destroyed and by whom). There will need to be documented records policies and procedures and evidence that supports that those policies and procedures were followed consistently. Many CPA firms do not have structured records management programs, so complying with this Rule in the appropriate fashion will be an added cost factor. For those firms with established records management programs, it will merely require a review, and possible fine tuning, of existing policies and procedures.
In order to keep electronic records available for inspection, it may be necessary to convert records from one version to another or to migrate from one storage medium to another. These conversion/migration issues can be costly, and sometimes cost more than the original record creation.
The cost of keeping electronic records (including potential migration costs) should not (over time) increase the cost of audits. On the contrary, increased efficiencies that result from electronic recordkeeping in document management and imaging systems should reduce the cost of performing an engagement for the CPA firm while continuing to ensure quality audits (or even increase the quality in some cases). Initial investments in document management and imaging systems may, however, be significant. Depending on the IT infrastructure and staffing already in place, an investment of $100,000 to $250,000 for each $5 million in net fees is likely with ongoing annual expenses of $50,000 to $100,000.
Q Are there additional costs related to the proposed rules? If there are, please identify them and provide supporting data?
A Additional costs include added CPE and internal training, increased administration of rules, and either an upgrade of existing administrative personnel to take on records management responsibilities or the use of outside consultants.
The benefits of a good records management program far outweigh the costs. These benefits include:
- Reducing labor requirements for organizing, retrieving and disseminating information
- Minimizing storage requirements
- Ensuring compliance with recordkeeping requirements, thus avoid costly fines or other penalties
- Reducing the risk and cost associated with pre-trial discovery in civil litigation and government investigation
- Reducing the time and effort to reconstruct mission-critical information in the event of a disaster
- Preserving organization memory
- Protecting an organization's most vital asset-information
Q Are there measures that the Commission should take, such as encouraging accounting firms to keep more records electronically, to lower storage costs?
A While storing records electronically may be cheaper in some respects (e.g., the cost of a server versus the cost of a file cabinet when comparing the amount of information each can hold), the cost of "managing" any medium should be taken into account. Deleting a folder when a client discontinues services or removing a series of folders when a hard drive becomes full is not managing records in a consistent fashion. The true cost of keeping records electronically, in addition to the hardware and software, includes the cost of capture, indexing for quick retrieval, accessibility (which may include migrating from one medium to another to maintain readability), security and protection (which includes hold procedures to stop destruction in cases of investigation), and consistent destruction. Consistent destruction entails destroying information based on its value in a consistent manner (no picking and choosing what stays and what goes) in the normal course of business.
While encouraging accounting firms to keep more records electronically is preferable in firms with good records management programs in place, encouraging it in other firms is downright scary. According to a recent survey by Cohasset Associates, Inc. in Chicago, 53% of organizations (in general, not just CPA firms) do not include electronic records in their records management program. If the majority do not account for electronic records, they are exposing themselves to unnecessary legal, regulatory and business risks. It is recommended that CPA firms install records management programs under the direction of a qualified records manager to manage both paper and electronic records. Don't expect IT departments to know how to manage records based on their value. IT departments are trained in managing hardware, software, configurations and space issues. They are usually not qualified to manage records as records or to make value-based decisions.
Q We request comments on the reasonableness of the burden hours, cost estimates, and underlying assumptions related to the proposed disclosures.
A The underlying assumption that the majority of CPA firms can continue to manage their records like they have been is false. Those firms that don't have a complete inventory of their records, that don't have policies and procedures in place for the creation, maintenance and consistent destruction of records, that don't have hold procedures for records that are under investigation, that don't have someone knowledgeable in charge of records, that don't establish standards and that don't apply consistent practices and retention rules will be burdened with additional time and cost requirements to establish programs. And this is the majority of small to mid-sized CPA firms according to this author's opinion and almost 15 years experience in the industry.
The 15,000 burden hours cited in the Proposed Rule seems low if on a national basis. A firm of 30 employees should already be thinking about at least a part-time person dedicated to records management issues. While someone dedicated to records management may be employed at a lower cost than professional accounting staff, it must be taken into consideration that accountants spend the majority of their time creating, retrieving and saving records. If even a fraction of that time can be reduced through more efficient records practices, the cost savings will add up rapidly. However, there is a cost to establishing and maintaining a records management program, a cost CPA firms may not be accustomed to spending.
Section VI - Consideration of Impact on the Economy, Burden on Competition, and Promotion of Efficiency, Competition and Capital Formation
Q We request comment on the anti-competitive effects of the proposals.
The possible effects of our rule proposals on efficiency, competition, and capital formation are difficult to quantify. We request comment on these matters in connection with our proposed rules.
A There should be no adverse effect on competition. However, those firms with good records management practices should have a marketing advantage when it comes to efficiency of services (contained costs) and security of information. Those firms that make use of electronic document management and imaging systems also have the advantage of reduced storage costs, reduced client call-back time, increased use of space for staff workstations, a benefit for attracting and retaining staff, improved employee morale and better organized information for better decision-making.
Section VII - Initial Regulatory Flexibility Act Analysis
Q We request comments regarding the number of small entities that may be affected by the proposed rules and the existence or nature of the potential impact on those small entities. We also seek comments on how to quantify the number of small accounting firms that would be affected by the proposals, how to quantify the impact of the proposed rules on those firms, and how to lower the cost of record retention for small accounting firms.
A If a CPA firm is able to audit publicly traded companies, it is able to comply with the records retention rules as they relate to those audits, regardless of size. Records management procedures for smaller accounting firms should be the same as they are for larger firms. While smaller firms may not have dedicated records managers on staff and may need to rely more on costly consulting services, the records retention requirements are part of the engagement and should not be reduced merely based on firm size. Is there any less risk associated with a small firm vs. a large firm performing the audit?
Larger firms are more likely to have formalized records management programs than smaller firms, but the cost of implementing a program at any-sized firm will be surpassed by the benefits received and the future cost savings. Managing records the wrong way is more costly than managing them the right way. The recommendation is to do it the right way.
|