Deloitte & Touche LLPDecember 27, 2002 Mr. Jonathan G. Katz
RE: Release Nos. 33-8151; 34-46869; IC-25830
Dear Mr. Katz: Deloitte & Touche LLP is pleased to respond to the request for comments from the Securities and Exchange Commission (the "Commission") on its proposed rule regarding Retention of Records Relevant to Audits and Reviews, File No. S7-46-02. I. Introduction We strongly support the goals of the President of the United States, the United States Congress, and the Commission to improve the quality and transparency of financial reporting and corporate governance. Effective implementation of the Sarbanes-Oxley Act of 2002 (the "Act") will result in positive changes in governance and financial reporting. We are committed to assisting the Commission in the adoption of responsible rules to improve the quality of financial reporting and to help increase investor confidence in our capital markets. One element of the implementation of the Act is the Commission's proposed rule concerning retention of records relevant to audits and reviews. We support appropriate audit documentation requirements that will enhance audit effectiveness. However, our concern is that the scope of the proposed rule, and significant ambiguities in its language, will likely have the unintended effect of diminishing audit quality. II. Overall Comments on Retention of Records Relevant to an Audit or Review Pursuant to Section 802 of the Act, the Commission has proposed a rule related to the retention of records relevant to audits and reviews of financial statements that issuers file with the Commission. The Commission states that the availability of these records "should enhance oversight of corporate reporting and of the performance of auditors and facilitate the enforcement of the securities laws." Release at VII.B ("Objectives"). These are worthy objectives, and we support the Commission's efforts to promote the retention of relevant documentation by auditors. The principle authoritative literature on audit documentation, found in Statements on Auditing Standards (SAS) No. 96, Audit Documentation, was recently adopted by the Auditing Standards Board and is effective for audit periods beginning on or after May 15, 2002. It provides more specific guidance and documentation requirements than in the past and, in conjunction with other current standards, we believe already reflects in large measure the objectives of Congress and the Commission in adopting new requirements on documentation to improve the conduct of audits. Ideally, the Commission would monitor the effectiveness of SAS 96 before undertaking to promulgate a new rule of its own for document retention. However, we appreciate that the imposition of a time frame under Section 802 requires that the Commission proceed now with its own new rule. Therefore, we take this opportunity to focus our comments on the proposed rule on concerns regarding the significant risk that the breadth and ambiguity of the proposed rule will have the unintended effect of diminishing audit quality. For example, ambiguities and imprecision of language in the proposed rule could be interpreted as essentially requiring that auditors retain all documents necessary to allow a third party to re-perform the audit. Forcing an auditor to retain all such documentation would place an overwhelming burden on the auditor, and could otherwise inhibit the audit process, such that the focus of the professional would necessarily shift from effective auditing to the collection and preservation of documents. Moreover, whatever the form of the rule ultimately adopted by the Commission, a violation of its provisions will subject auditors to potentially severe penalties imposed by the Act - including prison terms as long as 10 years. For that reason alone, there is no room for uncertainty in the language of the final rule. Whatever substantive provisions the Commission may ultimately adopt must be presented in language that is a paragon of clarity and precision. For these reasons, and as more fully discussed below, we urge the Commission to reconsider certain important aspects of the proposed rule. III. The Proposed Rule Could Possibly Have an Inhibiting Effect on the Audit Process Fundamental to the audit is the ability of the engagement team to communicate with the client, and to consult with other team members and with other professionals within the firm to obtain information about and reach conclusions on complex accounting and reporting issues. During the consultation process, information is shared, and initial or preliminary conclusions may be reached. During the audit there may initially be differences of professional judgment, which are often based on incomplete information, and which are frequently resolved through the consultation process. Circumstances that may inhibit the consultation process could have serious implications for audit quality. We support the retention of relevant information concerning audit conclusions reached as well as disagreements with the client, or unresolved disagreements within the audit firm, as provided for in the auditing literature. However, obligations to retain audit documentation without limit will likely influence the manner in which individual auditors engage in the valuable give-and-take discussions inherent in a rigorous audit process. For example, communications leading up to the final conclusion might be conducted largely through conversation. Such a practice may lead to misunderstanding of the facts and thereby reduce audit quality. IV. Key Provisions of the Proposed Rule Are Overbroad and Ambiguous Section (a) Could Require the Retention of All Documents Section (a) of the proposed rule incorporates terminology that is inherently overbroad and dangerously ambiguous. For example, the phrase "financial data related to the audit or review" could be so broadly interpreted as to require the retention of virtually all documents received or generated by an auditor - a scope well beyond that currently contemplated by existing standards, and wholly unnecessary to the objectives of Section 802 of the Act. Absent some further definition or refinement of terminology such as "financial data related to," the auditor has little guidance as to what limitations may exist on the duty to retain documents. Currently, an auditor will receive or have access to innumerable documents that would be subject to inspection, but which would not conceivably be required to be preserved in the audit working papers. These documents may include materials of the issuer which are inspected by, but for which copies are never delivered to, the auditor. Examples of this documentation include such things as client invoices, electronic data files from the client, manual reports reviewed in the course of an audit, and superceded versions of a document. The auditor may make notations as to these documents, either by category or with some greater degree of detail allowing the identification of individual documents. Under the recently issued SAS 96, Audit Documentation, working papers must include an identification of items tested, including excerpts or copies of significant contracts and agreements, but does not require retention of copies of all items received from the issuer. Ambiguities and imprecision of language in the proposed rule could be interpreted as effectively requiring that auditors retain documentation necessary for a third party to re-perform the audit. Yet, it has never been required, nor can it reasonably be expected, that the documents retained by an auditor will reflect fully all of the procedures performed by and considerations of the auditor. The Panel On Audit Effectiveness, in its August 31, 2000 Report and Recommendations, rightly noted appropriate limitations on the scope of documentation to be retained by the auditor ("Panel Report"). In it recommendations with regard to "Working Papers and Documentation," the Panel specifically observed:
In response to the Panel Report's recommendations, the Auditing Standards Board ("ASB") undertook a project to amend the standard on audit documentation. In the course of this project, which culminated in the issuance of SAS 96, the ASB considered at length the concept of a re-performance standard, including ongoing discussions with senior SEC officials. In the context of its oversight responsibilities, the SEC did not object to the issuance of SAS 96. In drafting SAS 96, the ASB rejected a re-performance standard, in part because of concerns about its having a detrimental effect on audit effectiveness. In particular, a likely result would be to place greater importance on the collection and preservation of documents than on effective auditing. In addition, as discussed in the Panel Report referenced above, the ASB took the view that not everything that an auditor considers is in documentary form. To enable a third party to re-perform the audit, all information that the auditor considered would have to be documented sufficiently for someone not involved in the audit to understand. The ASB believed this was overreaching and not needed to perform an effective audit. The ASB further believed that a re-performance standard would unnecessarily promote challenges to the reliability of the issuer's financial information and the auditor's work where none should reasonably or legitimately be made. Congress also did not contemplate that auditors would be required to retain all documents when it passed the Act. First, the language of Section 802 requiring the Commission to promulgate rules relating to the retention of relevant records, uses the term "such as" and a list of examples of categories of documents. The phrase "such as" has generally been interpreted to mean "of a kind or character about to be indicated, suggested or exemplified; for instance," and its use in Section 802 indicates that the categories of documents listed in that section are merely "exemplary" of the documents that the Commission may regulate. Catalina Marketing Int'l v. Coolsavings.com, Inc., 289 F.3d 801, 811 (Fed. Cir. 2002). The Commission thus satisfies its legislative mandate by requiring the retention of applicable "relevant records," which may, but not necessarily include, for example, documents that "contain . . . financial data relating to such an audit or review." 18 U.S.C. § 1520(a)(2). Second, Section 802 requires the Commission to make only those rules as are "reasonably necessary" to ensure retention of relevant records. The legislative history further supports the proposition that Congress intended to limit the obligation of auditors to retain documents. The predecessor version of Section 802 that was referred to the Senate Judiciary Committee initially required the retention of a wide range of documents, without calling for Commission rulemaking. The original bill provided that auditors "shall maintain all documents (including electronic documents) sent, received, or created in connection with any audit, review, or other engagement for such issuer for a period of five years." S. 2010, 107th Cong. § 2 (2002). The Judiciary Committee amended the bill in order to "narrow the scope of the new audit records destruction crime created in Section 2." S. Rep. 107-146, at 21 (2002). The structure of the amendment demonstrates that the Judiciary Committee was certain that "audit and review workpapers" should be retained, but was concerned about the scope of other types of "relevant records" that should be retained. As Senator Hatch, the amendment's co-sponsor, explained:
Thus, the legislative history is clear that Congress intended for the Commission to require only those documents that are "reasonably necessary" to capture the final conclusions of an audit to be retained. A retention obligation, as potentially broad as that proposed by the Commission, could also have the effect of essentially requiring that the audit firm become a repository for the issuer's financial records. To the extent the Commission believes that financial information of the issuer relevant to its financial reporting or the audit should be retained, the obligation and cost to retain that information logically belongs to the issuer, and not the audit firm. The Requirement for Retention of Documents that "Cast Doubt" On The Auditor's Final Conclusions Is Overly Broad and Ambiguous The intent of the Commission by including in Section (c) of the proposed rule a requirement that auditors retain any documents that "cast doubt on the final conclusions reached by the auditor" is by no means clear. However, to the extent it purports to require the retention of documents other than those relating to disagreements, it is clearly overly broad and at the same time is unclear as to the scope of the documents that must be retained. We do not believe Congress or the Commission intended to impose a significant additional burden on auditors, which inevitably would require that they focus as much on document identification and preservation as on performing substantive audit work. Consequently, we believe that any notion of "casting doubt" should not extend beyond disagreements and differences of opinion. Furthermore, the requirement that documents be retained should not be triggered until the disagreement or difference of opinion has been identified. The literature currently addresses documentation requirements regarding disagreements. If the concept of casting doubt in the proposed rule is intended to extend beyond what is currently considered a disagreement, the rule must make clear in what respects it purports to do so. We believe the current requirements of U.S. Auditing Standards (AU) Section 311, Planning and Supervision, AU Section 380, Communication With Audit Committees, and Item 304 of Regulation S-K provide appropriate guidance for documentation of disagreements. For example, AU 380 provides, with respect to disagreements with management: Disagreements with management may occasionally arise over the application of accounting principles to the entity's specific transactions and events and the basis for management's judgments about accounting estimates. Disagreements may also arise regarding the scope of the audit, disclosures to be included in the entity's financial statements, and the wording of the auditor's report. The auditor should discuss with the audit committee any disagreements with management, whether or not satisfactorily resolved, about matters that individually or in the aggregate could be significant to the entity's financial statements or the auditor's report. For purposes of this section, disagreements do not include differences of opinion based on incomplete facts or preliminary information that are later resolved (footnote omitted.) [AU 380.13] In addition, AU 311 requires the following with respect to disagreements within the audit firm: The auditor with final responsibility for the audit and assistants should be aware of the procedures to be followed when differences of opinion concerning accounting and auditing issues exist among firm personnel involved in the audit. Such procedures should enable an assistant to document his disagreement with the conclusions reached if, after appropriate consultation, he believes it necessary to disassociate himself from the resolution of the matter. In this situation, the basis for the final resolution should also be documented. [AU 311.14] Item 304 of Regulation S-K sets out in detail standards for determining the existence of a "disagreement" between the auditor and issuer for purposes of disclosure in a Form 8-K relating to a change in auditor. If it is the intent of the Commission to require documentation of disagreements or differences of opinion beyond those currently described in the literature, the proposed rule must clearly define what disagreements they might be. We believe that the appropriate test should be "disagreements on issues that are material to the issuer's financial statements or to the auditor's final conclusions regarding any audit or review." Regardless of the intended scope of Section (c), the task of identifying which documents "cast doubt" and therefore must be retained is going to be particularly difficult, requiring that the auditor exercise true omniscience during the course of the audit. An auditor will review a wide array of material relating to any particular accounting or audit issue, and whether any portion of that material might cast doubt on a final conclusion obviously cannot be determined until the final conclusion is reached, which typically would be some time, and perhaps well after, the material is first reviewed. Only then would the auditor know whether the materials earlier reviewed would be subject to the rule's retention requirements, at which time at least some of those materials may no longer be available for retention. For example, auditors will often back up their electronic files as work progresses, and the disks containing the back-ups are recycled periodically, such that only the most recent back-ups would be available at any point in time for retention. Not knowing what the auditor's final conclusions will be, or whether there will be any disagreements or differences of opinion as to them, identification at any point in time of the documents for which retention would be required under Section (c) is wholly impracticable. This would be even more problematic as to documents that must be retained because they "cast doubt" for reasons other than that they relate to a disagreement or difference of opinion. A possible response, albeit one we believe is totally unacceptable, would be to have auditors retain every piece of audit documentation until final conclusions are reached, or risk severe criminal and civil penalties. Imagine the burden of having to search, following a post hoc identification of final conclusions, weeks or months of audit documentation (e.g., including tremendous numbers of computer disks containing periodic back-ups of electronic files) for documentation that "casts doubt." There is some indication that materials in addition to those relating to disagreements or differences of opinion would be called for by Section (c). Section (c) itself says that materials to be retained would, "for example," include documentation of differences of opinion. Similar language appears in the portion of the commentary of the release captioned "Differences of Opinion." At the same time, however, footnote 24 of the commentary strongly suggests that no such additional material be retained. Specifically, in discussing the retention of superceded drafts and auditor review notes, footnote 24 states that such documents "would not have to be retained" if they do not "reflect a difference of opinion." Thus, if such documents do not "cast doubt" because they relate to a difference of opinion, they do not have to be retained under Section (c). Although we concur with the limits implicitly stated in footnote 24, we believe that the Commission needs to be explicit in defining the limits of this section. Moreover, if the "cast doubt" language is limited to materials regarding disagreements and differences of opinion, the Commission still must clarify what constitutes a "disagreement" or "difference of opinion," and as to what "final conclusions" could give rise to a disagreement or difference of opinion. On a separate point, we believe the Commission should address in its final rule whether issuers should be required to retain all documentation related to disagreements within the issuer's accounting department(s). V. Existing Professional Standards Largely Reflect the Objectives of the Proposed Rules and Section 802 of the Act SAS 96 (AU 339.04) states "...audit documentation is the principal record of auditing procedures applied, evidence obtained, and conclusions reached by the auditor in the engagement." "The quantity, type, and content of audit documentation are matters of the auditor's professional judgment." As discussed above, additional guidance addresses more specifically the Commission's interest in preserving documents relating to differences of opinion. Both AU 380 and AU 311, contemplate documentation of "disagreements" or "differences of opinion" that may exist on significant accounting or auditing issues. The Commission's proposed rule clearly requires that such disagreements and differences of opinion should be documented in the working papers, and that is what the literature provides. We believe the documentation requirements articulated in SAS 96 reflects the objectives of Section 802 of the Act, requiring that the Commission "promulgate...such rules and regulations, as are reasonably necessary, relating to the retention of relevant records...." [emphases added]. SAS 96 requires that audit documentation be sufficient to "enable members of the engagement team with supervision and review responsibilities to understand the nature, timing, extent, and results of auditing procedures performed, and the evidence obtained; ... and show that the accounting records agree or reconcile with the financial statements or other information being reported on" [AU 339.06.] Neither SAS 96 nor Section 802 of the Act require that the auditor retain all documents that contain financial information relating to the audit or review; but only those relevant records "that form the basis of an audit or review." "The quantity, type, and content of audit documentation are matters of the auditor's professional judgment" [AU 339.01.] The current practice is to retain "...audit programs, analyses, memoranda, letters of confirmation and representation, abstracts or copies of entity documents, and schedules or commentaries prepared or obtained by the auditor" [AU 339.05], "...abstracts or copies of significant contracts or agreements that were examined to evaluate the accounting for significant transactions...documentation of tests of operating effectiveness of controls and substantive tests of details that involve inspection of documents or confirmation should include an identification of the items tested" [AU 339.08], "...audit findings or issues that in his or her judgment are significant, actions taken to address them...and the basis for the final conclusions reached..." [AU 339.09]. Appendix A of AU 339 provides a list of additional documentation requirements that are included in other professional standards. In sum, the Commission need not dramatically depart from the requirements already embodied in recently updated professional standards, which, in our view, are consistent with the objectives of Section 802. We believe that these standards protect investors, while at the same time adequately protecting auditors and issuers from overly burdensome requirements and risks of diminished audit quality associated with ambiguous documentation requirements that could be interpreted as a re-performance standard. VI. Economic Impact In the proposed rule, the Commission estimated the incremental burden on firms to be no more than one hour for each public company audit client. We recognize that the proposed rule does not require the creation of records; however, we do believe the proposed rule could significantly increase the amount of effort and work associated with the retention of records. First, the Commission's estimate of the labor needed to comply with the proposed rule is unrealistic. The time it would take to implement the proposed rule would greatly exceed "one hour" per client. Additionally, the ambiguous terms of the proposed rule will require audit firms to commit significant periods of time in substantively complying with the rule. For example, if the "cast doubt" provision were retained, it would take untold hours for audit firms to make any post hoc reviews of documents to determine whether they indeed "cast doubt" on the final conclusions of the audit. Additional documentation would be required to indicate on superceded documents why those documents have been superceded, why those documents do not support the final audit conclusion, or why financial data analyses have been changed or updated. Second, the Commission's cost estimate only considers the labor element and fails to appreciate the other costs attendant with complying with the proposed rule. The proposed rule states "Section 802 is intended to require the retention of more than what traditionally has been thought of as auditor's workpapers." A broad interpretation of the proposed rule would encompass retention of documentation that would go substantially beyond what would currently be retained. For example, auditors generally do not retain such things as in progress working papers, review notes, daily backups, transfer packages used to share audit documentation between team members, full versions of client reports, or superceded report drafts. The breadth of the proposed rule would increase the already voluminous number of documents retained by auditors. Audit firms will have to invest substantial sums in upgrading electronic storage. Audit firms will have to expend money and time to redesign their information technology infrastructures to accommodate the vast amounts of information that would need to be retained and accessed. For example, it is possible that programmatic changes would have to be made for expanded audit technologies and to increase storage capacity. Implementing the proposed rule would be costly to audit firms and these costs would be passed on to the issuers. We believe the economic analysis in the Release is unrealistic and that the Commission should acknowledge that the effort required is likely to be substantial. VII. Conclusion The ASB recently revised the standard for audit documentation after significant consideration of the views of the SEC and the Panel on Audit Effectiveness. Since SAS 96 is only now becoming effective (for audits of periods beginning on or after May 15, 2002), the Commission should refrain from intended or unintended expansions of document retention requirements until experience with the requirements of SAS 96 is available. We urge the Commission to revise the proposed rule to address the concerns we have identified. If you have any questions, please contact Robert J. Kueppers at (203)-761-3579.
cc: The Honorable Harvey L. Pitt, Chairman of the Securities and Exchange Commission
|