1、 1 外文翻译 原文 Current Research Questions on Internal Control over Financial Reporting Under Sarbanes-Oxley Material Source: Lessons for Auditors Author: Jian Zhang and Kurt Pany The Sarbanes-Oxley Act (SOX) of 2002s requirements regarding internal control over financial reporting requirements for manag
2、ement and auditors have had a profound effect on both public companies and public accounting firms. While SOX has resulted in the public disclosure of numerous internal control deficiencies, the cost of compliance has also been widely questioned. Attempts to better understand the laws overall effect
3、 have resulted in copious amounts of research. What follows is a brief summary of certain recent research findings that relate directly to the audit of internal control over financial reporting. Only limited references to the studies discussed are provided below; the Sidebar provides a more detailed
4、 list of references. Certain topics that the authors subjectively feel to be of lesser interest (e.g., the relationship of internal control reporting to a lower cost of capital; changes in investors wealth and wealth redistribution; and material weakness disclosure related to the quality of accounti
5、ng accruals) were not included. Background In response to the high-profile business failures at Enron and WorldCom, in July 2002 Congress passed SOX. The laws aim was to reinforce investor confidence and protect investors by improving the accuracy and reliability of corporate disclosures. SOX introd
6、uced challenging internal control performance and reporting requirements under its section 302 and section 404. SOX section 302 requires the principal executive officer and the principal financial officer to certify and sign annual and quarterly reports submitted to the SEC, including certifying tha
7、t those officers are responsible for establishing and maintaining internal controls. SOX section 404 requires that annual reports filed by registrants include an assessment of the effectiveness of the companys internal controls and an auditors report on that assessment. Specifically, the auditors re
8、port under AS2 ordinarily included two opinions: one on managements assessment of 2 internal control, and one on the effectiveness of internal control. (In July 2007, the SEC approved AS5, which replaced AS2. The audit report under AS5 eliminates the separate opinion on managements assessment. The P
9、CAOB considered the opinion on managements assessment redundant with the opinion on internal control itself.) The discussion below focuses on material weaknesses and situations in which auditors have identified a material weakness and have issued an adverse opinion relating to internal control. This
10、 is the bulk of the research available on internal control reporting. Modified audit reports can also be issued because of an inadequate management assessment of internal control, restrictions on the scope of audits, referral to the report of other auditors, subsequent events, and the inclusion of a
11、dditional information in managements report on internal control. Ideally, reports on internal control not only result in improvements, they also provide financial statement users with an early warning about potential future problems that could result from weak controls, as well as the possibility th
12、at past financial results may have to be restated. Because capital markets operate on the principle that the vast majority of companies present reliable and complete financial data for making investment decisions, good internal control is considered an important factor in achieving good-quality fina
13、ncial reporting. Material weaknesses in internal control provide warnings about potential future financial statement problems. SOXs internal control requirements quickly became controversial, because companies complained about the costs involved and the perceived redundancy between the auditors and
14、managements tests of controls. While the SEC originally estimated average costs of the internal control provisions at less than $100,000, actual costs have been higher. Estimates have varied significantly. On the high end, Charles River Associates (now CRA International) found that it cost $7.8 mill
15、ion on average for a company to implement section 404. Investment News (May 16, 2007) estimated first-year total compliance costs at $4.51 million per company in 2004, a number that decreased to $2.9 million in 2006. Note that individual company estimates are ordinarily made by management, a group g
16、enerally predisposed against SOX (78% of 200 companies in the survey reported by Investment News said that section 404 compliance costs still outweigh any benefits). Continuing high compliance costs led the PCAOB to consider ways that would reduce the costs and procedures related to auditors interna
17、l control reporting. In May 2005, the PCAOB emphasized that auditors should apply a “top-down” 3 approach that relied upon the results of a risk assessment performed by the auditors. The risk-assessment results should identify controls to test by starting at the topcompany-level controls and the fin
18、ancial statementsand linking to significant accounts, relevant assertions, and, finally, to the significant underlying processes in which other important controls exist. Subsequently, both the SEC and the PCAOB issued standards aimed at controlling costs related to internal control reporting while a
19、ttempting to retain effective reporting. Research Questions: Magnitude of the Problem How many companies disclose material weaknesses in internal control? Glass Lewis 297 after the restatement; 111 both before and after restatement. The reported data are consistent with the “Special Comment” by Mood
20、ys Investors Service (“The Second Year of Section 404 Reporting on Internal Control,” May 2006), which concluded that material weakness reports are often lagging indicators of financial statement problems, undermining their usefulness to users of financial statements. Similar findings were reported
21、by Audit Analytics, which performed an analysis of nearly 3,000 filings and found that material year-end adjustments and restatements of financial statements served as predictors of a material weakness. Do identified material weaknesses increase the cost of audits and delay audit reports? The limite
22、d research available suggests that the answer in both cases is yes: when material weaknesses are identified, the cost of an audit increases, as does the 5 time to complete the audit. Companies with control deficiencies in personnel, inadequate segregation of duties, and problems with the closing pro
23、cess experience longer delays. Research Questions: Investor Impact Do investors care about material weaknesses in internal control? One might expect the answer of “some do and some dont,” and there is undoubtedly some validity to this position. Yet, researchers need a more objective way to address q
24、uestions about whether the disclosure of particular information (such as a material weakness) matters to investors. Researchers examine whether the information in question affects the market price of a companys stock. They calculate the difference between the actual return for a stock and the market
25、 as a whole around the date on which the information becomes publicly available, and determine whether there is an abnormal return for the security. In the case of a material weakness, that information may become available through a number of means, although most frequently it is through SEC forms 8
26、-K, 10-Q, or 10-K, depending in part upon the timing. One would expect a negative market reaction to such information, because it would generally represent an unexpected internal control deficiency. Recent studies generally conclude that, on average, the initial disclosure of a material weakness in
27、internal control results in a negative stock market reaction. Thus, by this measure, stockholders do care about material weaknesses and punish companies that have them. Does an adverse audit opinion result in a negative market reaction? This question is more difficult to address with the method used
28、 in the preceding question. Given that a material weakness is generally disclosed by management prior to the auditor issuing an adverse opinion on internal control, one would not expect the stock market to be “surprised” by such an adverse opinion. If the audit report is the first disclosure of the
29、material weakness, however, one would expect a market reaction. One study (Lopez, Vandervelde, and Wu, “An Auditors Internal Control Report, An Experiment Investigation of Relevance,” unpublished working paper, University of South Carolina, 2006) concluded that, at least for the participants in thei
30、r study, the auditors opinion on the effectiveness of internal controls is value-relevant. They conclude that the assessed stock price for companies receiving an adverse opinion on the effectiveness of internal controls is significantly less than for companies receiving an unqualified opinion. 6 Doe
31、s the stock market react to the details (characteristics) of material weakness disclosures? During his tenure as SEC Chief Accountant, Donald Nicolaisen stated that not all material weaknesses are likely to be viewed as equally significant. Consistent with this statement, Moodys Investor Service pub
32、lished a report in 2004 that proposed material weaknesses could be classified into “Category A,” which relates to controls over specific account balances or transaction-level processes, or “Category B,” which relates to company-level controls such as the control environment or the financial reportin
33、g process. Moodys believes that auditors can effectively “audit around” Category A material weaknesses by performing additional substantive procedures in the area where the material weaknesses exist. Thus, for companies with Category A material weakness, there is ordinarily no negative reaction, ass
34、uming management takes corrective action to address the material weakness in a timely manner. On the other hand, Category B material weaknesses may result in a negative reaction (e.g., a decrease in stock price or bond rating). This is mainly due to a belief that auditors may not be able to effectiv
35、ely audit around problems that have a pervasive effect on a companys financial reporting. Can investors distinguish between different types of material weakness, as Moodys suggests? Several studies have found that the Moodys distinction appears to be accepted by investors. For example, one study (J.
36、S. Hammersley, L.A. Myers, and C. Shakespeare, “Market Reactions to Internal Control Weakness Disclosures,” Review of Accounting Studies, forthcoming) examined the stock price reaction to managements disclosure of internal control weaknesses required under SOX section 302. The study found that some
37、characteristics of internal control weaknessestheir severity, managements conclusion regarding the effectiveness of controls, their auditability, and the specificity of disclosuresare informative. Of the 57 types of weaknesses identified, the following five were considered less auditable than others
38、: Internal control weaknesses that are red flags for fraud or that allow fraud to occur; Insufficient documentation to support transactions or adjusting entries; Inadequate lines of communication between management and accounting staff and auditors that prevent transactions from being recorded corre
39、ctly; Problems with financial statement closing procedures; Lack of key personnel (CFO or controller), and evidence that management overrode internal controls. 7 These items generally correspond to the categories proposed by Moodys. The study also found that the information content of internal contr
40、ol weakness disclosures (the size of the market reaction) depends upon the severity of internal control weakness. What the Current Research Indicates These available research on audits of internal control of financial reporting in the wake of SOX can be summarized with a few conclusions: Approximate
41、ly 11% of companies received adverse opinions on internal control in 2006, down from 16% in 2005. Companies that disclose material weakness are younger, smaller in size, growing rapidly, but less profitable. In addition, these companies have relatively more-complex capital structures. Stock options,
42、 lease accounting, nonroutine transactions, and the period-end closing process have frequently been the source of material weaknesses. Companies with material weaknesses frequently find the need to restate earnings. Disclosure of the material weakness often occurs subsequent to the restatement. The
43、existence of material weaknesses often results in more expensive and time-consuming audits. The stock price of companies with material weaknesses generally falls after the disclosure. Investors distinguish between an account-specific material weaknesses, which may be auditable, and a company-level m
44、aterial weakness, which may not. Investors react more negatively to company-level material weakness disclosures. 8 译文 萨班斯 -奥克斯利法 案下当前对财务报告内部控制的问题研究 资料来源 : 审计教训 作者： 章剑和 科特 .帕尼 萨班斯 -奥克斯利法案 （ SOX） 2002 年关于财务报告内部控制对管理层与审计师的要求 ，已经对上市公司和会计师事务所产生了深远的影响。尽管萨班斯法案导致众多企业公开披露内部控制缺陷，合规成本也受到广泛的质疑。为了更好的理解这个法案的总体影响，
45、展开了丰富大量的研究。 以下是对与财务报告内部控制的审计直接相关的最新研究成果的简要概括。仅限于对下面提供的参考文献进行讨论研究，补充工具条提供了更详细的参考文献 清单。某些笔者个人觉得较不感兴趣的主题未包括在内。（例如：内部控制报告与较低资本成本的联系；投资者的财富与财富再分配的变动；与会计应计项目的品质有关的实质性缺陷披露） 背景 针对安然、世通这种高知名度企业的倒闭事件，美国国会于 2002 年 7 月通过了萨班斯法案。该法案的目的是增强投资者的信心，并通过提高上市公司自愿性信息披露的准确性和可靠性以保护投资者的利益。萨班斯法案在其第 302、404 节中，分别提出了具有挑战性的内部控制
46、的执行情况和对财务报告的要求。 萨班斯法案第 302 节规定，公司的首席执行官和财务总监必须 对呈报给美国证券交易委员会（ SEC)的年度和季度报告予以保证，保证包括这些人员对建立和维持内部控制负责。法案第 404 节要求，注册人提交的年度报告要包括管理层对公司内部控制的有效性评价以及审计师对内部控制评价的鉴证报告。具体来说，该准则要求审计报告需要包括两个意见：一是管理层对内部控制的评价，二是对内部控制的有效性。（ 2007 年 7 月， SEC 通过了第五号审计准则，以替代第二号审计准则。第五号审计准则消除了关于评价管理层自身评估流程。PCAOB 考虑到了管理层对内部控制的评估意见本身是多余
47、的。 下面的讨论致力于实质 性缺陷和情况，审计人员已经确信存在重大缺陷可以出具否定意见的审计报告。这是关于内部控制报告的大量可行性研究。因为管理层对内部控制的评价不足，审计范围的限制，其他审计师的审计报告，期后事项，以及更多的管理层内部控制报告的信息而修改的审计报告也可以发布。 理想状况下，不仅会改善内部控制报告，还为财务报表使用者提示了预警-由于薄弱的控制，重申过去财务业绩的可能性引起的一个未来潜在的问题。由于资本市场按一定的原则进行运作，即大多数的企业要提供可靠完整的财务数据以做出投资决策，良好的内部控制被认为是实现高规格的财务 报告的重要因素。内部控制重大缺陷提供了财务报表未来潜在问题的
48、预警。 萨班斯法案中内部控制的要求很快就引起争议。企业都在抱怨占用成本以9 及审计师与管理者的控制测试的冗余。尽管 SEC 原先估计内部会计控制平均成本会低于 10 万美元，但是实际成本往往更高。估计已经发生很大显著的变化。在高端市场，查尔斯河联营公司（现加拿大税务局）发现一个公司实施第 404条款花费的成本平均为 780 万美元。投资新闻 2007 年 5 月 16 日估计第一年即2004 年每家公司总共的遵循成本为 4.51 亿美元，在 2006 年这个数字会减少到了 290 万美元。需 要注意的是，个体公司的估计通常由管理层作出，他们普遍倾向于反对萨班斯法案（ 200 家接受投资新闻调查
49、的公司中有 78%认为，实施第 404 条款的遵循成本仍大于他所带来的任何利益）。 居高不下的遵循成本使 PCAOB 考虑了一个能够降低审计师内部控制报告的成本及程序的方式。 2005 年 5 月， PCAOB 强调审计人员应采用“自上而下”的方法，依赖于审计师作出的风险评估结果。风险评估结果应该能够从顶级公司级控制和财务报表识别控制测试，并结合重要账户，相关认定，最终到了其他重要的显着存在的基本过程控制。随后， SEC 个 PCAOB 发行了有关内部控制报告的控制成本的准则，同时要保持有效的报告。 研究问题：问题的严重性 有多少家企业披露了内部控制重大缺陷？ Glass Lewis & Co.发现在 2006年， 1118 家美国公司和 90 家外国公司中，有十二分之一的公司美国上市证券公司披露了 1342 重大缺陷。此外， 97 家美国公司在 2006 年自发地披露重大缺陷，低于 2005 年的 116 家（见“ The Materially Weak”，黄牌趋势警报
