Words: 3317
corporate and business law BY etu20110952 GASPARD vjrgile LAFITTE Pierre AC504E External auditing Take home case Pacific Sunwear of California Inc Executive summary ????” 3 The Sarbanes Oxley act: a compliance plan 4 Overview: 4 Summary of the Sarbanes-Oxley 4 The Sarbanes-Oxley act: ????” 404: Checklist: 5 Auditing standards n05: description of the procedures to comply with the section 5 International standards of auditing in reference with the 6 Processes to comply with the Section case……………………………………………… How to comply with the 7 Procedures section 404? mplemented by Pacific Sunwear……………………………………………………………………….. 8 Evaluation of the effectiveness of the process implemented by 9 Impact of the information disclosed on the stock PacSun ????” 10 Costs and benefits of Sarbanes- Oxley ????” 13 Recommendations for 15 References…………………………. 16 Appendix A : Deadline for the compliance with the different sections of internal the act………….. ????” . 17 Appendix B: Certification required by the SEC about . 9 Appendix C: Certification required by 20 the SEC about disclosure controls Executive summary Pacific Sunwear of California entered in the stock market on Nasdaq in 1993. The Sarbanes Oxley act redacted in 2002, established new or enhanced standards for listing companies in the US markets and in particular the section 404 about the creation of an internal report each year, in response to a number of major corporate In this report, we will establish the impact of this United States federal law on PacSun by analyzing the process engendered, influence of the disclosures on the stock price, and the cost/benefits relation. The Sarbanes Oxley act: a compliance plan The Sarbanes-Oxley act enacted in 2002 is a United States federal law to respond to some major corporate and accounting scandals such as Enron, Tyco international or World com. These scandals cost billions of dollars to investors when stock prices collapsed and decreased the public confidence about nation’s securities markets and auditing standards.
So, this standard established new or improved standards and regulations, for all US public company and all foreign companies listed in the US stock markets. This act contains 11 sections and required the Securities and Exchange Commission (US regulator which regulates the securities industry and the stocks and options markets) to implement the rules and comply with the new law. The deadlines to implement SOX are exposed in Appendix 1 .
Summary of the Sarbanes-Oxley act: Then, we are going to describe quickly the different sections of the SOX act (except the section 4 explained below): 1 Public Company Accounting Oversight Board (PCAOB): the objective of this board is to register and regulate all public accounting firms to implement compliance standards 2 Auditor independence: creation of standards for external auditor ndependence to reduce conflicts of interest 3 Corporate responsibility: defines the relation between external auditors and corporate audit committees 5 Analyst conflicts of interest: evokes practice to create a new public confidence in the reporting 6 Commission resources and authority: highlights practice to create a new public confidence in the financial analysts 7 Studies and reports: SEC has to make various studies and explain their findings 8 Corporate and criminal fraud accountability: describes criminal penalties for fraud 9 White collar crime penalty enhancements 0 Corporate tax returns required to be signed by the Chief Executive Officer 1 1 Corporate fraud accountability: identified corporate fraud and records classified as criminal offenses The Sarbanes-Oxley 404: Checklist: The section 4 is about enhanced financial disclosures and increases requirements for financial reporting like off-balance sheet transactions. It requires internal controls to offer the accuracy of financial reports and disclosures. An internal control system is failures, or weaknesses in the system that must occur. The section 404 is the cornerstone of the section 4 and demands that each annual eport contain an internal control report.
This additional report assesses the responsibility of management for establishing and implementing adequate procedures for financial reporting. This report must include: assessment of effectiveness of internal control structure and procedures, any code of ethics and contents of that code. Consequently, this section is really decisive because it implies extra costs to comply with this requirement for registered public companies in the US stock markets. The Appendix 2 and 3 sum up the certifications required by the SEC. Auditing standards 05: description of the procedures to comply with the section 404 Issued the 24th may 2007, the Auditing standards n05 substitutes the Auditing standards n02.
The Public Company Accounting Oversight Board releases the AS n05 to describe the procedures to comply with the section 404: o Highlights a top-down risk based approach (financial risk assessment) o Places greater reliance on entity-level controls o Focuses on understanding and testing controls related to risks for significant accounts and disclosures o Allows for greater ability to rely on work of others o Changes definition of material weakness and significant deficiency: – Material weakness: “a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis. ” Significant deficiency: “A deficiency or combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important to merit the attention by those responsible for oversight of the company’s financial reporting. o Simplifies the auditor’s opinion by eliminating opinion on management’s ssessment of internal control 5 International standards of auditing in reference with the case The section 404 referred to some ISA standards: ISA 230 about audit documentation ISA 300 about planning an audit of financial statements ISA 330 about the auditor’s procedures in response to assessed risks ISA 500 about audit evidence ISA 600 about using the Work of Another Auditor 6 Processes to comply with the Section 404 After evoking the requirements of the section 404, we will describe the processes implemented by Pacific Sunwear first and by the other listed companies in general. Complying with Sarbanes-Oxley is complex; compliance requires a multiple approach involving many departments and many people which will be detailed below. How to comply with the Section 404?
Generally, according to Sanjay Anand an internal control in accordance with Sarbanes-Oxley is following an eight-step process: 1 Establish a compliance committee which is specialist of the compliance with Sarbanesoxley and can have a general overview of the company about the risk and the solutions. The objective of this committee is to commit the various departments, to provide training and to communication about the objectives. Assess risk in order to identify the magnitude and potential impact of each risk in order to create a risk portfolio. 3 Set reporting objectives by determining the probability of risks and errors to define decision rules and reporting objectives.
For ensuring internal control compliance, these areas need to be created: personnel control, system and resource controls, strategic planning controls and business service controls. 4 Prepare a formal implementation plan, which is a transition plan to move from project step to a day-to-day operation for an internal control system. Communicate the ongoing procedures by presenting clearly and effectively with the focusing on understanding, acceptance and observance. 6 Provide training implemented by the compliance committee in internal policies, practices and procedures. 7 Document processes and risk management certified by the Chief Executing Officer and the Chief Financial Officer so as to demonstrate the efficiency of the internal control system. Perform continuous evaluation performed by the manager in order to establish and maintain controls and to ensure the appropriate compliance. 7 Procedures implemented by Pacific Sunwear The most expensive costs of compliance were those linked with the section 404: costs about internal controls over financial reporting. The procedures of compliance are only described for the two first years in the case study: 2004 and 2005. Before the compliance, PacSun had not internal control system. They only created it in mid 2003 and they paid the services of a Big-4 auditing firms as required by the section 404. They expanded the internal control department at the end of 2004.
About the procedures they implemented in 2004, PacSun followed a process in five steps: 1) Scope and plan the evaluation 2) Document the controls nd correct deficiencies 5) Reports on internal control They identified also 21 major business processes assigned to an “owner” with the objective to develop detailed process narratives. These major business processes were divided into sub processes with the detail of the business objectives and the risks. At the end of 2004, they had identified a total of 238 key controls and they managed to highlight a significant deficiency about the revaluation of deferred leases which can affect by definition the reliability of external auditing data.
Then, all public officers had to certify in their area that the control was effective. The CEO and CFO certified then of the fairness and reliability of the financial statements. In 2005, the process became easier because all the information had already been created. They reduced the number of key controls to 222, only a 7% decrease, in comparison with larger companies (19% of decrease). They discovered a new significant deficiency because they didn’t recognize liabilities about the company’s loyalty program. 8 Evaluation of the effectiveness of the process implemented by PacSun Strengths: Enables to discover two significant deficiencies which misstate the financial statements
Enable to create an efficient internal control system, which reduces the risks and increases the efficiency of the global system Implementation of a double control : internal control and Big-4 auditing firms control Better assessment of risks implied Significant reduction of the costs after the first year of implementation of about 40%, comparable to the other companies Commitment of all the employees which can increase the motivation and the corporate culture Better disclosure of financial information for financial analysts and investors Weaknesses: Compliance costs of $2 million in 2004 and $1. million in 2005 Additional costs associated with the training of the staff with the necessary creation of a SOX program training The compliance is very time-consuming with an increase of the formalization Competitive disadvantage in comparison with the other competitors not listed Overall, PacSun had efficiently implemented the compliance and the weaknesses will tend to reduce over the long term.
However, PacSun management believed that the costs are greater than the benefits engendered. The costs implied and generally the time spent to respect the compliance rules, can Justify this opinion. Impact of the information disclosed on the stock prices In 2005, PacSun need to restate his prior two years’ financial statements, which resulted in no material change to net income. Auditors Judge restatement like deficiencies but they don’t agree about the type of deficiency: two of the Big-4 firms judge this particular type of restatement as only a significant deficiency, i. e. a control deficiency, or combination of control deficiencies, that adversely affects the company’s ability to be in accordance with GAAP.
The others two Judge it to be a material weakness, i. e. significant deficiency, or combination of significant deficiencies, that result in more than remote likelihood that a material misstatement of financial statements will not be prevented or detected. by the PacSun loyalty program called “Pac Bucks”. In fact, the liabilities and expenses of this program were not recognizing in the proper quarter. This accounting problem was considered by external auditors like a significant deficiency, but not a material weakness. Thus, in FY 2005, PacSun received clean financial statement and 404 opinions. What is the impact of Information Disclosure provided by these deficiencies n PacSun’s stock price?
In this graph, we can see that the PacSun’s stock price is very volatile between 2005 to 2007 (Beta higher than 1) when the NASDAQ is regularly up. This volatility can be explained by 10 the convergence of PacSun to SOX and the substantial increase of information provided on the firm. But it is very hard to have a real opinion of the impact of Information Disclosure on stock Market Returns with a unique firm. Thus we will answer with papers which study this impact on a large sample of US Company. “The Sarbanes-Oxley Act of 2002 is one of the , if not the, most important pieces of egislation affecting corporations traded on the US stock exchanges, since the Securities Act of 1932 and Securities Exchange Act of A934 were enacted” (Gordon et al. 2007).
The SOX act introduced significant changes to financial practice and corporate governance regulation, including new rules designed to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws. And the part of the Act having the most impact must be Section 404, which requires management to submit to the SEC with the company’s annually filed financial statements, an internal control report, an assessment of the ffectiveness of the internal control structure and procedures for financial reporting, and finally an audit report which include a description of material weakness in such internal controls and of any material noncompliance. Furthermore, where significant deficiencies exist, they need to be identified as required under SOX like we saw in the PacSun case.
Many studies demonstrate that the passage of mandatory government regulation like SOX may be altering the operation of capital market by affecting the stock performance of firms. In 2007, Balakrishnan et Al. , examine, by a dataset on stock arket abnormal returns and consists of 300 firms, how the stock market reaction varies for 8-K filling and how this reaction have changed since the passage of the SOX act. The result is that the SOX have the particularity to increase the information flow of a firm. Thus when a disclosure of a deficiency is promulgated, the information is quickly announced by media and have a direct negative impact on the stock market price.
Inversely, when a firm received clean financial statement and 404 opinions, we can think that stock price is positively impacted because it’s an evidence of a very ood internal control of the firm. Another interesting dimension to consider would be the size of the firm. “The effect of Sarbanes-Oxley on the firm’s information environment is expected to vary with the size of the firm” (Ghose et al. 2006). In fact, international firm, but in the US sportswear market, this size is important. In a stock market where diversification is one of the solutions to leverage the risk, PacSun can be a blue chip. Thus, a special attention is paid to it by media. 1 Finally, we can say that disclosure of these deficiencies have had a negative effect on irm’s stock price but, on the contrary, clean financial statement certification and Good 404 opinion have a positive impact on stock price. In addition, a firm can decide to increase the speed with which information reaches investors by publicizing it in media articles. It’s a good way to build a loyal firm’s brand image i. e. increase the investor recognition and limited the impact of bad news on the stock price. 12 Costs and benefits of Sarbanes-Oxley PacSun executives seem convinced that the costs of complying with SOX were greater than the benefits to the company.
Though, according to a survey entitled “Oversight Systems financials Executive Report” conducted with 222 corporate finance leaders, 74 percent said their company benefited from SOX, 79 percent reported “significantly stronger” or “somewhat stronger” internal controls as a result of SOX, 46 percent said SOX compliance benefits the company by ensuring accountability and 75 percent said they would vote to keep Section 404 if they were members of Congress. In fact, the benefits of SOX Compliance are multiple: There is a positive influence on maintaining investor confidence (and long-term share price) through increased ransparency and fewer surprises. Financial reporting is more timely and reliable. Overall control culture and corporate governance process are improved. Outdated, redundant and inflective processes and controls are eliminated. Employee on- boarding process is easier…
Then, why did PacSun not benefit from the compliance process to the same extent as some other companies? Or were their compliance costs too high? The main issue of PacSun is this medium size ($1 billon in market capitalization). The high cost of SOX implementation is financially draining many firms. The SOX doesn’t ake a distinction between large-cap billion-dollar companies and small-cap; $75- millon companies (the minimum cap to be obliged to apply SOX). Therefore, the Act requires all public companies to comply with the same regulations; it doesn’t take into consideration that small companies aren’t as complex in organizational structure as large companies.
Because large corporations have complex business models, more complicated accounting practices, they already have a lot of controls in place to ensure the efficiency of their operations that are required by SOX. In other hand, maller companies have simpler organizational structures and, thus, have slighter accounting practices, which generate simpler financial statements. These small firms require less internal controls. Therefore, since small companies have simpler subject to the same internal control and external auditing requirement of large companies. In the case of PacSun, this business model and accounting practice are closer from a small firm as shown this number of key controls (222 versus an average of 540 for the large companies). In addition, the SOX were created to fight against corporate scandals like Enron.
But the majority of these scandals have occurred in large corporations with thousand of shareholders by the intermediary of retirement/pension fund. PacSun doesn’t have the same type of shareholders and doesn’t require the same level of protection for the shareholder interests. Therefore, although shareholder interests should be protected, SOX regulations aren’t needed for smaller firms that have simple business structures and a small number of shareholders that are unlikely to fraud themselves (entrepreneurs who start the company, their families, and public shareholders without any link between them). Implanting SOX is a long and costly process for companies.
In the case of PacSun where his market is not occupied by large companies but especially by little firms (under the $75-million cap) which don’t apply SOX, this implantation creates for PacSun a competitive disadvantage and stumps their growth by requiring them to spend excessive amounts of money and time to implement regulation. As example of costs, we have the cost of training, the implementation of a strong internal control, an increase of the size of finance/accounting departments, the fees of the audit firms… ; he required amount of money is disproportionately larger in comparison with the largest firms. Thus in conclusion, we can say that SOX were designed in priority for large and complex companies. These costs are too high in relation with the engendered benefits for small caps. 4 Recommendations for PacSun Continue the work to reduce the number of key controls and try to improve a large part of them (better define it and really find an utility) Check the conformity between all marketing projects and internal control before a launching Optimize the balance between internal and external auditors to reduce the work of he external auditors Change your mind: SOX is an advantage to improve internal control Create a training and development program with an e learning module for example References Anand, S. (2006), “Sarbanes-Oxley guide for finance and information technology professionals”, John Wiley and Sons, 2nd edition Balakrishnan, K. , Ghose, A. and Ipeirotis, P. 2007), “the Impact of Information Disclosure on Stock Market Returns: The Sarbanes- Oxley Act and the Role of Media as an Information Intermediary’, University of Cambridge Bowling, D. Julien, R. and Rieger, L. (2003), “Implementation of Sarbanes-Oxley S 404: Ensuring Compliance, Leveraging Opportunities” Ghose, A. and RaJan. U. (2006) “The Economic Impact of Regulatory Information Disclosure on Information Security Investments, Competition, and Social Welfare” Proceedings of the Workshop on Economics of Information Security, University of Cambridge Gordon, L. , Loeb, M. , Lucyshyn, W. and Sohail, T. (2006), “The Impact of the Sarbanesoxley Act on the Corporate Disclosures of Information Security Activities. ” Journal of Accounting and Public Policy, 25(5) pp. 503-530. Grinberg, E. 2007), “The impact of Sarbanes Oxley Act 2002 on Small Firms”, Pace University Ramos, M. (2004), “How to comply with Sarbanes-Owley Section 404. Assessing the Effectiveness of Internal Control”, John Wiley and Sons, Inc. Available on: http:// books. google. fr/books? id=GAMR23qTQUC=process+to+comply+with+section +404=frontcover=bl= LaTJJAf1 e 1 16 Appendix A : Deadline for the compliance with the different sections of the actl professionals”, John Wiley and Sons, 2nd edition, page 63/64 17 18 Appendix B: Certification required by the SEC about internal controls2 professionals”, John Wiley and Sons, 2nd edition, page 68