The SEC’s management guidance (Release 33-8810) and how to use it

• Explain the two principles behind the SEC’s 2007 interpretive guidance
• Vary the nature and extent of evidence by ICFR risk
• Determine when ongoing monitoring or daily interaction supports the assessment
• Document management’s evaluation so a third party can follow it

What the release is

Release No. 33-8810 (also 34-55929), Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, took effect June 27, 2007. It is interpretive guidance for management, not for auditors. A companion amendment made clear that an evaluation that complies with the guidance is one way to satisfy the evaluation requirements of Exchange Act Rules 13a-15(c) and 15d-15(c). Management may use another approach, but this is the approach the SEC described.

Two principles

The guidance is organized around two principles.

1. Evaluate whether controls adequately address financial reporting risks. Management identifies the risks that could result in a material misstatement and evaluates whether it has controls that address them. The guidance describes a top-down, risk-based approach and the role of entity-level controls. It does not require management to identify every control in a process or document every business process.
2. Base evidence on risk. The nature, timing and extent of evaluation procedures should be tailored to the risk characteristics of the financial reporting element and the related control, which the release calls ICFR risk. Management should focus its evaluation of operation on the areas with the highest ICFR risk.

Assessing misstatement risk and control failure risk

The release lists characteristics that raise misstatement risk for a financial reporting element, including the extent to which it involves judgment, is susceptible to fraud, has complex accounting, experiences change in the nature or volume of transactions, or is sensitive to environmental factors such as technology or economic developments.

For the likelihood that a control fails, management considers the type of control (manual or automated) and how often it operates, its complexity, the risk of management override, the judgment involved, the competence of the people who perform or monitor it, changes in those key personnel, the nature and materiality of the misstatements it addresses, and how far it relies on other controls. Entity-level controls, such as the strength of the control environment, also affect these judgments.

Evidence choices

The release allows evidence from ongoing monitoring and from direct testing, and management varies the mix by ICFR risk.

• When ICFR risk is low, management may conclude that evidence from ongoing monitoring is sufficient and no direct testing is required.
• In higher-risk areas, management performs more direct testing.
• Self-assessments are an efficient source of evidence in low-risk areas.
• Management’s evaluation ordinarily considers evidence from a reasonable period during the year, including fiscal year-end.

In smaller companies, management’s daily interaction with its controls may provide sufficient knowledge to evaluate their operation. Daily interaction means ongoing direct involvement with, and direct supervision of, the control by the people responsible for the assessment.

Documentation

Instruction 2 to Item 308 of Regulation S-K requires management to maintain evidential matter, including documentation, that provides reasonable support for its assessment. The release gives management flexibility in how it documents, and the documentation should allow a third party, such as the external auditor, to consider the work performed. Where management relies on daily interaction, it still documents the basis for its conclusion.

Evaluating deficiencies

The release defines material weakness by reference to Exchange Act Rule 12b-2 and Regulation S-X Rule 1-02. It lists situations management should evaluate as possible material weaknesses: fraud by senior management whether or not material, a restatement to correct a material misstatement, a current-period material misstatement that ICFR would not have detected, and ineffective audit committee oversight. It also uses the "prudent official" test: if a deficiency might prevent prudent officials from concluding they have reasonable assurance that transactions are recorded as necessary to prepare GAAP financial statements, management treats it as an indicator of a material weakness. Lesson 12 works through the evaluation.

Management and auditor approaches differ

The release says management and the auditor may use different testing approaches. The auditor follows AS 2201; management follows its own risk-based judgment. Coordinating the two saves work, but management is not required to test the way the auditor tests.

Risk-based evidence plan at Ashbury Software Holdings