To Our Clients and Friends:

On March 9, 2004, the Public Company Accounting Oversight Board (PCAOB) announced that it adopted a professional standard for the attestation that independent auditors must provide on management's report on internal control over financial reporting. This report is commonly referred to as the "section 404 internal control report" because it is required by Section 404 of the Sarbanes-Oxley Act of 2002.

Effectiveness of the standard, known as "Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting Performed in Conjunction With an Audit of Financial Statements," remains subject to approval by the SEC.

The PCAOB's release and the standard itself can be found at:
http://www.pcaobus.org/rules/Release-20040308-1.pdf

Preliminary observations:

• The PCAOB notes that the idea that an attestation involves less work than an audit is "erroneous." The standard requires an auditor to "audit" the company's internal control over financial reporting. The auditor's attestation on management's report is the result of the audit process.
• The release notes concerns expressed by public companies that, from a cost perspective, auditors should not be required to excessively duplicate the work of the internal auditors. These concerns stemmed in part from language in the proposed standard, to the effect that the auditor's own work must provide the "principal evidence" for the audit opinion. The standard as adopted does not retreat from this concept. However, auditors will have "considerable flexibility in using the work of others" and will be permitted to use their judgment as to how much work must be duplicated.
• The standard requires auditors to assess certain aspects of the effectiveness of the audit committee, which is of course the body that directly supervises the auditors. If oversight by the audit committee is deemed ineffective, the auditor must report this, in writing, to the company's board of directors.
• The auditor must provide two opinions: one on management's assessment of internal control over financial reporting, and a second on the effectiveness of the company's internal control over financial reporting.
• As is the case with management's report, the existence of any material weakness will prohibit the auditor from finding that the company's internal control over financial reporting is effective. If there is a material weakness, a qualified opinion (such as, "effective, except for . . .") is not permitted. In this case, the auditor is required to express an adverse opinion, such as, "internal control over financial reporting was not effective."
• As for the requirement that management state the framework used in its report, the release calls "Internal Control - Integrated Framework" published by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission a suitable framework for U.S. companies.
  
  

King & Spalding LLP