| EXECUTIVE SUMMARY | |
 Since the advent of the Sarbanes-Oxley Act, companies no longer can rely on their external auditor as an internal control. They must report most errors the auditor finds as material misstatements and material weaknesses unless they can prove their own controls would have found the error. James Brady Vorhies, CPA, CIA, CISA, is manager of financial controls compliance for a Fortune 500 company in Dallas. His e-mail address is bvorhies@juno.com . |
efore the Sarbanes-Oxley Act, when an audit partner walked into the controller’s office and said, “We found a material error during our review of the company’s Form 10-Q or 10-K report,” the controller was, of course, appalled an error had occurred. But he or she also generally was relieved the auditor had found it in time for the company to record an adjusting entry so the financial statements were fairly stated. The auditor’s diligence meant that the controller wouldn’t have to issue a restatement and the auditor wouldn’t have to report the error as an uncorrected/unrecorded misstatement.
But section 404 of Sarbanes-Oxley changed the world drastically. Now, if the audit partner finds a material error, the controller likely will immediately need to review the company’s internal control over financial reporting and identify a mitigating control. Furthermore, if the external auditor finds a material misstatement while reviewing the quarterly or annual SEC reports that the company can’t prove it would have found on its own—and has an appropriate mitigating control—then the error is a material misstatement and a material weakness.
This article will help CPAs responsible for completing balance sheet account reconciliations better understand the new importance of this process following the introduction of section 404. It also will explain what changes companies may need to make in the timing and quality of reconciliations to fulfill this new role.
In a survey of 200 finance and accounting executives,
Respondents confirmed that timely, accurate account reconciliations have become a critical internal control practice in the wake of Sarbanes-Oxley.
Respondents pointed to a lack of management focus, insufficient understanding of the process, a dearth of written policies and procedures and lack of training as challenges affecting their ability to sustain a timely and accurate account reconciliation process.
Most participants said they use Microsoft tools such as Excel or Access to perform reconciliations but also are considering more customized technology-based solutions.
Source: Fall 2005 Roundtable on Balance Sheet Integrity, Jefferson Wells, www.jeffersonwells.com .
WEAK CONTROLS?
Balance sheet account reconciliations are one of the oldest and most important accounting processes. Yet, in many companies they’re underappreciated as an internal control over financial reporting. Before Sarbanes-Oxley many companies relegated this control to a corrective role; since the control operates after the financial reports are issued, it is effective only in identifying misstatements for correction. With increasingly tight SEC filing deadlines and section 404 requirements, many companies haven’t recognized the importance of accelerating balance sheet account reconciliations in order to make them detective controls and to complete them in time to identify and correct errors before the company files SEC reports.
PCAOB Auditing Standard no. 2, An Audit of Internal Control Over Financial Reporting in Conjunction with An Audit of Financial Statements, says when the auditor identifies a material misstatement in the current-period financial statements that was not initially identified by the company’s internal control over financial reporting, it is a strong indicator of a material weakness—even if management subsequently corrects the misstatement. The company must identify these errors itself or, if the auditor finds them first, be able to prove it would have found them.
As the controller begins to walk through the company’s internal control over financial reporting, he or she will review each control to see whether they would have found the error and thus have been the required mitigating control. The controller might review
Checklists of journals to be recorded.
Analytical reviews of the balance sheet, income statement and cash flow statement.
Reviews of the notes to the financial statement as included in the Form 10-Q or Form 10-K.
After the controller examines all of the above controls and determines none would have found the error, there is yet one more control that might have done the job—balance sheet account reconciliation. But unfortunately the company isn’t scheduled to complete this process until the week after the SEC report is filed.
If the controller completes his or her mental review of the company’s internal controls and is unable to identify a mitigating control for the error and therefore has a material misstatement that will, even if it is recorded, leave a material weakness in its wake, the need to accelerate the account reconciliations becomes clear. Regardless of the cost and effort involved in the reconciliation process, no other internal control is as capable of identifying misstatements in balance sheet accounts.
It also becomes apparent why since Sarbanes-Oxley the auditor no longer is one of the company’s internal controls. As companies search for a substitute for this important role, many are realizing they can avoid a material weakness in their internal control over financial reporting by completing the account reconciliations before the SEC filing.
THE ROAD TO RECONCILIATION
Companies need to reconcile all accounts that could contain a significant or material misstatement and post all necessary adjustments to the general ledger in a timely manner. Necessary adjustments include all identified general ledger entries that—either individually or in the aggregate—are significant or material to the financial statements, with the most necessary adjustments being those that would result in a material misstatement if they were not recorded. The company also should analyze all nonreconciled accounts and nonposted identified adjustments to the general ledger to determine their effect and the potential for financial misstatement or significant deficiency or material weakness.
Only companies that have reconciled all accounts and understand the potential misstatements that may exist in nonreconciled accounts can be comfortable that their auditor will not identify significant and material financial misstatements during the auditor’s review of the SEC filings.
It’s difficult for today’s accounting departments to reconcile all accounts on a monthly basis given the shortened SEC filing deadlines and other factors. Companies generally will need to begin this effort by determining the risk and magnitude of misstatement inherent in each balance sheet account. I recommend a risk rating —reviewing all balance sheet accounts and rating them on quantitative and qualitative criteria such as
Quantitative risk factors.
Volume of transactions.
Dollar value of transactions.
Normal account dollar balance.
Qualitative risk factors.
Complexity of transactions.
Volatility, complexity and subjectivity of accounting rules.
Fraud susceptibility of transactions.
Level of automation vs. manual intervention.
Regulatory oversight.
Quality of internal control over transactions.
Of course, the volume, size and complexity of transactions as well as the normal dollar balance of the account are factors that contribute to the risk of financial misstatement. The last factor listed above includes any quantitative or qualitative factors CPAs should include in the determination, including the quality of internal control over financial reporting for the account.
Regardless of the risk-rating process a company decides to use, for the purposes of this discussion we will use
High , for accounts where there is a reasonable potential for the account to be misstated by a material amount.
Medium , for accounts where there is a reasonable potential for the account to be misstated by a significant amount up to a material amount.
Low , for accounts where there is no reasonable potential for the account to be misstated by a significant or material amount.
All high- and medium-risk accounts should be reconciled and all necessary general ledger reconciling adjustments recorded before the company’s post-closing adjustment review process. For low-risk accounts, CPAs should perform an analytical review of the account balance to ensure it is within reasonable limits that would provide adequate evidence upon which to base a conclusion that the account does contain a significant or material misstatement. If such a conclusion is not reasonable based on the results of the review, then the account should be timely reconciled before the company’s post-closing adjustment review process.
During its post-closing adjustment review process, the company should accumulate and review any significant nonposted reconciling items identified from the reconciliations and other uncorrected/unrecorded accounting entries identified during other review processes to determine whether the books should be reopened and any or all of these entries posted. CPAs must apply appropriate materiality to analyze these items both individually and in the aggregate and to determine the effect of such items on a quarterly and year-to-date basis. Any uncorrected/unrecorded adjustments the auditor found in the current period also should be included. The company also must include prior-period errors that were corrected in the current period, because correcting these items in the current period creates errors in this period.
In this proposed model, any of the items listed above that are left out of the company’s post-closing adjustment process generally will result in a control deficiency, since they must be identified and included in the normal post-closing adjustment process. Provided the company finds these items and appropriately includes them in its SEC reports, late determination should not result in a material weakness. However, the longer it takes to identify them, the more difficult and inefficient it becomes to reopen the accounting ledgers and record the transactions or to adjust the SEC registrant’s financial statements. Moreover, a company would not want to find such items after it has released its earnings.
For many companies it will be a major effort to accomplish reconciliations in this shortened time frame. However, a company needs to be able to timely prevent or detect significant and material misstatements in its balance sheet accounts. Even though the external auditor no longer is a company control, he or she still is able to identify these misstatements if the company does not.
| Practical Tips |
 Because the external auditor is no longer an internal control, try to complete account reconciliations before SEC filings to avoid a possible material weakness. |
Companies that perform their balance sheet account reconciliations too late for them to count as preventative controls should
Ensure all of the company’s balance sheet accounts are reconciled currently. You don’t want to find that some of these accounts have not been reconciled and have undetermined errors.
Risk-rate all accounts.
Ensure all high- and medium-risk accounts are reconciled in time to incorporate all identified general ledger adjustments into the earnings release.
Ensure a timely analytical review of the account balances of all low-risk accounts to ensure they provide adequate evidence upon which to base a conclusion that the accounts contain a significant or material misstatement. If such a conclusion is not reasonable based on a review, the account should be timely reconciled so the company can incorporate identified general ledger adjustments into its earnings release.
Develop an appropriate post-closing adjustment process if one is not currently in place.
Adopt a continuous improvement process for balance sheet account reconciliations that will eventually enable the company to accomplish the above steps before its post-closing adjustment review process.
A NEW TOOL
As controllers and company management begin to better understand the role balance sheet account reconciliations can play in detecting and preventing financial statement misstatements, significant deficiencies and material weaknesses, they will see the need to improve both the timing and overall quality of these reconciliations. If they are able to make these improvements, they then can use reconciliations to compensate for the failure of primary controls as well as to detect and prevent deficiencies and material weaknesses. 
