The healing has begun. It's been six years since the passage of the Sarbanes-Oxley Act, and four years since companies faced their first Sarbox audits. After a painful start, compliance with the act has become more or less routine for many businesses and their external auditors.
But what about the CFO-auditor relationship? Once close and collegial, it turned acrimonious at the start of the post-Sarbox era, when auditors drew back from their clients in the name of objectivity. Has the passage of time produced a détente, or are relations between the two parties still tense? What effect have regulations passed in the wake of Sarbox had on the relationship — and, for that matter, on audits? We decided to find out, through interviews with and surveys of finance chiefs and auditors. (The CFO's perspective is presented here; for the auditors' side of the relationship, see the companion story, "Auditor Angst.")
Let's start with some reasonably good news. In March, CFO magazine conducted a survey of 205 senior financial executives on the state of external audits (see the link to "What CFOs Have to Say about Auditors" at the end of this article). Forty-two percent of those executives said they were very satisfied with their audit firms, while 44 percent said they were somewhat satisfied. Anecdotally, CFOs who have seen both audits and auditor relationships improve in recent years attribute much of the change to greater familiarity with Sarbox.
"People have had a chance to digest Sarbanes-Oxley — to get used to it and work with it for a while," says Barbara Klein, CFO at CDW, a provider of technology products and devices that was recently acquired by a private-equity firm. Finance chiefs say their departments are documenting controls and accounting decisions more carefully and preparing more thoroughly for their audits; 27 percent have added internal-audit employees in the past two years, according to CFO's survey.
Auditors have come up to speed, too, say finance chiefs. "I wouldn't go so far as to say that auditors have loosened up, but they've developed a more standardized approach to working with [Sarbox]," says Chris Johns, CFO of PG&E Corp., the holding company of the California utility giant. "They've become more efficient."
At Johnson Controls, for example, auditors have developed a method for deciding when to refer issues to the national office. "There's more of a system now," says Bruce McDonald, CFO of the $34 billion diversified industrial company. "They set some parameters for people to exercise their local judgment." By contrast, in the early years of Sarbox, it was "frustrating" when auditors started passing questions on to the national office, says McDonald. "It extended the time frame on a lot of decisions."
Stingy with Advice
Still, many auditors continue to be reluctant to provide advice — and many CFOs continue to chafe at that reluctance. Forty-two percent of survey respondents who were dissatisfied with their auditors say they don't provide enough guidance on accounting issues.
At a recent gathering of finance executives from around the country, grumbling about reticent auditors was universal. One CFO complained that she was paying more for her audit but getting much less for her money, because her auditors no longer provided accounting advice, which she considered the most valuable component of audits past.
"They'll give you information, but they won't give you a recommendation," sums up Peter Kruse, CFO of Nissan Forklift. (Ironically, information delivery is among the key complaints that auditors levy against clients; see "Auditor Angst.")
PG&E is one of many companies that have engaged a third-party consulting firm to help address complicated accounting questions. "By the time we go to our auditors with an accounting issue, we've pretty much got it wrapped up," says Johns. "In the past there was a lot more willingness on the part of our auditors to engage and talk about the accounting. Now they'll listen, but it's by no means similar to the conversations we had before [Sarbox]."
Seventy percent of CFOs say they meet with their auditors ahead of time to determine the areas up for review, a critical exercise in which CFOs point out the greatest risks and share the work internal audit has already done. But these conversations are more guarded than they once were.
"The auditors leave a little bit in their back pocket," says Tom Ackerman, CFO at Charles River Laboratories, a provider of research models and laboratory services to biotech and pharmaceutical firms. "In earlier days they would lay out everything they were going to look at, but these days they don't share their entire audit program with you. There's a little bit left unsaid."
Although practically everyone complains about the dearth of auditor advice, that ranks as the number-three gripe of finance chiefs. What's number one? Fees.
Audits in the post-Sarbox era are too expensive, according to nearly half of those who say they are dissatisfied. Fees were widely expected to fall after the first year of Sarbox implementation, but in fact they have continued to climb at most companies. Eighty-two percent of finance executives surveyed reported an increase in fees from 2007 to 2008, although the majority of those say the increase was slight — from 1 to 10 percent. Only 6 percent of companies saw fees fall. Seventy-three percent expect fees to rise again next year.
Given the increased scope and complexity of audits, rising costs seem inevitable, says CDW's Klein. "With the passage of Sarbanes-Oxley, there was more work, and if there's more work there's going to be more cost," she says. "The fees have come down from the early years, but they're never going to be at the levels they were pre-Sarbox."
CFOs bemoan the complexity of new accounting regulations and say they expect complicated rules to drive audit costs even higher in the years to come. "If you look at something like derivatives accounting, you have companies like Fannie Mae and the major banks, which have an awful lot of smart people who go through the issues with their auditors, and they can't seem to get it right," says McDonald of Johnson Controls. "The complexity of these standards is worrying, and documenting and implementing them tend to drive up costs."
At the top of the list of future audit-cost drivers are fair-value issues, say CFOs: 37 percent of survey respondents said fair-value accounting standards like FAS 157 and FAS 159 would be most likely to raise the price of their company's audit in the next year. A short supply of audit staff and a possible new format for financial statements also ranked as areas that will increase costs.
The Effect of AS5
One measure that many hoped would reduce costs significantly was Auditing Standard No. 5, issued in July 2007 by the Public Company Accounting Oversight Board (PCAOB). AS5 instructs accounting firms to take a more selective, risk-based approach to audits. But although the standard has helped matters (along with a similar Securities and Exchange Commission interpretation), it has hardly been revolutionary.
"AS5 hasn't resulted in the change a lot of us expected," says PG&E's Johns. In fact, a majority of finance chiefs surveyed by CFO — 64 percent — say they have seen no audit changes at all as a result of the new standard.
Still, a third of CFOs report that auditors have narrowed their scope at least somewhat thanks to AS5. That's confirmed by Robert Kueppers, deputy CEO at Deloitte, who says AS5 has reduced Deloitte's time on engagements and enabled the firm "to hold the line on audit costs."
At Johnson Controls, McDonald has been one of the lucky few to see a significant impact: "The adoption of AS5 and the risk-based approach resulted in probably about a 20 percent reduction for us in the cost of compliance with Section 404 [which mandates documentation and testing of internal controls]. The auditors have been able to step back and look at something like our petty-cash controls and say, 'That's not going to lead to a significant financial-reporting problem.'"
Ackerman of Charles River says he was skeptical about whether auditors would really take AS5 to heart and scale back the scope of their audits. "It seemed like they might have a hard time moving away from entrenched practices," he says. But Charles River has benefited from the new standard: its audit fees came down more than 15 percent in 2007 from 2006. "Once AS5 was written down, it gave audit firms something to lean on," says Ackerman. Auditors used to include 90 percent of the company's global locations for either complete or limited testing, but last year fewer locations were scrutinized. "The approach was more risk-based, taking into consideration the work we do at each of the different locations," says Ackerman.
Jonathan Mason, CFO of specialty chemical maker Cabot Corp., views AS5 as "a step in the right direction." He says the company's auditors are making a greater effort to identify significant controls and examine those areas thoroughly. External auditors are also relying more on the internal auditors' efforts, he adds. "The auditors are not going to write an opinion based on internal audit's work, but they can get comfort on some of the less critical areas," says Mason. This marks a significant shift from the early Sarbox days, when external auditors couldn't consider internal audit's work, because of a mandate that external auditors conduct testing on all material items. Ackerman also notes that there is now a greater reliance on testing done by the internal-audit staff than in the past, and says this has been a major factor in reducing Charles River's audit costs.
With time and experience, auditors have gained a better understanding of the PCAOB's expectations. "What you saw initially was a disconnect," says Mike Burke, a former KPMG partner who is now CFO at Aecom Technology, a provider of technical- and management-support services. "The auditors focused on the minutiae and companies focused on the biggest risk areas. Now we have a greater alignment between the way auditors and companies look at the business."
The Way Ahead
Clearly, both companies and auditors have come a long way since the early days of Sarbox implementation, when no one knew quite what regulators expected or what was required for a "passing" grade on Section 404. "There was a lot of running around, chasing our tails, and learning from month to month," recalls McDonald. Adds CDW's Klein, "Both companies and auditors probably did more work than was required because we didn't know exactly what was required."
The lessons learned by auditors and finance staffers as they institutionalize the many changes mandated by Sarbox have proved as important as the additional guidance from regulators in improving the process. While the CFO-auditor relationship may not be as warm as before, it's still evolving. One good sign: finance executives don't seem quite as angry as they were a few years ago.
Of course, there will continue to be struggles over fees and the amount of advice or information auditors are willing to share, as well as how long it takes to get that information. But many CFOs see things moving in the right direction. "We are moving much closer to a collaborative relationship," says Mason. "Collaboration does not mean that the company doesn't have the primary responsibility for making the accounting decisions and judgments. It just means that the auditor can add value."
Kate O'Sullivan is a senior writer at CFO.
To see what CFOs in our survey had to say about auditors, click here.