The Plane Fell Out Of The Sky The

"The Plane Fell Out Of The Sky: The Doctrine of res ipsa loquitor Applied to SOX 404" By Roberta A. Barra, Ph. D.

Based on an on-going research project n With Martin Taylor n And n Richard Mark n At University of Texas at Arlington

SOX 404 n Mgmt responsible for establishing adequate I/C structure—following SEC guidelines n Year-end reporting of I/C assessment Effectiveness of I/C structure and procedures n Only over financial reporting n n Auditor’s responsible for following AS-5 (PCAOB standard)

So What’s The Problem? n SOX is a law n Eventually courts are involved n Implies lawyers n Lawyers don’t view the world in the same way we do n Possible conflict between SEC guidelines and PCAOB Auditing Standards

Key Differences n Reasonable Assurance n Cost/Benefit n Effectiveness n Inherent Limitation n Research

Reasonable Assurance n Lawyers: it’s a relative term to the particular standard —has not yet been established for SOX n Accountants—”concept that no matter how well designed, I/C cannot guarantee that objectives will be met n Accountants—PCAOB & SEC use “reasonable” in their standards; neither are necessarily going to fit what any particular firm/CPA thinks n Problem—the courts are not necessarily going to use our standard or our definition

Cost/Benefit n Lawyers - If there is a material weakness the system is not effective without the control regardless of cost; cost a factor, not a controlling factor. Accuracy & adequacy are the key factors n Accountants - Integral part of reasonableness. But measurement is seldom done in practice n Problem—the courts are not necessarily going to be sympathetic to a cost/benefit defense

Effectiveness n Lawyers—Lack of valuable research n Accountants—research not necessary, theory is enough n Accountants—state or condition that can be measured; Board and management have reasonable assurance that objectives are met n Problem—May become a free for all in court, one expert versus another expert without substantive research to back any expert’s claims

Inherent Limitation § Lawyers—res ipsa loquitor? A fraud happened, someone is to blame § Not SOX (fraud is intentional action), State or Fed negligence standard that might come up in SOX case § Accountants—Consistently recognizes no control system is perfect § Problem—Courts may buy inherent limitation but if not, then anyone might be found negligent: management, internal auditors, external auditors

Possible defenses § Accountants—If negligence is found, proportional liability will afford protection § Accountants—following GAAS will afford protection § Problem: Proportional liability is available only in some states, not all; Federal law similarly fractured, may not apply in Federal law to SOX at all § Problem—Courts will not automatically agree that a GAAS audit is sufficient; they have been critical before (Continental Vending), Supreme Court has stated on number of occasions that GAAP, GAAS are not necessarily same standards courts have to follow

Possible Defenses § Management—have good internal controls n Problem—what is good internal controls? n Management—good corporate governance (index) n Problem—no down side; in fact there recent evidence to suggest good internal controls starts with good control environment

Research n Lawyers: calling for empirical research to support “effective” internal controls n Romano of Yale Law School has concluded in her criticisms of SOX that executive certification of financial statements are unsupported by the empirical academic literature. [Romano, 2005]

Research - Lawyers n “…a broader and more recent examination of the extant empirical academic literature actually supports several of the provisions that Romano and others critique… We concede that Congress does not seem to have perused in any great detail the Journal of Finance and perhaps allowed its subscription to the Accounting Review to lapse. ” [Prentice and Spence, 2007]

Research - Accountants n We don’t need research n Theory will suffice n Academics citing Practitioners

Problem n Theory isn’t sufficient in a court of law n The expert witness with empirical research to support their claims will be more credible n The firm who has implemented controls supported with empirical research will be more credible n Theory used to say the world was flat and the sun revolved around the earth n Empirical testing of those theories proved otherwise

Some Published Research n Hollinger and Clark, 1983 (Inventory Controls) n Beck, 1986 (SOD) n Heins, 2006 (Passwords) n Howard, 2006 (Passwords) n Barra and Griggs, 2007 (SOD)

Working Papers n Novoselov, 2007 (Collusion/SOD) n Barra, 2007 (Penalties) n Barra & De. Pillis 2007 (Collusion)

Potential Liability other than SOX n “Legally, it is clear that even after pro- defendant judicial and legislative reforms to securities law in the mid-1990 s, auditors continue to face potential risks of liability for a host of potential causes of action at both the state and federal level. The aggregation of these risks could - at least under the right theoretical conditions - create a risk portfolio that might be ‘cataclysmic’ in nature “

Potential Liability other than SOX

Potential Liability other than SOX

Potential Liability n Tort: res ipsa loquitor? n The accountant’s view of effectiveness: “no news is good news” n With fraud: implies controls NOT effective unless one buys into inherent limitation n And circumvention of controls n

Conclusion n SOX makes internal control the province of the courts n It is too late to keep attorneys out of internal controls n More important then ever that accountants know and understand how attorneys think n Law courses more important then ever for an accountant’s education

Conclusion n Legal land mine for auditors and management n External auditors should work more closely with management; less dictatorial in their approach n More practical research by academics n And quickly!

Questions to Consider n Should Auditors be JDs? n Or should a JD be part of the audit team? n Should we require more law courses as part of the accounting curriculum? n If so, which courses should be required? n What research needs to be the top priority for accounting academics? n How can be best protect both management and accountants (internal and external? )

Questions to consider n How can we get both internal and external accountants working together on establishing objective internal controls? n Other questions? ? ?

Thank you!