amper

1. Non-Accelerated SOXEfficient Implementation

2. 3

3. SOX PrimerSelected History A Continuum of Financial Reporting Regulation & Guidance 1934 - The Securities Exchange Act Requires issuers to file 10 K�s & 10 Q�s Requires adequate books & records and internal controls 1977 � Foreign Corrupt Practices Act Requires internal accounting controls for financial reporting 1987 � The Treadway Commission Recommended steps to reduce fraudulent financial reporting 1991- The Federal Deposit Insurance Corporation Improvement Act (�FDICIA�) Recommended management�s assessments and assurances over a bank�s internal controls. 4

4. SOX PrimerSelected History A Continuum of Financial Reporting Regulation & Guidance (continued) 1992 � The COSO Report Recommended framework to identify risks and design internal controls Framework embraced by SEC and PCAOB 2002 � Sarbanes Oxley Act Extension of the Securities Exchange Act of �34 Requires an opinion from management and the external public accounting firm over controls for financial reporting 2003 to 2008 � SEC Extends Multiple Deadlines 2009 � New Political Climate Makes Further Extensions Unlikely New SEC Appointee, Mary Schapiro � It�s time that we bring uniformity to the system� 4

5. SOX PrimerWho Must Comply All SEC Registrants: S-1 filers must comply with SOX Accelerated filers: Market cap > $75 million Year ends after November 15, 2004 Non-accelerated filers: Market cap < $75 million Year ends after December 15, 2009 5

6. SOX PrimerMain 404 Elements Formalized, Annual, Two-Step Process: Section 404(a) � Management�s Assessment of Internal Controls: Document and test internal controls Assert that controls are adequate (or not) for the preparation of reliable financial statements Section 404(b) � Requires an External Audit of Internal Control: Independently review management�s basis for Assertion Independently test controls Attest that management�s system of controls is adequate (or not) for the generation of reliable financial statements 6

7. SECTION 404 SOX PrimerOther Elements 7

8. SOX PrimerAuditing Standard No. 5 July 25, 2007 - SEC approved PCAOB�s AS #5 Replaced Auditing Standard No. 2 Provides interpretive guidance for external auditors Goal = improving the efficiency and effectiveness of their SOX 404 efforts Key Features: Less prescriptive than AS #2 Provides audit scalability � matching size & complexity of client Requires a risk-based approach to focus to eliminate unnecessary procedures Provides principles-based approach for reliance upon work of others 8

9. SOX PrimerClassifications of Deficiencies Under AS-5: Significant Deficiency: �A significant deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of a registrant�s financial reporting� Material Weakness: �A material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company�s annual or interim financial statements will not be prevented or detected on a timely basis� 9

10. SOX PrimerPCAOB Guidance - Small Public Companies January 2009 - PCAOB published guidance for Auditors of Small Public Companies External auditor & management collaboration required: Highlight Tone at the Top Use a Top Down Approach to identify key controls Concentrate on Areas of Risk Evaluate and understand the risk of management override Understand the significance of having informal documentation Address Segregation of Duty (SOD) issues Understand Information Technology Controls Prepare for a financial reporting skills evaluation 9

11. NON-ACCELERATED CONSIDERATIONS 10

12. Non-Accelerated ConsiderationsInternal Control Defined Policies & procedures to ensure the achievement of an objective: Documentation Performing reconciliations Security Organizational design 12

13. Non-Accelerated Considerations Common Control Deficiencies 13

14. Non-Accelerated Considerations Inherent Challenges Internal Control � Inherent Challenges: Lack of accounting resources for effective segregation of duties IT staff with dual responsibilities � production & development Ability of senior executives to override controls Ability to recruit & retain sophisticated GAAP and IT talent 12

15. PRACTICAL APPROACH 14

16. Practical ApproachLessons From Accelerated Filers What went right Top-down approach � risk-driven scoping Started project early Honest evaluation of problems Held key individuals accountable What went wrong Late start Limited collaboration with external auditors Underestimated amount of work required Attempted to self-test Did not effectively involve business process owners Did not take into account Information Technology Staff project with people who had �day jobs� 16

17. Practical ApproachOptimizing AS5

18. Practical ApproachOptimized AS5 � Key Controls

19. Practical Approach Phased Predictable Process

20. Practical ApproachSuccess Factors Don�t Delay Educate yourself - Rules & Guidance Create sustainable, top-down, risk-based approach Build �Entity-level� controls Limit reliance upon �Process-level� controls Learn from Lessons past Objective Assessment of Financial Statement Risk Constant collaboration with External Auditor Timely remediation of Control Deficiencies Balance internal resources with external experts 18

21. Practical ApproachControl Deficiencies SOX = perfection not mandated �Living with� certain deficiencies = Management / Board choice: Material Weakness - 10-K disclosure required Disclose reasoning for accepting material weakness Shareholders, prospective investors, lenders � ultimate judges Significant Deficiencies � no disclosure required 12

22. Practical ApproachCost & Scope Factors Cost for Management Assertion & Auditor Attestation impacted by: Nature & complexity of operations and financial reporting Extent of documentation supporting ICFR and Management testing Nature, timing and adequacy of management testing For single-location, non-accelerated entities: Typical cost = $30,000 to $75,000 for first year Requires 300 to 750 hours of client effort Unknown is remediation of control deficiencies 15

23. WRAP-UP 19

24. Wrap UpContinuous ICFR Process Internal Control for Financial Reporting (�ICFR�): Focus on continuous process: �Once a year� event insufficient likely creating inefficiencies Ongoing Monitoring: Control deficiency remediation Process changes requiring documentation updates Efficiency opportunities Rolling Risk Assessment: Continuously update risk assessment, for old & new risks Establish a Control Culture: Embracing control culture Reduces surprises & fire drills 20

25. Wrap UpThe Amper Advantage Amper�s �SOX-in-a-Box� Service: Fixed Price Range � typically $25,000 to $60,000 Scope of effort determined within first week Transparent scheduling and assignment of duties: Amper duties Client duties Industry-specific templates easily adapted to your company Experience rivaling any other provider: No one beats us in practical non-accelerated experience Over100 dedicated SEC compliance specialists near you 23

26. Contacts Pete Bible Leader, Public Company Practice 732-287-1000 bible@amper.com Andy Barfuss Leader, Business & Risk Advisory Services 732-287-1000 barfuss@amper.com 24