Overview

1. Overview • Understanding Occupational Fraud and Material Misstatement • The Current Environment • The Regulators Response • Sarbanes Oxley Section 404 • Moving Forward

2. Understanding Occupational Fraud and Material Misstatement

3. Defining the Terms • Occupational Fraud – The use of ones occupation for personal enrichment through the deliberate misuse or misapplication of the employing organizations resources or assets. • Asset Misappropriations • Cash • Theft of inventory • Corruption • Accepting Kickbacks • Engaging in Conflict of interest • Fraudulent Statements • Financial • Non-Financial Source: “2002 Report to the Nation”; ACFE

4. Defining the Terms • Material Misstatement – The omission or distortion of accounting information that makes it probable that the judgment of a reasonable person relying on the information would have been changed or influenced by the omission or distortion. • Can occur with intent or without • Can be monetary or non-monetary (notes to financial statements)

5. Perspectives on Fraud • 6% of annual revenue • Costs $600 billion annually • $4,500 for every employee • 37% of companies worldwide suffered during previous two years Source: “2002 Report to the Nation”; ACFE

6. Perspectives on Fraud • The average fraud goes undetected for 18 months • The median loss for schemes involving falsification of an organizations financial statements is $4.25 million • Management accounts for more than 40% of cases Source: “2002 Report to the Nation”; ACFE

7. So…whatever happened to……..? • Worldcom (improper profits, loans, overstated cash flows) • Rite Aid (inflated earnings, improper use of company funds, conspiracy, obstruction) • Enron (hid losses in off balance sheet entities, controls failed) • Tyco (unauthorized pay, deception regarding company financial condition) • Many others!!!

8. So, Why all the Fraud? • Changes in Culture • Downsizing • Diminished loyalty • Bottom-line pressures • Executive incentives skyrocketing • Technology • Globalization

9. The Regulators Response

10. SAS 99 • Professional skepticism • Brainstorming • How can fraud occur? • Inquiries • Fraud risk • Fraud occurrence • Corroborative evidence • Management override of I/C • Revenue recognition • Unpredictable audit test

11. A Proactive Approach • Passage of Sarbanes-Oxley in 2002 • President Bush states the act as, “...the most far reaching reforms of American business practices since the times of Roosevelt.” • Formation of PCAOB • Chairman and members appointed by SEC • Increased SEC Enforcement • Enforcement actions initiated increased 25% over last five years • Complaints and questions rose 71% over last five years (48,169 to 82,337) • Increased Enforcement staff

12. What Does all this Mean? • All of these initiatives put more pressure on company stakeholders to focus on the prevention and detection of fraud and material misstatement BUT HOW??? • One way...strengthen and monitor the internal control environment • That is the mandate of Sarbanes-Oxley Section 404

13. Sarbanes-Oxley Section 404

14. Understanding the Requirements • Management • Independent Auditors

15. Management Assertion (Not SEC Approved) Management of W Company, Inc. (the Company) is responsible for establishing and maintaining adequate internal control over financial reporting. This internal control contains monitoring mechanisms, and actions are taken to correct deficiencies identified. Management assessed the Company’s internal control over financial reporting as of December 31, 200X. Based on this assessment, management believes that, as of December 31, 200X, the Company maintained effective internal control over financial reporting, including maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the Company, and policies and procedures that provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with accounting principles generally accepted in the United States of America and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company, based on the criteria for effective internal control over financial reporting established in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. SAMPLE

16. Auditor Attestation (Not SEC Approved) We have examined management’s assertion included in the accompanying [title of management’s report] that W Company, Inc. maintained effective internal control over financial reporting as of December 31, 200X, including maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the Company, and policies and procedures that provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with accounting principles generally accepted in the United States of America and that receipts and expenditures of the Company are being made only in accordance with authorizations of management and directors of the Company, based on the criteria for effective internal control over financial reporting established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. W Company’s management is responsible for maintaining effective internal control over financial reporting. Our responsibility is to express an opinion on management’s assertion based on our examination. In our opinion, management’s assertion that W Company, Inc. maintained effective internal control over financial reporting as of December 31, 200X, is fairly stated, in all material respects, based on criteria established in Internal Control-Integrated Framework, of the Committee of Sponsoring Organizations of the Treadway Commission. SAMPLE

17. Timing of 404 Implementation

18. Considerations for Management Management’s Responsibilities • Assess effectiveness of controls over financial reporting • Provide auditor with assertions • Submit control report with annual report

19. Considerations for Management Develop an Internal Control Self Assessment Methodology • Identify Objectives • Develop Project Plan • Develop the Self-Assessment Model • Populate the Model for Evaluation

20. Considerations for Audit Committees Section 404 reinforces the Sarbanes-Oxley Act’s requirement for the audit committee to oversee the company’s internal control over financial reporting Key Actions • Understand Increased Independent Auditor involvement • Monitor progress • Hold management accountable • Self-assess

21. Considerations for Independent Auditor Key Elements of an Internal Control Audit • Audit and render an opinion on management’s assessment of internal controls over financial reporting • Communicate significant deficiencies and material weaknesses • Evaluate management’s report for appropriateness

22. Sounds Involved...What’s in it for me? Strong Internal Control • Reduce potential for fraud • Gain (or regain) investor trust • Comply with laws and regulations • Gain visibility into operating inefficiencies • Minimize whistleblower actions • Set the “tone at the top” The Business Case for a Strong Internal Control Program Weak Internal Control • Increased exposure to fraud • Misstated financial statements • Unfavorable publicity • Negative impact on shareholder value • SEC sanctions • Lawsuits or other legal actions

23. Moving Forward

24. Outlook for the Future • Accept that the environment has profoundly changed • Promote understanding of internal control within the organization • Factor into your business model the cost of developing an internal control program • Monitor developments and refinements in the Regulators standards • Understand the limits of internal control