Indian SOX Act – did we achieve the desired outcome?

The Companies Act, 2013 (“Act”) took a major step in raising the bar on corporate governance in India with the introduction of Internal Financial Controls (“IFC”). The Act has imposed specific responsibilities on the Board, Audit committee, Management as well as Auditors.

It requires the Board to state that they have laid down internal financial controls to be followed by the company and that such controls are adequate and were operating effectively.

Auditors are required to separately issue an opinion on whether the company has an adequate IFC system in place and about the operating effectiveness of such controls. The requirement is in addition to the audit opinion on the financial statements.

This reporting requirement for auditors came into effect from the year ended March 31, 2016. The ICAI has issued a guidance note on audit of internal financial controls over financial reporting which provides a comprehensive guidance on IFC.

Internal financial controls gained importance after the Sarbanes-Oxley Act (SOX) of 2002 added this requirement for most public companies in the US following accounting scandals at Enron, Tyco International and WorldCom in the early 2000.

In India, internal financial controls assumed importance after the Satyam scandal in 2009.

The ICAI guidance note explains that for auditor reporting, the term ‘IFC’ is restricted within the context of the financial statements and relates to internal control over financial reporting only (ICFR).

This is also consistent with the practice adopted for SOX reporting in the US. The guidance note has similarities with PCAOB Auditing Standard No. 5, which is applied by auditors in the context of SOX reporting.

For example, guidance contained in US auditing standard is very similar to what has been included in the guidance note, including definitions such as significant deficiency and material weakness related to internal controls. As per the guidance note, auditors shall issue a qualified or an adverse opinion on ICFR if ‘material weaknesses’ in the company’s ICFR are identified as part of their audit. The guidance note specifies indicators of material weaknesses in ICFR.

Though the requirements are similar to international practice there seems to be difference in reporting results by the companies/director’s report and auditors in the first year of IFC reporting as compared to reporting done under SOX in the first year of adoption.

On a review of Director’s Report and Auditor’s Report of a large number of Fortune 500 Companies, it was noted that there were very few negative observations with respect to the ICFR adoption and compliance.  Essentially the large companies and their auditors have confirmed that the internal controls are designed appropriately and operating effectively. Similarly, most of the smaller companies have also confirmed compliance with the legislation.

As compared to this in US, when reporting under SOX was made mandatory, wherein the systems and processes are generally believed to be advanced and the implementation of the framework was applicable only to large listed companies, the result was quite different.

Per the survey conducted by SEC, 23.1% of the Public Companies who were first time compliers reported material weaknesses. As per another survey conducted the total number of material weakness reported were high in the year of implementation which gradually declined. During 2005 and 2006, companies disclosed more than 6,000 material weaknesses in their financial reporting controls.

Some weaknesses were pervasive throughout the companies’ systems of internal controls. Other weaknesses were isolated to one financial procedure or accounting area. About 165 companies received adverse internal-control audit opinions two years in a row, 55 companies received adverse opinions after receiving clean opinions in year one.

It is a bit surprising to see largely clean reporting for Indian Companies considering the material weaknesses reported for SOX which has similar reporting requirements.

Further, considering that legislation meant a highest degree of establishment of internal control framework which takes significant time and cost to implement, clean reporting on IFC in the first year was not expected.

Though no survey or compilation is available at present in India to substantiate the facts and the types of weaknesses, the number of companies who have reported compliance is significant.

We presume such compliances are not considered theoretical and mere documentation exercise rather management has laid down internal financial controls which are adequate and operating effectively.

Most of the Companies who had to implement ICFR have appointed expert professionals and have come up with an appropriate document as suitable to the Company.

Are the Audit Committees and the Boards accepting the matrices drawn by the consultants as is or are asking the relevant questions and are taking informed decision?  Also statutory auditors should not consider this as a checklist exercise.

There is onus on the statutory auditor to evaluate the remediation measures implemented by the management of the company in case of deficiencies identified.

In reality, such remedial actions by the management in many cases are carried out towards end of the year and in some cases even after the year end.

In the US, post implementation of SOX Act, the regulators had carried out reviews of files in which they had raised concerns on the reporting of some of the Companies where the reports did not contain any material weaknesses. In India, we need to see whether peer review carried out by ICAI could highlight such concerns.

Ultimately, most companies have complied with the Act by adhering to the documentation standards required for the implementation of ICFR. However, It is yet to be seen whether the additional reporting as required under the statute has provided the ultimate users with the desired outcome and whether it is successful in boosting the investor confidence.