Sarbanes Oxley: No Accounting for ‘Computer Errors’

By Bill Bittner, President, BWH Consulting

Section 404 of the Sarbanes Oxley legislation, which requires management to attest to adequacy of internal controls, will come under discussion in an SEC roundtable scheduled for April 13th.

The National Retail Federation has issued a letter expressing concern over the disparity in the requirements of auditors for compliance with Section 404 and the costs associated.

In a letter to the Chairman of the SEC William Donaldson, the NRF’s president and CEO Tracy Mullion wrote, “We support the principles of sound and transparent financial reporting and the underlying importance of effective internal controls. We have concerns, however, that confusion about and inconsistent application of the Act have undermined its objectives and effectiveness. We further question whether the initial intent of this Act–to restore investor confidence–has been balanced against the cost of its implementation.”

Price Waterhouse Coopers published an interesting newsletter on the subject that relates directly to the use of technology. Specifically, PWC sights the use of spreadsheets in the preparation of financial input or summarization. As employees become more sophisticated in their use of computer spreadsheets to capture and summarize details, they expose the firm to more chances of “computer errors” generating erroneous results.

PWC cites a May 24, 2004 Computer World article that states 20-40 percent of spreadsheets have errors, and an audit by the University of Hawaii that found 49 of 54 spreadsheets had errors. Examples of real world errors in financial reporting caused by “simple” spreadsheet blunders, such as cutting and pasting improperly, are also provided in the PWC article.

While much of the retail paperwork has been reduced through EDI and computer applications, there still exist many instances where individual data summaries are prepared for specialized functions. Much of this is done through the use of spreadsheets.

Moderator’s Comment: Are you concerned about the use of spreadsheets for preparing management or financial reports? Is the National Retail Federation
correct to be concerned that “confusion about and inconsistent application of the (Sarbanes Oxley) Act have undermined its objectives and effectiveness?”

PWC makes five suggestions for assuring the accuracy of spreadsheets. They suggest that companies should prepare an inventory of the spreadsheets in use,
evaluate their complexity, determine the necessary level of controls for “critical” spreadsheets, evaluate whether adequate controls are in use, and develop action plans for improving
controls. Another option, of course, is to ask whether another method (such as an application designed for the purpose) should be used in place of the spreadsheet.

The PWC recommendations are directed specifically to spreadsheets used for financial reporting, but many of the spreadsheets used in retail are for capturing
trends or aiding operational decisions. I believe all spreadsheets need to be reviewed periodically to assure their accuracy. –
Bill Bittner – Moderator

• Letter to U.S. Securities and Exchange Commission – National Retail Federation
  
• Final Rule: Management’s Reports on Internal Control Over Financial Reporting and Certification of
  Disclosure in Exchange Act Periodic Reports – U.S. Securities and Exchange Commission
• The Use of Spreadsheets: Considerations for Section 404 of
  the Sarbanes-Oxley Act – July 2004 – Price Waterhouse Coopers