Executive Summary Imagine a world in disarray. Imagine many people suffering devastating losses from large investments in the securities market, once perceived as providing generous future returns. There have been several events in our nation’s history that have impacted the lives of many Americans. Recent scandals and related corporate failures have triggered new laws and increased regulation in order to restore confidence in the securities market and to provide reliable and accurate information for investors. The Sarbanes Oxley Act of 2002 was a large stepping stone in that movement and has impacted many public companies. SOX requires public companies registered with the Securities Exchange Commission to evaluate the effectiveness of its internal control over financial reporting and disclose this information in its financial statements. For instance, Dell Inc., a large multinational IT corporation, was one of the many large corporations affected by the implications of SOX. First, Section 404 of SOX requires Dell’s management, under the supervision of the CEO and CFO, to establish and maintain adequate internal control in accordance with the rules defined in the Securities Exchange Act. In addition to establishing the controls, they are also required to evaluate the effectiveness of the controls against the criteria established in the Internal Control-Integrated Framework issued by COSO. Second, Section 409 of SOX requires management to disclose material changes in internal control, and the results or potential effects of those changes. Finally, Section 404 of SOX requires Dell’s auditing firm to evaluate management’s assessment of Dell’s internal control and to issue an opinion on the quality and accuracy of the assessment. All in all, SOX raised corporate responsibility to assess and improve internal control over financial reporting. It also increased the responsibility of accounting firms by expanding audits beyond financial reporting to also assessing the controls over financial reporting. The Sarbanes-Oxley Act, endorsed by U.S. Senator Paul Sarbanes and U.S. Representative Michael Oxley, was enacted on July 30, 2002 as a reaction to several major corporate failures and accounting scandals including Enron, Tyco International, Adelphia, and WorldCom. The act contains 11 sections ranging from corporate responsibility to criminal penalties, and also covers topics such as auditor independence, corporate governance, assessment of internal control, and enhanced financial disclosure. From the beginning, SOX has largely impacted many corporations and auditing firms. One such company is Dell Inc. Dell Inc. is a multinational IT corporation that specializes in manufacturing, selling, and supporting computers and related products and services. Dell’s Annual Report filed on March 8, 2005 was the first year SOX was required to be implemented for most public companies. When comparing this report to Annual Reports prior to the SOX implementation, it is easy to see the increased responsibility for Dell and the firm auditing their financial statements. This becomes evident in the auditor’s opinion letters, the management’s letter on internal control, the auditor’s letter on internal control, in addition to several other disclosures in their Annual Report. Item 9A—Controls and Procedures of the Dell’s Annual Report includes the following sections: Evaluation of Disclosure Controls and Procedures, Management’s Report on Internal Control Over Financial Reporting, and Changes in Internal Control Over Financial Reporting.
According to SOX Section 404, “Issuers are required to publish information in their annual reports concerning the scope and adequacy of the internal control structure and procedures for financial reporting. This statement shall also assess the effectiveness of such internal controls and procedures.” Dell’s management, under the supervision of the CEO and CFO, are therefore responsible for establishing and maintaining adequate internal control over financial reporting in accordance with rules defined in the Securities Exchange Act. Management also evaluates the effectiveness of Dell’s internal control against the criteria established in the Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). COSO is a voluntary private organization dedicated to providing guidance to executive management and government entities on critical aspects of governance, ethics, internal control, risk management, fraud, and financial reporting. Many organizations use a common internal control model developed by COSO in assessing their control systems, which auditors will then review to certify and ensure the effectiveness of that assessment. In addition, SOX Section 409 states that, “Issuers are required to disclose to the public, on an urgent basis, information on material changes in their financial condition or operations.” For this reason, management also has to evaluate whether a change in Dell’s internal control occurred during the period, and based on that evaluation, if a change in internal control has “materially affected, or is reasonably likely to materially affect, Dell’s internal control over financial reporting” (59). Prior to SOX, management was not legally required to conduct these evaluations and public companies did not disclose their effectiveness over internal control. However, the passing of SOX not only required most public companies to perform and disclose these assessments, but also for auditors of accounting firms to ensure the quality and accuracy of those assessments. Section 404 of SOX states, “the registered accounting firm shall attest to and report on the assessment on the effectiveness of the internal control structure and procedures for financial reporting.” As a result, Dell’s post-SOX report contains an additional section in the auditor’s opinion letters, evaluating the management assessment over internal control included in Item 9A, Management’s Report on Internal Control Over Financial Reporting. The audit firm’s responsibility in the audit of Dell’s internal control included “obtaining an understanding of internal control over financial reporting, evaluating management’s assessment, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we consider necessary in the circumstances.” (34). This new responsibility of the auditing firm is to evaluate management’s assessment against criteria established in the Internal Control-Integrated Framework issued by COSO. Before SOX, independent accountants were required to certify only the presentation of the financial statements, and additional disclosure on the company's controls and procedures were not included in the notes to the financial statements. Similar to the auditor’s opinion on the presentation of consolidated financial statements and financial statement schedule, the opinion expressed on management’s assessment over internal controls must be in accordance with the standards set by the Public Company Accounting Oversight Board (PCAOB). According to the Report of Independent Registered Public Accounting Firm, from the Annual Report, Dell’s internal control over financial reporting includes those policies and procedures that:
(i) Pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company;
(ii) Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and
(iii) Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.
These guidelines largely impact how Dell’s daily accounting work is carried out. Prior to SOX, the general accounting behind these policies and procedures was most likely considered standard and routine for most companies. Yet, high level executives and management of many large corporations took advantage of loopholes in the system for personal gains, costing investors billions of dollars and diminishing public confidence in the nation’s securities markets. The rationale behind SOX was to restore this public confidence and to strengthen corporate accounting controls over financial reporting. Despite the costs and complex regulations induced by SOX, its benefits to the investment world have far outweighed its shortcomings. By enforcing the three statements above, it becomes more difficult for Dell’s executives, as well the executives of other public companies, to manipulate the numbers to achieve personal gains at the expense of its shareholders. In addition to protecting shareholders, the three statements also ensure that companies, such as Dell, provide factual and accurate information in their financial statements, allowing the public to make wiser investment decisions. Section 302 lists the requirements for financial reporting under SOX. If Dell either avoids or violates these requirements, it could face the potential consequences stated in Section 802 of SOX which “imposes penalties of fines and/or up to 20 years imprisonment for altering, destroying, mutilating, concealing, falsifying records, documents or tangible objects with the intent to obstruct, impede or influence a legal investigation.” If that was not enough, the auditor of Dell’s financial reports could also face potential consequences. Section 802 of SOX also “imposes penalties of fines and/or imprisonment up to 10 years on any accountant who knowingly and willfully violates the requirements of maintenance of all audit or review papers for a period of 5 years.” Since its inception in 2002, the Sarbanes-Oxley Act has largely impacted accounting firms and financial reporting for public companies. Despite its opposition, it has supported the movement to a world with greater reliability and accuracy in financial reporting.