SEGMENT 1:

Amanda Engstrom, Chief of Staff & Senior Vice President, Center for Capital Markets Competitiveness ,
U.S. Chamber of Commerce

- Before the end of June the Supreme Court is expected to issue a decision in the case of Free
  Enterprise Fund v. Public Company Accounting Oversight Board (“PCAOB”).
- Sarbanes-Oxley (“SOX”) created the PCAOB to regulate the audit profession. Under SOX, PCAOB
  members are appointed by the Securities and Exchange Commission (“SEC”).
- The plaintiffs in the lawsuit contend that the method of appointment for PCAOB members violates
  the appointments clause of the Constitution. It is the position of the plaintiffs that the Constitution
  requires the PCAOB members to be appointed by the President, subject to confirmation by the
  Senate.
- The Supreme Court has never issued a decision on the appointments clause and this is a case of
  first impression.
- At a minimum, if the PCAOB were to lose this case, the PCAOB would be considered to be
  improperly constituted and its standards and work placed in jeopardy. This will cause uncertainty
  within financial reporting policy possibly causing loses for both investors and businesses. Without
  oversight of auditing, the potential for unscrupulous practices may also increase.
- SOX lacks what is known as a severability clause. A severability clause is normally common in
  legislation. With a severability clause, a law which has a portion thereof declared unconstitutional,
  the offending section is jettisoned, but the rest of the law remains in effect. Without a severability
  clause, if one section of the law is declared unconstitutional, then the entire law may be
  unconstitutional.
- Therefore, at a maximum, if the PCAOB were to lose the case, the possibility exists that all of SOX
  will be declared unconstitutional. This will have ramifications throughout financial policy, internal
  controls, governance and executive compensation.

SEGMENT 2:

Sam Guzman, Senior Manager, National Audit & Assurance, Former Assistant Chief Auditor, Public Company Accounting Oversight Board (PCAOB),
Reznick Group, P.C.

- Company’s should talk with their auditor’s early in the process to maximize efficiency and minimize
  costs.
- Discuss with auditor’s what areas they can possibly “use the work of others” and ensure the
  auditors are comfortable that the person performing the work is competent and objective.
- Discuss sample sizes and possibly sampling methodology with auditor’s.
- Start testing as early as possible in order to allow time to remediate any deficiencies prior to year
  end.

SEGMENT 3:

William W. Levi, Director, Risk Solutions Practice,
RSM McGladrey, Inc.

- Re-engineering control frameworks: Greater reliance on “automated” and “entity” controls will
  provide efficiencies and reduce the cost of Section 404 compliance.
- Continuous Controls monitoring: Reduce the cost of Section 404 compliance while improving
  financial governance.
- Breakdown the Silos: Compliance management will reduce the cost and complexity of meeting the
  requirements of multiple regulations.
- How Smaller Public Companies can implement a efficient cost effective Section 404 compliance
  program.

SEGMENT 4:

Steven L. Siemborski, Partner, Regional Advisory Services Leader, National Solution Leader Governance Risk and Compliance,
Grant Thornton LLP

- Preventive Controls VS. Protective Controls
- Sox Efforts Into Grc And Erm And Erm Light
- Current Environment – Greater Reliance On Various Service Providers

SEGMENT 5:

Harold I. Zeidman, Partner, Department of Professional Practice - Audit and Risk Advisory,
KPMG LLP

- Improving IT environment and governance that allows a greater reliance on “system” controls thus
  reducing reliance on “manual” controls (which typically are more time-intensive to test and
  maintain)
- Improving the level of precision of monitoring-type control activities (such that they can prevent/detect
  a misstatement in the place of one or several transactional controls)
- Effectively calibrating ongoing and separate evaluations to maximize efficiency and effectiveness
- Reassess the control portfolio to ensure only key controls are selected for testing
- Reassess the control portfolio to ensure that testing isn’t too weighted towards lower risk financial
  statement accounts and assertions and that the type of testing is appropriately calibrated to the risk
  associated with the control
- Determine if monitoring-type controls at “sub-group” or headquarters level can reduce the collective
  amount of testing at lower risk locations in a multi-location environment
- Lack of an internal audit function doesn’t necessary preclude the external auditor from relying on the
  results of work performed by management, especially in lower-risk processes
- “Flatten out” the timeline for testing internal controls; perform testing at earlier interim periods and
  consider the level and extent of testing necessary to rollforward the conclusion to year-end
- Migrate legacy computing systems to common platforms in a multi-location environment to
  potentially reduce the extent of IT general controls testing
- Consolidate routine processes into shared-service type functions such that the testing of one
  control activity at the shared-service center could satisfy a control objective for multiple locations
- Standardize accounting and reporting policies in a multi-location environment in processes where
  standardization makes sense. This could help to create testing efficiencies for management and
  the external auditors (i.e., a common audit program for multiple locations)
- Hold planning meetings each year with external auditors; find out where bottlenecks and
  inefficiencies occur
- Work with external auditors to increase their use of the work of management and internal audit;
  think about minimizing the total cost of SOX 404 compliance, not just either internal (404a) or
  external auditor (404b) effort
- Exercise the same level of care when evaluating deficiencies as external auditors; evaluations
  should be carefully documented using an established framework; this documentation should not
  be outsourced to the external auditor. Maintaining contemporaneous documentation in a core
  repository of processes, key controls, and related deficiencies (and the evaluation thereof) may
  reduce auditor effort