banner blog v2

Register Below to Receive Updates & Useful Information

Follow Us

Browse by Tag

Current Articles | RSS Feed RSS Feed

Vibato's May Announcements

  
  
  
  
describe the image

It's an exciting month here at Vibato! Check out new website, CPE events, and informational resources!

Should Internal Audit Report to the Audit Committee Directly?

  
  
  
  

Over ten years after Sarbanes-Oxley (SOX) was passed, a new survey from The Institute of Internal Auditors’ Audit Executive Center reflects the legislation is doing its job. The report, “2013: Time to Seize New Opportunity,” found that 75 percent of Fortune 500 companies who participated show their Chief Audit Executives report to the CEO or CFO, as well as the Board of Directors and or Audit Committee.  The first year of SOX in 2002, only 20 percent of CAE’s were reporting to their CEO’s.

Accounting Tip of the Day! Secure Network Solution

  
  
  
  

Accounting Tip of the Day!

External Network Access Tip:

At times, external users may need to access your secure network (think onsite auditors who may need to use a printer or the like). This presents a Sarbanes-Oxley COBIT compliance problem as well as introducing your network to the potential hazards of a virus or a computer without a firewall. Since it can be very difficult to keep track of internal vs. external devices on your network on a day-to-day basis, we at Vibato and AccountingTemplates.com have come up with a nice solution to help mitigate the risk while providing a solution for companies with limited staff to help manage this problem. 


1) Utilize a log that tracks each time an external user is granted access
2) Require the external user to sign an agreement confirming that they have current anti-virus definitions running on their device as well as an active firewall
3) Require the external user to confirm that they will abide by their contract (which usually stipulates clauses around confidentiality), conduct requirements, usage policies, etc. 

We will have an “External Network Access Package” available for download on 4/1/2013 with the launch of accountingtemplates.com so check back with us soon or send us your contact information and we will notify you when it is published!










Vlog on how to deal with your SSAE 16

  
  
  
  

Check out CIO and Co-Founder of Vibato, Teresa Bockwoldt, explain the importance of your SSAE 16 and how to safely analyze it. The checklist she refers to in the video can be found on AccountingTemplates.com HERE

What the JOBS Act Means for SOX Compliance

  
  
  
  
describe the imageThe jobs act created a new category of issuer, called an "Emerging Growth" (ECG) company, in the interest of stimulating equity investment in companies by modifying the regulations surrounding registration, capital-raising activities, and compliance requirements. To qualify for this category, a company must have produced less than 1 billion of revenue in it's prior fiscal year (and must not have sold common equity in a registered offering prior to December 8, 2011). A qualifying company would lose ECG status when one of the following occurs:
  • Five years elapse from the IPO date
  • Company produces more than 1 billion in gross revenue
  • Company issues more than 1 billion in non-convertible debt within a 3-year period
  • Company reaches accelerated-filer status (>$700MM public market float)
As an ECG, a company would be exempt from an external audit of their internal controls over financial reporting (SOX 404(b)) as long as they maintain ECG status. This would be a maximum of 5 years from the IPO date if no other conditions specified above are met before that time.

This does not exempt any existing public companies from SOX 404(a) reporting requirements (management attestation). Management attestation is essentially self-reporting by Company Management on the implementation and effectiveness of their internal controls over financial reporting. These attestations are provided in the quarterly and annual filings of public companies.

In addition, existing public companies who do not qualify for ECG status are still subject to 404(b) requirements (external audits) once they exceed non-accelerated filer status (>$75MM in public float). This means that the JOBS Act has no impact on the requirement for existing public companies to meet existing requirements.

A high-level background on the Sarbanes-Oxley requirements include:
  • 404(a) – Management attestation (self-reporting) 
    • As of June, 2010 the percentage of adverse Management-Only Assessments (404a) filed was about 10X higher than the rate experienced by companies required to file Auditor Attestations (404b) 1 Number of first-time 404 filers receiving an adverse opinion in 2009 was 28.9%2 (includes management self-reporting) 
  • 404(b) – External audit of internal controls over financial reporting Management support & commitment can be challenging Little or no compliance expertise internally Employee training may be required for process execution At the very least, re-training is often involved 
  • 404(c) - Non-accelerated filers granted a permanent reprieve for 404(b) Management is still responsible for 404(a) reporting – this includes documenting controls and attesting to their effectiveness

For a more comprehensive summary of the JOBS Act and how it affects private companies planning to IPO, click here.

If you would like more information on how to implement best-practice internal controls in a cost-effective and efficient manner or rationalize your existing system of internal control, please contact us to discuss your needs.

Open Letter and Video Blog to Mitt Romney & Newt Gingrich Regarding Sarbanes-Oxley

  
  
  
  

Open Letter and Video Blog to Mitt Romney & Newt Gingrich Regarding Sarbanes-Oxley

Sarbanes-Oxley Kills Jobs? Mitt Romney & Newt Gingrich Think We're All Fools

  
  
  
  
Announcement

Mitt Romney is suggesting that investors rely on Corporate America to 'do the right thing' and not steal, overstate earnings, lie to line their own pockets, etc. even though this thinking has been proven inaccurate over-and-over again.

Change to Sarbanes-Oxley Section 404 Requirements in 2012 Likely

  
  
  
  
Magnifying Glass

New legislation is gaining steam that would change the definition of which companies are subjected to an external audit review of their internal controls (e.g., Sarbanes-Oxley Section 404(b)). The bill, called 'H.R.3606 - Reopening American Capital Markets to Emerging Growth Companies Act of 2011,' passed the House by an overwhelming bipartisan vote of 54-1. The bill still has to go through the Senate and then get Presidential approval before it becomes law (you can follow the progress here: http://www.opencongress.org/bill/112-h3606/show). 

COSO - updated "Internal Control -- Integrated Framework"

  
  
  
  
Vibato Chart

COSO is coming out with a revision to the famous 'COSO Cube' and they have submitted a draft for public comment. The COSO Cube provides the basis for all internal control infrastructures, including Sarbanes-Oxley implementations, and it gives guidance on how to structure and audit control procedures. PwC participate in the update and they have provided a nice synopsis below of the pending change:

Why Your Company Needs an Internal Control for Whistleblowing

  
  
  
  

Two former Boeing staff members learned the hard way that SOX whistleblower rights do not extend when the whistle is blown to the media, rather than to their company supervisors, federal agencies, or Congress.

All Posts