In a webcast sponsored by EY and Financial Executives International, Robert Wadley, a partner in EY's professional practice group, said companies beginning to implement the COSO framework are finding a number of common gaps and implementation challenges.
Many of these issues need to be addressed in the near future if those entitles hope to adopt the new framework by mid-December, Wadley added.
"As companies begin their [implementation] project plans, they need to review their existing controls and map them against the COSO principles to identify gaps," Wadley explained. "Companies should plan to complete their analysis of gaps by the end of the third quarter if they hope to finish implementation in 2014. Some gaps may be minor and may just require additional documentation, while others may require new controls, which in turn will require a testing process."
Wadley said the new COSO framework requires companies to expand a review of controls beyond the traditional boundaries of the organization to include the operations of outsourced functions and business partners.
"If a company has a code of conduct, they need to understand whether their outsourced providers are applying that company's code of conduct," Wadley said.
Under the new framework, just having a code of conduct is not considered an effective risk management strategy -- companies instead have to identify and address any deviations from the documented code of conduct.
Wadley said risk assessment plays a larger role in the revised framework, which has a particular focus on fraud risk. Companies are being asked to evaluate the fraud triangle -- incentives, opportunities and rationalization -- and to perform preventative documentation and testing.
Organizations adopting the revised framework are also reviewing their monitoring processes, which Wadley described as the glue that holds their controls environment together. He said many companies are using the new framework as a reason to revamp controls that may not be been refreshed extensively since the adoption of the Sarbanes-Oxley Act.
Revenue Recognition
The converged revenue recognition standard issued by Financial Accounting Standards Board and the International Accounting Standards Board on May 28 was another recent significant financial reporting development that companies need to begin planning for.
Although time remains before the Dec. 15, 2016, implementation date for public companies, the extent of the potential changes means companies need to begin planning now.
The standard calls for a five-step process for recognizing revenue:
- identify the contract with a customer;
- identify the contract's performance obligations;
- determine the transaction price; allocate the transaction price to the performance obligations;
- and recognize revenue when (or as) the performance obligations are satisfied.
Because the new revenue standard offers less industry-specific guidance than the rules it is replacing, EY professional practice group partner Nancy Salisbury said companies will likely have to rely more on estimates and business judgment as they prepare filings under the new standard.
For example, determining the transaction price may prove to be the most challenging to implement since contracts could include provisions that may alter the cost of specific services or elements of a transaction. As a result, Salisbury said many companies may rely more on estimates or wait until they receive revenue to recognize it.
Wadley and Salisbury said changes to the revenue recognition process will also likely require companies to adjust their controls environment.
Transition Process
Jeremy Simons, a partner in EY's professional group, said the American Institute of Certified Public Accountants is forming 16 industry groups to help financial executives interact with peers and other stakeholders to better understand common implementation challenges.
Similarly, FASB and the IASB have formed a joint Transition Resource Group to help companies implement the new standard. The group's first meeting, which will be broadcast online, is scheduled for July 18.