April 21, 2005 Georgetown University Conference Center Washington, DC

1. April 21, 2005 Georgetown University Conference Center Washington, DC 37th Financial Forum of the Society of Utility and Regulatory Financial Analysis (SURFA) Securities Regulation: Risks and Realities in the Era of Sarbanes-Oxley Lessons Learned and Moving Forward Society of Utility and Regulatory Financial Analysis (SURFA)

2. Section 404 – Lessons Learned and Moving Forward

3. Section 404 – Lessons Learned and Moving Forward First year 404 results What percentage of accelerated filers with November 30, 2004 or December 31, 2004 year-ends will report ineffective internal control over financial reporting? • Less than 1% • Between 1% and 5% • Between 5% and 10% • Between 10% and 15% • More than 15% Society of Utility and Regulatory Financial Analysis (SURFA)

4. Total 404 Reports Adverse Reports Percentage 2,458 211 8.6% Section 404 – Lessons Learned and Moving Forward First year 404 results Preliminary Results Note – The above information is through April 4, 2005 and includes companies with a November 30, 2004 or a December 31, 2004 year-end. It does not reflect final results as some companies used the SEC’s 45 day exemptive order. Accordingly, the number of adverse reports is expected to increase through April 30, 2005. Society of Utility and Regulatory Financial Analysis (SURFA)

5. Section 404 – Lessons Learned and Moving Forward First year 404 results • Most material weaknesses have related to AS 2.139 or AS 2.140 circumstances – (e.g., restatements or material audit adjustments) • Most frequent areas of material weaknesses: • Accounting for income taxes • Misapplications of generally accepted accounting principles • Insufficient accounting resources • System access at the application level • Revenue recognition Society of Utility and Regulatory Financial Analysis (SURFA)

6. Section 404 – Lessons Learned and Moving Forward First year 404 results • Market reaction to material weaknesses has been moderate – slightly negative • Investors appear to be reacting differently to the type of material weakness: • Relationship between material weaknesses and the risk of future financial statement restatements • More process specific material weaknesses appear to be of less concern to investors versus those that are pervasive • Less pervasive material weaknesses should be easier to remediate Society of Utility and Regulatory Financial Analysis (SURFA)

7. Section 404 – Lessons Learned and Moving Forward First year 404 costs • Level of effort required: • Significant task for both management and the auditor • Many companies more than doubled their original estimates; some more than tripled their original estimates • Some large companies spent more than 100,000 hours of internal time • Why was such a large effort required: • Deferred maintenance – Documenting and evaluating the design of internal control over financial reporting had not been done in recent years • Limited management guidance • Steep learning curve • Remediation of deficiencies was more extensive and time consuming than expected Society of Utility and Regulatory Financial Analysis (SURFA)

8. Section 404 – Lessons Learned and Moving Forward Lessons learned • The need for strong controls over the selection and application of accounting policies as well as a periodic review of the appropriateness of those policies • Information technology general controls and automated application controls • Over-emphasis on routine controls and under-emphasis on softer components of internal control Society of Utility and Regulatory Financial Analysis (SURFA)

9. Section 404 – Lessons Learned and Moving Forward Lessons learned • Evaluating the significance of control deficiencies: • Complex and time consuming process given the relatively large number of control deficiencies • Not unusual to see companies with hundreds and sometimes thousands of deficiencies • Point in time concept allowed companies to remediate existing material weaknesses • Framework for evaluating control exceptions and deficiencies was a useful tool: • Still required significant judgment by management and the auditor • Consideration of compensating controls was difficult • Additional practical experience will be helpful Society of Utility and Regulatory Financial Analysis (SURFA)

10. Section 404 – Lessons Learned and Moving Forward Lessons learned • Strong controls over the selection and application of accounting policies, including periodic review, are critical • Accounting policies have become increasingly complex and results show many companies have not kept controls up to date (“deferred maintenance”) • Design may be ineffective as accounting personnel may not have commensurate GAAP knowledge to perform the control Society of Utility and Regulatory Financial Analysis (SURFA)

11. Section 404 – Lessons Learned and Moving Forward Lessons learned • Evaluating ITGC control deficiencies was complex • Testing of automated application controls when ITGC are ineffective • Controls related to ERP systems have not been fully implemented • Opportunity for increased reliance on automated application controls versus manual controls Society of Utility and Regulatory Financial Analysis (SURFA)

12. Section 404 – Lessons Learned and Moving Forward Moving forward • SEC roundtable on implementation of Section 404 held on April 13: • Six panel discussions chaired by SEC staff • All major constituencies will be represented • Costs and benefits of 404 will be a major focus. • Potential areas of clarification to AS 2: • Risk-based approach – vary nature, timing and extent of testing from year to year • Use of management’s self-assessment testing • Reliance on ITGC to reduce testing of automated application controls • Measuring potential impact of control deficiencies on interim materiality Society of Utility and Regulatory Financial Analysis (SURFA)

13. Section 404 – Lessons Learned and Moving Forward Moving forward • PCAOB recently issued a proposed auditing standard on reporting on the elimination of a material weakness • Establishes a stand-alone engagement that is entirely voluntary • Engagement could be undertaken at any time during the year • Reporting is limited to the elimination of the material weaknesses identified in an annual assessment process • Auditor's report based on management's assertion that the material weakness has been eliminated • This type of engagement may not be appropriate for all material weaknesses Society of Utility and Regulatory Financial Analysis (SURFA)

14. Section 404 – Deficiencies, Common Problem Areas & Reporting

15. Section 404 – Deficiencies, Common Problem Areas & Reporting Sox 404 Year-end Survey Results of 250 PwC client results Society of Utility and Regulatory Financial Analysis (SURFA)

16. Section 404 – Deficiencies, Common Problem Areas & Reporting Survey Results – Significant Deficiencies and Material Weaknesses Society of Utility and Regulatory Financial Analysis (SURFA)

17. Section 404 – Deficiencies, Common Problem Areas & Reporting Survey Results – Significant Deficiencies and Material Weaknesses • Systems (25%) • Models and Spreadsheets (15%) • Period-end Financial Reporting (15%) • Application of GAAP (15%) • Reconciliations (10%) • Taxes (10%) • Entity Wide (0%) • Other (20%) • Primarily estimation controls (Valuation, FAS 91) Society of Utility and Regulatory Financial Analysis (SURFA)

18. Section 404 – Deficiencies, Common Problem Areas & Reporting Compliance Week Data Registration results • Total 2,335 • Adverse Opinions 131 (6%) • Extensions 348 (13%, 19% combined) Types of Material Weaknesses • Systems (9%) • Review, Monitoring, Documentation (16%) • Period-end Financial Reporting (2%) • Application of GAAP/Accounting Personnel (23%) • Reconciliations (1%) • Taxes (6%) • Entity Wide (13%) • Other (30%) – Primarily specific process breakdowns (Revenue, AP, Accruals, Leases, etc.) Society of Utility and Regulatory Financial Analysis (SURFA)

19. Overall Year 2 Considerations Deficiency monitoring and disclosures • Timely disclosure of “known” material weaknesses • Disclosure may be needed prior to filing a Form 10-Q or Form 10-K • Significant deficiencies that remain uncorrected after some reasonable period of time should be regarded as a strong indicator that a material weakness in internal control over financial reporting exists Society of Utility and Regulatory Financial Analysis (SURFA)

20. Overall Year 2 Considerations Polling Question Which of the following “change events” may warrant disclosure under Section 302? a. Remediation of a material weakness b. New system c. Acquisition d. Business or management reorganization e. Termination/resignation of CFO f. Fraud g. All of the above Society of Utility and Regulatory Financial Analysis (SURFA)

21. Overall Year 2 Considerations Deficiency monitoring and disclosures • Change events (“material changes”) under Section 302 may need to be disclosed – whether good or bad changes • PCAOB proposed new auditing standard – Reporting on the Elimination of a Material Weakness Society of Utility and Regulatory Financial Analysis (SURFA)

22. Operate Identify technology enabler Identify required improvements Beyond 404: Recognizing and Building Value Step 7 Steps to a sustainable Sarbanescompliance program Step 6 With on-going compliance, the emphasis shifts from documentation of controls and initial testing to: • Regular evaluation and testing • Resolution of exceptions • Keeping up with changes in people,process, and technology • Improving the control environment to minimize exceptions Implement Step 5 Step 4 Design compliance program elements Step 3 Step 2 On-going compliance also means identifying and replacing “band-aid” remediation fixes to minimize potential future control breakdowns, especially for those controls tagged as significant deficiencies or material weaknesses. Assess year one process & output Step 1 Formalize SOX program office PwC