Assurance in a Real Time Economy Alan Anderson, CPA Chair – AICPA Assurance Services Executive Committee Managing Principal – Assurance Services At LarsonAllen, LLP.

AGENDA Our Instant Gratification Culture The Current Reporting Model Conceptual Framework Assurance Services Executive Committee (ASEC) How Do We Move This Forward?

Our Instant Gratification Culture Consider the following: Does anyone talk “face to face” anymore? Do you sit and relax and enjoy a meal? Who in the room doesn’t have a cell phone? When was the last time you read a historical financial statement to make a decision?

Is Real Time Economy Already Here? Consider the following: How do you make decisions on investment performance? Do CFOs wait for month end financial statements to inform their CEO what is going in the business? What information is used by stock analysts to make “buy” or “sell” decisions? What happens to a stock price when a company misses the “consensus earning estimate?” Why does the SEC place so much emphasis on “forward looking information?”

The Real Time Economy? I IT’S ALREADY HERE!!!

Assurance In a Real Time Economy? “Houston we’ve got a problem” Current Assurance model is: Not timely -- it’s after-the-fact information Not informative enough Ignores many factors of performance

Historical Financial Statements Current Reporting Model Historical Financial Statements Continuous Reporting Past Future Present Lagging indicators… One size fits all (GAAP) Ignores non-financial measures Reports results of past decisions Leading indicators… Tied to mission, vision and values Tied to factors critical to success Moves decision criteria to forefront The current model does serve as an effective foundation from which business reporting should start. However “real time” decisions are made by looking at BOTH the lagging indicators ( the historical Financial statement) and leading indicators which enhances business reporting as the information is much closer to the event. Not always “real time” but certainly “near real time.” The one size fits all concept to financial reporting is over 20 years out of date, and the loss of relevance or at least the need for more information can easily be identified.

Historical Financial Statements Current Reporting Model Historical Financial Statements Continuous Reporting Past Future Present Lagging indicators… Periodic Historical Cost-basis Financial only Statements Looking backward Leading indicators… On-demand Real-time/future Value-basis Comprehensive Custom reports Looking forward

Common View of Real Time Assurance Exclusive Focus on What should get reported and assured Currently Assurance over reporting of performance measures along with their Historical Financial statement has been slow to develop Regulators talk about changes as if management should just “do it” and auditors can assure it. Readiness is a big issue XBRL is an Enabler

Real Time Assurance Requires….. A Broader View than “WHAT” gets reported. Need to Also Focus on When to Report (Real Time) How will the Information get reported (print or electronic)

Real Time Assurance Requires….. Greater Emphasis on Assurance on the Reliability of Systems, Processes and People (rather than a focus on the numbers) And Finally Movement away from a “one size fits all reporting concept” Needs Industry Specific information

REAL TIME REPORTING - A CONCEPTUAL FRAMEWORK 5 Elements Deployment Information Dissemination Technology XBRL (HOW) Business Information Financial & Non-Financial Measures .Business use Standards Setters (WHAT) Foundational Concepts System Reliability Corporate Accountability Understandable Disclosures SEC Plain English FASB Projects Continuous Audit Trust Services COSO ERM OCEG GRI (WHEN)

CONVERGENCE TO “ REAL-TIME” ELEMENTS OF REAL TIME REPORTING CONVERGENCE TO “ REAL-TIME” SCALABLE System Reliability Corporate Accountability Financial and Non-Financial Measures Enhanced business reporting should provide a comprehensive, understandable picture of a company's priorities, challenges, accomplishments, risks and financial position. It should also be customizable to meet the unique needs of diverse user groups, and it should help users of information see the organization more through the eyes of management. The conceptual framework for enhanced business reporting is based on five fundamental elements: 1) System Reliability. Successful entities are proactive in their assessment and management of information technology related risks. These organizations understand the competitive advantage in protecting the completeness and accuracy of data, guarding against the inappropriate access to systems and data, and ensuring the availability of systems to users. Enhanced business reporting envisions providing assurance (potentially on a continuous basis) on systems reliability and data integrity to enhance the level of stakeholder trust in information provided. 2) Financial and Non-Financial Measures. The core of any reporting model will continue to be financial information based on generally accepted accounting principles (GAAP) and Securities and Exchange Commission (SEC) reporting requirements. However, most, if not all, business entities have identified critical internal financial and non-financial measures to more completely monitor performance. The inclusion of a wide range of financial and non-financial performance measures in business reporting will enable stakeholders to see an entity more through the eyes of management. This more transparent disclosure will lead to better understanding of management’s objectives as well as the risks and opportunities associated with providing both equity and debt. 3) Information Dissemination. Technology opens an array of opportunities to provide stakeholders with an almost infinite number of alternative displays of business information. The information needs of large and small equity investors, creditors, those interested in non-financial performance measures, and people interested in environmental issues vary widely. EXtensible Business Reporting Language (XBRL), a standard for disseminating information, now provides a technology that enables entities to provide online, globally accessible information that can be customized to meet the special needs of disparate stakeholder groups. 4) Understandable Disclosures. Disclosure documents need to be written in plain English so that investors can fully understand information being provided. 5) Corporate Accountability. The catastrophic financial reporting failures of 2001 and the enactment of the Sarbanes-Oxley Act have increased public focus on the adherence of corporations to the highest standards of ethical behavior. The Special Committee will promote the reporting of corporate accountability data, including information on environmental, health, safety, and social responsibilities; corporate governance; privacy requirements; and enterprise risk management. Understandable Disclosures Information Dissemination

CONVERGENCE TO “Continuous Assurance” Migration Toward Real Time Assurance CONVERGENCE TO “Continuous Assurance” Deployment System Reliability HOW Corporate Accountability Information Dissemination WHAT The conceptual framework for enhanced business reporting is based on five fundamental, scalable elements (define scalable, then define elements): 1) System Reliability. Enhanced business reporting envisions providing assurance (ideally on a continuous basis) on systems reliability and data integrity to enhance the level of stakeholder trust in information provided. SR essentially makes the convergence to real or near real time reporting possible. 2) Financial and Non-Financial Measures. The core of any reporting model will continue to be financial information based on generally accepted accounting principles (GAAP) and Securities and Exchange Commission (SEC) reporting requirements. However, the inclusion of a wide range of financial and non-financial performance measures in business reporting will enable stakeholders to see an entity more through the eyes of management, leading to better understanding of management’s objectives and more efficient allocation of capital. 3) Information Dissemination. Technology makes it possible to provide stakeholders with an almost infinite number of alternative displays of business information. Extensible Business Reporting Language (XBRL), a standard for disseminating information, now provides a technology that enables entities to provide online, globally accessible information that can be customized to meet the special needs of disparate stakeholder groups. 4) Understandable Disclosures. Disclosure documents need to be written in plain English so that investors can fully understand information being provided. 5) Corporate Accountability. The catastrophic financial reporting failures of 2001 and the enactment of the Sarbanes-Oxley Act have increased public focus on the adherence of corporations to the highest standards of ethical behavior. The Special Committee will promote the reporting of corporate accountability data, including information on environmental, health, safety, and social responsibilities; corporate governance; privacy requirements; and enterprise risk management. Understandable Disclosures Financial and Non-Financial Measures and Information

AICPA – Assurance Services Executive Committee (ASEC) Mission: To enhance the quality, relevance and usefulness of information or its context for decision makers and other users by Identifying and prioritizing emerging trends and market needs for assurance, and Developing related assurance methodology guidance and tools as needed.

ASEC OBJECTIVES Identify significant trends giving rise to assurance needs, determine the potential assurance guidance that would best meet those needs. Develop assurance guidance by creating suitable criteria when necessary, and/or performance guidance as appropriate Communicate new assurance methodologies, guidance and opportunities to our members. Provide leadership in identifying and prioritizing emerging assurance trends and market needs while engaging and collaborating with users, preparers and influencers.

ASEC - Risk in a Real Time Economy Risk – Real Time Economy Risk Model Early indicators of risk- how to identify, weigh and manage Report on effectiveness of controls against COSO ERM framework assess risk not just against controls over financial reporting (may or may not need to be a 3rd party opinion) Change the model so the opinion goes more to observations around risk to start to close the expectation gap, formalize feedback to clients around risk, consider getting input from other professionals as well such as rating agencies, analysts, etc.

ASEC Real Time Assurance Guidance on continuous auditing (continuous control monitoring + data monitoring) Data level assurance Control monitoring Data selection and validation Data quality Relevance Customized business reports Real time customizable business reports

REAL TIME ASSURANCE EXAMPLES: Continuous monitoring of transactions and processes Detection and corrective action Continuous monitoring of controls System controls will supplant manual controls Measurement and assurance across enterprise processes Most assurance costs are justifiable by increased data quality Data level assurance increases the efficiency Enhances accuracy of reporting Continuous monitoring of controls (and their reporting on EBR) allows for control effectiveness measurement and detection: Continuous Controls, placed by computer systems have a profile of activity. Computer programs, or test data, can be inserted in the data stream to test whether these controls are active. Systems can be “pinged” to understand certain types of control activity. Continuous monitoring processes are meta-controls (controls of controls) and require assertions and review under Sarbanes-Oxley: If you apply an audit test on a close to continuous basis and act on fallacious outcomes you are de-facto a control of the system. For example a continuous audit procedure that checks for duplicate payments at HCA is now part of the day to day processing activity of the company. Continuous auditors reprocess it just to check if it is being used. Continuous auditing is a process that will serve to check the controls that are in place, and this is consistent with the requirements of Sarbanes Oxley 404 which requires auditors to report on controls.

WHAT DO WE NEED TO DO? ASEC will work together along industry lines to create thoughtful proposals for greater transparency involving both simplification and enhancement ASEC will Lead positive change, through collaborative solutions

WHY DOES OUR GLOBAL PROFESSION NEED TO BE INVOLVED? Everyone has a “stake” in this… Management needs real time information to run the business Owners need real time information to provide the level of oversight Creditors need real time information to make lending decisions Auditors need to pay attention to the needs of the users of real time information Continuous reporting and assurance is evolving in the business community through independent efforts

THE FUTURE OF ASSURANCE IN A REAL TIME ECONOMY - SOME FINAL THOUGHTS The need for change in reporting impacts both public and private companies Change will be evolutionary, not revolutionary New models will be developed for providing assurance for on-line, real time, historical and forward looking financial information, as well as for performance measures Tom Hood to wrap-up/summarize

Questions and open discussion