The Securities and Exchange Commission, as a matter of policy,
disclaims responsibility for any private publication or statement by any of its
employees. The views expressed herein are those of the author and do not
necessarily reflect the views of the Commission or of the author’s colleagues
upon the staff of the Commission.
Introduction
Thank you, Dean [Holder], for the kind introduction and invitation to speak
at today’s 35th annual SEC and Financial Reporting Institute
Conference. As has been the case at each of these prior events, today, you
will hear from a number of accounting experts — among them staff from the
Commission’s Office of the Chief Accountant and Division of Corporation Finance.
You will hear about a number of accounting and financial reporting
matters, including those of particular focus for the staff.
Before I continue, let me remind you that for me and all of the SEC staff
speaking at this conference, the views expressed are each speaker’s own and not
necessarily those of the Commission, the individual Commissioners, or other
colleagues on the Commission staff.
This morning I would like to talk about ways management, audit committees,
auditors, and other constituents can reinforce the credibility, reliability, and
usefulness of financial reporting for investors. I will address:
- Implementation activities related to the recently issued standards on
revenue recognition and leasing;
- Continued focus on internal control over financial reporting (ICFR);
- Opportunities to provide input to the Public Company Accounting Oversight
Board (PCAOB) regarding its important standard setting activities; and
- Continued vigilance on the responsibilities for maintaining auditor
independence.
Brian Croteau, Deputy Chief Accountant for the Professional Practice Group
in OCA, is here today and will address ICFR matters and elaborate on a few of
the auditing and audit committee topics in later panel discussions. Mark
Kronforst, Chief Accountant for the Division of Corporation Finance, is also
here today and will address the recently issued Compliance and Disclosure
Interpretations regarding non-GAAP financial measures.
[1]
I look forward to each of the panel discussions today as they will address a
number of priorities of the staff.
Within each of these areas, there are new and emerging issues to be
identified, managed, and overseen by those with financial reporting preparation
and oversight responsibilities. Investors are counting on each of you to
fulfill your respective responsibilities for high quality financial
reporting.
Implementation activities
In December, Chair White spoke about the priority of revenue recognition
and other new standards.
[2]
So I would like to turn first to observations about those activities.
I expect the FASB will soon issue a standard for credit impairment of
financial instruments.
[3]
If issued, the standard will join other recently issued guidance on
revenue,
[4]
leases,
[5]
and financial instruments classification and measurement,
[6]
thereby completing the key priorities identified in the FASB and IASB’s 2008
Memorandum of Understanding.
[7]
I commend the FASB and IASB’s efforts, through these standard setting
activities, to enhance the quality, consistency, and comparability of financial
reporting across the globe.
To provide perspective on the magnitude of the transactions addressed by
the new revenue and leasing standards, consider the following:
- In 2014, the S&P 1500 companies, which cover approximately 90% of the
U.S. market capitalization, recognized revenue in their financial statements
that sums to over $12.8 trillion.[8]
The new revenue standard, when adopted by public companies as early as next
year, will enhance the reporting and disclosures for the vast majority of
those revenue transactions by providing comprehensive guidance that will apply
across industries and registrants, whether domestic or foreign.
- For leases, the magnitude is also significant. In 2005, the SEC
staff estimated the value of off-balance sheet lease obligations of SEC
registrants to total $1.25 trillion. The new standard, which permits
early application and is effective in 2019 for calendar year-end public
companies, will enhance transparency of lease obligations and assets by
requiring that these previously unrecorded off-balance sheet items generally
be reported on the balance sheet.[9]
Given the pervasiveness of these changes, now is a good time for companies
to focus on audit committee and investor outreach and education regarding the
effect of the new standards on companies’ financial reporting.
[10]
It is also a good time for companies, their audit committees, and their
auditors to assess the quality and status of implementation plans so that the
implementation of the standards achieves the financial reporting objectives
intended by the standard setters. Without an appropriate allocation of
time and resources, companies risk a financial reporting failure along with
oftentimes significant, adverse consequences for shareholders.
Revenue recognition
Chief Accountant Jim Schnurr and I have repeatedly spoken on the topic of
revenue recognition, including through prepared remarks on ten separate
occasions.
[11]
These remarks reflect our individual views about the value of the new
standard, the value of communication and disclosure during this implementation
phase, and the need for reasonable judgment in order to achieve the objectives
of the standard. We have also highlighted the importance to implementation
of the role for audit committee oversight and dialogue with external auditors
and to application of ICFR. Successful implementation requires the
engagement of senior management throughout an organization. If there are
individuals within your organization that underestimate the efforts required, or
the overall importance of a successful implementation of the new revenue
recognition standard, you might consider sharing some of our staff remarks on
the topic.
Interpretative activities
Given the importance of implementation, my staff continues to actively
monitor the profession’s transition efforts including the FASB’s Revenue
Transition Resource Group (“TRG”) and the AICPA’s Financial Reporting Executive
Committee, among others, to identify the nature and volume of implementation
questions and views on those questions. While I am optimistic that the key
practice issues that require standard setting have been identified through the
implementation activities of preparers, auditors, and standard setters, I am
concerned that other application questions have not yet been fully resolved by
the AICPA industry groups or, if needed, presented to the TRG for
resolution. I encourage all constituents to communicate their views timely
so that investors, companies, auditors, and regulators can understand and
evaluate remaining implementation questions.
To the extent that preparers, industry groups, or other constituents have
identified questions but have chosen not to raise them in hopes of preserving
their current accounting, let me caution you that auditors, regulators, and
others will look to understand those revenue policies and how they are
consistent with the principles in the new revenue recognition standard.
It’s just a matter of timing as to when we gain that understanding, whether
before or after companies implement the standard.
With two TRG meetings tentatively scheduled for the remainder of 2016, the
time to escalate implementation questions is now. The later a registrant
or industry group waits, the less opportunity it has to weigh in on the outcome,
and the greater the possibility of needing to narrow diversity through
subsequent standard setting or, if the principles in the standard were not
appropriately applied, through a potential correction in the financial
statements.
Recent OCA consultations relating to revenue recognition
The staff in OCA has received consultations from registrants on their
particular accounting policies for revenue recognition under the new
standard. In forming our views, the staff considers first the nature,
design, and economic substance of the transaction, then the:
- language in the standard and the related basis for the standard setters’
conclusions;
- implementation discussions, such as those at the TRG; and
- objectives expressed in the standard for consistency and
comparability.
OCA’s consultations with registrants have addressed the following:
- The application of the definition of a “contract” within Topic
606. While a future contract might appear to be likely or even
compelled economically or by regulation, in the staff’s view it would be
inappropriate to recognize revenue except for a contract with enforceable
rights and obligations.
- The contract combination guidance. The guidance in Topic 606 explicitly
limits which contracts may be combined to those with the same customer or
related parties of the same customer and OCA objected to a registrant’s
planned extension of the contract combination guidance beyond those
parties.
- The application of the guidance for royalties based on when a report with
the amount of revenues earned is received, not when the royalty sale or use
occurred. The standard setters did not provide a lagged reporting
exception with the new standard. Accordingly, I believe companies should
apply the sales- and usage-based royalty guidance as specified in the new
standard. The reporting, which may require estimation of royalty usage,
should be supported by appropriate internal accounting controls.
Presentation and disclosure policies
The new revenue standard, as with the current standard, provides
presentation and disclosure guidance. The new standard, for example,
requires an analysis of consideration paid to customers or other parties that
purchase the entity’s goods or services from the customer to determine when to
recognize and how to classify those payments. A company must support its
presentation – whether gross or net – according to the principles in the
standard, so that investors can understand the nature of the transactions and
relationships represented within the presentation.
While presentation is just one aspect of the new revenue standard, it
highlights several key themes as we think about transition.
- First, revenue recognition policies should be consistent with the
principles in the standard. Often, this will require a careful
evaluation of the:
- detailed information regarding the specific facts and circumstances
within the arrangement;
- relevant accounting and reporting issues raised;
- conclusions reached (and basis for those conclusions);
- analysis of the possible alternative answers considered and
rejected;
- disclosure about the accounting; and
- any audit committee views on management’s accounting and financial
reporting conclusions.
- Second, the guidance has changed. Existing revenue recognition was
primarily a risk and rewards based model, while the new standard is focused on
control. Companies should not assume their existing conclusions, such as
its principal versus agent assessment, will remain unchanged under the amended
guidance.
- Third, given the possible changes in the accounting determinations,
companies will need to design and implement internal controls to evaluate the
application of the standard to a company’s specific facts and
circumstances.
- And finally, I encourage companies to provide useful disclosures to
investors with appropriate investor education on the impact of adoption of the
new standard.
Speaking of disclosures, the SEC staff has long advised that a registrant
should provide transition disclosures to investors of the impact that a recently
issued accounting standard will have on its financial statements when that
standard is adopted in a future period.
[12]
The preparation of the transition disclosures should be subject to
effective ICFR and disclosure controls and procedures. As management
completes portions of its implementation plan and develops an assessment of the
anticipated impact the standard will have on the company’s financial statements,
internal and disclosure controls should be designed and implemented to timely
identify relevant disclosure content from the implementation assessments and to
ensure, where necessary, that appropriately informative disclosure is
made.
Investors should expect the level of transition disclosures to increase as
a company progresses in its implementation plans and, when necessary, engage
with company management to understand these disclosures.
Leasing
Turning to leasing, the FASB’s new standard on leasing will also require
careful implementation planning, management, and oversight.
Under the new guidance, lessees will recognize an asset and liability for
nearly all of their leases. This requirement is applicable even if the
lease is embedded in other arrangements, such as for information processing,
outsourcing, and long-term supply contracts. While current leasing
guidance also requires that embedded leases be identified and accounted for
separately, the new guidance will require most leases to be accounted for
on-balance sheet.
Each lease also needs to be classified as an operating or finance lease.
The classification will determine the specific balance sheet presentation
and the expense recognition model, whether straight-line rent expense for an
operating lease or uneven expense for a finance lease.
As with revenue recognition, I encourage companies to assess the quality
and status of implementation plans to achieve the financial reporting objectives
intended by the standard setters, while also providing timely investor education
on the anticipated effect of the lease standard prior to adoption.
Importance of ICFR
As I mentioned earlier, well-designed controls support the process by which
accounting judgments and estimates are made and the resulting quality of the
financial reporting. Our capital markets expect that companies present
reliable and complete financial data for investment and policy decision
making. Central to this expectation is that public companies maintain
reliable and trustworthy accounting records that are supported by appropriate
internal controls. Being able to represent that an effective system of
ICFR is in place and, where appropriate, has been audited by an independent
accountant, strengthens public confidence, promotes reliable financial
reporting, and encourages investment in our nation’s capital markets.
We are routinely reminded that investors view management’s ICFR
assessments, and independent auditors’ attestation on ICFR, as beneficial and
important to investor protection. For these reasons, ICFR remains a high
priority for the OCA staff, and we continue to work closely with our colleagues
in the Divisions of Corporation Finance and Enforcement to help ensure that ICFR
matters are appropriately addressed.
I am very pleased to see the amount of attention that ICFR assessments will
be given during this conference, including the ICFR panel discussion to be held
later today and will include my colleague, Brian Croteau, Deputy Chief
Accountant in OCA. While I will leave it to the panel to address a number
of more specific ICFR matters, I would like to share a few thoughts on several
higher-level developments impacting ICFR.
As you know, the FASB’s Conceptual Framework for accounting is premised on
providing users with relevant financial information that faithfully represents
the economics of a transaction. Management’s ability to consistently
exercise sound professional judgment to meet financial reporting objectives
depends, to a large degree, on the effective design and operation of
ICFR.
In the words of the COSO 2013 Framework,
[13]
an effective system of ICFR must include a process to identify and assess those
internal and external factors that can significantly affect a company’s ability
to achieve the objective of reliable financial reporting. Such factors
include the major changes in GAAP that will become effective over the next
several years. While I have said the same relating to revenue, it is
important to give current and ongoing consideration to implementing or
redesigning controls as necessary in connection with the application of the many
new standards.
Such changes in accounting have the potential to significantly impact many
important areas of financial reporting and may extend beyond simple tweaks to
the process-level control activities. For example, a key consideration for
all issuers should be setting the right “tone at the top” by creating an
environment in which management and employees from all relevant levels and areas
in the organization can combine their respective expertise in performing the
analysis and evaluating alternatives to arrive at well-reasoned professional
judgments. In those situations where material changes are made to ICFR in
advance of the adoption of a new standard that also impact current period
financial reporting, management has an obligation to disclose such changes in
its quarterly filings with the Commission.
ICFR remains a significant area of focus not only for OCA but also for our
colleagues in the Divisions of Corporation Finance and Enforcement. A
recent enforcement action against an issuer and several individuals, including
company management, the company’s auditors, and a company consultant, for
deficient evaluation of the company’s ICFR, demonstrates our coordinated efforts
related to ICFR as well as some of the challenges that remain in this area.
[14]
From my perspective, there are three important takeaways from that
case:
- The first is that management has the responsibility to carefully evaluate
the severity of identified control deficiencies and to report, on a timely
basis, all identified material weaknesses in ICFR. Any required
disclosure should allow investors to understand the cause of the control
deficiency and to assess the potential impact of each for disclosure as a
material weakness.
- The second is the importance of maintaining, or augmenting with, competent
and adequate accounting staff resources to keep books, records, and accounts
that accurately reflect the company's transactions and to maintain internal
accounting controls designed to ensure that company transactions are recorded
in accordance with management's authorization and in conformity with GAAP.
Qualified accounting resources will be of vital importance in connection
with the adoption of the new accounting standards that I mentioned
earlier.
- And finally, management has to take responsibility for its assessment of
ICFR. That responsibility cannot be outsourced to third party
consultants. At the same time, third party consultants have obligations
to uphold when assisting management in its evaluation of ICFR.
Opportunities for improvement related to ICFR assessments are also
reflected in the fact that the PCAOB continues to identify frequent deficiencies
in the audits of ICFR. OCA staff continues to encourage all stakeholders
to take a broader view of the PCAOB inspection findings.
[15]
The ICFR auditing issues identified by the PCAOB may not be just a problem of
audit execution but rather, at least in part, be indicative of deficiencies in
management’s controls and assessments.
Notwithstanding the need for continued improvement in the assessments and
reporting of ICFR by both management and auditors, both the PCAOB and the SEC
staff are keenly aware of the ongoing discussions regarding the impact of some
of the changes made by audit firms to their audit methodologies, policies, and
procedures in response to the PCAOB inspection findings in this area.
In 2015, the PCAOB, with SEC staff observing, conducted a number of
outreach meetings with preparers, auditors, and other constituents to better
understand the concerns of the various groups regarding the ICFR assessments by
companies, their interaction with the audits of ICFR, and related inspection
findings of the PCAOB. The staff continues to encourage regular
discussions among management, auditors, and audit committees on existing and
emerging issues in assessments of ICFR. This appears to be particularly
important for matters such as changes being made to the firm’s audit approach
and methodology, assessment of risks for the audit, and selection of relevant
controls to be tested and relied on by the auditors in the context of the
existing guidance from the SEC and the PCAOB.
With the 2015 financial reporting season behind us, the staff has recently
reengaged with the various stakeholders in order to assess progress on the
issues previously discussed and to stay informed of new issues that might have
emerged. Much of what we have heard thus far tends to be fact specific and
necessitates a focused discussion, but Brian Croteau will share some additional
information with respect to this ongoing outreach on the later
panel.
While the staff has heard of some success stories that could be attributed
to greater communication among auditors, management, and audit committees, it
appears that the steps outlined last year
[16]
have not yet in all instances yielded the full level of potential
benefits. Undoubtedly, this is due, at least in part, to the timing of our
outreach and communications, which took place in late 2015 when much of the
audit planning and ICFR assessment work had already been completed.
Therefore, I would like to encourage all of you to engage in audit planning and
risk assessment discussions now as it relates to the current year audit.
There is no doubt in my mind that an effective dialogue around ICFR will
ultimately lead to more reliable financial reporting for the benefit of
investors.
It is clear that investors view ICFR assessments as beneficial and
important to investor protection. Therefore, the staff remains sharply
focused on overseeing the requirements for ICFR assessments and reporting and is
committed to resolving any challenges that may remain in this area.
PCAOB standard setting
I would like to now turn to the PCAOB and its role in enhancing the
credibility of public company financial reporting. The PCAOB’s inspections
program has undoubtedly played an important role in improving the quality of
independent audits over the past several years. While the inspection
program is an essential element of the Board’s oversight work, inspections have
the natural limitation of only being able to identify, report, and require
remediation of deficiencies in auditors’ performance that have already taken
place. While there is certainly an element of learning that comes with an
inspection experience that should inform auditors’ future performance,
inspections cannot fully achieve their objective without the complement of
rigorous and high-quality auditing standards that keep pace with the evolution
in financial reporting.
Over the past couple of years, Commissioners and staff alike have spoken
[17]
about the need for the PCAOB to take a fresh look at its standard setting
process with the objective of making more significant progress on some important
longstanding projects on the Board’s standard setting agenda. These
projects include, among others, auditing standards in the area of accounting
estimates, including fair value measurements, auditors’ use of the work of
specialists, and use of other auditors. There is also important work to be
done to modernize the PCAOB’s existing quality control standards.
Investors are counting on the continued development and maintenance of a set of
high-quality standards that establish the expectations for auditor
performance.
Over the past year, the PCAOB has undertaken significant efforts to
evaluate and re-design its standard setting process. Those efforts have
included, among others, the Board retaining the services of an external
consultant to take an independent look at its existing processes. The
staff has already seen encouraging results from some of the initial changes as a
result of these efforts. Overall, I commend the PCAOB for its commitment
to high-quality auditing standards.
One natural outcome of the Board’s review of its standard setting process
should be increased transparency into the PCAOB’s work and more opportunities
for stakeholder input throughout the lifecycle of a standard setting project.
I believe the standard setting process of the PCAOB, or any standard
setting body for that matter, can benefit greatly from increased engagement of
all relevant stakeholder groups in a process that is transparent and supports
open communication regarding a diversity of viewpoints.
Additionally, based on comments made by Marty Baumann, the PCAOB’s Chief
Auditor, during a recent meeting of the PCAOB’s Standing Advisory Group, it
appears that in redesigning its standard setting approach, the Board is
appropriately focused on establishing processes that will help it to timely
identify, understand, and address the implications to audit quality of new and
emerging risks.
[18]
These risks include the impact of changes in technology and the growing
use of big data on the manner in which audits are conducted – that is, risks
that are inherent in the dynamic environment in which today’s public companies
operate. Other risks may emerge as a result of business or regulatory
trends, such as continuously evolving accounting frameworks, new business
models, ever more complex transactions, and continued globalization. In
order to preserve and, where necessary, strengthen the quality of independent
audits in the years to come, it is essential to ensure that auditing standards
are appropriately responsive to these developments.
Independence
Finally, investor confidence in financial reporting is highly dependent on
auditors’ commitment to maintaining independence from issuers. Auditor
independence lies at the very foundation of the profession and is necessary to
maintain auditors’ objectivity and lend credibility to the fair presentation of
the financial statements.
When speaking about independence, the staff often emphasizes that it is
important for auditors to remain independent of issuers in both fact and
appearance. Indeed, in today’s world, where quick headlines spread within
seconds through a multitude of alternative media outlets, being perceived as
independent may be every bit as important as consistently remaining independent
in fact.
While compliance with the letter of the law and the specific restrictions
delineated in the Commission’s Rule 2-01(c)
[19]
are critical to auditor independence, it is equally important to consider the
general standard and the fundamental principles of auditor independence and
investors’ perception. Reflecting on the staff’s experiences with recent
issuer and auditor consultations as well as enforcement investigations, I
encourage all of you to consider the services and relationships between issuers
and auditors and their potential impact on independence more broadly.
Consider, for example, whether the services or relationships:
- Create a mutual or conflicting interest between the auditor and the audit
client;
- Place the accountant in a position of being an advocate for the audit
client;
- Place the accountant in the position of auditing its own work; or
- Result in the accountant acting as management or an employee of the audit
client.
The last two points potentially will be of increased importance in
connection with companies’ implementation of the new accounting standards that I
mentioned earlier. As companies make changes in their systems, processes,
and controls, auditors should be careful not to assume the role of management in
re-designing these elements of the companies’ financial reporting
infrastructure.
[20]
Business and close personal relationships between an auditor and its issuer
audit client, including the issuer’s affiliates and other associated parties,
are another good example of an area that could generate serious questions about
an audit firm’s independence. This is, at least in part, due to the
natural tension that exists between an audit firm’s desire to build a good
working relationship with management at its audit client and the need to avoid
situations that may lead outsiders to question the auditor’s independence.
Similarly, independence conflicts may also arise as a result of an audit firm’s
pursuit of its otherwise legitimate business strategies, such as pursuing
marketing alliances.
While Rule 2-01
[21]
lists explicit types of relationships between the auditor and the audit client
that are independence impairing, the Commission’s rules and guidance did not
identify all circumstances that might bear on the auditor’s independence.
Therefore, it is particularly important for auditors, management, and audit
committees to be continually cognizant of other circumstances that might bear on
independence and evaluate them against the fundamental principles that I
mentioned a moment ago.
Audit firms should also have sufficient training, policies, and procedures
in place to provide the firm personnel with appropriate guidance for maintaining
independence in fact and appearance in all required situations. Given the
complexity of some of the judgments involved, auditor independence is a shared
responsibility among auditors, audit committees, and management.
Accordingly, I believe it is equally important for management and audit
committees to have appropriate policies and procedures in place that are
consistently executed to promote a thorough identification and evaluation of
potential auditor independence conflicts. I encourage you to continue
consulting with the staff in OCA as you find appropriate, as we have specific
staff members who specialize in addressing questions on independence
matters.
Lastly, I mentioned the important role that audit committees play in the
oversight of auditor independence. Assessing auditor independence is an
important aspect of the auditor oversight responsibilities, which have been
vested in audit committees since the Sarbanes Oxley Act of 2002.
[22]
Under its provisions, audit committees of listed companies are directly
responsible for the appointment, compensation, and oversight of the work of any
registered public accounting firm employed by the issuer.
As you have heard in other forums,
[23]
investors appear to be keenly interested in learning more about how audit
committees discharge these and other responsibilities vested in them. In
this respect, the SEC staff continues to evaluate the feedback received on the
Commission’s concept release regarding possible revisions to audit committee
disclosures.
[24]
The staff also monitors the trends in additional voluntary disclosures
made by audit committees of some issuers and considers how rules of the
Commission could best facilitate disclosure of additional information sought by
investors.
Conclusion
In closing, I look forward to working with the accounting profession as we
collectively embark on this period of change and implementation. Within
each of the areas that will be discussed today, there are new and emerging
issues to be identified, managed, and overseen by those with financial reporting
preparation and oversight responsibilities. Investors are counting on each
of you to fulfill your respective responsibilities for high-quality financial
reporting.
Thank you for your kind attention and I look forward to discussing these
matters further later in the session.
[4]
Accounting Standards Update No. 2014-09,
Revenue from Contracts with
Customers (Topic 606).
[5]
Accounting Standards Update No. 2016-02,
Leases (Topic
842).
[6]
Accounting Standards Update No. 2016-01,
Financial Instruments-Overall
(Subtopic 825-10): Recognition and Measurement of Financial Assets and Financial
Liabilities.
[8]
Amount represents total sales reported for fiscal year 2014 by the S&P 1500
index companies. See
http://us.spindices.com/indices/equity/sp-composite-1500.
This number does not reflect the impact of the new standard including, for
instance, the potential recognition of revenue that is deferred under the
current guidance.
[12]
See SEC Staff Accounting Bulletin (SAB) No. 74 (Topic 11:M),
Disclosure of
the Impact that Recently Issued Accounting Standards Will Have on the Financial
Statements of the Registrant When Adopted in a Future Period.
[13]
See
Internal Control – Integrated Framework, published by the Committee
of Sponsoring Organizations of the Treadway Commission (May 2013) (“COSO 2013
Framework”),
available at: www.coso.org/IC.htm.
[17]
See, for example,
Remarks before the 2014 AICPA National Conference on
Current SEC and PCAOB Developments, December 8, 2014 – James Schnurr, Chief
Accountant, available at:
https://www.sec.gov/News/Speech/Detail/Speech/1370543609306;
Remarks before the 2014 AICPA National Conference on Current SEC and PCAOB
Developments, December 8, 2014 – Brian Croteau, Deputy Chief Accountant,
available at
http://www.sec.gov/News/Speech/Detail/Speech/1370543616539;
and
Statement at Open Meeting on the PCAOB Proposed Budget and Accounting
Support Fee for 2015, February 4, 2015 – Chair Mary Jo White,
available at:
http://www.sec.gov/news/statement/2015-spch020415mjw.html.
[19]
See Rule 2-01(c) of Regulation S-X.
[21]
See Rule 2-01 of Regulation S-X.
[22]
See Section 301 of the Sarbanes Oxley Act of 2002.