1. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) April 21, 2005 Georgetown University Conference Center Washington, DC 37 th Financial Forum of the Society of Utility and Regulatory Financial Analysis (SURFA) Securities Regulation: Risks and Realities in the Era of Sarbanes-Oxley Lessons Learned and Moving Forward

2. Sarbanes-Oxley roundtable discussion Section 404 – Lessons Learned and Moving Forward

3. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) First year 404 results What percentage of accelerated filers with November 30, 2004 or December 31, 2004 year-ends will report ineffective internal control over financial reporting? Less than 1% Between 1% and 5% Between 5% and 10% Between 10% and 15% More than 15% Section 404 – Lessons Learned and Moving Forward

4. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) 8.6%2112,458 PercentageAdverse ReportsTotal 404 Reports Preliminary Results Section 404 – Lessons Learned and Moving Forward First year 404 results Note – The above information is through April 4, 2005 and includes companies with a November 30, 2004 or a December 31, 2004 year-end. It does not reflect final results as some companies used the SECs 45 day exemptive order. Accordingly, the number of adverse reports is expected to increase through April 30, 2005.

5. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) First year 404 results Most material weaknesses have related to AS 2.139 or AS 2.140 circumstances – (e.g., restatements or material audit adjustments) Most frequent areas of material weaknesses: -Accounting for income taxes -Misapplications of generally accepted accounting principles -Insufficient accounting resources -System access at the application level -Revenue recognition Section 404 – Lessons Learned and Moving Forward

6. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) First year 404 results Market reaction to material weaknesses has been moderate – slightly negative Investors appear to be reacting differently to the type of material weakness: -Relationship between material weaknesses and the risk of future financial statement restatements -More process specific material weaknesses appear to be of less concern to investors versus those that are pervasive -Less pervasive material weaknesses should be easier to remediate Section 404 – Lessons Learned and Moving Forward

7. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) First year 404 costs Level of effort required: -Significant task for both management and the auditor -Many companies more than doubled their original estimates; some more than tripled their original estimates -Some large companies spent more than 100,000 hours of internal time Why was such a large effort required: -Deferred maintenance – Documenting and evaluating the design of internal control over financial reporting had not been done in recent years -Limited management guidance -Steep learning curve -Remediation of deficiencies was more extensive and time consuming than expected Section 404 – Lessons Learned and Moving Forward

8. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Lessons learned The need for strong controls over the selection and application of accounting policies as well as a periodic review of the appropriateness of those policies Information technology general controls and automated application controls Over-emphasis on routine controls and under-emphasis on softer components of internal control Section 404 – Lessons Learned and Moving Forward

9. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Lessons learned Evaluating the significance of control deficiencies: -Complex and time consuming process given the relatively large number of control deficiencies -Not unusual to see companies with hundreds and sometimes thousands of deficiencies -Point in time concept allowed companies to remediate existing material weaknesses Framework for evaluating control exceptions and deficiencies was a useful tool: -Still required significant judgment by management and the auditor -Consideration of compensating controls was difficult -Additional practical experience will be helpful Section 404 – Lessons Learned and Moving Forward

10. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Lessons learned Strong controls over the selection and application of accounting policies, including periodic review, are critical Accounting policies have become increasingly complex and results show many companies have not kept controls up to date (deferred maintenance) Design may be ineffective as accounting personnel may not have commensurate GAAP knowledge to perform the control Section 404 – Lessons Learned and Moving Forward

11. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Lessons learned Evaluating ITGC control deficiencies was complex Testing of automated application controls when ITGC are ineffective Controls related to ERP systems have not been fully implemented Opportunity for increased reliance on automated application controls versus manual controls Section 404 – Lessons Learned and Moving Forward

12. PricewaterhouseCoopers Moving forward SEC roundtable on implementation of Section 404 held on April 13: -Six panel discussions chaired by SEC staff -All major constituencies will be represented -Costs and benefits of 404 will be a major focus. Potential areas of clarification to AS 2: -Risk-based approach – vary nature, timing and extent of testing from year to year -Use of managements self-assessment testing -Reliance on ITGC to reduce testing of automated application controls -Measuring potential impact of control deficiencies on interim materiality Section 404 – Lessons Learned and Moving Forward Society of Utility and Regulatory Financial Analysis (SURFA)

13. PricewaterhouseCoopers Moving forward PCAOB recently issued a proposed auditing standard on reporting on the elimination of a material weakness -Establishes a stand-alone engagement that is entirely voluntary -Engagement could be undertaken at any time during the year -Reporting is limited to the elimination of the material weaknesses identified in an annual assessment process -Auditor's report based on management's assertion that the material weakness has been eliminated -This type of engagement may not be appropriate for all material weaknesses Section 404 – Lessons Learned and Moving Forward Society of Utility and Regulatory Financial Analysis (SURFA)

14. Sarbanes-Oxley roundtable discussion Section 404 – Deficiencies, Common Problem Areas & Reporting

15. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Section 404 – Deficiencies, Common Problem Areas & Reporting Sox 404 Year-end Survey Results of 250 PwC client results

16. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Section 404 – Deficiencies, Common Problem Areas & Reporting Survey Results – Significant Deficiencies and Material Weaknesses

17. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Section 404 – Deficiencies, Common Problem Areas & Reporting Survey Results – Significant Deficiencies and Material Weaknesses Systems (25%) Models and Spreadsheets (15%) Period-end Financial Reporting (15%) Application of GAAP (15%) Reconciliations (10%) Taxes (10%) Entity Wide (0%) Other (20%) - Primarily estimation controls (Valuation, FAS 91)

18. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Section 404 – Deficiencies, Common Problem Areas & Reporting Compliance Week Data Registration results Total 2,335 Adverse Opinions 131 (6%) Extensions 348 (13%, 19% combined) Types of Material Weaknesses Systems (9%) Review, Monitoring, Documentation (16%) Period-end Financial Reporting (2%) Application of GAAP/Accounting Personnel (23%) Reconciliations (1%) Taxes (6%) Entity Wide (13%) Other (30%) – Primarily specific process breakdowns (Revenue, AP, Accruals, Leases, etc.)

19. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Deficiency monitoring and disclosures Timely disclosure of known material weaknesses -Disclosure may be needed prior to filing a Form 10-Q or Form 10-K Significant deficiencies that remain uncorrected after some reasonable period of time should be regarded as a strong indicator that a material weakness in internal control over financial reporting exists Overall Year 2 Considerations

20. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Polling Question Which of the following change events may warrant disclosure under Section 302? a.Remediation of a material weakness b.New system c.Acquisition d.Business or management reorganization e.Termination/resignation of CFO f.Fraud g.All of the above Overall Year 2 Considerations

21. PricewaterhouseCoopers Society of Utility and Regulatory Financial Analysis (SURFA) Deficiency monitoring and disclosures Change events (material changes) under Section 302 may need to be disclosed – whether good or bad changes PCAOB proposed new auditing standard – Reporting on the Elimination of a Material Weakness Overall Year 2 Considerations

22. Steps to a sustainable Sarbanes compliance program Identify required improvement s Design compliance program elements Identify technology enabler Operate Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 With on-going compliance, the emphasis shifts from documentation of controls and initial testing to: -Regular evaluation and testing -Resolution of exceptions -Keeping up with changes in people, process, and technology -Improving the control environment to minimize exceptions On-going compliance also means identifying and replacing band-aid remediation fixes to minimize potential future control breakdowns, especially for those controls tagged as significant deficiencies or material weaknesses. Formalize SOX program office Assess year one process & output Implement Beyond 404: Recognizing and Building Value