Johnson Price & Sprinkle PA
A&A Advisor
January/February 2012
SOVEREIGN DEBT DOWNGRADE
IMPACTS U.S. ACCOUNTING
When Standard & Poor’s took the unprecedented step of
cutting the rating of U.S. sovereign debt from AAA to a AA+
rating, the announcement was accompanied with a negative
outlook in S&P’s long-term assessment of that debt.
While certainly not a positive scenario, the announcement was not
totally negative. S&P did:
t "ïSNUIFTIPSUUFSN645SFBTVSZ"SBUJOH
t /PUFUIBU""SBUJOHTEJêFSGSPN"""SBUJOHTCZPOMZB
small amount
t /PUFUIBUOPDPSQPSBUFEFCUPSPOBHMPCBMCBTJTIPMEJOH
a AA+ credit rating had defaulted on its debt between
1981 and 2008
It also is important to note that neither Moody’s
nor Fitch, the two other major rating agencies,
concluded that a downgrade of U.S. sovereign debt
was appropriate.
In several instances, the requirements of U.S.
GAAP (generally accepted accounting principles)
incorporate the need to consider risk-free rates of return.
As such, questions have bubbled up about whether returns on
U.S. sovereign debt still would be considered the appropriate rates in
following U.S. GAAP requirements.
A&A Advisor
As examples, the FASB Accounting Standards Codification
(FASB ASC) incorporates the use of that rate as follows:
t FASB ASC 820, Fair Value Measurements.
When fair value measurements are based on
use of a present value methodology, using the
guidance in FASB ASC 820-10-55-5, the time
value of money element within the fair value
measurement is represented by the rate on riskfree monetary assets that have maturity dates
or durations that coincide with the period
covered by the cash flows. This rate is referred
to as a risk-free interest rate.
t FASB ASC 958, Not-for-Profit Entities.
Commonly, not-for-profit entities are the
recipients of unconditional promises to give.
These contributions need to be recorded at
fair value.
When using present value techniques to
measure the fair value of the contributions,
not-for-profit entities need to determine the
amount and timing of future cash flows or, for
promises to give noncash assets, the quantity
and nature of assets expected to be received.
In using the present value methodology to
record contributions, the guidance in FASB
ASC 958-605-30-4 includes a reference back
to FASB ASC 820-10-55-5 to discern the
appropriate rate that should be included in the
present value measurement. As discussed above,
that appropriate rate is a risk-free interest rate.
t FASB ASC 410, Asset Retirement and
Environmental Obligations.
Using the guidance in FASB ASC 410-2025-4, reporting entities need to recognize the
fair value of a liability or an asset retirement
obligation in the period in which it is incurred
if a reasonable estimate of fair value can be
made. An expected present value technique
usually will be the only appropriate technique
with which to estimate the fair value for an asset
SFUJSFNFOUPCMJHBUJPO5PUIBUFOEVOEFSUIBU
technique, reporting entities need to discount
expected cash flows using a credit-adjusted riskfree rate.
www.jpspa.com
January/February 2012
Essentially, fair value measurements that are determined
using an income approach, as detailed in FASB ASC
820, incorporate a risk-free rate of return when present
WBMVFUFDIOJRVFTBSFVTFEJOFêPSUTUPBQQSPYJNBUFGBJS
value. Then, when fair value is the measurement target,
other authoritative literature refers to the guidance
in FASB ASC 820, which serves as the literature that
addresses how fair value measurements should be
determined.
Particularly on point related to whether the AA+ U.S.
sovereign debt rating would be the appropriate rate to
incorporate into measurements using a risk-free rate of
return, the guidance in FASB ASC 715, Compensation –
Retirement Benefits, perhaps provides some of the more
valuable insight. In FASB ASC 715-20-S99-1, information
is included in the FASB accounting standards related
UPB4FDVSJUJFTBOE&YDIBOHF$PNNJTTJPO4&$
TUBê
announcement associated with the selection of the
discount rate used for measuring defined benefit pension
obligations, as follows:
At the measurement date, the SEC staff expects registrants
to use discount rates to measure obligations for pension
benefits and postretirement benefits other than pensions
that reflect the then current level of interest rates. The staff
suggests that fixed-income debt securities that receive one of
the two highest ratings given by a recognized ratings agency
be considered high quality [for example, a fixed-income
security that receives a rating of Aa or higher from Moody’s
Investors Service, Inc.].
Given the above-noted guidance, combined with the
fact that two of the three major rating agencies in the
6OJUFE4UBUFTDPOUJOVFUPHJWFUIF645SFBTVSZUIFJS
IJHIFTUQPTTJCMFSBUJOHTUIFCFMJFGJTUIBU645SFBTVSZ
rates still would constitute risk-free interest rates that
could be incorporated into U.S. GAAP measurements
calling for use of risk-free rates.
This view is supported by the fact that many market
QBSUJDJQBOUTTUJMMWJFXUIF645SFBTVSZBTB"""EFCUPS
In addition, market activity following S&P’s downgrade
PG645SFBTVSZTFDVSJUJFTIBTSFTVMUFEJOZJFMETPOUIPTF
securities that are even lower than the yields that could
be generated before the downgrade.
2
A&A Advisor
WHY DO PROSPECTIVE
FINANCIAL STATEMENTS?
WHAT IS THE
ACCOUNTANT’S ROLE?
Companies try to make informed decisions to deal with
whatever challenge or opportunity may be around the
corner. But they don’t have a crystal ball.
5PQMBOGPSUIFGVUVSFDPNQBOZNBOBHFNFOUVTFT
prospective financial information. The most basic
prospective information is an operating budget, which is
usually prepared on an annual basis. Management uses
this budget to monitor expected operating results against
actual operating results.
The use of budgets allows management to make changes
JGBDUVBMSFTVMUTEJêFSGSPNFYQFDUBUJPOTUIFSFCZ
mitigating the impact of a downturn in revenue or
an increase in expenses. However, as times change, a
company may need more than just annual budgets to
FêFDUJWFMZNBLFEFDJTJPOTBCPVUGVUVSFPQFSBUJPOTPSUP
interest lenders and investors in providing financing to
the company.
Changes in business
conditions – or the desire
to expand – create the need
to consider the impact of
alternatives.
If concerned with estimating future operating results
based on an existing situation only, management can use
a forecast to present that information. If management
XPVMEMJLFUPDPOTJEFSEJêFSFOUTDFOBSJPTQSPKFDUJPOT
based on hypothetical assumptions may be more useful.
Forecasts and projections can be prepared for one year,
or multiple years, into the future. They may also be
prepared for quarterly or monthly periods.
In any case, it is important to remember that, while
prospective financial information can be a useful tool,
it is inherently limited because future outcomes are
impossible to predict.
www.jpspa.com
January/February 2012
Management can use projections:
t 5PPCUBJOëOBODJOHCZTIPXJOH
prospective lenders how the company
will repay debt in future periods
t 5PTIPXQPUFOUJBMJOWFTUPSTIPXUIFBEEJUJPOBM
capital invested will result in an increase in the
value of the company over time or provide a
return on the investment from operations
t 5PBTTJTUXJUIEFDJTJPOTSFHBSEJOH
expansion, investing in property, starting
a new line of business or terminating
an existing product or service
Projected financial information can be limited to cash
flows, or it can be in the form of a full set of projected
statements on the accrual basis.
Projections and forecasts are based on assumptions,
which should be clearly presented so a user of the
prospective financial information can evaluate their
reasonableness. While forecasted financial information
can be for general use, projected financial information
must be restricted in use.
Accountants can assist in the preparation of forecasts and
projections in a variety of ways. They can either examine
or compile prospective financial information (from
financial information and assumptions provided by
management), depending on whether a level of assurance
is needed.
The accountant can also perform “agreed-upon
procedures” to forecasts or projections prepared by
the client. All interested parties would agree to
these procedures.
The accountant’s role in performing an examination
includes reviewing the underlying documentation
in support of the assumptions and assessing the
reasonableness of the assumptions. The accountant
who compiles the prospective information provides no
assurance on the reasonableness of the assumptions.
In preparing the assumptions used in generating
prospective financial information, industry knowledge,
historical knowledge about the company and its
operations, and an awareness of economic conditions
and their impact on the company are crucial. In
addition, the accountant should consider other factors,
such as the impact of competition, interest rates,
demographics and other relevant matters.
3
A&A Advisor
The accountant’s role may
include guiding management
in making reasonable
assumptions and in modeling
particular scenarios. But the
ultimate responsibility for the
assumptions and scenarios
rests with management.
At a minimum, the accountant must issue a
compilation report whenever the CPA firm is
associated with prospective financial statements
provided to third parties. If prospective information
is for internal use only, a compilation report is
not required, and the CPA acts solely in the role
of a consultant to management in preparing the
prospective information.
In either case, the accountant obtains an engagement
letter to clearly indicate the role of the accountant and
the limitations on the services provided.
Projections and forecasts can be generated using
spreadsheet software with formulas that allow for
an easy adjustment to amounts when assumptions
change. Also, software products are available to
handle more sophisticated modeling of various
“if-then” scenarios and to generate a full set of
prospective financial statements: balance sheets,
income statements and cash flow statements.
Whenever there is a need to plan for the future or
evaluate alternative plans for company operations,
management can use prospective financial information
as a tool in making decisions. And third parties,
such as lenders or investors, may give prospective
information more credibility if the accountant
plays a role in reporting on that information.
www.jpspa.com
January/February 2012
WHEN IT COMES TO IT
SECURITY – CHOOSE THE
REPORT TO FIT THE PURPOSE
If you have been in the service industry for a while and
have a basic understanding of internal control audits,
you probably have heard of a Statement of Auditing
4UBOEBSET/PSFQPSU
SAS 70 has been a huge success thanks to an
ever-increasing demand by clients for a detailed
understanding of their service provider’s process and
internal controls. The industry demand has expanded
the SAS 70 report’s coverage areas beyond its original
intention: an internal control audit focusing on the
service providers’ systems relevant to their clients’
financial reporting.
What is an SOC 2 report?
One of the most common areas outside the traditional
4"4GSBNFXPSLJTBTFSWJDFQSPWJEFST*5PQFSBUJPOT
(e.g., data security). The service provider’s management
and various external parties, such as users, regulators,
business partners and prospective clients, constantly
demand assurance in this area.
Facing this dilemma, the American Institute of CPAs
replaced SAS 70 with the new Service Organization
Controls (SOC) reporting package, which includes three
reports. SOC 2 is the dedicated reporting mechanism for
BOJOEFQUISFWJFXPGUIFTFSWJDFQSPWJEFST*5JOUFSOBM
controls.
What organizations should consider
an SOC 2 report?
Although any service provider can have an SOC 2
report, this report is more suitable for organizations
whose main business is to collect, process, transmit,
store, organize, maintain or dispose of information for
other entities. Ideally suited for the SOC 2 report are
cloud computing companies that provide on-demand
network access to a shared pool of configurable
computing resources.
*GZPVSDPNQBOZTNBJOCVTJOFTTJTIFBWJMZ*5ESJWFO
and, in the past, you were unsure of an SAS 70 audit’s
relevancy to your firm, you will now find the SOC 2
report is relevant because it is specifically designed
GPS*5JOUFSOBMDPOUSPMT
4
A&A Advisor
For service providers whose primary business is not
BT*5ESJWFOCVUXIPXPVMEMJLFUPSFWJFXJOUFSOBM
DPOUSPMTJOTPNFHFOFSBM*5SFMBUFEBSFBTTVDIBT
physical access to a server room or the logical access
to operating systems, an SOC 1 report may be a good
PQUJPO*UTDPWFSBHFPG*5SFMBUFEBSFBTJTMFTTFYUFOTJWF
than an SOC 2 report but can provide some basic level
of assurance on information security.
An SOC 1 report covers service providers’ internal
control relevant to users’ financial reporting. The reason
GPSBMMPXJOH40$UPDPWFSCBTJD*5DPOUSPMTJTUIBU
these controls are so pervasive that nonaccomplishment
will cause disruption to the entire business function.
How do SOC 2 and SAS 70 differ?
SOC 2 does not give service providers much discretion
to determine what can be included in the report. But,
under SAS 70, service providers can determine what
they want to achieve by defining control objectives
based on their own assessment of pertinent risks.
Under SOC 2, service providers choose one or more
of the five principles – security, availability, processing
integrity, confidentiality and privacy – defined by
UIF5SVTU4FSWJDFT1SJODJQMFT541
5PNFBTVSFUIF
achievement of the selected principles, they must use
BMMDSJUFSJBMJTUFEJOUIF541PSUIF(FOFSBMMZ"DDFQUFE
Privacy Principles.
www.jpspa.com
January/February 2012
Who are the primary users
of SOC 2 reports?
(JWFOUIFVOJWFSTBMJOUFSFTUJO*5DPOUSPMTBO40$
report is designed to have a broader audience than an
SAS 70. Expect to see a continued growth in demand
from various external parties, such as regulators,
business partners and prospective clients.
However, an SOC 2 report is considered a restricteduse report and should not be used as a mass marketing
tool. At a minimum, the intended audience should have
knowledge about the service providers’ business processes
and the interaction of the service providers’ systems
with clients.
;LSMWUYEPM½IHXSGSRHYGX
an SOC 2 exam?
At minimum, practitioners should have:
t &YQFSJFODFJOBUUFTUBUJPOFOHBHFNFOUT
for example, SAS 70 audits
t ,OPXMFEHFPGUIFSFMFWBOUTUBOEBSET
GPSFYBNQMF541
t ,OPXMFEHFPGUIFTFSWJDFQSPWJEFSTJOEVTUSZ
Although an SOC 2 is a new reporting format, the
underlying standards have been around for a number
of years and may be the most relevant guidance for
*5SFMBUFEJOUFSOBMDPOUSPMT
Service providers can add additional criteria, but any
omission of those pre-defined criteria must be justified
and explicitly explained in the SOC 2 report.
5