The first in a three-part series on strategies to minimize costs of upcoming Independent Private Sector Audit (IPSA) of the CMR required under the SEC final conflict minerals regulation. Each installment focuses on one strategy.
For companies subject to SEC’s conflict minerals rule, independent third party audits (IPSAs) of their Conflict Minerals Report (CMR) are required depending on the outcome of their due diligence process1. While the final regulation specifies the audit objective and auditing standards, many questions exist as to what the audit will involve and how much it will cost. Both the AICPA and The Auditing Roundtable have developed guidance for auditors in applying the GAO “Yellow Book” standards.
Recall that the SEC’s stated audit objective has two components – the auditor is to express an opinion or conclusion as to whether
- the design of the issuer’s due diligence framework as set forth in the Conflict Minerals Report, with respect to the period covered by the report, is in conformity with, in all material respects, the criteria set forth in the nationally or internationally recognized due diligence framework used by the issuer, and
- whether the issuer’s description of the due diligence measures it performed as set forth in the Conflict Minerals Report, with respect to the period covered by the report, is consistent with the due diligence process that the issuer undertook.
Restated for simplicity,
- does the company’s due diligence framework – as it is described in the text of the CMR – conform to an accepted standard, and
- did the company actually do the due diligence activities it described in the CMR as having been undertaken.
The audit will not offer an opinion on the actual effectiveness of the company’s programs or due diligence efforts. In the preamble to the final regulation, the SEC stated that they
… recognize that an audit objective requiring an auditor to express an opinion or conclusion as to the design and description of an issuer’s due diligence measures is not as comprehensive as an audit objective requiring an auditor to express an opinion or conclusion as to the effectiveness of due diligence measures or the accuracy of conclusions in the Conflict Minerals Report.
77 Fed. Reg. 56329 (Sept, 12, 2012)
So let’s face questions most (especially consultants and auditors) don’t want to ask out loud – what is the value of the IPSA, and is it worth the expense? Are there ways to reduce the cost of the audit?
We won’t address the first question, as each company will answer that in their own context.
On the cost question – regardless of whether there is perceived value in the expenditure – we believe opportunities exist to manage costs while still producing an audit of the necessary quality and scope of the regulations and the GAO audit standard.
We see three main considerations in reducing IPSA costs. The first two are fairly traditional audit concepts; the third delves into details of what constitutes conflict minerals “due diligence”. This article will look at audit planning; the others topics will be covered in later installments.
As with any audit, planning is crucial to success and cost management. Representative sampling parameters can have a significant cost impact. For IPSAs, this may be most important in the context of the second objective, which is likely to have a larger universe of potential audit evidence that the first objective.
Another scope and cost matter is how an auditor deals with supplier or contract manufacturer location visits as part of the implementation verification. Planning certainly impacts if/how/how many such visits are addressed within the audit; but we believe there is a threshold matter of whether visits to supplier or contract manufacturer locations should be conducted as part of the IPSA at all2.
Generally speaking, the use of contract manufacturers can reduce the IPSA cost, as implementation verification does not mandate visits to those locations. SEC’s regulation allows reliance on representations made by suppliers and doesn’t specify particular forms of verification as part of the due diligence (or RCOI for that matter).
This article looked at only one example of planning. Other matters can impact the cost of the IPSA as well which we did not explore, such as sampling parameters and the need for testing of controls associated with the audit evidence.
1 We realize that many companies will fall within the two-year deferral tied to a “DRC conflict undeterminable” classification.
2 Part 3 of this series will discuss the due diligence process scope in relation to the IPSA, and why supplier/contract manufacturer CSR visits are outside outside the conflict minerals due diligence framework and also an IPSA.
This article was updated to reflect new information after the original publication date, and represents views, observations and opinions of The Elm Consulting Group International LLC/Elm Sustainability Partners LLC and is not to be construed as legal advice, nor should it be relied on without appropriate business and legal reviews.