XBRL IS being audited - at what cost?

Imagine being called to the stand in court and being asked "So, what 'good faith efforts' did you make to ensure that there were no errors in your filing to the SEC?" That question has been keeping CFOs, Audit Partners, and more recently Audit Committees up at night. Certainly the traditional filings in HTML format (for 10Ks and 10Qs) are subject to audit and review as required by the SEC. The XBRL versions of the same documents do not carry that requirement, so nothing "must" be done. 

The same holds true in the UK, where the is no requirement for assurance over the XBRL versions of financial statements that will be filed with the CT600 to HMRC starting April 2011. Only the Danes seem ready to require assurance, and that remains to be defined.

In 2008 I wrote "XBRL Will be Audited", and " and in November 2009, I wrote "So, What about Assurance (or, "Lord make me virtuous, but not yet").

There is of course no mandate for assurance (or audit) of XBRL filed with the SEC today. Filers have been provided with a 2-year window of litigation relief provided they are able to demonstrate a "good faith effort" to produce error-free XBRL. What happens after that 2-year window is anyone's guess. As the first-tier filers are coming up on that 2-year period, I expect they are asking themselves what a "good faith effort" is, especially if some filers are opting for some form of assurance.

XBRL has turned out to be about as expensive as the SEC estimated (for first year, block tagging). But those cost estimates did not include any costs for assurance over the XBRL. This is a cost to filers that was not estimated in the proposed and final rules (because it is not mandated). And if you ask them, the SEC will say "No, assurance is not required. We would hope that companies will take whatever steps they think are appropriate to ensure that their XBRL data is error-free, but we do not require assurance. That is a market led issue."

But make no mistake, XBRL IS being audited. We just aren't allow to call it that. Officially, "reviews" of XBRL are being performed under the guidance provided in the Agreed Upon Procedures (AUP) recommendations of the AICPA.

So what is the price of sleep? Apparently sleep starts around 60 auditor hours, and grows to at least 100 - all for the first filings. Second year (detailed tagging) and the cost of a good night's sleep increases to well over 200 auditor hours. So, on top of the SEC's estimates, companies should expect an additional $15,000 - $25,000 in auditor fees (although from what I've heard, the floor really is around the $25,000 level). Second year (detailed tagging) costs will probably be closer to an additional $50,000 - $75,000 in audit fees.

Now if you are a $1million - $3million in audit fees company, then that extra is pretty cheap for a good night's sleep.

But if you are a third-tier, non-accelerated filer, than those costs are simply outrageous, and other solutions for assurance over the XBRL will need to be found - fast.

Such solutions are possible, but I have yet to see them reach the market, and I am watching for those solutions. But today, the major accounting firms have no incentive to actually create such process improvements or tools - their giant clients are willing to pay the extra, and as they have the few skilled individuals, they are able to charge a premium for those services.

But for the remainder of the market, substantive testing of every tagged element simply does not seem to make sense, or at least as much sense as substantively testing each entry in the financial statements. And we know that does not happen - that's what "materiality" and "sampling" are all about.

But better ways are possible. Cheaper, faster. Just not on the market - yet.

A work in progress