Circuit City 2005 Annual Report Download - page 32

While progress is being made to remediate the material weaknesses identified, we are continuing to monitor
these processes to further improve our procedures as may be necessary.
Our former independent registered public accounting firm, Deloitte & Touche LLP, issued a material weakness
letter to the Company which addressed both the weaknesses at the Company’s United Kingdom subsidiary and
inadequate oversight and control activities on the part of senior management of the Company over its remote
subsidiaries. These matters were discussed in detail among management, the audit committee and our former
independent registered public accountants.
Section 404 of the Sarbanes-Oxley Act
We are not yet subject to the internal controls certification and attestation requirements of Section 404 of the
Sarbanes-Oxley Act of 2002 because we are not an accelerated filer. Based on SEC implementing regulations in effect
as of June 30, 2006, at the end of fiscal year 2007 Section 404 of the Sarbanes-Oxley Act of 2002 will require that
management provide an assessment of the effectiveness of the Company’s internal control over financial reporting and
that the Company’s independent registered public accounting firm will be required to audit that assessment.
We are continuing to work to achieve compliance with the requirements of Section 404. We have dedicated
substantial time and resources to documentation and review of our procedures, including the hiring of additional
internal audit staff in both the United States and in Europe. We will also evaluate the need to engage outside
consultants to assist us. We have not completed this process or its assessment, due to the complexities of our
decentralized structure and the number of accounting systems in use. We have not completed our assessment of our
internal control over financial reporting. In addition to the two material weaknesses as of December 31, 2005 discussed
under the caption “Disclosure Controls and Procedures,” we have identified a number of internal control significant
deficiencies, including controls in the information technology area, that may affect the timeliness and accuracy of
recording transactions and which, individually or in the aggregate, could become material weaknesses in future periods
if not remediated. While the Company does not believe that the following are currently material weaknesses, they are
designated as significant deficiencies as of December 31, 2005:
We have a significant amount of work to do to remediate the items we have identified. In the course of
completing our evaluation and testing we may identify further deficiencies and weaknesses that will need to be
addressed and will require remediation. We may not be able to correct all such internal control deficiencies in a timely
manner and may find that a material weakness or weaknesses continues to exist. As a result, management may not be
able to issue an unqualified opinion on the effectiveness of the Company’s internal control over financial reporting as
of December 31, 2007, if required.
Changes in Internal Controls Over Financial Reporting
Our management is not aware of any changes in internal control over financial reporting that occurred during the
quarter ended December 31, 2005 that materially affected, or were reasonably likely to materially affect, our internal
control over financial reporting.
Item 9B. Other Information.
• The disparate operating and financial information systems used at certain of our locations have inherent
limitations resulting in a control environment heavily reliant upon manual review procedures and
adjustments. These deficiencies include inadequate or lack of systems interfaces and the preparation of
numerous manual journal entries.
• Internal control deficiencies in the information technology area include lack of adequate general controls.
We lack program change and project management controls, have inadequate segregation of duties between
information technology department development and production functions, need formal information
technology strategic planning, need formal documentation of information security procedures, need
security around user rights to certain application systems and need to implement formal help desk
procedures.