Paying royalties: How music licensees can prepare for the new attestation requirements July 30, 2015 Share Subscribe RFP More than a century ago, Congress amended U.S. copyright law with Section 115 of the Copyright Act, which gives anyone the right to make and distribute a copy of a musical work without permission, so long as the licensee follows the law and pays a set royalty to the copyright owner.1 This compulsory license, meant to prevent monopolistic behavior, was created at a time when the primary method of copying and selling musical compositions was through perforated player piano rolls.2 Sadly, copyright law has not kept up with changes in technology. As anyone in the modern music business can attest, the onset of digital media has changed the paradigm for both music copyright owners and compulsory licensees. The U.S. Copyright Office acknowledges that current rules are in dire need of reform to modernize and encourage licensees to remove gross inefficiencies.3 Antiquated systems for collecting and storing data on music recordings and their owners, for example, create risks for all who license and sell musical works — from Apple to local recording studios. (See sidebar: “Who are today’s compulsory licensees?”) Even diligent licensees that devote significant resources to track this information can’t always find who owns copyrights for certain recordings or the underlying musical work. This state of affairs sets the stage for mistrust and rampant lawsuits for unpaid royalties. Who are today’s compulsory licensees? There are generally two types of organizations that license and distribute copyrighted musical works: large players such as Apple, Spotify and Amazon, which have ample resources and know-how, and smaller tech companies with fewer staff members and resources. While the staff at the smaller companies may be talented, their talents don’t necessarily apply to complex regulatory issues. The big three music groups (Sony, Warner and Universal) sometimes negotiate directly with a copyright holder to use their works, in which case they are no longer considered compulsory licensees. Regardless of their size, all licensees are affected by these regulations, and royalty payment disputes can lead to incomplete music libraries — a key differentiator in the industry.As a first step toward crafting a new vision for the music industry, in early 2014 the U.S. Copyright Office solicited input from any and all music industry participants. Among its conclusions are that it’s impractical to overhaul the system, but step-by-step efforts can make progress. New regulations issued in November 2014 target the issue of collecting and storing data. One rule requires that licensees follow a set of guidelines, and include much more detail in the monthly and annual statements provided to copyright owners to whom they pay royalties. By formally implementing and documenting processes and controls over annual reports, both manual and automated, and by having a CPA certify that those controls are well-designed and operating effectively, licensees can expect to drastically reduce their risk of being sued for not paying royalties. For most licensees, however, complying with the new regulation will require a significant amount of work — and with maximum judgments for noncompliance up to $150,000 per infringement, the stakes are high. The good news is that licensees have some leeway to design a process that works for their organization and then engage a CPA to determine whether it’s robust enough to satisfy regulatory scrutiny. To put these robust controls in place and comply with the new reporting and attestation requirement, licensees must review their existing monitoring and testing processes, document the criteria that management will use to support its written management assertion — in other words, their written claim that they’ve paid all the royalties due — and then determine the exact steps they will take to comply with the regulation. Preparing for the new standard: A roadmap Until now, the music publishing industry has been largely based on relationships. Big publishers simply trusted that licensees with which they have deep, long-term ties were providing accurate royalty statements. However, while compliance used to be somewhat haphazard, by the end of 2015 it’s likely that licensees will no longer be able to delay adhering to this standard. Enforcement of this new regulation is inevitable. Technically, licensees are required to issue these annual reports “on or before the 20th day of the sixth month following the end of the fiscal year covered by the Annual Statement.”4 But the real timing will most likely be driven by when publishers request them — and exactly when that will happen is unclear. Since it could take up to six months to ensure that proper controls are in place and the consequences for inaction are severe, licensees must be prepared to issue these reports and attestations whether or not publishers have already asked for them. If a licensee fails to issue an annual report that shows evidence of having the proper controls in place, they will receive a warning and have just 30 days to do so. If they don’t issue the report, the licenses in question are no longer valid, and the licensee is considered a copyright infringer. At that point, they may face lawsuits where fines could go as high as $150,000 for each infringed work.5 For a company that licenses a million titles per year, this could mean crippling fines. By taking the following steps, licensees can ensure that, when the time comes, they will be compliant. Conduct an internal review A licensee must start by reviewing its own existing monitoring and testing processes to determine whether they are sufficient and whether they will provide all the data necessary to construct the written management assertion required by regulators. Typically a licensee would want a trusted outside party — a CPA firm — with industry experience and deep knowledge of the new rules to come in and assist with a readiness assessment. Generally a company’s finance team and royalty department will lead the effort and manage the relationship with the CPA firm. IT personnel are also heavily involved since the bulk of the necessary data — even at the smallest companies — is processed through automated systems. The first phase of the readiness assessment generally is as follows: The engaged CPA firm meets with each of the company’s functional leaders to develop a project plan and assign responsibilities and timing for both the CPA firm and the company’s internal professionals. The CPA firm holds meetings to learn about the business process and identify controls in place to meet all criteria. They will then discuss how to test each new control and work with management to determine the type of evidence required to test each activity. Finally, the CPA firm provides a gap analysis detailing where controls are adequate and where there are gaps or deficiencies, walks company leaders through the gaps that need to be addressed and provides recommendations for remediation. Generally this process takes two to four weeks and ends with a written report to management with suggestions for remediation strategies, so that remediation efforts can begin as soon as possible. There is typically a lag time of up to three months between when the CPA firm provides the gap analysis and when it conducts the audit, to give the company ample time to solve problems and put the proper controls in place. Remediate any identified deficiencies To avoid conflicts of interest, the CPA firm cannot be involved in designing and implementing any needed remediation actions, processes and controls. Where internal resources are thin or perhaps lacking the necessary know-how, some companies choose to hire a consultant to fix operational deficiencies. Others choose to manage this internally. In our experience, there are several common operational issues associated with calculating royalties on licenses that companies can address themselves: Sometimes miscalculations occur where the compositions that fall under the license requirement might not actually be the right compositions. Poor processes result in licensees incorporating into their total count items such as speech, nature sounds and other recordings that don’t belong. Some companies that stream music pay per composition, when they should actually be paying per subscriber, which would result in a smaller royalty amount. Smaller, newer companies may not have taken the time to implement adequate internal controls, in which case they may need to start from scratch. Older, larger companies frequently use legacy systems, such as mainframe computers, to calculate royalties. For several reasons — most due to the fact that these legacy systems lack transparency and are unwieldy after years of custom modifications — it is extremely difficult to put internal controls in place. Licensees must then decide to either replace their entire IT system or switch to manual calculations. The one common theme among licensees large and small is that given all of their business functions, the calculation and processing of royalty payments seem to garner the least amount of control. Devising the proper remediation strategies and implementing internal controls around the royalty process will not only mitigate the risk of lawsuits or regulatory fines over missed payments but also help ensure more reliable and cost-effective financial reporting. Good controls help ensure that reported financial data is accurate and complete, and they can substantially reduce the amount of testing external auditors would have to perform, saving money. Perform the CPA audit Finally, licensees will have to hire the right third party (or parties) to act on their behalf and provide audit services for their annual statements. According to the latest regulation, annual statements of account must be in compliance with regulations issued by the Register of Copyrights, which calls for the annual statement of account to be prepared in accordance with the attestation standards established by the AICPA and certified by a licensed CPA firm. Now, this may be the rule, but it’s rather confusing since the attestation standards do not dictate how to prepare a report, establish processes and controls, or comply with regulations. The attestation standard is written for auditors, not for management. Nonetheless, experienced auditors with a deep understanding of both internal controls and regulators’ concerns will ensure that licensees’ annual statements of account pass muster. The time to act is now But what if the CPA firm’s readiness examination uncovers internal processes and controls that aren’t up to snuff? Clearly, completing a readiness assessment before an audit is critical to make sure that process gaps are filled in and regulators’ requirements are met. Compulsory licensees that fail their certification test put themselves at great financial risk — perhaps even at risk of bankruptcy. If for any one licensee the sheer amount of data involved precludes the CPA firm from certifying the actual figures on the annual statement — a publisher may have 1,000 statements, for example — the CPA firm may instead sample controls and conduct an examination in accordance with the attestation standards established by the AICPA to certify: That the processes used, including how the licensee calculates statutory royalties, resulted in annual statements that conform to the new standards outlined by the regulation That during the period covered by the statement, the licensee’s related internal controls were suitably designed and operated effectively Download the PDF. Contacts Lawrence Griff Partner, Audit Services T +1 203 327 8370 E firstname.lastname@example.org Kristina Vieni Managing Director, Special Attestation Reporting T +1 212 542 9612 E email@example.com 1 United States House of Representatives, 110th Congress, first session. “Statement of Marybeth Peters, The Register of Copyrights, Before the Subcommittee on Courts, the Internet, and Intellectual Property, Committee of the Judiciary,” March 22, 2007. See www.copyright.gov for details. 2 Ibid. 3 United States Copyright Office. Copyright and the Music Marketplace: A Report of the Register of Copyrights, p. 132, February 2015. See www.copyright.gov for details. 4 See U.S. Copyright Office, Title 37, Part 210, Subchapter A — Copyright Office and Procedures at www.copyright.gov for details. 5 See Purdue University Copyright Office, “Copyright Infringement Penalties,” at www.lib.purdue.edu for more on copyright penalties.