404(b) Delay: Not Likely to Change Much

News that the Securities and Exchange Commission will probably give smaller companies yet another extension on the auditor’s attestation requirement of Sarbanes-Oxley has certainly set much of Corporate America abuzz—but don’t expect it to change all that much, experts say.

A delay would give issuers with less than $75 million in market capitalization more time to get their internal controls in order and provide a welcome break on audit fees for another year. Other than that, experts say a one-year delay is unlikely to change the plans of most issuers; either they’re well along in their Section 404 compliance efforts and will press on, or have been procrastinating since the start and will keep on doing so.

Rhodes

Since non-accelerated filers did not need to comply with the auditor attestation requirement this year anyway, it shouldn’t change their current efforts, says Mike Rhodes, head of the corporate governance practice at auditing firm Citrin Cooperman. “The delay doesn’t change anything management has to do. It just delays when the auditors get involved,” he says.

SEC Chairman Christopher Cox startled the business community last month when he announced that he would seek another year’s delay for Section 404(b) of Sarbanes-Oxley for non-accelerated filers. The provision requires companies to get an external auditor’s attestation that internal controls over financial reporting are effective, and it had been set to apply to non-accelerated filers for fiscal years ending on or after Dec. 15, 2008. Now it seems likely the Commission will push that deadline back to Dec. 15, 2009.

Section 404(a), which requires companies to conduct their own assessment of internal controls, went into effect last month. Non-accelerated filers will now need to include that assessment in their next annual report, as large filers have done since 2005.

Speaking before Congress on Dec. 12, Cox said he would recommend another one-year delay of 404(b) while the SEC conducts a cost-benefit study of Section 404 generally. Corporate America has largely denounced the rule as more expensive than its worth, and backlash over its initial implementation led the SEC and the Public Company Accounting Oversight Board to scrap the original standards auditors and companies used to assess internal controls.

The cost-benefit study ostensibly is to see how new, more relaxed compliance guidance issued last year is working, and Cox says non-accelerated filers should not have to comply with Section 404(b) until that study is complete and its findings digested.

Those who spoke with Compliance Week in the days after Cox’s testimony say most small public companies are aware of the news, but don’t want to change course after months of preparing for Section 404 compliance anyway.

Levy

“Every single CFO asked us about the impact of the potential delay,” says Peter Levy, a partner at audit firm Sobel & Co. who works with about a dozen non-accelerated clients. “And every one said they’re interested in assuring their financial house is in order and it’s full steam ahead.”

Rhodes also says his clients are all moving “full force ahead.”

Still, the small companies already tending to their SOX obligations aren’t the ones people are worried about. Trent Gazzaway, a partner at auditing firm Grant Thornton, says most non-accelerated filers “really haven’t done anything to support their assertions about the effectiveness of their internal controls this year.”

Benoit

Likewise, Bob Benoit, president of Lord & Benoit, which specializes in SOX compliance for smaller public companies, says: “My guess is there are about 4,000 companies out there who’ve done nothing and would like to continue to do nothing.”

Rhodes agrees. “I’m guessing any companies that have suspended what they were doing are companies that weren’t taking this that seriously to begin with,” he says.

If another delay is approved, observers say it will become even tougher to convince procrastinators that they need to take Section 404 compliance seriously. And those are the companies that most need to improve their internal controls.

Ueltschy

“Because of the repeated delays, smaller issuers are becoming increasingly confident that they will never be required to have an auditor assessment of their controls,” says Richard Ueltschy, head of Crowe Chizek’s financial institution audit practice.

Gazzaway notes that smaller companies have more restatements, more material weaknesses, and more instances of fraud. If the auditor requirement is put off another year, he says, most companies will just postpone evaluating their controls.

“The value of the audit is that when people know somebody independent is looking over their shoulder, they tend to do the right thing,” Gazzaway says. “I’m not suggesting … that all non-accelerated filers have terrible internal controls, but a naiveté exists about the strength of their internal controls because those organizations haven’t taken a hard look to see if their internal controls are effective or not.”

Levy and other observers say they expect a repeat of what happened when accelerated filers had their first auditor assessments under Section 404: Companies will state that their internal controls are fine, and then get a rude awakening when the auditors show up one or two years later. “Companies that should’ve never gone public in the first place will have the most onerous issues,” Levy says.

Creating Confusion

Cox’s announcement is sending a somewhat mixed message. While the chairman has long said that all companies eventually will be required to comply with Section 404, in his testimony he said another delay is necessary “to base our decision on final implementation of Section 404(b) on the best available cost data.” That has some people wondering whether the SEC might change its plans yet again.

“I don’t think it’s what they intended, but that sends the message that it’s possible, even then, that this may be delayed further or could go away,” Gazzaway says. “Companies are saying, ‘Why would we want to go through this effort when it’s been delayed every year and it sounds like it’s going away?’”

As for the Section 404 cost-benefit study the SEC will presumably conduct in coming months, observers say it’s unlikely to provide much insight on Section 404 burdens for the smallest companies. That study, which isn’t expected to be complete until at least June, will be based on data from accelerated filers and will focus on those complying with Section 404 for the first time.

“Unfortunately I think it’s going to be another situation where we’re chasing our tail,” says Rhodes. “There’s no real data to benchmark against and we’re not going to be able to assess the true costs until these companies go into full implementation.”

Gazzaway

Since the data will come from companies with a market cap of at least $75 million, it will be of limited use for determining true costs for the smallest companies. “They can take the larger company data and infer what it means for small companies, but we’ve already done that,” says Gazzaway.

Levy dismisses the study as “lip service.” “It’s a political tool, a vehicle to accomplish whatever way the SEC decides to follow based on the political winds,” he says.

Moreover, Gazzaway adds, “You can’t look at audit fees in a vacuum.” Numerous factors, such as mergers and acquisitions and new accounting standards, all affect audit fees each year, he says.

“The hours involved in internal controls audits are coming down across the board, but other hours are replacing them,” he says.

“In the absolute worst case, if 404(b) gets repealed for non-accelerated filers legislatively or through weak regulation, they’re the ones who will suffer the most,” says Gazzaway. “The gap between the quality of their financial reporting and that of 404-compliant companies is already there and it’s going to continue to widen.”

The result, he says, will be a higher level of risk associated with those financial statements that investors will have to factor into the cost of capital. “That all translates into more audit procedures and higher rates per hour,” he adds. “Companies will have to pay auditors to audit around bad internal controls systems.”