New Concern: Materiality Determination In 308(c)

Now that the first deadline related to Section 404 of The Sarbanes-Oxley Act has come and gone, companies are focusing on quarterly disclosures of changes in internal controls over financial reporting mandated by Item 308(c) of Regulation S-K.

A provision somewhat forgotten amid the chaos of 404, Item 308(c) requires companies to “[d]isclose any change in the registrant’s internal control over financial reporting identified in connection with the evaluation [of internal controls] that occurred during the registrant’s last fiscal quarter … that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting.”

Seidel

Up until now, Item 308(c) has largely been off executives’ radar screens. “People really haven’t had to look at 308(c),” notes Amy Seidel of Faegre & Benson in Minneapolis.

Part of the reason Item 308(c) hasn’t garnered much attention up until now is that the SEC has indicated that disclosures of changes to internal controls wouldn’t be required before the initial Section 404 assessment was completed.

Graff

And that’s a reasonable position, says Edmund Graff, a partner in the Washington, D.C., office of Pillsbury Winthrop Shaw Pittman. “It makes sense that, until you made your initial evaluation of internal controls, you wouldn’t need to talk about any changes in advance of [those] assessments,” he says.

At the same time, however, disclosure of changes to internal controls has been required since 2002; Section 302 of Sarbanes-Oxley requires that companies disclose “whether there have been significant changes in the issuer's internal controls….” As a result, Item 308(c) shouldn’t be a major surprise to most companies. “With the first quarter of the evaluation requirement kicking in,” says P.J. Himelfarb of Weil Gotshal & Manges in Washington, D.C., “it’s just a formalization of a process that companies have gotten through for a few years.”

Himelfarb

The issue, says Himelfarb—who previously served as special counsel in the Securities and Exchange Commission’s Division of Corporation Finance—may be determining what must be disclosed. “The only real change is that, as part of a rigorous 404 process, you may have identified a lot of deficiencies, things may be more things ripe for disclosure, and [there may be] more challenges for determining what is material,” says Himelfarb.

Besides materiality, there is the question of timing; namely, should companies disclose quarterly updates before filing their first 10-K assessment of their internal control over financial reporting. Graff at Pillsbury Winthrop Shaw Pittman admits that companies have been “doing it both ways,” with some disclosing changes to internal controls and others holding off until after the initial evaluation of internal controls was completed. However, notes Graff, “we were advising our clients that they should go ahead and disclose the changes they were making even before that,” he said.

Some Uncertainty

On Oct. 6, 2004, the SEC released its second set of answers to “frequently asked questions” about Section 404 of Sarbanes-Oxley. In that FAQ, the Commission addressed the following question: “Is a registrant required to disclose changes or improvements to controls made as a result of preparing for the registrant’s first management report on internal control over financial reporting?”

The response to that question was:

“Generally we expect a registrant to make periodic improvements to internal controls and would welcome disclosure of all material changes to controls, whether or not made in advance of the compliance date of the rules under Section 404 of [SOX]. However, we would not object if a registrant did not disclose changes made in preparation for the registrant’s first management report on internal control over financial reporting. However, if the registrant were to identify a material weakness, it should carefully consider whether that fact should be disclosed, as well as changes made in response to the material weakness. …”

While the answer to the question was loose, and while many experts felt the FAQ offered a reprieve for some issuers, it’s no surprise that companies still felt pressure to disclose. “FAQ number 9 basically said you don’t have to foreshadow what’s going to happen with 404,” says Himelfarb. “There was some break as you got ready for 404, but you always had 10b-5 [to think about] and, if you had a material weakness, the better course clearly was to disclose changes made in response.”

Gunning

Gina Gunning of Jones Day in Cleveland agrees. “The staff FAQ may have created some uncertainty as to when 308(c) disclosure is required in relation to preparation for the registrant’s first management report on internal control over financial reporting.” However, Gunning notes that “the certifications required by Section 302 of Sarbanes-Oxley have led prudent registrants down the path of compliance with 308(c) since its inception.”

Echoing the sentiments of Graff at Pillsbury Winthrop Shaw Pittman, Gunning says that, “a lot of registrants, if not most registrants, have been complying with 308(c) all along.”

Determining Materiality

The focal point when it comes to 308(c) reporting is determining when a change to internal controls over financial reporting is “material.”

Seidel of Faegre & Benson acknowledges there’s “not a lot of guidance” in terms of determining what is material. “It’s very much a facts and circumstances test—it’s not a bright-line test. The purpose behind 308(c) is to disclose any change that makes the evaluation you made at year-end somehow unreliable for investors.”

That includes changes made even though an earlier problem hasn’t been identified, she notes. “Even if you didn’t have any problems and didn’t disclose any weaknesses, if you make a material change, you have to disclose [that]—even if it’s an improvement, an enhancement, a better way. If, at the end of the year, you told me that your controls were effective and you’re making changes, as an investor I want to know [that],” she says.

In trying to decide what an investor wants to know, Graff says companies “need to look at what would be the impact if something went wrong with that control.” Of particular importance are changes to key controls that could impact the veracity of a company’s financial reporting. “Clearly if you have a control, a key control, and if there was a problem with that control which could arise to the level of a material weakness and you make any change to that control that hasn’t gone through [the Section 404] scrutiny, that’s the kind of disclosure that you need to put in,” says Graff, “alerting investors that you have a control that is no longer the same that it was.”

Himelfarb notes that “there’s been a lot of debate about whether the [SEC] staff should give more guidance on materiality. … People are split, a lot of people would like a lot more clarity on materiality. [Others say,] be careful what you wish for.”

Seidel said she attended a recent Section 404 roundtable where many of the participants were hoping the Commission would provide more guidance on what is material. “I think that’s impossible,” she says. “Materiality really is a facts and circumstances, company-specific determination. Companies [may just] have to live with some amount of uncertainty. To expect the SEC to define it much better is hoping for something that’s just not going to happen.”