Rumors Fly On SOX, AS2 Changes

Speculation on how regulators may amend compliance rules for Sarbanes-Oxley has reached a fever pitch recently, as the Securities and Exchange Commission and the Public Company Accounting Oversight Board prepare to release critical guidance for 2007 within weeks.

The new rules should focus on two distinct but related issues: guidance to help corporate executives understand their responsibilities when they assess their internal control over financial reporting, and changes to Auditing Standard No. 2, which external auditors use to conduct their own review of a company’s internal controls. Corporate America has hollered for years that it has too little of the former, leaving businesses with little recourse when auditors use AS2 to enforce draconian crackdowns on internal controls.

In principle, the PCAOB will issue changes to AS2, while the SEC will amend regulations for SOX and the internal control provisions in Section 404 of the law. Both agencies, however, have said they want to release any changes in tandem, so businesses can digest all of the implications at one time. The PCAOB is expected to kick off the process by issuing its proposed revisions in early December; the SEC will unveil its proposed guidance for management at its next open meeting on Dec. 13.

“The goal is for both documents to be out contemporaneously and to have everything resolved by spring in time to have an impact on next year’s financial reporting,” SEC spokesman John Nester told Compliance Week.

The guidance will be all the more important because non-accelerated filers—the vast majority of publicly traded companies in the United States—haven’t yet had to comply with Section 404’s internal control requirements; they are slated to do so starting at the end of next year.

Negotiations between the two agencies have unfolded behind closed doors in recent weeks. Press reports have reported a wide range of rumors—from SEC Chairman Christopher Cox striking a deal with the PCAOB over a Sunday morning meeting, to no agreement at all—but both agencies have been largely silent on their efforts. In a joint statement issued last week, they would only say that “considerable progress has been made and the SEC and PCAOB continue to meet to coordinate efforts” on Section 404 reforms.

That statement came following reports that Cox had sent a letter to the PCAOB that supposedly urged the Board to consider adding a scalability provision to AS2. PCAOB spokesman Michael Shokouhi confirmed that a meeting between Cox and PCAOB officials subsequently took place on Nov. 12, but he declined to provide any specifics about the meeting or the letter from the SEC. The SEC also wouldn’t comment on the contents of the letter.

Sources close to the matter say the letter, which included comments from the SEC on a draft proposal of forthcoming changes to AS2, suggested that the PCAOB add a provision for some scalability of the rules based on company size. Other than that, sources say, the regulators are in agreement on the proposed revisions.

Anxiety On The Sidelines

Corporate America—and the watchdogs that oversee it—are anxiously waiting to see how regulators will tweak the rules. While many corporate executives hope the regulators will do more to ease the compliance burden on companies, governance gurus are hoping they won’t loosen the rules at the expense of investor protections.

Brounstein

Richard Brounstein, chairman of the small public company task force at Financial Executives International and a member of the SEC Advisory Committee on Smaller Public Companies, says he is “hopeful” that the SEC will make reforms in line with the committee’s recommendations and the SEC’s own July 11 concept release, which called for input on how a Section 404 audit can be more of a risk-based process.

Jim Thyen, president and CEO of Kimball International and co-chair of the SEC Advisory Committee on Smaller Public Companies, says he’s pleased that the committee’s work is “being taken seriously and being given consideration” and that a discussion on scaling is being pursued. “The scaling recommendation is something the advisory committee was unanimous about very early in our process,” he says.

Thyen

Thyen says the current 404 compliance burden on smaller public companies “is forcing cost choices on smaller public companies that can be very adverse to their financial health and to shareowners.” Without relief, he says, “There seems to be growing evidence of negative impact on shareholders and U.S. capital markets, something the advisory committee indicated they felt would happen.”

At the other end of the spectrum are voices like Barbara Roper, director of investor protection at Consumer Federation of America. She says her group fears the impending revisions “will be used to gut key investor protections of Section 404.”

PROPOSAL

An excerpt follows from the SEC’s proposed rule that would extend the reporting deadline for smaller public companies.

INTERNAL CONTROL OVER FINANCIAL REPORTING IN EXCHANGE ACT

PERIODIC REPORTS OF NON-ACCELERATED FILERS AND NEWLY PUBLIC

COMPANIES

AGENCY: Securities and Exchange Commission.

ACTION: Proposed extension of compliance dates.

SUMMARY: We are proposing to further extend for smaller public companies the dates that were published on September 22, 2005, in Release No. 33-8618 [70 FR 56825] for their compliance with the internal control requirements mandated by Section 404 of the Sarbanes-Oxley Act of 2002. Pursuant to the proposal, a non-accelerated filer would not be required to provide management’s report on internal control over financial reporting until it files an annual report for a fiscal year ending on or after December 15, 2007. If we have not issued additional guidance for management on how to complete its assessment of internal control over financial reporting in time to be of assistance in connection with annual reports filed for fiscal years ending on or after December 15, 2007, this deadline could be further postponed. Under the proposal, the auditor’s attestation report on internal control over financial reporting would not be required until a non-accelerated filer files an annual report for a fiscal year ending on or after December 15, 2008. If revisions to Auditing Standard No. 2 have not been finalized in time to

be of assistance in connection with annual reports filed for fiscal years ending on or after

December 15, 2008, this deadline could also be further postponed.

We also are proposing to provide a transition period for newly public companies before

they become subject to compliance with the internal control over financial reporting

requirements. Under the proposal, a company would not become subject to these requirements until it previously has been required to file one annual report with the Commission.

Source

Proposed Rule On Internal Control Over Financial Reporting For Non-Accelerated Filers (Securities And Exchange Commission; Aug. 9, 2006)

Roper does credit efforts to simplify Section 404 compliance, especially for companies of smaller resources, as something “that needed to happen.” But she also stresses that having all companies comply with Section 404—something the SEC has repeatedly said it will do—“is non-negotiable.” The CFA also wants regulators to continue to require annual controls testing for companies of all sizes, she says.

“There ought to be an absolute expectation that all companies will take basic steps to ensure they have the appropriate internal controls to ensure the accuracy and reliability of their financial statements and that those controls are being tested by independent auditors annually,” she says. “We had a requirement for internal controls without teeth behind it for 30 years. Our experience with Section 404 should tell us how well that was implemented.”

Roper also objects to scaling requirements based on a company’s market capitalization, which is how the SEC already has defined accelerated filers, who have had to comply with SOX since 2004.

Roper

Roper, however, says, “You don’t want companies fluctuating in and out of some requirements.” She suggests some sort of scale based on revenue, since those numbers are less volatile from year to year.

No Real Change Soon

Regardless, any eventual changes to the current rules appear to be months away. Shokouhi at the PCAOB notes that the Board first must propose its changes to AS2 in an open meeting and put them out for comment; only then would it make any further changes as appropriate and send its revised proposal to the SEC. Then comes a public comment from the SEC, and only after that would the SEC approve final changes—or ask for still more revisions.

Under an extension of the compliance deadline proposed by the SEC in August, many smaller public companies would start complying with the management-attestation portion of Section 404 for fiscal years ending on or after Dec. 15, 2007. The attestation from external auditors—one of the sorest points of SOX compliance among accelerated filers so far, since it usually costs a fortune—would not be due until fiscal years starting on or after Dec. 15, 2008. The SEC also granted relief for certain foreign private issuers and proposed transitional relief for newly public companies.

The SEC said at the time that it wanted to delay the compliance deadline for the management-attestation requirement by five months so it can get its forthcoming guidance in executives’ hands well before their Section 404 deadlines arrive.

The Commission noted that if the guidance wasn’t out in time to be helpful, that deadline could be postponed further. Similarly, it said if revisions to AS2 aren’t complete in time to be of assistance in connection with annual reports filed for fiscal years ending on or after Dec. 15, 2008, the deadline for the external-auditor attestation also could be postponed.