SOX 404 Civil Disobedience … What Would Happen?

Few would dispute that these are remarkable times in the history of capital markets, as public companies undertake major accounting changes to meet new regulatory requirements. But to what lengths might companies go to protest?

Exasperated by the enormity of it all—and resigned to the inevitability that they’ll have unfavorable reports to file—some public companies may be considering a bold approach. Karl Nagel & Co., a consultancy focused on helping public companies meet their mushrooming reporting requirements, is provoking companies to consider the alternative; namely, widespread civil disobedience related to Section 404 of Sarbanes-Oxley.

Nagel

“What if no one cares?” Nagel asks on an industry Web site he operates. “What if the financial markets decide that filers who have an unqualified financial statement opinion but decline to spend time and resources on 404 compliance (i.e., decline to state an assessment and receive an adverse or disclaimed opinion) are actually maximizing the company’s resources?” Nagel writes. “I suspect that after an initial hit, the price will return to its previous level, especially as more and more investment professionals begin to realize the failings of 404.”

Addressing The Challenges

The Sarbanes-Oxley Act of 2002, particularly its Section 404 requirements that companies test and certify the adequacy of internal controls to create sound financial results, has hit a sensitive nerve about cost and benefit.

The debate doesn’t focus on the objectives of Sarbanes-Oxley and Section 404; rather, critics say the documentation and reporting requirements go far beyond producing information that investors will value.

Surveys, estimates and early reports have placed the cost of compliance anywhere from $3 million to $40 million or more per company, which drags earnings ultimately. Critics like Nagel ask which investors value more, the information or the earnings?

The objections are perhaps loudest from smaller companies, which typically lack the resources necessary to isolate controls to the degree required for a clean opinion. In addition, smaller issuers have found themselves at the bottom of the auditing food chain as accounting firms have allocated resources to take in the onslaught of new work. Non-U.S. companies have turned up the heat as well, many of which already face stiff new requirements in their countries of origin.

The Securities and Exchange Commission has answered by extending effective dates for smaller companies and all but promising to do the same for foreign companies, but the commission stands fast on the rules and requirements themselves. It has charged the independent COSO (Committee of Sponsoring Organizations) with trying to find a solution to the small issuer problem, but probably not in time to impact filings before the first wave of effective dates.

“It’s Crossed My Mind”

As the debate continues to swirl, filing deadlines are rolling in over the course of 2005, depending on the size of the company and its fiscal year.

Livingston

Philip Livingston, past president of Financial Executives International and an audit committee chairman for two companies, said he hasn’t heard of any specific instances where a company is so frustrated with Sarbanes-Oxley that it might consider a minimalist approach to filing. “But it’s crossed my mind a few times,” he said. “I can see it as a real possibility for some companies. If a company has good controls, but if it’s not cost-effective to jump through the hoops and if the markets don’t react, it might be possible.”

SEC has conceded it expects many companies will not meet the full extent of the requirements to test and certify every last internal control, and it has indicated it won’t throw the book at companies that make a good faith effort to comply.

So what constitutes a good faith effort? Is it possible for a company to spare itself the full cost and burden of compliance, yet escape SEC’s enforcement radar and satisfy investors?

Nagel’s thought-provoking idea amounts to a movement of 404 civil disobedience. “Think sick-outs,” he said. “Nurses and cops never go on strike. It will be so much easier to file late, miss a schedule, file an amended, fudge the assessment and so on.”

This approach to “passive noncompliance,” if executed in large scale, could make a big statement, Nagel says. “It would be pretty interesting to see whether a filer with an unqualified financial statement opinion could ride out an adverse or disclaimed control opinion, especially if everyone took the same approach.”

In fact, Nagel says some executives may see it as a career move. “Some of these requirements fail to serve any useful purpose, and even threaten careers as executive management begins to see them more and more as cost sinks,” Nagel said. “What if management just declines to state and takes the hit on the opinion?”

Auditor, SEC Response

Legal and accounting experts raise a bevy of questions about whether a company could pull it off, and experts say Nagel’s core assumption is wrong.

Jorgenson

Mary Ann Jorgensen, a partner with Squire, Sanders & Dempsey who focuses on securities law, said Nagel raises an intriguing issue. She said recent SEC statements have made it clear that companies can file inadequate or incomplete internal control reports and still remain in good standing with the SEC for purposes of issuing securities, as long as other reporting requirements are met in time. She also points out that auditors have already said they can audit around material weaknesses.

Jorgenson says there is a continuum along which filing requirements can be met. At one extreme, a company files full, complete reports, in full compliance; at the opposite, a company files no report, which would constitute a violation. Between those two extremes, companies will file reports in varying measure of completion. “Somewhere on that continuum, a company can be OK,” she said, but it’s a gray area of the law that hasn’t been tested.

An SEC spokesman said it’s impossible to predict how the Commission might respond if individual companies or a group of companies decided to adopt a minimalist approach to internal control reporting. “Remedies, if any, would be subject to the circumstances of the case,” he said.

Wagner

Stephen Wagner, co-chair of the SOX steering committee for Deloitte & Touche, said he would urge clients to avoid the prospect of enforcement by focusing on the spirit of the law vs. the letter, which he believes ultimately would come into play if companies attempted any kind of minimal reporting movement. “Section 404 requires management to certify the effectiveness of control,” Wagner said. “If you try to mince words, what you come up with is air. The real question is: How much do we really have to do (not how little) to meet the requirements? The requirements are not arbitrary or optional.”

He also cautioned that audit firms would not be eager to serve clients who skirt the filing requirements, especially with the Public Company Accounting Oversight Board regulating the audit firms. It’s not clear whether PCAOB rules would prohibit an audit firm from serving a client who provides little or no internal control assessment, but Wagner said Deloitte would probably resign such a client.

According to PCAOB spokeswoman Christi Harlan, there's nothing in PCAOB's rules that would preclude an auditor from giving an opinion on financials if management issues a minimal report on internal controls. However, board rules require the auditor to test controls independent of management if the auditor is engaged to attest to both internal controls and financials. If for whatever reason an auditor firm can't test controls, it can't issue an opinion on controls or financials.

Investor Response

If a company could squeak past the internal control reporting requirements and take the auditor’s negative or disclaimed opinion to the market, how would investors respond?

At a recent 404 conference at Stanford University, Steve Galbraith of Maverick Capital said investors will react to material weaknesses or deficiencies. “Make no mistake about it, most investors will shoot first and ask later if you have a bad SOX opinion, in our view,” Galbraith said. “That said, I think your stock price will recover to intrinsic value” when the weakness or deficiency is explained and corrected.

Ann Yerger, executive director of the Council of Institutional Investors, says it’s hard to predict the short-term investor reaction to an unclean internal control opinion, but investors definitely have long-term interest. If a company filed little or no information, “That certainly would be a red flag about what that means about internal controls,” she said.

Yerger was quick to point out that investors are not the ones airing concerns about compliance. “I haven’t heard a single council member complain about cost,” she said. “Management is complaining, but the owners aren’t. If improvements in internal controls will increase investor confidence, then it’s money well spent.”

The current requirements to documenting internal controls are creating a catch-up exercise, Yerger said, because “companies are making up for years of lost time.” Internal controls first were required in the late 1970s with the Foreign Corrupt Practices Act, she said. “Investors are not that sympathetic,” Yerger said.

Wagner said he’s heard of clients who are finished with their first-year assessment and are now reviewing whether they did too much work to avoid getting a negative opinion from the auditor. “It’s good for companies to step back after the first year and ask whether it can be done more efficiently or more effectively,” he said. “Anything big like this always takes longer and costs more than you expected.”

Wagner predicts regulators will do the same after the first year and adjust the rules accordingly. “They’re keenly aware of the noise level and they’re making every effort to be responsive and do the right thing,” he said.

The U.S. Chamber of Commerce is vowing to continue the pushback against Section 404. “The unintended expansion of corporate governance rules and excessive compliance demands will cost the nation’s 17,000 public companies billions of dollars this year,” the Chamber says. “These excesses have discouraged bold business decision making, have sent both domestic and foreign companies fleeing from public markets, and have hurt efforts to attract strong board members and executives to public companies.”