Where’s The 404 Guidance?

As Corporate America digests recent compliance changes to Section 404 of the Sarbanes-Oxley Act, lawmakers continue to push the Securities and Exchange Commission to allow smaller companies yet another extension for the deadline to comply with the nettlesome law.

Regulators and other observers, however, are clear: Don’t bet on it.

While the SEC has not yet published the text of its final management guidance for Section 404, the Commission has approved the amendments and they should be released shortly. The Public Company Accounting Oversight Board has also published its proposed Auditing Standard No. 5 to accompany the new Section 404 guidance. In recent remarks, SEC officials have said that given those circumstances, small companies should have ample time to prepare for Section 404 compliance.

The SEC has previously postponed the deadline for smaller companies four times. Currently, those non-accelerated filers—any company with a market capitalization of $75 million or less—are scheduled to comply with the management attestation requirement of Section 404 for fiscal years that end on or after Dec. 15, 2007. They must comply with the auditor attestation requirement a year later.

Commission officials have said that if AS5 isn’t finalized in the coming months as expected, they’ll provide another extension. During a June 6 hearing in the House of Representatives, SEC Chairman Christopher Cox said he expects AS5 to be approved in its final form this summer. “If it is not, we’ll once again postpone the requirement that smaller public companies have a Section 404 audit until the new auditing standard is available, with plenty of time for them to prepare,” he testified.

Nevertheless, observers of the Section 404 saga tell Compliance Week that people should not expect any further extensions.

“We don’t expect another delay,” Amy Borrus, deputy director of the Council of Institutional Investors says. Borrus calls another delay “unwarranted” and says non-accelerated filers “have had several delays and ample time to prepare.”

Schacht

Similarly, Kurt Schacht, managing director of the CFA Centre For Financial Market Integrity, says: “We think there have been ample delays. If for some reason the SEC and the PCAOB don’t feel the new issuer-auditor rules are ready for prime time, then perhaps” there could be another delay. “But Chairman Cox seems confident, as does Chairman [Mark] Olson at the PCAOB.”

Rhodes

“I don’t think there’s likely to be anther extension,” adds Mike Rhodes, chairman of the governance practice at auditing firm Citrin Cooperman. Referring to calls from Capitol Hill for more time, he says, “I’m not sure even that is enough” for the SEC to further delay the deadline.

“Any further delay creates white noise about whether the legislation is necessary or appropriate any more,” Rhodes says. “I think it does still add value.”

Advice For Small Companies: Get Moving

Those companies that have not yet begun examining their controls or talking with their auditors about Section 404 compliance will face an uphill battle to meet next year’s deadline, experts say. But Rhodes says companies that have “at least gotten started” on the compliance process know “what they have to address and know what can be carved out based on AS5 and the SEC guidance.”

A valuable break for non-accelerated filers will be this first year where they do not need to get outside auditors’ attestations about their internal controls. That one year’s grace period “gives auditors time to get their arms around their approach” and allows companies to start a dialogue with their auditors, Rhodes says. “They can have conversation without necessarily impacting an opinion.”

Brounstein

While he declined to comment on what the SEC might do, Rick Brounstein, executive vice president at non-accelerated filer Calypte Biomedical Corp. and a member of the SEC Advisory Committee on Smaller Public Companies, says another year “would be helpful.”

“Others have pointed out that the process for larger companies has not been smooth, and working through the details more fully would be advisable,” Brounstein says. “If nothing else, the world needs to use AS5 and practice risk-based auditing. I would support not using the smallest companies as the testing ground.”

During the June 6 House Small Business Committee hearing to examine whether the guidance and the new audit standard will lower compliance costs for small companies, Cox told lawmakers, “The answer is yes.”

He said the SEC expects the “unduly high costs” of implementing Section 404 will fall because companies will be able to focus on the areas that present the greatest risk of material misstatement in the financial statements and because the SEC’s guidance will allow companies to exercise “significant judgment” in designing an evaluation tailored to their individual circumstances. “Our new guidance allows management to make use of that knowledge, which should lead to a much more efficient assessment process,” Cox testified.

“[T]he world needs to use AS5 and practice risk-based auditing. I would support not using the smallest companies as the testing ground.”

— Rick Brounstein

Member

SEC Smaller Company Advisory Committee

A chief complaint of the old regulatory regime had been that companies had no such guidance, and were left to be browbeaten by their auditors and the exacting standards of Auditing Standard No. 2. The PCAOB scrapped AS2 last month in favor of AS5.

Cox also said costs should come down for smaller companies that have already complied with Section 404. “While these smaller companies should benefit from the top-down, risk-based, materiality-focused, and scalable nature of both the SEC’s new guidance and the PCAOB’s new auditing standard, they should not have to expend new resources to do so,” Cox told the committee.

That same day, lawmakers on both sides of the aisle continued to press the SEC to delay compliance for smaller companies, arguing that more time is needed to assess whether the recent changes will actually reduce compliance costs for those firms.

House Small Business Committee chairwoman Nydia Velazquez, D-N.Y., released a letter repeating her previous call for the SEC to delay the deadline for non-accelerated filers for at least a year. In a similar request made in March, she also called for the SEC to develop a “hard dollar” estimate demonstrating the costs of the regulations on small companies.

Meanwhile, the chairman and ranking member of the equivalent Senate committee, John Kerry, D-Mass., and Olympia Snowe, R-Maine, who twice this year wrote the SEC to request a delay, sent a third letter to the SEC, again calling for a further extension of the deadline for small companies.

In addition, Kerry and Snowe in their latest letter also requested a full assessment of the cost of the new rules under the Regulatory Flexibility Act before they become effective later this year; a small-business compliance guide, to be published by the SEC, to assist small companies in implementing the internal controls requirements; and a regular report by the SEC Advisory Committee on the impact of Section 404, as well as how the financial burden of compliance with the Sarbanes-Oxley Act may be reduced.