Will Delay on 404(b) Cure Its Ills?

It won’t happen before the holidays, but smaller companies could soon get a gift they’ve been hoping for: another delay in complying with at least a portion of Section 404.

After months of insisting that no further delays would be forthcoming for small companies (they have already received two in as many years), Securities and Exchange Commission Chairman Christopher Cox last week announced that he now wants another one-year delay for Section 404(b) of Sarbanes-Oxley, which requires external auditors to assess companies’ internal controls over financial reporting.

Companies had been scheduled to begin compliance with Section 404(b) with fiscal years ending on or after Dec. 15, 2008; Cox would push that deadline to Dec. 15, 2009. He would not change compliance with Section 404(a), which requires companies to do their own assessments of internal control. That provision would still apply starting with fiscal years that ended last week. Section 404(b), however, is generally considered to be much more onerous for compliance than Section 404(a).

Cox

Cox dropped his bombshell in testimony before the House Small Business Committee. He did not say precisely when he will propose the delay, but his two fellow Republican commissioners are likely to go along with him. Indeed, Commissioner Kathleen Casey delivered a speech last week that praised just the sort of delay Cox wants to see.

Cox also said the Commission will conduct a Web-based survey of companies already subject to Section 404, along with in-depth interviews at some businesses. That data will help the SEC gauge the value of new guidance it gave last summer to ease Section 404 compliance, and help the Commission better understand the costs and benefits of SOX, Cox said. Then, he said, the SEC can base its decision on final implementation of Section 404(b) “based on the best available cost data.”

News of the possible delay drew the predictable jeers and cheers from various business and investor groups, who have long been at odds over whether Section should apply to non-accelerated filers (companies with less than $75 million in market capitalization). Among those welcoming the news was Rick Brounstein, director of The CFO Network and a member of an SEC advisory committee that had initially urged the SEC to exempt the smallest filers from Section 404 completely.

Brounstein

“It is quite logical to … make sure that this audit requirement will be cost effective when applied to smaller public companies,” Brounstein says. He wants to see at least one complete audit cycle pass, so regulators can measure the effect of Auditing Standard No. 5. The Public Company Accounting Oversight Board passed AS5 last summer to encourage auditors to ease up their demands on companies when auditing internal controls, which many faulted as unnecessary, exacting, and expensive.

Since then, business groups and many lawmakers have pressured the SEC to delay the compliance date to allow companies time to digest the changes; others continued to press for a permanent exemption. Still more, including some SEC staff members, said no extra time was needed.

Waiting on AS5?

COX COMMENTS

Below are excerpts of SEC Chairman Christopher Cox’s testimony to the House Small Business Committee.

Our SEC management guidance intended for the company’s own use will relieve smaller companies from having to rely on the audit standard as their de facto rulebook. It encourages cost-effective compliance. It is designed to eliminate unnecessary make-work that does little to further the goal of providing reliable financial statements to investors. For smaller public companies, the guidance will be in place the very first time they come into compliance, so that they can avoid wasteful and unnecessary compliance efforts that others have had to endure under the old standard. And the guidance was specifically written with smaller companies’ unique control systems in mind. It encourages management to tailor their documentation and evaluation approaches to their particular business. This is meant to put an end to the one-size-fits-all, check-list approach that many larger companies have bristled under as they tried to comply with 404 under the old standard …

the SEC will conduct a study of the costs and benefits of 404 compliance under the new auditing standard and management guidance. Currently, under the direction of the Office of Economic Analysis, the SEC staff is preparing to gather and analyze real-world data. The study will seek to identify trends and provide a comparison to costs under the old auditing standard. The study will also pay special attention to those small companies that are complying with section 404 for the first time.

This survey of costs and benefits is expected to have two main parts – a Web-based survey of companies that are subject to section 404, and in-depth interviews with a subset of companies including those that are just now becoming compliant. This dual approach will allow us to gather data from a large cross section of companies, while providing more detailed information about what drives the costs and where companies derive the benefits, especially for newly compliant companies. Because we are intent on using real data based on companies’ actual experiences, this survey will be taking place in the coming months as companies for the first time prepare their financial statements and undergo external audits under the new auditing standard and internal assessments with the aid of the new management guidance.

We anticipate that the study and analysis of the results will be completed no earlier than June 2008. Under the current schedule, smaller public companies would be expected to begin complying with Sarbanes-Oxley section 404(b) for fiscal years ending after December 15, 2008, with the result that unless there is an additional deferral, companies will incur compliance costs before the SEC has the benefit of the study and analysis. As a result, I intend to propose to the Commission that we authorize a further one-year delay in implementation for small businesses in order to base our decision on final implementation of section 404(b) on the best available cost data.

Source

House Small Business Committee (Dec, 12, 2007).

Investor activists were immediately suspicious of Cox’s argument that non-accelerated filers shouldn’t start compliance with Section 404(b) until after the SEC’s cost-benefit study. “If overturning the requirement isn’t on the table, if they’re not considering an exemption, then why suddenly do a cost-benefit analysis now? Why not finally implement the law?” asks Barbara Roper, director of investor protection for the Consumer Federation of America.

Cox has repeatedly said all companies ultimately will have to comply with Section 404, and suggested the same in his testimony, telling the committee: “When, eventually, smaller public companies do come into full compliance … ”

Roper, however, says it is “unconscionable” that more than five years after SOX was enacted, “the SEC has been unable to implement this.”

Roper

“Any company, small or large, that doesn’t have their internal controls in shape and ready to be audited by now is grossly negligent,” she says. “Most companies have spent all of their efforts lobbying to get the requirement overturned. Had they put the same kind of effort into getting their internal controls in shape, we’d be done by now and investors would be much better off.”

Likewise, Ann Yerger, executive director of the Council of Institutional Investors, says small companies “have had several years to prepare.” More extensions are “unwarranted, unwise, and unacceptable to investors … These annual reprieves are starting to look like a de facto derailing of a critical investor protection,” she says.

Meanwhile, a long list of SOX critics on Capitol Hill praised the idea of a delay. House Small Business Committee Chairwoman Nydia Velázquez, D-N.Y., called the decision “a major victory” for small companies and vowed to continue to press the SEC to collect the cost-benefit data in a timely manner. Senators John Kerry and Olympia Snow, chairman and ranking member of the Senate Small Business Committee, also supported a delay, as did Rep. Spencer Bachus, ranking member of the House Financial Services Committee.

Comments from Barney Frank, chairman of the House Financial Services Committee, were not immediately available.

Despite the initial enthusiasm for a delay, others do stress the need to resolve lingering questions about Section 404 for non-accelerated filers. “The guidance and [AS5] may not be enough for smaller companies,” says Herb Wander, who co-chaired the SEC advisory committee for smaller public companies. “Let’s see how it works first.”

Geoff Loftus, vice president of the Society of Corporate Secretaries and Governance Professionals, says his hope is that the SEC will “take another look at whether or not smaller companies have to comply with 404 the same way as larger companies do.”

Loftus

“If all they do is delay it, and at the end of the year say, ‘Do it like the big guys,’ it’s helpful, but not getting to the core issues,” he tells Compliance Week. “We feel the impact on small companies hasn’t been understood properly and the SEC hasn’t adequately dealt with their needs. The guidance they and the PCAOB issued, while helpful, isn’t enough.”

And Paul Sharman, CEO of the Institute of Management Accountants warns that other issues remain, such as a lack of a “practical implementation framework” for small businesses. He also worries about the two-year gap when companies are attesting to their internal controls but outside auditors are not; that could create legal liability problems, he says.

But Kurt Schacht, executive director of the CFA Centre for Financial Market Integrity, says, “It’s time to move forward.”

Schacht

“After four [or] five years of discussion, multiple rounds of new guidance, and a scaled back approach for Year One requiring only manager assessments, this can hardly be justified by lack of awareness, notice, or prep time,” he insists.