Will SEC Delay Of SOX 404 Make A Difference?

As was widely expected, the Securities and Exchange Commission has given companies whose market float is less than $700 million an additional 45 days to meet many of the requirements of Section 404 of the Sarbanes-Oxley Act.

“The Commission has become increasingly concerned that many smaller accelerated filers may not be in a position to meet that deadline,” the SEC said in making the announcement. “To ensure that there is a continuing and orderly flow of annual report information to investors and the U.S. capital markets, and to ensure that certain annual report filers and their registered public accounting firms are able to file complete and accurate reports regarding the effectiveness of the filers’ internal control over financial reporting, the Commission has determined that the exemptions set forth below are necessary and appropriate in the public interest and consistent with the protection of investors.”

Kroenlein

But, will these additional days really make a difference for these companies? It all depends upon whom you ask.

Most lawyers and accountants acknowledge that many of these resource-starved smaller companies could use the extra time to meet perhaps the most daunting provision of the landmark corporate governance legislation. “This will help a significant number of companies,” adds David Kroenlein, a corporate partner in the New York office of Winston & Strawn concentrating in public and private financing. “It will give a lot of companies that have been trying to meet the requirements but ran into resource issues a chance to stay in compliance.”

Lewis

Adds Colin Lewis of A.R.C. Morgan, a London-based consultant and advisory firm focusing on Sarbanes-Oxley compliance, “These new requirements have placed extreme pressure on the management responsible for the preparation of financial and internal control reporting and their external auditors audit of internal controls over financial reporting in conjunction with an audit of financial statements. As a result, a disproportionate number of registrants would potentially file Rule 12(b)-25 extensions that could raise unnecessary concerns about the registrant in the capital markets.”

Under the SEC's order, these smaller companies will still be required to file their financials within the 75-day deadline for their 10-K, including all of the information required by Item 9A (Controls and Procedures), except management’s annual report on internal control over financial reporting, required by Item 308(a) of Regulation S-K, and the Attestation report from the auditor.

Current Requirements

However the order does not change the current requirements of Item 308, which provides that management's report must contain an assessment of the effectiveness of the registrant's internal control over financial reporting as of the end of the company's most recent fiscal year, stresses the law firm Bracewell & Patterson, in a report fired off to clients. “Thus, although the exemptive order extends the filing deadline and thereby affords certain registrants and their auditors additional time to complete testing, management's assessment is still made as of the end of the fiscal year (for example, December 31, 2004 for those with a calendar year-end),” it elaborates.

What’s more, if the company has identified a material weakness in its internal control over financial reporting, or its auditor has identified a material weakness and communicated this finding to the registrant, before its 10-K is filed, the company must disclose this information in its10-K.

“The registrant must file an amendment to its Form 10-K to file the management report and the related auditor attestation report not later than 45 days after the end of the 75 day filing period specified in Form 10-K (regardless of whether the registrant relied on Rule 12b-25 to extend the 75 day filing period), and the registrant may not rely on Rule 12b-25 to extend the deadline for amending its Form 10-K to include the management report and the related auditor's attestation report,” Bracewell & Patterson adds.

In addition, a company that takes advantage of the SEC’s extension can't sell securities from an existing shelf registration until the company files an amendment to its 10-K containing management’s report and its auditor's attestation.

Magnitude Of Impact

Wagner

The order could affect as many as 1,600 companies, estimates Stephen Wagner, co-chair of the Sarbanes-Oxley Steering Committee for Deloitte & Touche. But he adds, “I don’t know if anyone has a firm handle on the number of companies in the group that need help.”

At the same time that it issued the order, the SEC said that the larger accelerated filers that don’t qualify for the extension “will be able to complete their internal control work by the existing Form 10-K deadline.”

If the SEC is correct, these companies will be completing their work awfully close to the deadline. In a survey of clients—mostly in the $5-billion-to-$20 billion range—completed in September and published in October, Ernst & Young found that since its previous survey published in March, “Many companies that anticipated completion before the end of the third quarter now predict a narrower gap between project close and the year-end.”

One of the reasons is that the number of controls being selected for evaluation and testing continues to increase, with many large companies testing tens of thousands of controls across their organizations, E&Y pointed out.

Nearly half of the companies in the survey estimated evaluation and testing will be completed just one to two months prior to their fiscal year-end. Although this is way up from just 13 percent in the prior survey, it underscores how little margin for surprises there was before the extension.

Perhaps the most significant finding is that those companies that had been looking to finish five or more months in advance of their fiscal year end have diminished from 40 percent in the earlier survey to only 8 percent now. This is important as the survey mostly documents companies larger than those that were given the extra 45 days. As a result, it underscores the challenges confronting the smaller companies that were not surveyed.

SEC Underestimation?

Most of the companies in the E&Y survey are finished or nearing completion with their documentation. Testing, however, is progressing but taking longer than anticipated in its prior survey, E&Y points out.

As for remediation, nearly 30 percent of the companies with a 2004 compliance deadline are conducting more than 75 percent of remediation during their last quarter as well. “Smaller companies are lagging somewhat behind their larger counterparts in testing and remediation,” the report adds. E&Y’s definition of smaller companies, however, includes companies with less than $5 billion in total revenues.

Annex

This could mean that the SEC underestimated which companies were at risk of missing the deadline and needed more time. Some note that the Commission should have raised the exemption threshold higher, given the results of E&Y’s latest survey. Indeed, Alan Annex, of Greenberg Traurig believes, “The 45 days will likely not help smaller issuers as the accounting firms resources are stretched thin at this time.” So, despite the additional time, he expects to see a number of these companies filing for delays.

He says if a company is still in the middle of its review and has not yet discovered anything, they will likely say something like, "We are still in the process of reviewing and documenting our existing internal controls but that nothing has come to our attention in connection with the review conducted thus far which would constitute a material weakness."

If they have uncovered something, however, they will need to disclose that "during our review we did identify certain deficiencies" and they would further advise as to remedial action. If you assume remedial action is taken, the company will have to wait at least three full months to test the new system.

Lewis of A.R.C. Morgan, however, is confident the extension will allow corporations and their external auditors who have just completed a ‘dry run’ and discovered that some key controls require remediation, an opportunity to observe the remediated control in operation for a "reasonable period of time." This would be sufficient to conclude the control is effective.

He adds, “inability to do so solely because the remediated control had not operated or new test had not been conducted for a reasonable period of time could otherwise result in a reportable condition that could have unintended capital market consequences, despite the fact that the control in fact after passage of a reasonable period of time would be proven effective.”