IOMA -- SEC Says No SOX 404 Waiver for Small Companie; More SOX Guidance Is on the Way

The Securities and Exchange Commission’s decision is made: There will be no compliance exemption from the internal controls requirement of the Sarbanes-Oxley Act’s (SOX) Section 404 for smaller public companies, despite a recommendation to the SEC to that effect by an advisory committee appointed to investigate the matter.

Although small public companies are unhappy about the outcome, this is good news for CPA firms that provide audit and advisory services to public companies that must adapt their monitoring and reporting practices to comply with SOX.

Section 404 requires public companies to report on the effectiveness of internal controls over their accounting practices and requires outside auditors to verify whether those controls are effective.

However, the SEC said it would issue another "short postponement" of the Section 404 compliance deadline for "nonaccelerated filers," many of which are small companies. In late 2005, the SEC postponed the Section 404 compliance date for nonacclerated filers until July 2007. The SEC did not say how long the additional postponement would be. The SEC also said it intends to provide all public companies with guidance on complying with the requirement.

The SEC’s Advisory Committee on Smaller Public Companies recommended in April that the smallest public companies be exempted from Section 404 because of their inability to afford compliance costs. The effective date postponement appears to be the SEC’s way of giving these smaller organizations a chance to prepare, but the agency emphasized in its May 17 announcement of its decision that "ultimately all public companies will be required to comply with the internal control reporting requirements of Section 404."

More clarification on the way. In a related development, the Public Company Accounting Oversight Board (PCAOB), the SOX enforcement arm of the SEC, said it will consider changes to its Auditing Standard No. 2 to "ensure that auditors’ primary focus during an integrated audit is on areas that pose higher risk of fraud or material error." Any changes the PCAOB makes to the standard must be approved by the SEC.

The PCAOB also said it would try to refine some definitions in the standard to give public companies and their auditors better guidance in complying with the standard, including what constitutes a "significant deficiency" or a "material weakness in internal control," as well as clarifying the meaning of "materiality" and scoping decisions.

These clarifications will help increase the effectiveness of CPAs who are assisting public company clients of all sizes in SOX-related engagements.

"The steps are designed to further improve the reliability of financial statements and to better protect investors while making the Section 404 process more efficient and cost effective," SEC Chairman Christopher Cox stated in a press release. "As we go forward, we will consider the special concerns of all companies that fall under our jurisdiction—large and small, foreign and domestic. By providing practical guidance to companies, by working with the PCAOB on their forthcoming revised standard for auditors, and by examining how the PCAOB inspection process is succeeding in increasing the efficiency and cost-effectiveness of the audit process, we will take a giant step toward ‘getting it right’ when it comes to Section 404 compliance."

To prepare for issuing further guidance on how company management can better assess its internal controls over financial reporting, the SEC said it would:

Issue a "concept release" covering a variety of issues that might be suitable for additional SEC guidance. This will include the "appropriate role" of outside auditors in connection with management’s assessment of its internal controls and the way in which outside auditors provide attestation about internal controls as possible alternatives to the current SEC approach.
Consider additional guidance from the Committee of Sponsoring Organizations of the Treadway Commission (COSO) to provide a better fit of Section 404 practices for smaller companies.
Issue guidance to public companies to assist them in performing the top-down, risk-based assessment approach to evaluating internal controls that the SEC wants.

The SEC also said it would inspect the PCAOB’s intention, announced May 1, to have its inspectors focus on whether auditors have achieved cost-saving efficiencies in the audits that they perform under Accounting Standard No. 2.

The SEC said its intent to provide guidance was based on "comment from a variety of sources" in the accounting, report filer, and securities industries that wanted more precision in the accounting standard and guidance in assessing the strength of internal controls. Those sources included remarks at its May 10 roundtable on the lessons learned from the second year of internal-controls reporting.

At least some of the guidance seems to be a response to the Government Accountability Office (GAO) report on SOX costs, released in early May. That report indicated that the cost of compliance with Section 404 is disproportionately higher as a percentage of revenues for companies with $700 million or less in market capitalization. The report said that the compliance costs could be encouraging some companies to become private.

A shifting approach to guidance? PCAOB Acting Chair Bill Gradison offered hints May 11 that the SEC’s announcement concerning small-company compliance was coming soon. He observed that the SEC had made a "policy decision" in 2005 not to give much additional guidance to company management on Section 404 implementation despite urging from report filers and auditors that it do so. However, after participating in the roundtable, he told a seminar of the Greater Washington Society of Certified Public Accountants, "I sense this time that they are more open to that request." Nonetheless, he also noted that there remained "a sense of caution" deeply rooted within the SEC that additional guidance might lead only to "more rules and less room for the exercise of professional judgment."

Gradison also indicated he is open to more PCAOB guidance for smaller auditing firms, many of which have five or fewer public company clients. That client base is so small that "as important as they are, they are not going to pay the rent" and "virtually none" of the small auditors have performed an audit of their clients’ internal controls strengths or weaknesses because of deadline extensions for the application of Section 404 to small companies, he said.

The SEC and the PCAOB must find "ways to help them, in ways which will cause them to want to continue to do audits of those [small] public companies," Gradison said. "It doesn’t serve our purpose very well in terms of trying to stimulate competition in the audit industry, which we want to do, and have as many options available as possible for financial report issuers large and small if we have a situation where a significant number of particularly small auditors just walk away from the business, saying, ‘It’s too complicated, life’s too short, I won’t do those internal controls features any more. They’ve got to find somebody else to take care of it.’ "

More legislation introduced. Despite the SEC’s decision, two bills pursuing small-company SOX exemptions have been introduced that could do an end run around the SEC if they should pass. Rep. Tom Feeney (R-FL) and Sen. Jim DeMint (R-SC) introduced legislation on the same day as the SEC announcement that seeks to exempt some small companies from Section 404’s internal control reporting requirements of SOX Section 404. The Feeney and DeMint bills—the proposed "Competitive and Open Markets That Protect and Enhance the Treatment of Entrepreneurs Act," or COMPETE—are companion legislation, but are not identical.

Both bills seek to enact as law provisions that are similar to the recommendations of the SEC’s Advisory Committee on Smaller Public Companies by exempting from Section 404 public companies with under $700 million in market capitalization and whose revenues do not exceed $125 million.

House cosponsors of the bill included Reps. Pete Sessions (R-TX), Candice Miller (R-MI), and Gregory Meeks (D-NY). Senate cosponsors included Mel Martinez (R-FL) and John Ensign (R-NV). Feeney, Meeks, and Rep. Mark S. Kirk (R-IL) testified April 5 before the House Regulatory Affairs Subcommittee, saying that there is broad-based bipartisan support in Congress for reform of Section 404 with respect to smaller companies. Subcommittee Chair Candice S. Miller said at the time that if regulators did not have the political will to address concerns about the disproportionate cost of Section 404 on smaller public companies, Congress would act.

According to a bill summary provided by Feeney’s and DeMint’s offices, small- and medium-sized companies—those with market caps of less than $700 million and product revenue of less than $125 million—could "opt out of Section 404 while still complying with standard internal controls guidelines that better fit their size and risk to investors." The lawmakers said that companies would "still be required to maintain enhanced internal controls, more transparency, and prohibitions on conflicts of interest."

By comparison, the SEC advisory committee recommended applying such an exemption to:

Microcap companies—those with equity capitalizations below approximately $128 million—that have less than $125 million in annual revenue; and
Small-cap companies—those with equity capitalizations between approximately $128 million and $787 million—that have less than $10 million in annual revenue.

Under Section 404, public companies must review their internal controls over financial reporting and publicly report any material weaknesses. The external auditor must report on whether management’s assessment of the effectiveness of internal controls is fairly stated and provide a separate opinion on whether the company’s internal controls are effective.

The Feeney and DeMint legislation calls for the SEC to create a de minimus standard of 5% for determining a material weakness in internal controls. Accordingly, the cost of a mistake would have to exceed 5% of net profits to trigger a failed audit. In February, SEC Chair Cox reported that most material weaknesses are related to revenue recognition and income tax.

In addition, the bills would instruct the SEC to better define "reasonable," "significant," and "sufficient"—terms that are used by the SEC "to direct companies and auditors in determining what is necessary to audit and how important accounting errors are to an audit," according to the summary. The SEC would have to give specific examples and establish "a means for a timely response by the SEC to requests from accounting firms for guidance on how these rules apply."