The SOX 404(b) Compliance Study: A Comment Letter Audit

When President Obama signed the Dodd-Frank Wall Street Reform and Consumer Protection Act into law on July 21, 2010 it immediately amended the Sarbanes-Oxley Act of 2002 by permanently exempting non-accelerated filers from the Section 404(b) requirement that they obtain an auditors’ attestation on management’s assessment of the effectiveness of internal controls over financial reporting.

The Dodd-Frank Act also requires that the Securities and Exchange Commission study how the burden of Section 404(b) compliance might be reduced for companies with market capitalizations of between $75 million and $250 million while still maintaining investor protections, and whether a reduction in or exemption from Section 404(b) compliance would encourage companies to list their initial public offerings in the United States.  The Commission has until April 21, 2011 to submit the study to Congress.

This is the second cost-benefit analysis of Section 404(b) that the Commission will undertake.

The First SOX 404(b) Compliance Study (2009)

Section 404 of the Sarbanes-Oxley Act, as originally adopted, was made up of two subsections:

• 404(a) requiring that a report on management’s assessment of the effectiveness of internal controls over financial reporting be included in a company’s annual report; and

• 404(b) requiring a company’s auditors to attest to, and report on, management’s assessment of the effectiveness of its internal controls over financial reporting.

Shortly after Section 404 took effect it became apparent that it was far more costly for companies to comply with the new requirements than had originally been anticipated, particularly with Section 404(b).  To address this issue, in 2007, the Commission released interpretive guidance to assist management in its assessment of internal controls over financial reporting.  That same year the Commission also approved the Public Company Accounting Oversight Board’s (PCAOB’s) new Auditing Standard No. 5–addressing an auditor’s attestation of, and report on, management’s assessment under Section 404(b)–which replaced the more conservative Auditing Standard No. 2.

Thereafter the Commission undertook a survey of companies experienced with Section 404(b) compliance to determine whether, and to what extent, the 2007 reforms affected their compliance costs. The results, published in September 2009, found the reforms were effective in reducing the overall cost of compliance.  The survey also found costs varied by:

• company size–with larger companies experiencing greater total costs, but smaller companies experiencing greater costs as a percentage of assets;

• whether a company was complying with Section 404(a) alone, or with both Sections 404(a) and 404(b); and

• the amount of time a company had been complying with Section 404(b).

Comments on the Current SOX 404(b) Compliance Study

In October 2010 the Commission issued a request for public comment on the Dodd-Frank-mandated Section 404(b) compliance study.  To date it has received 12 comment letters, 2 coming from organizations representing companies with market capitalizations of between $75 million and $250 million, 6 from accounting firms and organizations representing the accounting and investment industries, and the remaining 4 from individuals.

Comments from Organizations Representing Companies

Comment letters from the Independent Community Bankers of America and Biotechnology Industry Organization (BIO) both favor extending the Section 404(b) exemption for non-accelerated filers to companies with market capitalizations of between $75 million and $250 million, mainly on the basis of the costs of compliance outweighing the perceived benefits.  BIO also points out in its comment letter that in a capital-intensive, research and development-oriented  industry, such as biotechnology, it is not uncommon for a company to have a large market cap, in excess of $75 million, but little or no revenue, further compounding the cost of compliance issue.

Comments from Accounting Firms and Organizations Representing the Accounting and Investment Industries

The Center for Audit Quality’s (CAQ’s) comment letter (representative of most of the other accounting firm and organizational comment letters) argues against extending the Section 404(b) exemption for non-accelerated filers to companies with market capitalizations of between $75 million and $250 million, maintaining that:

• an auditor’s attestation of, and report on, management’s assessment under Section 404(b) encourages accountability on the part of management, which in turn enhances financial statement quality;

• the cost of implementing Section 404(b) has declined since the Commission’s 2007 reforms and with the development and availability of additional resources (such as publications by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission and CAQ itself); and

• such companies are already complying with Section 404(b) and therefore have the most expensive implementation costs, the startup costs, behind them.

As a means of possibly reducing the compliance burden on such companies CAQ recommends that the PCAOB issue “best practices” for a Section 404(b) audit, the Commission and PCAOB conduct a series of forums to discuss best practices and common issues with the companies and their auditors and that the Commission participate in a COSO project to update its internal control framework guidance.

In its comment letter, the CFA Institute recommends that the Commission amend Forms 10-k and 10-Q to require Section 404(b) exempt companies: (i) check a box on the front page of each report disclosing their exempt status, and (ii) include substantive disclosure in each report regarding:

• the reasons why they have taken advantage of the exemption;

• a description of the internal controls they have in place to prevent faulty or fraudulent financial reports; and

• why management believes such controls are sufficient (or not).

Comments from Interested Individuals

Finally we have a comment letter from Mr. Georg Merkl, a Swiss resident and frequent commenter on Commission rules related to internal controls over financial reporting.  Like the CFA Institute, Mr. Merkl also suggests that the Commission require Section 404(b) exempt companies to disclose their exempt status and include additional substantive disclosures regarding their internal controls over financial reporting in annual and quarterly reports.  Mr. Merkl also suggests that the Commission issue additional guidance regarding management’s obligations when an audit adjustment or restatement due to fraud or error occurs.

Some of Mr. Merkl’s more interesting suggestions to the Commission include:

• requiring a company to disclose whether the departure of its chief financial officer, or any key accounting personnel, is due to a disagreement over matters of accounting principle or practice, or financial statement disclosure;

• extending the Section 404(b) exemption for non-accelerated filers to companies that do not meet certain revenue requirements;

• less frequent audits for smaller companies (I think this would make for an excellent compromise.  The largest cost component of Section 404(b) compliance is in the auditing fees. By requiring smaller companies to undergo Section 404(b) audits less frequently, say, for example, every three years as opposed to annually, the Commission could substantially reduce the cost of compliance for such companies while still meeting Section 404’s goal of ensuring investor protection); and

• requiring an audit relying on fewer procedures, such as an audit attesting to, and reporting on, the existence of internal controls over financial reporting rather than their effectiveness (similar to Swiss requirements).

Overall the comments are pretty light compared to just about every other Dodd-Frank initiative underway.  Given the short time frame within which the study must be completed, the Commission’s current workload and continuing budgetary constraints, it’ll be interesting to see what the final study actually consists of.