The same mistakes plague Sarbanes-Oxley, says Poss. The agency's new assumption is that outside legal fees will run $300 per hour, a figure with which most CFO respondents concur. Poss argues that fees will run higher. "These are not quick consultations, and they're usually with senior partners," whose rates run from $400 to $700 per hour in most big cities, he says.
No doubt, the SEC's biggest miscalculation was its original estimate that Section 404 compliance would require an additional five hours' worth of work per annual and quarterly filing. The figures were too low "by at least a factor of 100" if not more, wrote Cary Klafter, director of corporate affairs for Intel's legal department, in a November letter to the SEC. "We can only hope that the Commission's burden estimates are not used for any substantive governmental purpose, since they are completely incorrect."
While the SEC typically receives few comments on such estimates, this one raised the ire of so many companies that the agency was forced to recalculate — ending up instead with an average 383-hour workload per company, for a total annual price tag of $91,000, not including additional auditors' fees. "We recognize the magnitude of the cost burdens and we are making several accommodations to address commenters' concerns and to ease compliance," the agency said in its final rules on Section 404, released June 5.
Those accommodations included changing the requirement to test internal controls from a quarterly to an annual activity (unless they are materially changed) and extending the compliance deadline from September 30, 2003, to fiscal years ending on or after June 15, 2004, for accelerated filers; all others will have a compliance deadline of April 15, 2005. The delay "was an effort to help reduce the burden in general, and help make sure it was done right," says SEC commissioner Cynthia A. Glassman. "We did not want a system where [companies] were going to have to redo things."
Just doing it the first time, however, will not be a picnic. While the year extension has prevented a lot of what SPSS CFO Edward Hamburg calls "unnecessary thrashing and spending," the rules make little accommodation for companies of different sizes and growth stages. And even the revised cost estimates are considered "low" or "very low" by more than 80 percent of survey respondents. That irks those who believe the SEC should be held to the same standard as the firms it regulates. "In Corporate America, if you make a bad prediction of what cost of sales or revenues are going to be in a future period, you're likely to get grilled by the SEC about why you thought it was reasonable," says Poss. "It would be interesting to see the same standard applied to regulators."
The Usual Beneficiaries
The yearlong respite reduces the need for outside help, and hence the cost. However, it won't change the fact that two constituencies — auditors and lawyers — stand to reap great gains as firms plow ahead. And given the uncertainty over what will get a pass from the SEC, the final tab is a moving target.
EMC has hired Deloitte & Touche to help sift its balance sheet and income statement into 30 processes (like sales and stock-option granting) and 250 subprocesses (like order taking, shipping, and billing), document them, test them, and package them into a central database for future audit purposes. But EMC's external auditor, PricewaterhouseCoopers, is also "part and parcel of the process," according to Teuber, giving informal approval to the firm's compliance strategy and fielding audit-committee questions on how well EMC is doing on compliance compared with other firms. (Companies can't use their external auditors to help them prepare the controls, but can consult with them on compliance strategies.)
Teuber says it's helpful to have two of the Big Four audit firms on the project. "It's all virgin territory," he says, "so you wouldn't want to do this in a vacuum." But those firms will be the ones collecting the bulk of EMC's $1 million compliance payments for 2003, excluding the final attestation fee.
Many of the Section 404 projects, such as documentation, are one-time efforts. But Sarbanes-Oxley is also guaranteeing audit firms a future income stream by requiring them to attest to the soundness of management assessment of internal controls once a year starting with 10-Ks filed on or after June 15, 2004. The final annual tab for that exercise is uncertain. The Public Company Accounting Oversight Board has yet to issue standards regarding how many controls must be tested, in what manner, and according to what criteria, so audit firms appear to be taking their time estimating the fees for attesting to internal controls. But so far, according to a Financial Executives International survey, CFOs expect to see audit fees increase 35 percent on average, and up to 100 percent at some companies.
What exactly audit firms will do to justify such increases is also cause for consternation. At Digene Corp., a Gaithersburg, Maryland, biotech firm, for example, president and CFO Charles M. Fleischman has watched his audit bill with Ernst & Young and other compliance-related fees increase by 72 percent for 2003. He is currently negotiating fees for 2004, which could jump by another 70 percent. And while he insists he has a good relationship with his auditor, Fleischman just wants "to understand what the scope of the work is — and how that matches up against the bill." So, before he authorizes payment for 2004, he is working with his audit committee and E&Y to determine exactly "what they are doing and where they are going to draw the line between assuring quality in financial reporting and just adding costs."
Reader Comments» Post a comment