More than 6,000 public companies face a serious dilemma about their Sarbanes-Oxley compliance: Should they use the current version of Section 404 now in reviewing internal controls over their financial reporting? Or should they wait until the Securities and Exchange Commission and Public Company Accounting Oversight Board issue final revisions later this year?
Decision time is approaching fast. Small businesses — or so-called non-accelerated filers — have until they file their 10-Ks for fiscal years that end on or after Dec. 15, 2007, to meet 404’s management assessment requirement. It’s a deadline that the SEC has extended several times, including that of the auditors’ attestation reports (non-accelerated filers don’t have to complete those documents until their 10-Ks are filed for fiscal years ending after December 15, 2008). And small-business advocates are hoping the SEC will extend those dates once again.
Another extension is needed, they say, because revisions to both Section 404 and the PCAOB’s Auditing Standard No. 2 are in flux. The two regulators presented their revised standards late last year, and together are revising AS2 (in a new standard as yet unnamed, but informally called AS5 by PCAOB board members). The original standards have been criticized for leading to costly and burdensome audits of companies’ internal controls. A more detailed standard than 404, AS2 has become management’s de facto standard for meeting auditors’ requirements.
Both regulators finished the public-comment period for their proposed revisions in late February. Earlier this month, the SEC commissioners voted to send their accounting staff to join the PCAOB’s in “fine-tuning” AS5. Both staffs are tasked with matching the tone and wording of the auditing standard with the SEC’s revised guidance for company management on complying with 404.
The staffers are incorporating more principles-based language into AS5, clarifying the new standard’s scalability for companies of all sizes, and adopting a less prescriptive approach for how auditors will decide to use the work of others, such as a company’s internal auditors. The SEC, which oversees the PCAOB, is hoping to approve the final version of AS5 in late May or early June.
Where does that leave small businesses that have yet to comply with Sarbox? Even if the SEC does meet the goal of implementing new standards this summer, the current timeline is “unreasonable,” according to Thomas Venables, CEO of Benjamin Franklin Bancorp of Franklin, Mass., who joined two other small-business executives in speaking at a Wednesday Senate Small Business & Entrepreneurship Committee hearing. Venables said his first year of complying with Sarbox gobbled up fully 6 percent of the annual profits of his bank, which has $913 million in assets.
Venables has the support of the committee’s chairman, Sen. John Kerry (D-Mass.) and ranking member Olympia Snowe (R-Maine), who sent a joint letter to the SEC and PCAOB imploring the regulators to extend their deadline for small companies. During Wednesday’s hearing, Kerry said the disproportionate effects of Sarbox on small companies is an issue he will continue to follow and may discuss further with the SEC. Kerry cited a government report that said small businesses would spend $1 for every $100 in revenue, compared to large companies that spend 13 cents for every hundred dollars of revenue.
Were the deadline extended, according to SEC chairman Christopher Cox, the first 404 audit reports for small businesses wouldn’t be filed until three years from now, in March 2010. Still, without extending the deadline, the SEC faces opposition from the small-business community. Sixteen of the 42 comment letters sent to the commission from small-business representatives sought “sufficient time” to consider the final guidance that will be eventually implemented, he noted.
Some non-accelerated filers are scoping their internal-control work now on the assumption that the SEC and PCAOB revisions won’t stray too far from what was presented to the public in mid-December, and that the SEC will not change the deadline, says Anthony Zecca, partner of Cohn Consulting Group, a division of auditor J.H. Cohn. If the SEC does not finalize the two new rules by July, small businesses will not have enough time to comply and the regulator will need to extend the timeline, Zecca told CFO.com.
The SEC and PCAOB hope their new standards will clarify the intent of Sarbox, reducing the number of audits that are overly cautious (read: costly) and increasing the investor’s confidence in the strength of internal corporate controls. Cox pushed aside any question that Sarbox should be rewritten, as some congressmen and Sarbox critics have suggested. “Despite the unduly high cost of implementing Section 404, I believe that the act overall — including Section 404 — may be fairly credited with correcting the most serious problems that beset our capital markets just a few years ago,” he said.