Small Co. Reprieve: Sarbox Deadline Delayed

Smaller companies get a one-year compliance extension on Sarbox 404(b).
Stephen TaubJune 20, 2008

The Securities and Exchange Commission has granted small companies a one-year reprieve with regard to complying with the auditor-attestation requirements of Section 404(b) of the Sarbanes-Oxley Act. When it approved the extension on Friday afternoon, the SEC said it wants to study the cost burden of compliance on small companies, defined as those having a market capitalization of $75 million or less.

On Thursday the Office of Management and Budget gave the SEC the go-ahead to proceed with data collection for a study on the costs and benefits of Section 404 implementation for smaller companies. The results of the study are expected to become available during the extension period.

With the extension, smaller companies will now be required to provide the attestation reports in their annual reports for fiscal years ending on or after December 15, 2009.

Drive Business Strategy and Growth

Drive Business Strategy and Growth

Learn how NetSuite Financial Management allows you to quickly and easily model what-if scenarios and generate reports.

“The extension of the Section 404(b) compliance date for smaller companies is the latest in a series of Commission efforts to help reduce unnecessary compliance costs for smaller companies while preserving important investor protections,” the SEC said in a press release.

Section 404 has two provisions: 404(a) requires company management to assess the effectiveness of the company’s internal controls over financial reporting, while 404(b) requires an auditor attestation on management’s assessment. Companies, especially small ones, have consistently complained that the costs to comply are unreasonably high. Most small companies vigorously dispute the SEC’s original assertion that compliance should cost them an average of $91,000 in their first year of compliance.

Earlier this year, consulting firm Lord & Benoit released a study pinpointing the average first-year compliance cost of Sarbox 404 for small companies at $78,474. That cost was broken down to include $53,724 for complying with 404(a) and $24,750 for 404(b). But many observers have dismissed that data as unrealistic. The study was based on information from just 29 small companies, as well as research culled from SEC filings and audit-fee data from Audit Analytics.

SEC chairman Christopher Cox first proposed the one-year delay for small businesses during December 2007 testimony before the House Small Business Committee, and the commission formally proposed this extension in February. The SEC cost-benefit study is being led by the commission’s Office of Economic Analysis with assistance from the Office of the Chief Accountant and the Division of Corporation Finance.

The SEC will now move forward with interviews and a Web-based survey as part of its effort to collect real-world data from a broad array of companies and analyze what drives costs — particularly for smaller companies — and where companies and investors derive the benefits from Section 404.

Larger companies, comprising more than 95 percent of the market capitalization of U.S. equity securities markets, have been subject to both provisions since 2004. In 2007 the SEC issued new guidance for management’s Section 404 assessment to help companies focus their reviews on the internal-controls issues that matter most to investors.

The cost-benefit study will help determine whether the new management guidance is having the intended effect of facilitating more cost-effective internal-controls evaluations and audits of smaller reporting companies, the SEC said in a press release.

Companies of all sizes, including smaller ones, are filing their first 404(a) reports this year with the benefit of the new guidance. Furthermore, the SEC and the Public Company Accounting Oversight Board voted unanimously to replace the standard for the 404(b) auditor attestation, which the SEC asserted is intended to make the process more efficient.

This year larger companies are filing their first 404(b) reports under the new audit standard.