The news last week that the requirements of Section 404(b) of the Sarbanes-Oxley Act might never, ever come to bear for small companies had Jeff Klausner, CFO of Infosonics, a wireless-equipment provider with a market cap of around $14 million, “doing backflips,” he says. “This wouldn’t change anything that we do; it would just save us a bunch of money on audit fees.”

The proposed Sarbanes-Oxley amendment, co-authored by Rep. Scott Garrett (R-N.J.) and Rep. John Adler (D-N.J.), has so far been passed only by the House of Representatives Financial Services Committee. Already, though, it has ignited plenty of interest. The proposal would permanently exempt companies with market caps of $75 million or below from 404(b) — following several compliance deadline extensions that the Securities and Exchange Commission has already granted them.

The bill would also direct the SEC to study ways to cut the compliance costs for companies with market caps of $75 million to $250 million, including the possibility of an exemption. Section 404(b) requires a company’s auditors to affirm management’s assessment of the company’s internal controls of financial reporting.

Many financial executives, like Klausner, say an exemption would mean the same level of integrity in their financials but with less cost. “We have a fairly good system of internal controls, and we’d like to keep that for our own well-being as much as anything else,” says Marty Schwenner, CFO of digital-power and motion-control systems manufacturer Magnetek, a company whose market cap dropped it from the accelerated filer range to the nonaccelerated filer range this year. “We view internal control as something that’s our responsibility whether or not Congress tells us it’s something that is.” Still, he estimates he’d save as much as half of the $352,000 he paid Ernst & Young for last year’s audit if Congress were to drop the auditor signoff requirement.

But accounting experts aren’t so sure. Sonia Luna, CEO of SOX Solutions, a Sarbox consultant in Los Angeles, says management’s assessment of internal controls — as required by Section 404(a) of the act — is often too cursory. “In practice, when 404(b) kicks in, companies begin to take their controls very seriously. They create new forms, new tasks, and new checklists so that someone externally can follow the trail,” she says. “Without it, there’s no sanity check [to decide whether or not there’s a material weakness].”

Even executives with good intentions may produce a flawed analysis. “My fear is that companies will fail to acknowledge the number of material weaknesses they actually have, because they don’t have the competency in-house [to determine whether weakness is major or not],” says Luna. Information-technology controls related to finance, in particular, are often not well understood by CFOs and CEOs.

Not surprisingly, auditors in general are opposing such a measure, which would mean large revenue losses for their firms. “We believe that the required independent audit of management’s assessment of the effectiveness of [internal controls]…has been integral to the achievement of the intended objectives of…SOX Section 404,” wrote Cynthia Fornelli, executive director of audit-industry consortium Center for Audit Quality, to the House Financial Service Committee. She noted various polls of investors that indicated they placed more confidence in assessments accompanied by an auditor sign-off.

While Luna, whose firm does not do audits, wouldn’t directly lose revenue, she says the loss of
404(b) would “prod people like us to do less. I work with the audit partner to make sure there’s a high bar to be set for internal controls; without him or her backing us up, it’s very hard to come in and say [to executives] that you’ve got to [do] this or that.” (Luna notes she wouldn’t expect such difficulties with her current clients, including Infosonics, who are “very ethical.”)

CFOs counter that the need for such sign-offs hinges in large part on the complexity of the business rather than its size. “For companies like ours where we don’t make money and aren’t going to make money for a long time, what people really want to know about is our clinical data,” says Ron Renaud, CFO of Idenix, a Cambridge, Massachusetts-based biopharmaceutical firm focused on developing drugs to treat Hepatitis C.

Renaud, who was a sell-side analyst covering the biotech sector from 2000 to 2006, says he “didn’t see much change in the transparency of financial statements before and after” they complied with Sarbox, including Section 404(b).

He also takes issue with a more basic matter: the SEC’s use of market caps to group companies. “It’s not unusual for a biotech company to have a successful product and go from being a nonaccelerated filer to a large accelerated filer in one quarter” — even surpassing the $250 million market cap that Reps. Garrett and Adler set as the limit in their bill, he says. (Of course, this past year many other companies in much more stable industries have seen that volatility, as well.) “If there was something a little less of a moving target, it would be helpful,” says Renaud.