The Securities and Exchange Commission has unanimously approved its new guidance for management’s assessment of internal controls over financial reporting. The vote comes after three years of companies using — and complaining about — a standard developed for audit firms.
At their Wednesday hearing, the commissioners signed off on an approximately 70-page document that was released in draft form in December. They also proposed a definition for “material weakness” (defined as having a reasonable possibility of leading to a material misstatement that will not be prevented or detected on a timely basis) and eliminated the requirement for auditors to attest to management’s process of evaluating internal controls.
Despite pleas from Congressmen, however, the SEC has decided not to extend the deadline of compliance for companies with less than $75 million in market capitalization. The SEC staff assured commissioners that the new guidance provides scalable and flexible ways for smaller companies to meet the end-of-’07 deadline (management assessment of internal controls must appear in annual reports for fiscal years ending on or after December 15, 2007).
The SEC says its new Section 404 guidance is meant to improve how the internal-control provision of Sarbox is implemented and interpreted, and it could lower compliance costs by focusing management’s attention on areas of materiality and giving managers more latitude in their professional judgment. By eliminating one of the two auditor opinions on internal controls, the SEC has lessened or eliminated “the pressures that managers have felt to look to auditing standards for guidance in performing these evaluations,” according to the guidance literature.
“Addressing cost in a substantive manner has become one of our primary goals,” said commissioner Annette Nazareth. “I don’t believe anyone anticipated the costs would be so high or that management’s assessment would become driven by the Public Company Accounting Oversight Board’s Standard No. 2.” But that’s exactly what happened, prompting CFOs to sound alarms about fees, auditors’ conservative approaches, and a lack of guidance tailored to corporate reality.
The new 404 guidance wins approval just one day before the PCAOB is expected to approve a new auditing standard for audit firms (Auditing Standard No. 5), which is intended to ensure that “auditors are able to achieve efficiencies through more judgment-based standards and not have to work for work’s sake,” said Zoe-Vonna Palmrose, SEC deputy chief accountant for auditing and professional practice issues.
Together, the two developments should provide relief to companies while honoring the intent of the law, according to SEC chairman Christopher Cox. “Congress never intended for the Section 404 process to be inflexible, burdensome, and wasteful,” he said. Rather, Sarbox was designed solely to provide “meaningful” disclosures to investors and restore their confidence in financial reporting after the corporate accounting scandals earlier this decade. The new guidance will now “right-size” management’s evaluation of corporate internal controls, Cox added.
Assuming that the PCAOB approves its new standard and gets final sign-off from the SEC, the regulators’ new guidance would apply to the 2007 audit cycle, Cox said. (As its oversight body, the SEC needs to approve of the PCAOB’s standards before they can be implemented.)
The new SEC guidance is voluntary, noted John White, the SEC’s director of corporation finance. “There’s no requirement for companies to alter the procedures they’ve used in the last three years to align with the interpretative guidance unless they choose to do so,” he said.
The commissioners called the changes to 404 a “step in the right direction” but didn’t rule out further modifications. Taking a top-down, risk-based approach will likely remain a work in progress. As commissioner Kathleen Casey noted, “We can’t, on the one hand, ask people to use their best judgment and on the other hand second-guess that judgment.”