Risk & Compliance

Sarbox on Ice?

True or false: The SEC, the PCAOB, and Congress are lightening up on Sarbanes-Oxley and legal liability.
David KatzFebruary 1, 2007

Although it’s not even five years old, there’s no question that the Public Company Accounting Oversight Board has seen better days.

Currently the target of a lawsuit that threatens its existence, the PCAOB has also been criticized by its boss, the Securities and Exchange Commission, for burdening Corporate America via excessive internal-controls rulemaking. Caught amid an apparent widespread counter-reaction to post-Enron reforms, the oversight board has become a poster child for over-regulation.

Indeed, if the plaintiffs in the lawsuit get their way, the PCAOB—and the Sarbanes-Oxley Act that spawned it—will no longer exist. In late December, a U.S. District Court judge heard arguments from both sides in the case against the accounting board. The plaintiffs, who contend that the PCAOB setup violates the Constitution, think that if they dismantle the board, all of Sarbox will tumble in the legal wake. While the judge is likely to hand down a ruling as soon as in March, Michael Carvin, a Jones Day attorney representing the plaintiffs, told CFO.com recently, the case will almost surely be appealed by the losing side and end up in the D.C. Circuit Court.

Assuming that the board hangs around for awhile, though, it’s sure to find itself on a short leash. For years, the SEC has faced heavy pressure to make the rules under Sarbox 404, which covers internal controls over financial reporting, cheaper and less burdensome for smaller companies. The commission responded late last year with new guidance on how corporations should comply with the rules and apparently pushed PCAOB to get with the program and revise its own controls standard for auditors, AS2.

Further, SEC members have laid the blame for the 404 brouhaha squarely on the accounting board’s brainchild. With the SEC failing to provide guidance until it issued its recent proposal, senior finance executives and controllers defaulted to AS2 as the key compliance guideline.

And that, the comissioners contend, led to disaster. “We had an atmosphere in which what-if scenarios created mountains out of molehills — a control failure for a $500 error could be just as significant as for a $50 million error,” Commissioner Paul Atkins told the Corporate Directors Forum in San Diego on January 22. “And, we had companies being told to document, analyze, and create process charts for literally tens or hundreds of thousands of supposedly key internal controls — and those numbers are for individual companies, not the market as a whole.”

Even the president got into the act in a speech on Wall Street on Wednesday. “We don’t need to change the law,” President Bush said of Sarbanes-Oxley, “We need to change the way the law is implemented. . . [c]omplying with certain aspects of the law, such as Section 404, has been costly for businesses and may be discouraging companies from listing on our stock exchanges.”

In response to such criticism, the SEC and the PCAOB are proposing that checks on internal controls should be limited to areas that could sprout the risk that a material misstatement could go undetected. By moving to a solid, agreed-upon definition of materiality, the regulators contend that they could make life a whole lot easier for corporations while still remaining rigorous.

The regulators’ sharpened language is one of a bevy of signals that federal rulemakers and legislators finally seem to be easing up after five years of post-scandal tightening. Add to that an increasingly aggressive push for tort reform for auditors, and you’ve got the makings of a full-scale loosening of strictures that, critics say, have entangled corporate finance.

Or do you? A second look shows that there may be more sound than fury in the movement to dismantle Sarbox, et al. Outside of the plaintiffs in the suit against PCAOB, few have openly called for a revocation of the 2002 law. Even the Committee on Capital Markets Regulation, a group backed by Treasury Secretary Henry Paulson that wants to free the U.S. capital markets from what it deems the excesses of 404, has no malign designs on the act itself. “We recommend no statutory changes in the Sarbanes-Oxley Act, including Section 404. Investors have benefited from the stronger internal controls, greater transparency, and elevated accountability that have resulted from this new law,” the committee said in its December 5 interim report.

At the same time, the group blames “the implementation of SOX 404 by the SEC and the PCAOB” for producing a “regime that is overly expensive.” Like the SEC, its solution consists largely in raising and clarifying the standard of what might be a material weakness in internal controls. The committee recommended that the PCAOB change AS2’s existing definition of a material internal-controls error from one in which there’s a “more than remote likelihood” that a material misstatement wouldn’t be detected.

That definition has befuddled auditors and made them overly scrupulous, the PCAOB acknowledges. Instead, Paulson’s group proposed, the definition should read: “A material weakness exists if it is reasonably possible that a misstatement, which would be material to the annual financial statements, will not be prevented or detected.” The SEC and PCAOB proposals, issued shortly after committee’s report, both use the new language.

On the surface, the new wording seems to represent a beachhead for the “principals-based” auditing that would represent a relief for audit clients over the old “rules-based” regime. After all, wouldn’t the “reasonably possible” definition ask auditors to exert a lot more judgment — and a lot less scurrying after minutiae — than “more than remote likelihood” would?

But the capital markets committee had another suggestion. The materiality standard for internal controls, it says, should be consistent with the one used in financial reporting. In line with that, the committee wants the SEC to revise its financial-reporting guidelines “so that scoping materiality is generally defined, as it was traditionally, in terms of a five percent pre-tax income threshold.”

“Traditionally,” however, seems to mean “before 1999.” In a staff bulletin the SEC issued that year, the commission sharply curbed the use of “rules of thumb” — like 5 percent of net income or earnings per share — as gauges of how big a misstatement must be before a company must report it. While such measures could be used as a jumping-off points in figuring out what to report, executives and auditors must “consider all the relevant circumstances” in evaluating what’s material, according to the bulletin.

In that context, the committee seems to be proposing a shift back to bright-line rules — to a specificity that’s generally considered the root of many of the problems associated with 404. Of course, the SEC and the PCAOB aren’t obliged to proceed in lockstep with the Paulson Group’s proposals. But the committee is bound to have an influence.

Similarly, the currently strong movement to limit auditor liability could lose steam. To be sure, both the capital markets committee’s report and an earlier “vision statement” by the chief executives of the five biggest auditors have called for reforms that would curb the effect of lawsuits against the firms.

The groups contend that another big prosecutor-driven auditor failure like Arthur Andersen’s would destroy existing competition in the market for audit services. They also argue that the threat of lawsuits has made auditors overly cautious — causing them to pile on 404 tests, for example.

In a striking statement that reveals the current level of support for auditor tort reform, Conrad Hewitt, the SEC’s chief accountant reportedly expressed worry on January 25 about potential auditor liability because there are only four major accounting firms left. “It’s a concern to us if something should happen to any of the four firms,” Hewitt said. “Something can be done, and should be done, for the accounting profession” to limit exposure to lawsuits, he added.

Others, however, think that placing a cap on the legal damages independent auditors can suffer removes an important deterrent to fraud. Douglas Carmichael, who was the PCAOB’s first chief accountant, feels that Hewitt’s comments were inappropriate in light of a January 22 report by the board that found abundant blunders in auditors’ fraud detection. The way to boost deterrence is for the PCAOB to follow up with the firms, says Carmichael, now the Wollman Distinguished Professor of Accountancy at Baruch College in New York City. “It’s certainly not to give auditors freedom from legal liability.”

In the current Democratically controlled Congress, such views are likely to get a sympathetic hearing. Indeed, advocates of liability caps could encounter tough sledding, considering the financial support Democrats get from the plaintiffs’ bar. As is the case with other apparent regulatory and legal rollbacks, the jury on tort reform is still out.