Risk & Compliance

Stalling on Sarbox

The regulatory-reform bill passed by the House last week suggests that lawmakers will either exempt smaller companies from getting internal-control...
Sarah JohnsonDecember 17, 2009

Rick Brounstein, CFO of microcap company NewCardio, hopes one day to be required to comply with the auditor-attestation requirement of the Sarbanes-Oxley Act, known as Section 404(b). Really, he does.

Presuming the time comes when NewCardio’s technology, which is designed to improve the accuracy of heart tests, goes to market and begins to collect significant revenue, the business could become more complicated, more global, and more needing of external checks on its internal controls over financial reporting, Brounstein says.

Until then, though, Brounstein doesn’t see a need to pay the extra auditing fee plus the additional man-hours to deal with the review process. He says complying with Section 404(b) would be an unnecessary expense, one that regulators have been unable to quantify for the smallest publicly traded companies since Sarbox was passed in 2002.

For the 2007 and 2008 reporting cycles, NewCardio reported it had effective internal controls. But doing the management report is easier “without having to write down all the stuff you do so that the auditor can see that you did [it],” says Brounstein. He couldn’t specify how much 404(b) would cost him, but he knows the added expense could affect next year’s budget.

At the moment, though, there’s a real possibility he won’t be required to comply. Promising it would be the last delay for companies with market capitalizations under $75 million, the Securities and Exchange Commission recently said those companies will have to provide 404(b) reports for 10-Ks filed for fiscal years ending after mid-June 2010. However, a key piece of legislation passed last week by the House of Representatives would give smaller companies yet another delay — or even a full exemption — from the requirement, as long as their market caps stay below a certain threshold.

The cluttered Wall Street Reform and Consumer Protection Act of 2009 carries several contradictions within its 1,279 pages. Despite the name, it would roll back the most onerous provision in the other major reform bill passed in this decade, Sarbanes-Oxley. The legislation simultaneously calls for another year-long delay for compliance, an exemption for the smallest of companies, and another study of the costs and benefits of full Sarbox compliance.

To be sure, the provisions could be tweaked or even deleted when the Senate puts its stamp on the legislation early next year. Still, political winds during the downturn could work in small businesses’ favor, according to Herbert Wander, a partner at law firm Katten Muchin Rosenman, who co-chaired the SEC’s Advisory Committee on Smaller Public Companies. “Everyone wants to get on the bandwagon to support small business,” he says. “It’s good for jobs and also good politically.” In 2006 Wander’s committee (of which Brounstein was also a member) recommended that, depending on revenue, some small-cap and microcap companies should be exempt from 404(b) unless regulators could come up with guidance tailored to their needs.

Earlier this year, an SEC study reported that the cost of Sarbox compliance has gone down over time. The commission concluded that larger companies — those that have had to fully comply with Section 404 — paid a mean total of $2.87 million when they first began following Sarbox, and expect to pay a mean of $2.03 million for their next internal-controls report. The commission figures the audits of their internal controls will cost a mean of $583,753 in fees.

The regulator also concluded that smaller companies will have to pay a disproportionately higher amount to comply than larger firms. As a result, Brounstein says the SEC should next question whether 404(b) is actually helping investors in smaller companies or “taking too much out of their bottom line.”

The House bill calls on the SEC to do more studies on 404(b) compliance, including another cost-benefit analysis and a report that could lead to lawmakers deciding that small companies could have a “Sarbox lite” version to follow. There are scaled-down versions of other SEC regulations for “smaller reporting companies” — those with under $75 million in market cap — allowing them to disclose less information, such as in the Compensation Discussion and Analysis section of their proxy statements. The new study would explore whether the SEC should consider revenue as well as market cap when determining which companies have to comply with 404(b). The study would look at companies with public floats of less than $700 million and revenues under $250 million

The reform legislation’s definition of a smaller reporting company differs from the SEC’s. The discrepancy in numbers will likely be worked out in Congress, explains Howard Berkenblit, a partner at law firm Sullivan & Worcester, or it could raise the possibility that some companies that already fully comply with Sarbox (some of the so-called accelerated filers) could get a reprieve. Indeed, another provision in the bill asks the SEC and Comptroller General to see how the burden of 404(b) compliance could be reduced for companies with market caps of between $75 million and $250 million.

Considering revenue when deciding which companies should comply with Sarbox would help firms like Brounstein’s, whose market caps may skew the complexity of their operations. Development-stage companies may have ballooning stock prices because of market excitement over their products but may have little or no revenue. Alan Eisenberg, executive vice president of emerging companies and business development for the Biotechnology Industry Organization, praises the concept of a revenue threshold. Society, he says, “would rather see dollars go into the development of new therapies to alleviate and treat and cure diseases than go into paperwork or regulatory compliance.”

In its 2006 report, the SEC’s small-company advisory committee noted that auditors of smaller firms believe “the smaller the company, the less valuable the internal control audit is to the financial statement audit.” With larger companies, the auditors need to rely more on internal controls, since it’s impractical to test a large number of transactions for complex operations that are in multiple locations.

Not surprisingly, the consultancies and accounting firms that stand to gain from new business are deflecting the notion that 404(b) compliance is an unnecessary “burden” for small business. Critics of the reform legislation insist that the process gets easier over time, and say smaller businesses are especially in need of the scrutiny since they are inherently more risky, with fewer finance staffers in place to provide proper checks and balances. “If they’re going public, they should be following the same rules as everyone else,” says Guy Clarke, a consultant at accounting firm Sensiba San Filippo.

Still, these critics do see both sides and acknowledge there’s not an easy answer, particularly when a lot of small businesses have been struggling in the past 18 months. “It’s an interesting debate, whether you should exempt smaller companies from having their internal controls audited just because it’s expensive,” says Berkenblit.