SEC Chairman Cox Proposes One-Year Delay in Requiring External Auditor Assessment of Effectiveness of Internal Controls of Smaller Public Companies

SEC Chairman Christopher Cox, in his testimony before the US House of Representatives Committee on Small Business on December 12, 2007, indicated that he intended to propose to the SEC’s other commissioners that the SEC authorize an additional one-year delay in implementing the requirement under Section 404(b) of the Sarbanes-Oxley Act of 2002 (SOX) that external auditing firms auditing the financial statements of smaller public companies provide an assessment of the effectiveness of such companies’ internal accounting controls.

This will undoubtedly come as welcome news to the approximately 5,000 companies with a public float of less than $75 million that will be affected by the proposed delay, which will almost certainly be adopted.  Those companies are aware of the significant costs larger public companies have had to absorb – reportedly  averaging $4.4 million in the first year, far above the $91,000 the SEC estimated when it adopted its SOX 404 rules in June 2003.  Earlier this year, the SEC and the Public Company Accounting Oversight Board (PCAOB) issued management guidance and a new auditing standard, respectively, in an effort to contribute to the lowering of the SOX 404 compliance costs.  The interpretive guidance and new auditing standard advocate a “top-down, risk-based” approach to the evaluation of internal controls.  Wisely, the SEC intends to conduct a study to determine whether larger companies’ compliance costs do, in fact, drop to a level that makes persuasive the view that the benefits outweigh the costs.  The SEC does not expect the study to be completed until June 2008.

Smaller public companies should realize that the proposed delay in implementing the SOX 404(b) requirement does not alter the timing of the date by which they must comply with SOX 404(a): the requirement that management of those companies assess, and report on, the effectiveness of their internal controls.  Smaller public companies will need to comply with this requirement beginning with fiscal years ending after December 15, 2007.

While many of those that commented on the SEC’s management guidance and the PCAOB’s new auditing standard when they were being proposed expressed an optimism that these efforts would help reduce SOX 404 compliance costs, I have significant doubts.  See my article entitled, “Will the Efforts of the SEC and the PCAOB to Lower SOX 404 Compliance Costs Prove Effective?” and the side-by-side comparison of the PCAOB’s prior and new auditing standard.

For the moment, the SEC has chosen to ignore those who believe that the SEC fundamentally misinterpreted what Congress intended in SOX 404: the external auditor’s assessment of management’s assessment of the company internal controls, not a separate assessment by the auditing firm of the company’s internal controls.  However, in recent months, the SEC has adopted a number of rule-makings that appear to suggest that the SEC has woken up to the possibility that the SEC is in jeopardy of regulating itself out of existence, as manifested by the number of companies either getting out from under the SEC’s oversight or choosing to avoid raising capital in a public offering in the US.  Let’s hope the survey results are analyzed and interpreted without bias, and that process is conducted in a transparent manner, so as to let the “real-world data” (as Chairman Cox referred to the data being solicited by the survey) speak for itself and guide further actions, if deemed appropriate.

If you have any questions about this advisory, please contact Don Meiers at 202.429.6261.