Corporate & Securities Law

By Jim Hamilton

Investor Groups Want No Legislative Exemption from SOX 404(b) Auditor Internal Control Attestation

In a letter to Senate leaders, investor groups opposed exempting smaller public companies from compliance with Section 404(b) of the Sarbanes-Oxley Act in the financial legislation moving through Congress. Section 404(b) requires an independent audit of a public company?s assessment of its internal controls. In the letter to Senate Banking Committee Chair Chris Dodd and Senator Richard Shelby, the committee?s Ranking Member, the Center for Audit Quality and the Council of Institutional Investors warned that a permanent legislative 404(b) exemption for smaller companies would create a dual class system of investor protection in the United States with no compelling reason to do so. If Congress agrees to a permanent 404(b) waiver for smaller companies, said the groups, there may be little independent scrutiny of financial reporting safeguards at half of all listed companies nationwide.

Reporting under Section 404 provides investors with meaningful information regarding a public
company?s internal control over financial reporting, emphasized the organizations, adding that the required independent audit of management?s assessment of the effectiveness of internal controls has been integral to the achievement of the intended objectives of internal control reporting under the overall Section 404 framework.

Moreover, the groups noted that a congressionally-mandated study by the SEC found that Section 404 provides benefits that are valuable regardless of a public company?s size. In their view, reporting requirement reforms, including the PCAOB?s adoption of Audit Standard No. 5 and the SEC?s management guidance, are reflective of the real-world lessons learned since the law?s enactment. The result has been a decline in compliance costs of approximately 30 percent. SEC Office of Economic Analysis, Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control Over Financial Reporting Requirements (September 2009.

The SEC?s study also determined that investors and other financial statement users regard internal controls disclosures to be beneficial and indicated that both 404(a) and 404(b) compliance has had a positive impact on their confidence in the companies? financial reports. The users generally indicate that Section 404 compliance leads management to better understand financial reporting risks, put in place appropriate controls to address financial reporting risks, and address internal control deficiencies in a more timely fashion than in the absence of the disclosure requirement.

Since investor confidence in public companies? financial reports is imperative to the successful operation of the capital markets, reasoned the groups, it makes sense to apply the benefits of Section 404(b) to investors to public companies of all sizes, even those that have not yet had to comply. This is especially meaningful in view of the fact small companies are more likely to issue earnings restatements.

In fact, noted the groups, a November 2009 study by Audit Analytics suggests that companies that have not yet had auditors review their internal control reports have a restatement rate that is 46 percent higher than larger public companies, despite claiming they have effective controls. Moreover, a 2009 analysis of restatements of small companies by Glass Lewis for the Ohio Public Employees Retirement System found a correlation between internal control problems and poor stock performance. The analysis revealed the large costs incurred by investors in the form of continued stock underperformance of small companies with deficient internal controls.

Currently, the House reform legislation, HR 4137, would permanently exempt non-accelerated issuers with a market capitalization of $75 million or less from Section 404 (b) of Sarbanes Oxley. The Senate bill, S 3217, does not contain a similar exemption.

Full post as published by Jim Hamilton's World of Securities Regulation on April 23, 2010 (boomark / email).