New SOX audit rule expected to help smaller companies

It may not be all that smaller companies were hoping for, but new rules issued by the Securities and Exchange Commission are expected to lower the costs of complying with Sarbanes Oxley’s dreaded auditing requirements.
The SEC recently released an official guidance to relieve small issuers of some of the burdens of complying with Section 404 of SOX. And the Public Company Accounting Oversight Board (created by SOX) also has issued a related new accounting standard to go hand-in-hand with the new guidance.
Approvals by appropriate regulatory agencies are expected to come this summer so that small companies will be officially subject to Section 404 by Dec. 15 for this calendar year.
Regulators say management and auditors should use a top-down, risk-based approach to audit the procedures that ensure a company’s financial reports are accurate. And they should scale the audit to the complexity of the company, and use the new, arguably less burdensome, definition of material weakness.
The auditor attestation has been clarified so that they now attest to the actual internal control procedures, not management’s process for developing them.
“If you surveyed CEOs of small business issuers, most would say they hoped for more relief – maybe even an exemption from 404,” said Deepak Nanda of Foley & Lardner’s Los Angeles office. “Absent that, I think the guidelines do present some relief.”
The SEC’s guidance isn’t much different from what was proposed and released for comment late last year, and some securities lawyers are just as unsure now as they were then that the changes will result in anything agitators hoped for – namely, less costly audits for small companies, an end to companies listing on overseas exchanges, and stemming the tide of public companies going private.
Those problems, they say, are symptoms of the larger U.S. market structure. And that’s not something a guidance on Section 404 will ever change.
“I don’t think this is going to make much of a difference in costs or for keeping businesses in the U.S.,” said Steve Honig of Duane Morris in Boston. “We still have the most highly regulated securities market in the world. While 404 is a significant cost center, tweaking 404 doesn’t address the totality of our regulatory scheme. Secondly, the stigma of 404 is going to continue in the minds of people stigmatized by it. The fact that tweaks were made in 404 is not going to impress those people who would rather go public in Bombay.”

The final say
The guidance was posted in the Federal Register on June 27. According to a statement by SEC Chairman Christopher Cox, the guidance focuses management and auditors on the internal controls that best protect against the risk of a material financial misstatement. Cox in his statement said “companies of all sizes will be able to scale and tailor their evaluation procedures according to the facts and circumstances.”
Auditors should use a top-down, risk-based approach when assessing internal controls of a company’s financial reporting system. Up to now, Nanda explained, auditors started with the lowest level functions in the accounting office and built a foundation with solid connections up the chain of command to the CFO, who certifies the company has effective internal controls.
“You start checking each and every step everybody goes through,” he said.
But the guidance tells management and auditors they can take a different approach, one a little less direct, Nanda said, because small companies work differently.
“The concept of testing internal controls, managers reports and auditors reports doesn’t make sense” because in these small departments, these employees sit next to each other and know what everyone’s doing all the time, Nanda said. “You don’t have this vast organization that requires all these levels of organization to check and report and makes sure there’s a system of controls in place to guard against fraud.”
In the guidance, the SEC is saying it’s permissible to build an audit around that reality.
The SEC also amended its rules to define the term “material weakness” as “a deficiency, or combination of deficiencies … such that there is a reasonable possibility that a material misstatement … will not be prevented or detected on a timely basis.”
The definition used to be “more than a remote likelihood,” and that was thought to be a very low trigger, Honig said. One could argue, however, that “reasonable possibility” is as amorphous as “more than a remote likelihood,” he pointed out. “If that’s so, what’s the big furor about here?” A clearer indication would be “more likely than not,” he suggested.
The SEC also revised the requirements for the auditor’s attestation report on the effectiveness of internal controls. According to the guidance, auditors should not assess management’s evaluation process, but should instead focus on actual internal controls over financial reporting.
But it remains to be seen whether that will actually play out. Auditors’ old habits die hard, Honig noted, as their business is risk.
The SEC also created a safe harbor provision so that companies conducting an internal control audit consistent with the guidance will be in compliance with Section 404.
“That at least gives a company some guidelines for what they’re required to do to comply with 404 requirements. That is probably one of the things that’s very good about this interpretive guidance,” said former SEC staffer Bryan Brown, now with Porter & Hedges in Houston.
Keeping with the SEC guidance, the PCAOB issued a new standard for auditor compliance under Section 404.
Auditing Standard 5 will replace Auditing Standard 2 and mirrors the SEC guidance. Its main objectives are to: