To 404(b), or Not to 404(b)?
Small companies will soon learn whether they will have to comply with
Sarbox's requirement to get an auditor's sign-off on internal controls.
Dan
Crow is one of the few small-company CFOs with an auditor's stamp on his internal
controls. Getting it wasn't as time-consuming or as costly as it would have
been several years ago, when large public companies first began complying
with one of the most onerous requirements of the 2002 Sarbanes-Oxley Act,
known as Section 404.
Still, Crow, who oversees
finance for retailer Hastings Entertainment, doesn't rule out dropping the
extra review next year if Congress decides to permanently exempt small public
companies from needing an auditor's sign-off on their internal controls — as
it seems poised to do. The Senate is expected to vote this week on the final
version of the financial regulatory-reform bill, which would exempt companies
with public floats below $75 million from complying with Section
404(b), the rule in question. (The House has already passed the bill.)
Crow
says a part of him believes that all publicly traded companies should be
"on the same page" and subject to the same rules, but another side
feels the time and cost of compliance can be burdensome, particularly for smaller
companies. "I just wish they would make the decision and stick with
it," he says.
Indeed,
regulators and lawmakers have wavered over the years when it comes to Section
404 and small businesses. The Securities and Exchange Commission has issued
many delays for companies with public floats below $75 million, or
"nonaccelerated filers." Two years ago, those companies finally had
to record their management's take on their internal controls, but they have
repeatedly received a break on getting external auditors to do similar
reviews.
The
most recent deferral from the SEC, which the commission swore would be the
last, means that nonaccelerated filers will have to include a 404(b) report (the
auditor's opinion on internal controls) with their next 10-K, starting for
fiscal years ending after June 15, 2010 — unless they get the permanent
exemption.
In
the meantime, volunteers such as Hastings Entertainment are in the minority.
According to research firm Audit Analytics, only 23 companies that
characterize themselves as nonaccelerated filers or smaller reporting
companies have so far filed a 404(b) report for the 2010 fiscal year. In
fiscal 2009, nearly 550 out of the more than 4,100 companies that filed
auditor-attestation reports did so on a voluntary basis, according to Audit
Analytics.
Larger
firms could eventually win a reprieve, too. The reform bill also calls for
the SEC to study how the "burden" of 404(b) compliance for
companies with market capitalization between $75 million and $250 million
could be reduced, and whether an exemption for them could increase the number
of initial public offerings in the United States.
Crow
says Hastings Entertainment's internal-control audit cost between $75,000 and
$100,000. He believes the cost and time involved in Ernst & Young's
blessing of his internal controls would have been far worse had he had to
comply with 404 years ago, when CFOs at larger companies and auditors were
just getting their feet wet with the new law and regulators had yet to make
it easier to comply by relaxing their guidance.
Like
many finance executives who have gone through the process, Crow says his
company has benefited from being fully 404-compliant, uncovering
inefficiencies in some processes, including the cancellation of purchase
orders. Moreover, says Crow, "it's nice for our shareholders to know
that we got an opinion from our auditors, whether or not we're required to do
so."
Consultants
and auditors who could use extra dollars from 404(b) reviews are mining for
similar notes of enthusiasm. Protiviti, a risk-management and internal-audit
consulting firm, recently released a survey of 400 executives — many of them
longtime, fully compliant Sarbox veterans — with 70% of them claiming that
the benefits of internal-control reviews outweigh the costs. (However, only a
minority of first-time Sarbox compliers said the same.)
Companies
have gained a better grasp of their controls and uncovered more efficient
ways to do business, says Bob Hirth, executive vice president and leader of
Protiviti's global internal audit and financial control practice. But it's
unclear whether small-cap firms will believe such data. "Some companies
will think, 'Why not demonstrate beyond our own [management] reports that we
have strong internal controls? Let's move forward,'" he says.
"Others never want to do it and will be glad they never have to do
it."
As
a group, accounting firms have lobbied Congress to forgo the exemption. In a
June letter to lawmakers working on the compromise version of the
regulatory-reform bill, the Center for Audit Quality, which represents audit
firms, and two investor trade groups insisted that an independent audit of
internal controls provides "an important safeguard against financial
fraud." However, lawmakers who support the exemption, including Rep.
John Adler (D-N.J.), claim it will preserve jobs and cut red tape for small
businesses.
In the meantime, small
businesses can wait out the decision. Since most of them have fiscal years
concluding at the end of 2010, they have until early spring to submit an
auditor review. Even auditors can understand small businesses' tendency
toward procrastination. "I can't blame them if they're waiting to see if
this becomes law, since there have been so many deferrals," says Stephen
Austin, managing partner of Swenson Advisors, a regional accounting firm in California.
Article was earlier published in one of the reputed financial magazine.
|
