SEC Says to Keep SOX 404(b) for Midsized Companies

The Securities and Exchange Commission has released a study recommending that the existing auditor attestation requirement in Sarbanes-Oxley be kept in place for companies with a public float of between $75 million and $250 million.

The study was mandated by last year’s Dodd-Frank Act, which exempted smaller public with a market capitalization of under $75 million from Sarbanes-Oxley Section 404(b) audits of management's assessment of internal controls (see Obama Signs Financial Reform Bill into Law).

The Dodd-Frank Act also called on the SEC to perform a number of studies, including one of how the SEC could reduce the costs of complying with Section 404(b) for companies whose market cap is between $75 million and $250 million while maintaining investor protection.

The SEC study, released on Friday, found that the costs of Section 404(b) have declined since the Commission first implemented the requirements of Section 404, particularly in response to reforms in 2007.  Investors generally view the auditor‘s attestation on internal controls over financial reporting as beneficial.  Financial reporting is more reliable when the auditor is involved with ICFR assessments; and there is not conclusive evidence linking the requirements of Section

404(b) to listing decisions of the studied range of issuers.

The SEC staff recommended that Congress maintain the existing investor protections of Section 404(b) for accelerated filers, which have been in place since 2004 for domestic issuers and 2007 for foreign private issuers. Thus no new exemptions should be provided.

“There is strong evidence that the auditor‘s role in auditing the effectiveness of ICFR improves the reliability of internal control disclosures and financial reporting overall and is useful to investors,” said the report. “The staff did not find any specific evidence that such potential savings would justify the loss of investor protections and benefits to issuers subject to the study, given the auditor‘s obligations to perform procedures to evaluate internal controls even when the auditor is not performing an integrated audit.”

The SEC staff also recommended that the SEC encourage activities that have the potential to further improve both effectiveness and efficiency of Section 404(b) implementation. The staff recommended that the Public Company Accounting Oversight Board monitor its inspection results and consider publishing observations on the performance of audits conducted in accordance with Auditing Standard No. 5, which allows for risk-based audits. The report noted that the PCAOB observations could assist auditors in performing top-down, risk-based audits of internal control over financial reporting, include the lessons that can be learned from internal control deficiencies identified through PCAOB inspections.

The SEC staff said it is also observing the Commission of Sponsoring Organizations of the Treadway Commission’s project to review and update its internal control framework, which is the most common framework used by management and the auditor alike in performing assessments of ICFR. The staff said it believes that the COSO project could contribute to effective and efficient audits by providing management and auditors with improved internal control guidance that reflects today‘s operating and regulatory environment and by allowing constituent groups to share information on improvements that can be made that enhance the ability to design, implement, and assess internal controls.

The Center for Audit Quality praised the results of the SEC report.  “I am pleased that the SEC’s Office of the Chief Accountant’s thoughtful study recommends retention of Section 404(b) of the Sarbanes Oxley Act for companies whose market capitalization is between $75 and $250 million,” said CAQ executive director Cindy Fornelli in a statement. “Section 404(b) requires independent auditors to attest to management’s assessment of the effectiveness of its internal controls over financial reporting (ICFR). The study concluded that costs of Section 404(b) compliance have declined and financial reporting is more reliable when the auditor is involved with ICFR assessments. Importantly, the study found that investors generally view the auditor‘s attestation on ICFR as beneficial. Finally, we are happy to see that there is no conclusive evidence linking the requirements of Section 404(b) to listing decisions of the studied range of issuers.”

Fornelli noted that the CAQ, joined by the Council of Institutional Investors, filed a comment last September with the SEC fully supporting retention of 404(b). “We hope this study will effectively discourage further discussions around ways to dilute the investor protections contained in Sarbanes-Oxley,” she said.

For reprint and licensing requests for this article, click here.
Audit Regulatory actions and programs
MORE FROM ACCOUNTING TODAY