If you listened carefully, you could almost hear the collective sigh of relief from 5,000 smaller public companies when Securities and Exchange Commission (SEC) Chairman Christopher Cox proposed yet another extension to the Sarbanes-Oxley (SOX) deadline for an external audit of Internal Control over Financial Reporting (ICFR).
The SEC previously appeared to be steadfast in upholding the set deadline for non-accelerated filers, or public companies with less than $75 million in public float, even though the business community continued to complain that SOX was too costly. The SEC is expected to vote on Cox’s proposal early this year and decide if that sigh of relief was premature.
The deadline for Section 404a compliance remains in effect for fiscal years ending on or after Dec. 15, 2007. That is when management must furnish its own assessment of internal controls. Section 404b, which requires an external audit of ICFR, was originally scheduled for fiscal years ending on or after Dec. 15, 2008. The extension would delay that requirement to Dec. 15, 2009.
A bearable burden
The proposed delay allows the SEC and the Public Company Accounting Oversight Board (PCAOB) to complete their study of the effect of the new Auditing Standard No. 5 on the costs for companies to comply with SOX. The additional year will give regulators the opportunity to fine-tune the new standard before audit firms apply it to smaller companies.
As the 404a deadline remains, companies should spend 2008 double-checking their assessments, improving high-risk areas and enhancing the efficiency of their control processes. The additional time before an audit also allows smaller reporting companies to review their approach with a third party before they become subject to scrutiny from external auditors and to build a sustainable, cost-effective approach for the long-term.
Regulations for public companies, best practices for private companies
Privately held companies also are benefiting from the approach the SEC has taken with non-accelerated filers. Many privately held companies, concerned about financial risk and controls, have adopted key aspects of SOX in their own operations. Any company that takes the time to assess control weaknesses and mitigate risks will reap the benefits of improved financial controls, reduced business risk, enhanced credit ratings and superior governance.
Many private company audit committee members are also audit committee members of publicly held companies and have witnessed some of the benefits of SOX. In the private company environment, these board members have pushed management to follow certain aspects of the SOX regulations in hope of applying some of the regulation’s more useful provisions. This is especially the case for regulated private entities such as community banks. Although this level of internal control is not required by the SEC for privately held banks, similar regulatory controls are mandated by the Federal Deposit Insurance Corporation (FDIC). Applying the lessons learned from SOX in these environments can improve both the efficiency and effectiveness of those efforts.
Companies considering an initial public offering (IPO) have one year after their first filing as a public company to comply with SOX regulations. Even though a company has additional time to become SOX compliant, preparatory controls work in advance of an IPO still proves helpful. Compliance costs can range from $100,000 to several hundred thousand dollars. In the long run, companies that take a more deliberate and well thought-out approach, focusing on implementing financial reporting systems, processes and controls the right way, will reduce their overall compliance and audit expense.
Privately held companies considering a buyout by a publicly held company should consider how efficient their internal controls are before an opportunity arises. Strong internal controls ensure the privately held company does not create a material weakness for the public buyer, which could become a barrier to completing a transaction. Strong internal controls also add confidence to the acquiring company during the courting process.
Preparing for a future of financial security
Once the current non-accelerated filers are in full compliance, privately-held companies, especially those with futures in the public realm, will have access to the lessons learned from their experiences.
Business ethics and process controls are part of the formula for a strong and successful company. Taking advantage of this very public learning and experimental period in government regulation will improve opportunities for private and public companies, whether they are required to file or not.
