The Undoing of Sox 404(b)

Effective April 27, 2020, a total of 492 issuers with annual revenues of less than $100 million are allowed to newly classify as nonaccelerated filers. The intention is to promote capital formation, preserve capital, and reduce unnecessary burdens for certain smaller issuers while maintaining investor protection.

Did this cause CFOs of smaller companies to breathe a collective sigh of relief as intended, or did the investor community’s level of confidence in company reporting just plummet? The answer is both.

According to Louis Arcudi III, CFO of Millendo Therapeutics, a biopharmaceutical company focused on developing treatments for endocrine diseases, eliminating the attestation for smaller companies could be a major game changer for small pharma and for public welfare as a whole. “The certainty and predictability provided by the proposed rule will enable small public companies like ours to prioritize investments in factors that actually determine success or failure in the biotech industry,” he commented to the SEC, adding, “We strongly believe that this proposed rule will benefit small public companies and their investors by freeing up more capital to hire talent, invest further in research and development, and expand our clinical pipeline to improve our ability to innovate [and] succeed in developing new drugs to treat the nation’s most intractable health problems.”

Others suggest that the benefits will be much more immediate. Daniel A. Baker, president and CEO of NVE Corporation, a manufacturer of high-performance electronic products used to acquire and transmit data, predicts a savings of almost one third of his audit costs. “Our audit is under way now,” he said, “so we don’t know for sure, but it appears it will save us about 30% of our fees, which is significant for a company our size.” It will also reduce the amount of time that the finance function will spend on document production for the audit, he added. “Those are resources we can redeploy on other things or return it to shareholders.” At the same time, it’s about equity, Baker explains. “Smaller companies spend a higher percentage of revenue on audits than larger companies. It helps level the playing field for us and other innovative smaller companies.”

SOME HAVE CONCERNS

Not everyone is convinced that removing the attestation of ICFR is a win-win for all parties. Most notably, members of the investor community, such as the Council of Institutional Investors (CII)—a nonprofit association of public, corporate, and union employee benefit funds; other employee benefit plans; and state and local entities that is charged with investing public assets, foundations, and endowments with combined assets under management of approximately $4 trillion—believes its stakeholders will be on the losing end of the deal.

In CII’s view, the ICFR auditor attestation “is an important driver of confidence in the integrity of financial statements and in the fairness of our capital markets.” CII, therefore, concludes that “the Proposed Rule amendments allowing low-revenue issuers to avoid the ICFR auditor attestation requirement could significantly affect the ability of investors to make informed investment decisions because it would substantially impact the quality of financial reporting by those issuers.” Furthermore, CII points out that the new SEC ruling flies in the face of its own better judgment. In commenting on the proposal to amend Section 404, CII noted, “We also are disappointed that the Proposal appears to reverse the conclusion and recommendations of a study of Section 404(b) by the SEC’s Staff of the Office of the Chief Accountant (OCA Study).”

According to the 2011 study, “The Staff believes that the existing investor protections for accelerated filers to comply with the auditor attestation provisions of Section 404(b) should be maintained (i.e., no new exemptions). There is strong evidence that the auditor’s role in auditing the effectiveness of ICFR improves the reliability of internal control disclosures and financial reporting overall and is useful to investors. The Staff did not find any specific evidence that such potential savings would justify the loss of investor protections and benefits to issuers…” (See bit.ly/2YgszyP.)

Meanwhile, auditors are concerned that for companies at the lower end of the revenue scale, which typically enter into a variety of complex financing agreements, dialing back Section 404 could result in a deluge of undetected material weaknesses. As EY commented to the original SEC proposal, “Notwithstanding the lack of significant revenues, we have observed that these issuers often enter into material complex financing and collaborative arrangements that require careful technical analysis to determine the appropriate accounting and financial statement presentation and disclosure.”

Therefore, EY concludes, “Without effective ICFR, low-revenue issuers may have a greater risk of failing to timely detect and correct material errors related to arrangements such as these.” At the same time, EY observed that low-revenue issuers may also have fewer and sometimes less-experienced employees performing and monitoring internal control functions: “As a result, we believe such issuers may have a higher likelihood of having unidentified material weaknesses in the absence of an ICFR audit.”

REPORTING QUALITY AND LOSS OF INVESTOR PROTECTION

It’s yet to be determined if these concerns will be justified. How companies and investors behave in the future will depend on a multitude of factors.

Some of those on the front lines of strategic financial management, like David Spacht, president of Artesian Wastewater Management and CFO of Artesian Resources Corporation, expect little change to their ICFR or to their investors’ level of confidence. For companies like Artesian, the eighth-largest investor-owned water utility in the United States by market capitalization, “There’s no reason to change the audit process or internal controls,” Spacht said. “We’re near the cusp of the $100 million mark and have been an accelerated filer on an interim basis for quite some time, so most of what we’re doing we believe will stay in place. There may be some limited savings or some step-down on certain procedures our auditors may do, but what’s the sense in cutting back on the controls we’ve already implemented?”

Companies close to the cut-off point in the SEC ruling will also be considering the potential administrative and audit fees of eliminating the ICFR attestation, Spacht said: “With current revenues at $83 million, Artesian is likely to rise above the $100 million mark and then be considered an accelerated filer, so do we really want to step back and then have to incur the cost of transferring back into that boat?”

At the same time, many companies that will fall under the new rule, like smaller banking entities, have other levels of oversight to comply with. For example, Artesian, as a water utility, has a host of additional reporting requirements, “so the step of looking at the controls is not that much more than what we would do on a normal basis anyway,” Spacht said. “What may change in the interim, however, are some of the smaller operational controls, like how we may record some of the booking entries for accounts payable [and] how we do some of the booking for receivables.”

For larger companies, complex corporate structure and processes create additional risks, but for smaller companies, a lot of the nano controls have really gone overboard, Spacht said. “Small companies don’t need the sort of managing that a larger company would need. In larger companies, you have so many people that are involved with the decision making and approval processes; whereas in smaller companies like ours, you have a much flatter approach.” For Artesian, “A lot of that’s a really deep dive in controls that probably the auditors won’t need to get into—only from the standpoint that they’re very familiar with our systems. And so long as we don’t have tremendous changes in how we operate, you know there’s really no need to do the deep dive.”

With respect to the impact on investor security, Daniel Baker said investors of NVE Corporation have little reason to be concerned, noting the long-established audit practices and the ongoing adherence to guidelines and recommendations for mitigating risk set by external standard setters. “We don’t think the SEC amendment will have a significant impact on the quality of our financials or the quality of reporting generally,” he said. “The auditors are still required to obtain an understanding of a company’s internal controls, even if they’re not auditing it in a formal sense. We’ll also continue to use the COSO [Committee of Sponsoring Organizations of the Treadway Commission] criteria internally for evaluating those controls.”

Baker also pointed to the progress companies have made with respect to mitigating control risk since the first implementation of Section 404. “It wasn’t that long ago that there were no attestations for internal controls, so there’s a much higher level of investor confidence now than in the past, and the COSO criteria are periodically updated, so assessing the effectiveness of our internal controls has gotten even more rigorous over time.”

As to whether or not the SEC ruling will promote capital formation, the views presented in the comment letters to the SEC are decidedly mixed. The SEC notes that some believe the proposed amendments would enhance capital formation or allow affected issuers to preserve capital, while others suggest that eliminating the ICFR auditor attestation would, in fact, increase the cost of capital for certain issuers because investors would require a premium to invest in issuers due to the heightened risk of ineffective internal controls (bit.ly/2SgNQ85).

According to Baker, eliminating auditor attestation will have little impact on what investors will do. “This [404 amendment] doesn’t seem like it would be one of the bigger factors that would determine whether somebody would invest in a smaller or newer company,” he said. “There tend to be higher risks in investing in smaller companies, and I think people who invest in smaller companies understand that.”

Spacht agreed: “If people are buying individual securities, they should have more of an in-depth awareness of who they’re buying securities with and make sure they understand the business before they dive into an investment. Now, if you’re dealing with some high-risk companies that have questionable practices, then you have to look at whether or not that’s an investment for you.” He added, “When you’re looking at institutional markets, those guys have people out there asking the questions, testing management, and doing their own deep dive to make sure that their investments are going where they think they’re going. The pullback of some of these nano controls shouldn’t really change their level of confidence in the companies they’re looking at.”

ENTER THE AUDITORS

It’s also still unclear what the role of the auditor will be for companies qualifying as nonaccelerated filers. Some suggest it will be much reduced, while others expect audit firms to find new ways to recapture potential lost ICFR audit revenues. The CFA Institute, representing the analyst community, said, “The requirement to eliminate the expression of an opinion on the audit of internal controls substantially lessens the auditors’ responsibilities in protecting investors. Further, the ICFR assessments by management are weakened by the fact that management knows such assessments will not be challenged by the auditors with the removal of the Section 404(b) requirement.”

But SEC Commissioner Hester M. Peirce is worried that auditors will divert their focus from the ICFR to the financial audit to recoup fees. In public statements, she has said, “One can imagine a scenario in which cost savings resulting from the rule merely shift to increased costs associated with the financial statement audit, and management’s time and attention are redirected to new evaluations in connection with the financial statement audit.”

She added, “The Public Company Accounting Oversight Board (PCAOB), through its inspection process, will continue to have the ability to affect the way that auditors conduct financial statement audits and internal controls audits. Moving forward, the PCAOB may need to consider whether auditors of financial statements for companies that take advantage of today’s exemption are folding a back-door internal controls audit into their financial statement audit.”

TIME WILL TELL

Overall, at the end of the day, finance executives will be weighing the costs and benefits of changing their control environment or eliminating the ICFR audit. Spacht said it will boil down to an individual cost/benefit analysis in each impacted company. “There will be companies that will loosen up on some of their controls because it may be cost-effective to do so. Some of the controls that have been put in place tend to slow down processes, so to the extent they can clear some out of the way, they will gain from efficiencies.”

Yet company size and the nature of the business will also factor into the equation, he added. “I don’t see that will happen in a lot of the larger filers that are getting near that $100 million cusp.” Companies that also have other regulatory responsibilities are also likely to maintain the status quo, he said.

Aside from the debate around the effects of eliminating the audit over ICFR, much of the recent background data to the rule is based on dated research, and, in reality, times have changed. According to former SEC Commissioner Robert J. Jackson Jr., the proposal makes no effort to update these studies, simply claiming that old data is enough basis for new rules. “While the costs of Section 404(b) might have driven the decisions of small firms and their investors fifteen years ago, they don’t do so today,” he said. He also points to his own current research that shows that investors in small companies value the auditor’s sign-off on the ICFR more than those in large accelerated filers.

Since the full impact of these changes is still unclear, affected companies will want to examine their current processes and approach to ICFR to determine the best strategy for the organization’s long-term success. There may be some savings that could be realized in reduced auditor scrutiny or, like Spacht noted, some might find that there’s more benefit in continuing current internal controls and processes. Meanwhile, in the absence of auditor attestation, investors are encouraged to keep an even closer eye on ICFR going forward.

IMA’S FRC AND SBC REACT

IMA’s Financial Reporting Committee (FRC) and Small Business Committee (SBC) submitted a joint comment letter to the SEC in July 2019 regarding the proposal, Release No. 34-85814, Amendments to the Accelerated Filer and Large Accelerated Filer Definitions, which the Commission subsequently adopted as final rules.

The FRC and SBC generally supported the amendments as a means to encourage public company growth by easing burdens and costs while simultaneously retaining requirements regarding management reporting on internal controls over financial reporting (ICFR). They did note, however, that evidence suggests that auditor attestation results in more effective ICFR, which provides benefits for smaller and emerging growth companies that may have ineffectual control systems.

Therefore, the FRC and SBC’s support for the amendments was contingent on an SEC look-back analysis after five years to assess the effects of the rule change and whether it achieved beneficial results. They also encouraged the SEC to consider the perspective and data of the Public Company Accounting Oversight Board.

©2020 by Ramona Dzinkowski. For copies and reprints, contact the author.