Speech by SEC Staff:
Investors, the Stock Market, and Sarbanes-Oxley's New Section 404 Requirements

by

Alan L. Beller

Director, Division of Corporation Finance
U.S. Securities and Exchange Commission

New York, NY
January 12, 2005

Thank you Bob for that kind introduction. I am very pleased to have the opportunity to speak to you today about some of the issues regarding the internal control reporting provisions of the Sarbanes-Oxley Act.

These provisions, which are emblazoned in the consciousness of the corporate, auditing and securities world as the "Section 404" provisions of Sarbanes-Oxley, have come to dominate the discussion of the Act and the consideration of its effectiveness. In one sense that is appropriate given their importance. It is certainly a more sensible environment than existed in October 2002, when, on the same day, the Commission proposed rules regarding internal control reporting and disclosure of whether a company had a financial expert on its audit committee. Although the internal control provisions, unlike much of the Act, did not give the Commission a rule-making deadline, they seemed important enough to merit early attention. In response to these proposals, we received more than 200 comment letters, and only about 60 of them addressed the internal control reporting provisions. Today I think we all understand how vital it is to pay more attention to the internal control provisions, for a number of reasons that are being discussed at this important conference.

You were fortunate to hear this morning some views of Don Nicolaisen, the Commission's Chief Accountant. For those of you that were hoping to hear something entirely different from me at lunch, I must report that Don and I have very similar messages. But I think you should take comfort that Don and I speak with one voice figuratively, if not literally, on this important topic.

Of course, the SEC, as a matter of policy, disclaims both of our remarks. So I must remind you that the views I express today are my own and do not necessarily reflect the views of the Commission or others on the staff.

Now I want to return to an earlier point. I said that the internal control reporting provisions have come to dominate discussion and consideration of Sarbanes-Oxley, and in once sense that is appropriate. The fact that you are here today assures me that you understand the importance of these rules. I believe these provisions, requiring that companies provide management's assessment as of fiscal year end of the effectiveness of internal control over financial reporting and that their auditors attest to that assessment, have the potential in the long-term to have the most important impact on financial reporting of all of the provisions of the Sarbanes-Oxley Act.

On the other hand, I think it is a mistake to focus, as some now apparently are doing, the discussion of the success of Sarbanes-Oxley solely on the costs and benefits of the internal control provisions. Such a view ignores the other very substantial benefits of the Act. It also plays into the hands of those who would seek to roll back the gains of Sarbanes-Oxley by having the public ignore or forget the widespread failures of corporate executives and directors and auditors and other gatekeepers that led to and justify Sarbanes-Oxley. The promise of effective regulation of the accounting profession by the PCAOB, the improvements in high-level attention to disclosure and processes that have resulted from CEO and CFO certifications and the Commission's accompanying requirements for disclosure controls, the increased attention of audit committees that are independent and have increased responsibilities, the more effective enforcement of our laws and rules resulting from the stronger enforcement provisions, and the ability to provide recompense to damaged investors under the Fair Funds provisions - are all critical improvements to our regulatory framework that we owe to Sarbanes-Oxley.

Now let's turn back to internal controls. Following the October 2002 proposal, the Commission adopted final rules in June 2003 to give substantial lead time for the PCAOB to develop its new auditing standard and for companies and auditors to implement the new rules. The PCAOB developed its new Auditing Standard No.2 regarding audits of internal control over financial reporting at the end of 2003. To give more time to companies, we extended the compliance dates to fiscal years ending on or after November 15, 2004 for accelerated filers and fiscal years ending on or after July 15, 2005 for other issuers.

In addition, because we believe these reforms to be so important, and because we are aware of the time and expense necessary to implement them, for more than two years now we have been encouraging companies and auditors to get an early start on planning, preparation and compliance. We have also tried to be sensitive to and sensible about the challenges of implementation, without backing away from our commitment to the Section 404 rules or minimizing their importance.

For example, we have issued FAQs on our rules, as has the PCAOB on their standard, and we continue to answer questions about implementation. In part because of the Section 404 requirements, the Commission has deferred for one year the full implementation of the accelerated filer rules. The Commission also issued an exemptive order to grant accelerated filers with a public equity float of less than $700 million an additional 45 days to file their Section 404 reports.

In addition to providing extra time, we have taken other steps to address special issues Section 404 raises for smaller issuers. We are pleased that COSO has agreed to take up our suggestion that it develop guidance for small businesses. In addition, the Commission recently announced the formation of its own Advisory Committee on Smaller Public Companies, which will look at issues of importance to smaller companies, including Section 404.

Given the November 15 fiscal year compliance date, we are just at the point where we are about to see management's first assessments and the accompanying audit reports. Of course, companies have always had internal controls related to financial reporting and have been required to have them since the adoption of the Foreign Corrupt Practices Act. But the Section 404 requirements will cause companies and their auditors to reexamine companies' internal controls, and, consequently, in many cases improve them. And, importantly, the new requirements provide transparency that will allow investors to assess a company's internal controls, often for the first time. Both companies and their investors, I believe, have a responsibility to take advantage of the opportunity presented by the new requirements.

For their part, companies and their auditors should take the opportunity to analyze and improve controls and provide complete and meaningful disclosure of their assessments. The definition of material weakness in Audit Standard No. 2 requires that management and the auditor must conclude that there is a material weakness in a company's controls if there is more than a remote likelihood that a control will fail to prevent or detect a material misstatement in the company's financial statements. Judgment may be required to determine whether a given deficiency in a company's controls is a material weakness. That judgment can come about for different reasons, including if a control was designed inappropriately or if it was not operating as designed.

It has been widely suggested that there will be some number of accelerated filers that report material weaknesses in their internal control over financial reporting. And where a company identifies a material weakness in these internal controls, it must conclude that its internal control over financial reporting is ineffective. In those cases we are looking for those companies to provide informative disclosure regarding those material weaknesses and their consequences and the plans they have to remediate those weaknesses. Investors have every right to expect not only strong internal controls but also good disclosure about issues regarding those controls.

While the first annual report season for the internal control reporting requirements has just begun, a number of companies have been disclosing changes to and material weaknesses in their internal controls in recent quarterly reports. I think that it is fair to say that companies' disclosures have been varied. Some companies have provided clear and informative disclosure, while that of others still needs work.

For their part, investors should remember that the internal control reporting provisions under Section 404 are disclosure provisions. Companies that complete their assessments and find material weaknesses and disclose them, and whose auditors complete the internal control audit and include the required report on internal controls, will be compliant with the reporting requirements of Section 404. Companies with internal control material weaknesses can also have financial statements and unqualified financial statement audit reports that meet our requirements, where the auditors are able to do substantive audit work that in effect overcomes those material weaknesses. Indeed, auditors have been doing that for a long time. Now investors will know and thus be better informed. And, importantly, material weaknesses in internal controls do not necessarily equate to deficient financial statements or financial statement audit reports.

Moreover, while we are and will be seeking appropriate disclosure through our rules and review and comment process, it is also incumbent on investors to demand from companies the disclosure they need to evaluate particular material weaknesses and to review and analyze that disclosure with particular care, in order to evaluate the implications of given material weaknesses for reliability of financial reporting and financial statements, and also to consider what remedial steps companies are taking. Any disclosure that a company has a material weakness is a serious matter for investors, but that disclosure should be the starting point rather than ending point for investors' analysis. Further, understanding companies' plans for remediation and their implications is particularly important in light of the fact that this is the first year that companies will be reporting under Section 404.

Also regarding remediation, where a company's internal control report discloses that management identified a material weakness at the end of the company's fiscal year (the time as of which the report must speak), but the company has remediated that material weakness by the time it files (or by the time of a subsequent filing), the report as of the end of the fiscal year must report the material weakness and the company must still include the necessary disclosures regarding the material weakness. The company may also further disclose (and may be required to disclose) that the material weakness subsequently was remediated. Indeed, some members of the advisory group established by the PCAOB have requested that the Board develop a standard for reviewing remediation, and the PCAOB staff has the matter under consideration.

Once this first round of internal control reports by accelerated filers is in, I believe that it is incumbent on us and on the PCAOB to step back, evaluate the processes that have been followed and what has been filed and consider what has worked and where improvements can sensibly be made. I would venture just two examples of what we might want to look at. First, we want to ensure that the rules encourage companies genuinely to improve their controls and processes to provide better reliability of financial statements and financial reporting. We are not seeking to encourage mere check-the-box compliance exercises. Second, Audit Standard No. 2 was carefully constructed by the PCAOB, and carefully considered by us, to ensure that it allowed for the application of professional judgment by auditors. We want to ensure that an appropriate scope for that professional judgment in fact exists in the process. I believe that we should take a look at these and other questions.

What this exercise will not do is accede to the pressure that some would wish to apply to use the actual or potential costs of compliance with this and other Sarbanes-Oxley requirements to support calls for modification of its purposes or core requirements. The costs of the reforms are important, and I can assure you we have been closely monitoring implementation issues. The benefits are also important. The actual data available at this time seem to fall far short of what would be necessary to look back and seek to reach firm empirical conclusions about costs or benefits that are supported by historical information. This is not surprising, since the Act is not even fully implemented yet. And, while there is no doubt costs are increasing, it will take some time to get an idea of ongoing costs, because costs in the first year or two of compliance are likely to be greater than those in subsequent years. Moreover, there are significant benefits of the Act, especially the Section 404 requirements, that are critical to the health and success of our capital markets but are hard to measure, such as improved investor confidence.

I believe we need to wait for the fully implemented Act and then review the costs and benefits of the Act, with proper sampling and measurement. In the meantime, as I noted before, companies should be striving to use the reforms as an opportunity to improve, rather than as an exercise in how to do the minimum work to stay in compliance.

In closing, I want to reiterate that the rules arising out of Section 404 of the Sarbanes-Oxley Act are among the most important of the last few years. The first year that companies and their auditors are applying these rules is presenting challenges, to them, as well as to investors and regulators. I urge companies to take advantage of the new rules to improve their controls, and to make sure that their disclosure truly informs investors about the status of their controls. I also urge investors to demand the information they need and analyze carefully the information companies provide about their controls.

Thank you, and I'm happy to take questions in the remaining time.

http://www.sec.gov/news/speech/spch011205alb.htm