May 25, 2007
Via Electronic Mail
The Honorable Kathleen L. Casey, Commissioner
The Honorable Paul S. Atkins, Commissioner
Nancy M. Morris, Secretary
Securities and Exchange Commission
100 F Street, NE
Washington, DC 20549
Re: SEC Open Meeting on Section 404 of the Sarbanes-Oxley Act, May 23, 2007
The Office of Advocacy of the Small Business Administration (Advocacy) is concerned that the U.S. Securities and Exchange Commission (SEC) failed to provide an extension for small public companies to comply with the internal controls reporting requirements under Section 404 of the Sarbanes-Oxley Act at the SEC’s meeting on May 23, 2007.
Although Advocacy supported the proposals by the SEC and the Public Company Accounting Oversight Board (PCAOB) to revise the implementing rules of Section 404, Advocacy believes that the Section 404 will still impose large and disproportionate costs on small public companies. Advocacy recently recommended that the SEC provide further extensions to Section 404 for small public companies: (1) to clarify major provisions in these documents, (2) to examine whether these proposals are actually cost-effective, and (3) to give these entities time to implement these new requirements. (1)Advocacy’s recommendations were affirmed by Senators John Kerry and Olympia J. Snowe, the Chairman and the Ranking Members of the Committee on Small Business and Entrepreneurship, who both voiced their support for an extension for small public companies this year.
Advocacy strongly applauds your willingness to revisit the issue of a further extension in the coming months, and strongly encourages your leadership in this effort. As commissioners, you two deserve credit for publicly acknowledging the impact Section 404 will have on small public companies, even with the flexibilities that were finalized at the SEC’s meeting this week.
The Office of Advocacy
Congress established the Office of Advocacy in 1976 by Pub. L. 94-305 to represent the views and interests of small businesses within the federal government. Advocacy is an independent office within the SBA, so the views expressed by Advocacy do not necessarily reflect the views of the SBA or the Administration. The Regulatory Flexibility Act (RFA)(2), as amended by the Small Business Regulatory Enforcement Fairness Act (SBREFA)(3), gives small entities a voice in the rulemaking process. Advocacy regularly hosts small business roundtables to solicit feedback and information from small business representatives on regulatory proposals.
Advocacy hosted a small business roundtable on January 2007 to solicit input from small business representatives on the new proposals undertaken by the SEC and the PCAOB to revise the implementing rules under Section 404. The SEC’s proposed management guidance attempts to set forth a “top-down, risk-based” approach for management to complete its internal controls reporting. The PCAOB also revised the controversial Auditing Standard No. 2, incorporating the same “top-down, risk-based” approach.
I. Advocacy Supports Proposed Clarifications in SEC and PCAOB Proposals
Advocacy is pleased that the SEC and the PCAOB have announced in meetings this week that they have clarified major provisions in their management guidance and revised auditing standards, pursuant to recommendations in Advocacy’s February 2007 comment letter.
Advocacy recommended that the SEC and the PCAOB must resolve differences between the conflicting management guidance and the revised auditing standard. Small businesses were concerned that the SEC’s management guidance is vague and “principles-based” to provide scalability for the management of small public companies, while the PCAOB’s revised auditing standard is more prescriptive and detailed on how auditors must evaluate a management’s internal controls reporting process. Small businesses also commented that there were significant inconsistencies between the two documents, such as the definitions of material weakness, significant deficiency and materiality. The SEC and the PCAOB have stated that they have fixed these issues in their approved documents.
II. The SEC Needs to Examine Whether Proposals are Actually Cost-Effective
A report by the SEC’s Advisory Committee on Smaller Public Companies noted that Section 404 costs in relation to revenue will be disproportionately borne by smaller public companies. This report found that small public companies with a market capitalization of under $100 million are expected to spend 2.55 percent of their revenue on Section 404 compliance, while larger companies with a market capitalization of over $1 billion are expected to spend 0.16 percent of their revenue on such costs.(4) A survey of actual compliance costs conducted by Financial Executives International in 2006 found that first-year compliance costs for Section 404 were $3.8 million for accelerated filers and $935,000 for smaller public companies or non-accelerated filers.(5)
Small business representatives at Advocacy’s roundtable recommended that the rules implementing Section 404 not be implemented until these proposals have been fully tested to determine whether they will actually result in scalability and cost savings for small public companies. The Chamber of Commerce recently recommended a further delay in Section 404 compliance until the new guidance has been adopted and tested for a full year by larger companies.(6)
“I am concerned that the SEC has provided no assurances that the new internal controls rules will actually reduce costs for small public companies because they have not yet completed the required Regulatory Flexibility Act review of the rule,” said Senator Snowe.(7)
Advocacy recommends that the SEC complete a revised final regulatory
flexibility analysis (FRFA) of the internal reporting requirements under Section
604 of the Regulatory Flexibility Act. The last regulatory analysis was
completed in August 14, 2003, and this final regulatory flexibility analysis
severely underestimates the cost of compliance with Section 404 at $35,286 per
year. With current industry estimates of Section 404 compliance burden at almost
$1 million per year for small public companies,(8) Advocacy also recommends that
the SEC produce a Small Business Compliance Guide for this rule as required
under Section 212 of the Small Business Regulatory Enforcement Fairness Act
(SBREFA).(9)
III. The SEC Should Provide a Further Extension for Small Companies to Implement
the New Requirements
Small public companies expressed concern with the timing of these proposals. Although the SEC and the PCAOB just released these proposals in December 2006 and these entities just approved these proposals this week, most small public companies will still be expected to complete a management report on internal controls by the end of this year and submit an auditor’s report attesting to these internal controls next year. (10)Participants at the Advocacy’s roundtable strongly recommended that the SEC provide a further extension for small public companies in order to provide management with extra time to understand and implement these complex Section 404 proposals.
Participants at the roundtable explained that it will take a longer time for small public companies to create and implement any new internal controls reporting process. Although small public companies regularly submit annual financial reports to the SEC, the internal controls reporting process is time intensive because it adds the new requirements of identifying processes, assessing risk levels, and documenting and testing the internal controls. Small companies are at a disadvantage in complying with Section 404 because they have more informal processes and fewer personnel and accountants.
Conclusion
Advocacy hopes that the SEC will respond to your leadership on this important issue and grant an extension to small public companies to comply with Section 404. Please feel free to contact me or Charles Maresca of my staff at (202) 205-6978 or charles.maresca@sba.gov, should you have a need for further information.
Sincerely,
/s/
Thomas M. Sullivan
Chief Counsel for Advocacy
Cc: Chairman Christopher Cox
Commissioner Roel C. Campos
Commissioner Annette L. Nazareth
The Hon. Susan Dudley, Administrator, Office of Information and Regulatory
Affairs
ENDNOTES
1. Comment letter from Thomas M. Sullivan, Chief Counsel, Office of Advocacy, Small Business Administration, to the SEC and the PCAOB (Feb. 21, 2007), available at http://www.sba.gov/advo/laws/comments/sec07_0221.html.
2. Regulatory Flexibility Act of 1980, Pub. L. No. 96-354, 94 Stat. 1164 (1980 (codified as amended at 5 U.S.C. § 601 et seq.).
3. Small Business Regulatory Enforcement Act, Pub. L. 104-121, Title II, 110 Stat. 857 (1996) (codified in various sections of 5 U.S.C. § 601 et seq.).
4. SEC Advisory Committee on Smaller Public Companies, Final Report of the SEC Advisory Committee on Smaller Public Companies 32 (Apr. 23, 2006) (Advisory Committee Report), available at: http://www.sec.gov/info/smallbus/acspc.shtml.
5. FEI, Survey on SOX Section 404 Implementation, Exhibit A: Costs by Filing Status (March 2006).
6. Press Release, U.S. Chamber of Commerce (May 23, 2007), available at: http://www.uschamber.com/press/releases/2007/may/07-94.htm.
7. See fn. 2.
8. See fn. 5.
9. Small Business Regulatory Enforcement Fairness Act, Pub. L. 104-121, Title II, 110 Stat. 857 (1996) (codified in various sections of 5 U.S.C. § 601 et seq.).
10. 71 Fed. Reg. 76,580 (Dec. 21, 2006). Under the SEC’s extensions, non-accelerated filers would submit a management assessment report with its annual report for the first fiscal year ending on or after December 15, 2007. These entities would not be required to submit an auditor’s attestation report until the following year, or the first fiscal year ending on or after December 15, 2008.