Skip to main content
Oct 31, 2007

Small triumphs

Clearing a path for small business

Since its launch in 2002, Section 404 of the Sarbanes-Oxley Act, the requirement for management to report on internal controls over financial reporting, has proven expensive and laborious for companies. Because of a lack of scalability, the costs have been greater for small companies, or those with less than $75 million in market cap. As a result, the SEC delayed compliance for small companies four times, recently mandating compliance for 2009. Fortunately, aids are available, and with efforts toward scalability, compliance could finally be plausible.

In May the SEC held an open

meeting on SOX 404, citing the Small Business Administration’s (SBA) concern over the deadline for small companies. Goals included clarity and cost-effectiveness to counter a report finding small public companies are expected to spend ‘2.6 percent of their revenue on Section 404 compliance, while larger companies … 0.16 percent.’ A Financial Executives International compliance costs survey in 2006 reinforced this disparity: ‘First-year compliance costs for Section 404 were $3.8 million for accelerated filers and $935,000 for smaller public companies or non-accelerated filers.’

SEC chairman Christopher Cox feels it’s time for small company SOX 404 to apply, given extensive improvements made by the SEC and the PCAOB.

Getting started

This past summer, the SEC voted in six measures to ‘improve capital raising for small business, and simplify SEC reporting for small business.’ Largely influenced by recommendations from the Commission’s Advisory Committee on Smaller Public Companies, these measures include: small business access to expedited shelf registration process for securities offerings; cutting paperwork for small businesses by allowing them to raise capital in a private offering after filing a simplified Form D online; shortened holding periods for restricted securities; giving issuers the benefit of a new, limited offering exemption from Securities Act registration requirements for offerings and sales of securities; eliminating limits on the number of employees who can receive stock options from their fast-growing private firms; and providing a simplified system of disclosure for almost 1,600 additional smaller public companies.

In addition to modifications easing the burden on small companies, compliance guides for federal regulations are available, in part due to an amendment (103) from ranking member of the US Senate Committee on Small Business and Entrepreneurship, Senator Olympia Snowe (R-ME). The amendment, which was co-sponsored by senators including John Kerry (D-MA), improved access to the compliance guides.

Snowe is a vocal advocate for small business. Responding to the reinforcement of the Maine Administrative Procedures Act, requiring ‘state agencies in Maine to conduct a small business impact assessment of all proposed regulations and to make that analysis available for public review,’ Snowe said the bill ‘will help ensure that small businesses [in Maine] are not unduly harmed by costly new regulations, ... [and] able to participate in the development of new regulations to make sure that they are narrowly tailored and not oppressive.’

SBA chief counsel for advocacy Thomas Sullivan thinks these additions will help small businesses feel less overwhelmed by Section 404. ‘By requiring federal agencies to produce understandable and useable compliance guides, Congress has taken a step toward helping to reduce that burden.’ The SBA’s Office of Advocacy has input into the compliance guides.

Voicing concerns

Conferences, where small businesses can confer on approaches, also offer useful tips on 404 compliance. At its annual Forum on Small Business Capital Formation in September, the SEC considered rule proposals around securities registration and disclosure requirements for small companies, with roundtable discussions on improving small business capital formation. Specific topics included smaller reporting company regulatory relief and simplification, revisions to eligibility requirements for primary securities offerings on Forms S-3 and F-3, and revisions to Rule 144 and Rule 145 to shorten holding periods for affiliates and non-affiliates.

Comment letters on subjects raised during the forum, for the most part, encourage proposals but stress a wait-and-see approach. In a comment letter on the elimination of the small business disclosure framework, Plexus Consulting general counsel Peter Chepucavage writes that the Regulation SB disclosure framework ‘will be beneficial to small issuers only if the legal and accounting costs associated will remain at least equal,’ adding, ‘We are concerned that the release does not exactly make this representation. If there is uncertainty we suggest that the SB regime be maintained for a two-year pilot period along with the amended Regulation SK proposal.’

Nella Radin, chair of the securities law committee for the Society of Corporate Secretaries and Governance Professionals, in a comment letter on small company regulatory relief and simplification, generally approves of the proposed rule changes, but thinks the SEC could ‘expand the scope’ of the definition of a small company and broaden ‘the relief provided to these small-cap companies.’

How it works

In addition to scalability, the SEC’s and PCAOB’s  alignment of management and audit guidance over the reporting of internal controls helps ease 404 compliance, given the clearer auditor role and elimination of auditor assessment of the effectiveness of management’s internal controls evaluation process.

Dissonance between management and audit guidance has meant expensive reliance on auditing standard number two. The SEC has frequently been made aware of this, and in a press release states its commitment to diminishing expenditures via a new approach to small companies: ‘the SEC’s new 404 guidance for management and the PCAOB’s new AS5 will work together to clearly delineate the company’s responsibility for the methods and procedures it uses in its internal controls evaluation process.’

These moves will also facilitate compliance for small companies by enabling management to cater evaluations to unique circumstances, as management is often acutely aware of internal controls. The guidance also decreases steps evaluating whether controls will provide reasonable assurance about the reliability of its financial reports.

Good intentions

Though the requirement for an internal controls audit under Section 404 won’t apply to smaller public companies with calendar-end fiscal years until their filings in the spring of 2009, the SEC suggests that getting ready is crucial. In a June speech, Cox advised ‘undertaking the company’s own assessment of its internal controls, beginning with their SEC reports in 2008.’

The guidance will be enlightening to many companies, but there is no obligation to follow them. So those fortunate enough to have understood the tedium of 404 are free to continue using their original processes.

Janine Armin

Janine Armin is deputy editor of Corporate Secretary