SEC

Implementing SOX 404 Requirements

Robert W. Rouse

The implementation issuesinvolving Section 404 of theSarbanes Oxley Act (SOX) con-tinue to challenge the efforts toensure fair and transparentfinancial reporting by publiclyheld companies. Section 404 ofthe SOX requires registrants toinclude in the 10-K filing areport by management on theregistrant’s internal controls overfinancial reporting. An auditor’sreport must accompany manage-ment’s assertions.

THE BOUNCING DATE

The Commission extendedthe original date for complianceto Section 404 for all filers inFebruary 2004. That date fornonaccelerated filers and foreignprivate issuers was then extend-ed to July 15, 2005. In earlyMarch, the Commission extend-ed the date by one year, to July15, 2006. The new date alsoapplies to requirements regard-ing certifications by manage-ment of these registrants.

The Commission’s ChiefAccountant Donald T. Nicolaisenstated, “The Section 404 require-ments are among the most impor-tant parts of the Sarbanes OxleyAct, and I encourage public com-

panies to devote the necessaryresources to make sure thoserequirements are implementedeffectively. I don’t underestimatethe effort this will require forsmaller companies and foreignprivate issuers, but this extensionwill provide additional time forthose issuers to take a good hardlook at their internal controls, asthe Act contemplates.”

The approximately 1,500foreign private issuers have beengranted other concessions in thepast. The Form 20-F, the equiva-lent of the U.S. registrants’ 10-K,can be filed within six monthsof the end of the fiscal year asopposed to the soon-to-be 60-days filing requirement foraccelerated U.S. registrants.Also, quarterly filings of finan-cial statements are not requiredif not mandated by the domicilecountry’s regulatory agency.While interim reporting isrequired by most foreign coun-tries, the interim period coverssix months in some countries.

Director of the Division ofCorporation Finance Alan Belleralso remarked, “Section 404reporting has the long-termpotential to substantiallyimprove the reliability of finan-cial reporting. It is already hav-

ing that effect for companieswith the vast majority of U.S.market capitalization. Given theburdens in designing and imple-menting Section 404 compliancefor smaller companies and non-U.S. companies, this extensionstrikes the right balance.”

The Commission alsoannounced that it would host aroundtable discussion regardingregistrants’ and accountingfirms’ experiences in imple-menting Section 404’s reportingrequirements. Representatives ofthe Public Companies Account-ing Oversight Board (PCAOB)will participate, and the round-table was planned for sometimein April.

In February, ComplianceWeek reported almost 600 regis-trants disclosed weaknesses intheir companies’ internal con-trols in 2004! This issue hasfrustrated this columnist forsome time. The Foreign CorruptPractices Act (FCPA), which waspassed in 1977, required regis-trants to maintain an adequatesystem of internal controls toprevent misstatements in finan-cial reporting. Why has thislong-standing requirement in theFCPA not been aggressivelyenforced by the Commission?

De

p a r t me

nts

89© 2005 Wiley Periodicals, Inc.Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/jcaf.20142

This requirement has beencited in numerous Accountingand Auditing Releases (AAERs)throughout the last 28 years. Theregistrant’s failure to maintain anadequate system of internal con-trols has been frequently notedas a factor in the resulting erroror irregularity in financialreporting.

The hundreds of reportedweaknesses during 2004 also begthe question of the related com-munication of the weakness bythe auditor to the registrant. Werethese weaknesses reported in2004 in existence for many years,and if so, were they communicat-ed to management of registrantsat the time of discovery?

The auditor could haveelected to expand the nature,timing, and extent of the sub-stantive testing to support theregistrant’s statements if suchweaknesses were present.Although this approach to audit-ing is no longer acceptablebecause of SOX, any materialweakness should have been com-municated immediately.

The aftermath of SOX con-tinues to generate mixed reac-tions and has consumed hugeamounts of time/money by allthe players involved in thepreparing, auditing, and regulat-ing of financial reporting. Hope-fully, most of these costs willindeed be of a “start-up” varietyand will not reoccur once theregistrant’s controls are in effectand well documented.

THE PCAOB’S ROLE

The PCAOB has been veryactive in addressing the imple-mentation of Section 404 withinthe public accounting firms thataudit registrants. Since the firstof the year, the Board has heldforums throughout the countryaddressing the implementation

issues of Section 404 within thesmall business environment.Another set of frequently askedquestions involving implementa-tion issues of Auditing StandardNo. 2, An Audit of Internal Con-trol Over Financial Reporting inConjunction with an Audit ofFinancial Statement, was issuedin late January and can beaccessed at www.pcaobus.org.

The proposed 2005 budgetfor the PCAOB of $152.5 mil-lion was revised, and the Boardapproved a budget of $136.1million for 2005. While theproposed budget was basedupon a staff of 300 by the endof 2004, a slower than forecast-ed rate of hiring actually result-ed in a staff of 262 as of theend of the year. The targetedstaff of 450 as of the end of2005 may be in jeopardy.

The PCAOB has generatedsome criticism within the privatesector. In February, the AmericanEnterprise Institute for PublicPolicy Research issued State-ment No. 215, Sunset thePCAOB. The paper, published bythe Shadow Financial RegulatoryCommittee of the Institute, notedthat in 2004, the Board’s budgetof $103 million supported a staffof 200, which translated into$500,000 of expenditures peremployee. If the SEC approvesthe revised budget of $136 mil-lion, the PCAOB will be spend-ing twice as much per employeeas the National Association ofSecurities Dealers.

The Board’s ability to fundits budget by imposing a fee onall public companies was alsonoted. The committee stated,“The Committee is unaware ofany other private company thathas been authorized to tax a sec-tor of the economy it does notregulate.” In noting that theCommission had the authority tooversee and discipline auditors

who attest to the statement ofregistrants, the committeebelieves that the basic functionshould be transferred to theCommission.

Once the Board has promul-gated an initial set of auditingstandards, a process described asobtainable within a few years,the Office of the Chief Accoun-tant could assume the duties ofupdating the auditing standards.At that time, Congress should“sunset the PCAOB.” The brief-ing paper can be accessed atwww.aei.org.

Commissioner Paul Atkins,in a speech to the Atlanta Chap-ter of the National Associationof Corporate Directors, alsonoted that issues have indeeddeveloped because of the actionsof the Commission in the imple-mentation of SOX. Atkins saidthat the SEC has “in some waysstepped outside its traditionalsphere of regulatory activity,and, as a result, has come intoconflict with other establishedregulatory frameworks.” He alsonoted, “I do have concerns aboutthe Act and what we have doneto implement it.”

Commissioner Atkinsremarked that in the recent“Index of Economic Freedom,”published by the Wall StreetJournal and the Heritage Foun-dation, the United States is nolonger among the top ten “mostfree” countries. He commented,“Although it is wonderful to seeother countries becoming morefree, I do not like to see the U.S.losing its reputation for being agreat place to do business.”

He then turned his attentionto Section 404 of SOX. In notingthat he was the only commis-sioner who had actually beeninvolved with a control review ofa company, CommissionerAtkins stated, “ I have seen how,especially in troubled situations,

90 The Journal of Corporate Accounting & Finance

© 2005 Wiley Periodicals, Inc.

July/August 2005 91

© 2005 Wiley Periodicals, Inc.

a control review can take on alife of its own and balloon into amassive project, with volumes ofdocuments and flowcharts thatseem obsolete as soon as theyare printed and distributed sim-

ply because a corporation is adynamic, ever changing entity.”

He continued, “This paper-work sometimes provides littlepractical benefit, except to theaccounting firm’s bottom line. I

hope that Section 404 doesn’tlead us in this direction.” Hepromised to take the oversight ofthe PCAOB seriously and urgedhis audience to monitor theBoard’s progress.

Robert W. Rouse is a professor of accounting, College of Charleston, and a member of the SEC Regula-tions Committee of the American Institute of Certified Public Accountants (AICPA).