Public Companies Await SEC’s Final Ruling on SOX Filing Status Proposal

Business community and accounting industry are divided on proposed changes to internal controls requirements

The Securities Exchange Commission (SEC) recently issued a proposal that would eliminate the internal controls audit requirement for hundreds of corporations across the U.S., by changing public company filing status categories. While there are arguments on both sides of this proposal, regardless of the outcome, public companies will still need to assess internal controls over financial reporting (ICFR) under the Sarbanes-Oxley Act, and CFOs should remain vigilant in their approach.

We examine this potential change, its impact, and stakeholder reaction below.

What are the proposed changes?

Under the SEC proposal, any corporation with both an annual revenue of less than $100 million and “public float” of less than $700 million would be considered a smaller reporting company (SRC) and would therefore be exempt from Section 404(b) of the smaller reporting company (SRC), which requires the public company’s auditor to issue an opinion on their internal controls.

The key element of the proposed change is the amendment to the definitions of “accelerated filer” and “large accelerated filer.” The proposal also amends the public float thresholds used to determine when an issuer will exit a filing status.

Who is affected by SEC proposal?

The SEC estimates that the proposed change to the filer definitions could impact between 350 and 450 U.S. public companies.

So what do these companies look like? They have median total assets of $190 million, median number of employees of 160, and median issuer age of 18 years old. Thirty percent of the companies are in the pharmaceutical industry and another 30% are in banking and financial services.

What is the potential impact?

The primary benefit for these organizations from the SEC proposal is a reduction in costs associated with SOX compliance, both in terms of external auditor fees and internal employee hours.

Since the passage of the Sarbanes-Oxley Act in 2002, SOX compliance has been viewed by many as burdensome and costly, and disproportionally so to smaller public companies. It is often argued that funds and time could be redirected to better serve the strategic direction of an organization as opposed to spending it on compliance requirements.

SOX was originally put in place to protect the public investors in the wake of the Enron and WorldCom scandals. Despite the costs, SOX has helped tremendously to restore a high degree of confidence in the financial reports of publicly traded corporations.

The proposed changes to SOX could impact this confidence. According to MarketWatch, a study by research firm Audit Analytics found that 70% of the adverse opinions issued for public companies’ internal controls since 2014 were for companies with less than $100 million in revenue – which is the same size of the companies that would be exempt under the SEC proposal.

Moreover, a 2017 study by accounting professors at the University of Washington and Georgetown University estimated that 20% of exempted firms had ineffective internal controls from 2007 to 2014, according to The Wall Street Journal. During that same period, just 11% of them disclosed such a weakness. The study also found that 41% of exempted firms provided insufficient information to identify the causes of the weaknesses in their internal controls, compared with just 7% for firms that were compliant with SOX.

More recently, The Wall Street Journal reported that 11 of the companies that would be exempted from additional internal control oversight under the SEC proposal restated their 2018 financial results, leading to a loss of over $290 million in shareholder value.

SOX 404(a) compliance still required

It’s important to note the proposed SEC amendment will not change the requirement for company’s management teams to assess ICFR under SOX 404(a).

However, one concern is that without the immediate presence of SOX 404(b), which currently applies at the $75 million public float threshold, many non-accelerated filers presently might not do enough with regards to ICFR.  These cases show the positive influence of SOX 404(b) in encouraging corporations to focus on internal controls. The SEC proposal would not only impact the estimated 350 to 450 newly exempt companies, but also those who are on the brink of becoming an accelerated filer.

Another important point to note is that the proposed amendment will not change the requirement for CEO and CFO certifications of financial reports, which bear criminal and civil penalties of up to $5 million and 20 years in prison if violated.

What is the reaction to SEC proposal?

The comment period closed in late July and all submissions were posted on the SEC’s website. The proposal has received mostly positive reactions from the business community, while accounting firms and investors have voiced concerns.

The Big Four accounting firms cautioned the SEC on the impact of these proposed changes. PwC stated “We believe this may potentially have a detrimental impact on the quality of financial reporting for these registrants,” while EY said “such issuers may have a higher likelihood of having unidentified material weaknesses in the absence of an ICFR audit.”

Other accounting firms have challenged the SEC’s estimates of the amount companies would save in audit fees, noting that the savings will not be as high as the SEC has reported, and the potential negative ramifications would not be worth the cost savings.

Continue to prioritize internal controls

While we can’t predict exactly how the comments will impact the final ruling and where the SEC will ultimately land, we can make some high-level recommendations.

Public company CFOs should consider how the potential changes would impact their filing status and reporting requirements. Furthermore, CFOs should continue to prioritize internal controls over financial reporting. We believe it still makes good business and regulatory sense to strengthen the fabric of ICFR by making it risk-focused, scalable and flexible to accommodate business growth.

Regardless of the final ruling on the SEC proposal, exempt companies should remain vigilant in their approach. Sustainable and operationally effective ICFR go a long way in enhancing stakeholder value over the long term.

Contact us to learn more about the SEC’s proposed amendment and what it could mean for your public company.