March 14, 2005
SOX 404 comments pertaining to micro-cap companies.
Ladies and Gentlemen:
The following comments reflect only my own personal views and neither those of my employer, PlanGraphics, Inc., nor its board of directors. PlanGraphics is a micro-cap Reg S-B reporting company that will be required to make its first SOX 404 report during 2006.
I certainly agree that effective internal controls over financial reporting are essential to the accuracy of financial reporting and complete disclosure. On the other hand, based on conversations with colleagues in other public companies, and SOX 404 driven changes that I have observed in our auditors during the past year, I believe that extremely narrow interpretation of and inordinate implementation expectations of SOX 404 guidance by audit firms are resulting in excessive and unnecessary costs.
Of course the closer look by management at, and the external audits of, internal controls should improve both financial internal controls and disclosure controls. Hopefully this will also improve investor confidence. I believe, however, there must be some balancing of the benefit of each measure with its cost.
SOX 404 Costs. The costs of compliance with Section 404 may have been significantly underestimated. Information available to me indicates that the additional fee for the independent audit of managements internal control evaluation is costing from 75 to 150 of the financial statement audit. The additional cost for managements documentation and evaluation of internal controls, whether performed internally or with the assistance of consultants, is equal to or exceeds the internal controls audit fee. For a micro-cap company such SOX 404 costs are extremely difficult to support.
Documentation and evaluation by management. A factor contributing to the cost is that SOX 404 requires management to establish and maintain an adequate internal control structure and procedures for financial reporting. As I review publicly reported SOX 404 internal control deficiencies and material weaknesses, it appears to me that existing literature and guidance contemplate a single intricate approach that is perhaps too concerned with 100 documentation of every single control to the extent that an existing effective control in use but not documented cannot be considered I do not believe this is appropriate. I am also seeing that inconsequential amounts with an extremely remote chance of occurring are also receiving undue attention disproportionate to any potential effect on disclosure and financial reporting. The impression I get is that audit firms may be applying a one-size-fits-all approach to SOX 404 compliance and imposing unnecessary large company control requirements on micro-cap companies. Hopefully COSOs project to revisit internal controls for small companies will provide needed guidance that recognizes the differences in control systems to be applied to small companies.
Significant deficiencies. Micro-caps with their limited staff are more heavily impacted by PCAOB standards on reporting requirements for material weaknesses and significant deficiencies. The present standards require remediation of all significant deficiencies, using very low thresholds that contemplate more than a remote probability of a misstatement that is more than inconsequential. The concept removes the micro-caps ability to prioritize significant deficiencies from matters of far less importance. It also encompasses potential control deficiencies and misstatements that might be possible but at the same time are neither likely nor significant, consuming time and resources better applied to higher priority control needs with a history of risk and managing the control processes.
Micro-cap companies appear to be losing their business advisors. Current practices and SOX 404 compliance reporting clearly imply to me that SOX 404 now prevents audit firms from giving guidance to their clients or from being involved in the formation and application of complex GAAP and accounting treatment inherent in internal controls. Such consultations by clients are often regarded by auditors as internal control deficiencies or a reportable material weakness. While this may be an over-interpretation of rules in an attempt to insure auditor independence, the impact on micro-cap companies without sophisticated accounting technical staff and even audit managers many times have to refer back to their national technical staff for advice, is that they will now have to retain separate professional accounting advisors on GAAP matters. The micro-caps are also losing the benefit of the additional business advice and other expertise previously available from their auditors. Unfortunately, auditors apparently have now been reduced to inspectors of financial reporting and associated disclosure and internal controls.
In summary, I look forward to COSOs clarification of internal control requirements for micro-cap companies.
Sincerely,
Fred Beisser
Senior Vice President Finance
PlanGraphics, Inc.