March 30, 2005
Sirs,
As a user of financial statements and the publisher of The Analysts Accounting Observer, I am pleased to offer my observations on Section 404 of the Sarbanes-Oxley Act.
I agree with many of the firms who have argued that the cost of implementing the internal control reviews has been exceedingly high, and that the efforts have been draining for their staff. I completely disagree with them when they say the effort has been without benefits.
While costs have been heavy in the past year, I believe theyre heavy because firms are repairing corporate infrastructures that have been neglected for years. Firms are now raising the issue of the costs of future compliance being worse than initially expected. If future compliance efforts require the same cost level incurred thus far, Section 404 might not be the problem. Instead, the problem might be that attention to internal control fundamentals is long past due.
Section 404 is not really a completely new rule: what it requires of firms is what they should have been doing all along. Internal control evaluation has long been a staple of modern auditing, and the Foreign Corrupt Practices Act of 1977 made an adequate internal control system a requirement for publicly-traded companies. There is nothing inherently novel about requiring a system of financial reporting designed to capture transactions that have occurred and report them to shareholders in meaningful fashion - all while making sure that the firms assets are not placed in jeopardy.
The numbers being tossed around regarding total compliance costs are impossible to verify, and certain to be exaggerated to make the point that the reviews are all cost, no benefit. The complaints ring hollow: if there is supposed to be an adequate internal control system in place already, and it costs so much to comply with Section 404 - how adequate was the system before?
For the past several months, I have monitored the material weaknesses filings reported to the SEC. Not every discovered weakness pointed to a future financial meltdown - but Id have to say that every weakness Ive noticed would have raised concerns about the reliability and fairness of published financial information if they went uncorrected - and thats why the SEC needs to be firm in not rolling back large parts of Section 404.
I agree with the critics who claim the cost of Section 404 has fallen more heavily on smaller companies than larger companies - but that should not be an excuse for non-compliance. By their very nature, small firms will have a tougher time building functional internal controls. It can be difficult for them to find adequately trained personnel because they compete with larger firms having greater resources for the same accounting professionals, and theyre less likely to afford enough personnel for a perfect segregation of duties. At the same time, they need to be attentive to building proper controls wherever they can; doing this in their growing years is less likely to be disruptive than building proper controls after their financial reporting functions have solidified - or after a reporting failure has occurred.
I believe the SEC has been on the right track in listening to its various constituencies and being flexible in setting deadlines. This has been amply demonstrated in its dealings with non-accelerated filers and foreign registrants. I urge the Commission to stay on that track - but I also urge the Commission to resist any efforts to undermine the intent of Section 404.