March 28, 2006
For the past two years I have worked with several public companies required to comply with section 404. In all cases, improvements have been made to the financial reporting process because of the section 404 requirement. However, the largest gains have been with the smallest companies whose accounting practices usually need much attention.
Investors deserve reliable financial reports, and smaller public companies will most likely not be compelled to improve their financial reporting process without some type of audit requirement. The goal for section 404 should be to make it more cost effective for small companies, not reduce its effectiveness.
One possibility for smaller companies could be to reduce the areas of focus for their assessments of internal controls. Entity-wide and financial reporting controls could be the focus for smaller companies since these areas tend to be most important to investors and have caused the greatest problems for larger companies. This approach of course, would necessitate a new auditing standard for small company internal control assessments.
The risk-based approach guidance that was drafted in 2005 by the SEC and PCAOB attempted to streamline SOX efforts but fell short. External auditors will not change their audit approach to section 404 with the PCAOB "breathing down their neck." Perhaps the relationship between the registered accounting firms and the PCAOB needs to be reassessed before section 404 can become a reasonable, cost-effective exercise.