Statement on the Rollback of Auditor Attestation Requirements
March 12, 2020
Today, in the face of extensive objection from investors, we strip away a layer of investor protection for financial reporting.[1] The rule adopted today removes the requirement that an auditor attest to the adequacy of internal controls over financial reporting (ICFR) for public companies with revenues of less than $100 million.[2] Eliminating the auditor attestation removes a critical gatekeeping function that we know works to improve the reliability of financial reporting for investors.[3] And we sacrifice this important protection for an admittedly modest[4] cost reduction for issuers that could well be negated by an increased cost of capital.
There are valid concerns on both sides of the policy choice the Commission makes today. Public companies with relatively lower revenues are understandably concerned about costs related to regulatory compliance; investors are understandably concerned about the extent and reliability of disclosures they need to make informed investment decisions.
Rather than balancing these concerns, however, the final rule overrides investors’ views, and eliminates the auditor attestation requirement at lower-revenue companies. In fact, as we have seen with other rules,[5] the final rule swings further than the proposal in the direction that concerned investors, eliminating the ICFR auditor attestation requirement for certain business development companies (BDCs) as well.[6]
I have a growing concern that we may not give adequate consideration to the views of investors on certain issues. There have been a number of releases over the past several months where, as here, there was a clear division of views between investors and other commenters. This was true, for example, for the proxy guidance issued last August,[7] amendments to the Volcker Rule last September,[8] the shareholder submission thresholds proposal last November,[9] the accredited investor and resource extraction proposals last December,[10] and the exempt offering framework proposal last week.[11]
In each case, the comment file revealed a clear divide and, in each case, we disfavored or even disregarded investor views. This fact is documented in my prior statements on these releases,[12] and continues with the rule adopted today.[13] There must be a limit to the number of times we can credibly assert to investors that we act in their best interests by making policy choices they directly oppose.[14]
* * * *
With today’s final rule, we roll back an important protection over financial reporting put in place by the Sarbanes-Oxley Act in the wake of major corporate accounting scandals. Financial reporting is only as reliable as the controls in place to ensure its accuracy, thus internal controls over financial reporting form what we have called “the first line of defense in detecting and preventing material errors or fraud in financial reporting.”[15] Today’s rule diminishes the role of the gatekeeper—the auditor—in that first line of defense, thereby increasing the risk to investors of unreliable financial reporting.
The release notes that, although we are eliminating the auditor attestation requirement, auditors still review internal controls as part of their audits of financial statements. There is value in that review, but there is a significant difference between that review and an opinion from auditors as to the adequacy of internal controls. Attestations are designed to, and do, heighten and focus the attention of those in a position to ensure efficiency and compliance. Attestations increase accountability and they work. It’s a kind of “buck stops here” approach that is lost under the new rule.[16]
We are justifying this loss on the grounds that eliminating the auditor attestation will reduce costs for low-revenue issuers and thereby promote capital formation. Both propositions are questionable. First, the final rule rests in part on the unsupported hypothesis that relieving companies of modest additional costs for auditor attestation will encourage more companies to go public.[17] Unfortunately, there just isn’t evidence for this intuition, which animates a number of other recent policy choices.[18]
Second, the final rule rests in part on the idea that, however modest the compliance costs savings are, lower-revenue issuers can use those funds for other, presumably more productive, ends.[19] But any cost savings for those companies may well be diminished or even negated by an increase in the cost of capital for issuers that do not have auditor attestations. We know from the comment file that investors do not want this change. That fact, in and of itself, certainly makes it plausible that investors may require a premium to compensate for the increased risk.
Thus, while the benefit to public markets of the rollback is unclear, its effect is not. There will be less information for investors about the quality of internal controls, less detection of ineffective internal controls, and less accountability for management regarding its assessment of internal controls.[20]
Finally, I note that this proposal and final rule have engendered much debate, particularly related to the economic analysis. Our economists have responded with substantial new analysis, and I’m grateful for their work.[21] It seems likely, however, that the new analysis will prompt further significant debate.[22]
For example, it would have been helpful to have commenters’ analysis regarding at least one counterintuitive finding in the economic analysis. There is a chart on page 160 of the release that appears to suggest that the market reacts positively to the disclosure of ineffective internal controls at low-revenue issuers.[23] Respectfully, such a result, at a minimum, deserves deeper scrutiny.[24] Unfortunately, it will be too late for us to consider public comment on this point, or any of the other substantial new analysis in the release.
While there may be continued debate regarding, for instance, whether low-revenue issuers present heightened risks related to financial reporting, there is no question that removing the auditor attestation requirement increases the risk overall to investors of ineffective internal controls and unreliable financial statements. Because we have not justified taking that risk or adequately taken into consideration the views of investors, I must respectfully dissent.
[1] Commenters expressing opposition to the proposed rule include investors, investment professionals, financial analysts, and investor advocates. See Letter from the Council for Institutional Investor (July 25, 2019); Letter from CFA Institute (Aug. 22, 2019); Letter from Better Markets (July 29, 2019); Letter from Consumer Federation of America (July 29, 2019). See also Letter from the Center for Audit Quality (July 29, 2019) (“We understand that this Proposal is intended to promote capital formation, and while we are supportive of this goal overall, we believe the amendments in the Proposed Rule may not have the intended benefits to capital formation and may weaken the other two pillars of the mission.”); Letter from BDO USA, LLP (July 29, 2019) (“While lower-revenue issuers may be less susceptible to the risk of certain kinds of misstatements (such as revenues), we believe that less management attention to internal controls may result in a higher risk of misstatements in other accounting areas.”); Letter from Professor Mary Barth, et al. (July 11, 2019) (“Although it might be socially desirable to encourage investment, and research and development, we believe there are ways to do so without sacrificing oversight.”).
[2] The rule newly excludes from the definition of accelerated filer companies with public floats of $75 million or more (but less than $700 million) with less than $100 million in revenue (or in the case of business development companies, less than $100 million in investment income).
[3] See Amendments to the Accelerated Filer and Large Accelerated Filer Definitions, Final Rule, Rel. No. 34-88365, 58 (Mar. 12, 2020) [hereinafter Adopting Release] (“In the Proposing Release, we presented evidence that the imposition of the ICFR auditor attestation requirement has been associated with benefits to issuers and investors, such as reduced rates of ineffective ICFR and more reliable financial statements.”); see also Letter from Professor Weili Ge, et al. (July 26, 2019) (discussing their study’s finding that “404(b) compliance would reduce internal control misreporting by 38.1 percent (from 9.3 to 5.8 percent)”).
[4] See Adopting Release at 111 n.430 (“[W]e estimate that the annual savings represents [] 0.7 percent of the median revenue and 0.1 percent of the median market capitalization of the affected issuers that would be newly exempt from all ICFR auditor attestation requirements.”); see also Letter from Professor Mary Barth, et al. (July 11, 2019) (“[T]o the average affected company, the cost savings amounts to 0.48% of revenue and 0.09% of market value. These low percentages suggest that, for the average affected company, the costs savings is economically insignificant and is unlikely to affect the average company’s investment decisions or decision regarding whether to be publicly listed.”); Letter from Deloitte & Touche LLP (July 26, 2019) (“From a cost perspective, we expect that reductions in audit hours that some may anticipate due to exemption from the requirement to perform testing of the operating effectiveness of ICFR may be partially offset by an increase in audit efforts necessary for a standalone financial statement audit.”).
[5] See, e.g., Financial Disclosures about Guarantors and Issuers of Guaranteed Securities and Affiliates Whose Securities Collateralize a Registrant’s Securities, Final Rule, Rel. No. 33-10762 (Mar. 2, 2020). At the proposing stage for the registered debt rule, investors expressed concerns that we were permitting the alternative disclosure that is allowed by these rules in lieu of subsidiary financial statements to occur outside of the financial statement footnotes. Their concern was that such disclosure is not audited. The proposal at least contemplated requiring the alternative disclosure to be made in financial statement footnotes in some subsequent periodic reporting by the parent companies. The final rule, however, abandoned this approach, permitting the alternative disclosure to occur outside of the financial statements at the time of registration and in all subsequent periodic reporting, swinging even further in the direction that troubled investors.
[6] The rule exempts operating companies on the basis of revenue. Because BDCs generally do not report revenue, the rule exempts them on the basis of investment income. The release says we are including BDCs in the exemption to afford them parity with operating companies. See Adopting Release at 46. It may or may not make sense to treat low-investment income BDCs the same way we are treating low-revenue operating companies for purposes of auditor attestations, but it is difficult to make that assessment on the basis of this release. I would at least expect to see some discussion of whether low investment income for BDCs has the same implications as low revenue for operating companies for accounting purposes, but no such discussion or analysis is included in the release.
[7] See Commissioner Allison Herren Lee, Statement on Proxy Voting and Proxy Solicitation Releases, n.9 (Aug 21, 2019).
[8] See Commissioner Allison Herren Lee, Statement on Amendments to the Volcker Rule, n.10 (Sept. 19, 2019).
[9] See Commissioner Allison Herren Lee, Statement on Shareholder Rights, n.1 (Nov. 5, 2019). This statement also identified a division of views on the proxy advisor proposal. As to that proposal, however, I am very appreciative of recent recognition and consideration of concerns raised by investors and others. See Commissioner Elad L. Roisman, Speech at the Council of Institutional Investors (“CII”) Conference (Mar. 10, 2020) (“Based on feedback from many commenters who utilize the services of proxy voting advice businesses, I understand that there is concern that these days devoted to issuer pre-review could disrupt current voting practices….I take this feedback seriously, and I am certainly open to considering other ways to accomplish the policy goals of improving the total mix of information available to the marketplace and enhancing fairness and transparency in the voting process.”).
[10] See Commissioner Allison Herren Lee, Statement on the Proposed Expansion of the Accredited Investor Definition, nn.7-10 (Dec. 18, 2019); Commissioner Allison Herren Lee, Statement on Proposed Resource Extraction Rule, n.12 (Dec. 18, 2019). For the accredited investor proposal, there was not so much of an investor-industry division of views as a nearly universal support for indexing for inflation, with scant, and primarily industry, opposition to this measure. See Amending the Accredited Investor Definition, Proposed Rule, Rel. No. 33-10734, 74 nn.202-03 (Dec. 18, 2019).
[11] See Commissioner Allison Herren Lee, Statement on Proposed Amendments to the Exempt Offering Framework, n.4 (Mar. 4, 2020).
[12] See supra notes 7-11. This is also true for a number of other recent rulemakings. For example, this occurred in the final rules regarding registered debt disclosure, which disregarded investor objections to specific provisions of the new rules that permit disclosure to occur outside of audited financial statements, eliminate a continuous reporting obligation, and eliminate requirement for foreign private issuers using an accounting framework other than U.S. GAAP or IFRS reconcile that framework with U.S. GAAP. See Financial Disclosures about Guarantors and Issuers of Guaranteed Securities and Affiliates Whose Securities Collateralize a Registrant’s Securities, Final Rule, Rel. No. 33-10762, nn.253, 323, 336 (Mar. 2, 2020) (evidencing investor opposition to specific aspects of the adopted rule). We saw this again in the proposal to update Regulation S-K Items 101, 103 and 105, which favors the principles-based approach preferred by issuers, rather than balancing the use of principles with line item disclosure as advocated by investors. See Modernization of Regulation S-K Items 101, 103, and 105, Proposed Rule, Rel. No. 33-10668, nn.16-17 (Aug. 8, 2019) (evidencing a clear division of views between investors and issuers). The same was true for the proposal to update MD&A and other Regulation S-K items, which proposed to eliminate line-item disclosure requirements, including tabular disclosure of selected financial data, separately-captioned off-balance sheet arrangements, and tabular disclosure of known contractual obligations, despite investor comments advocating retaining those items. See Management’s Discussion and Analysis, Selected Financial Data, and Supplementary Financial Information, Proposed Rule, Rel. No. 33-10750, nn.35-37, 180-82, 196 (Jan 30, 2020) (evidencing investor preference for retaining these disclosure items).
[13] See Adopting Release at 6 nn.7-8 (evidencing support for the rules from industry commenters, and opposition from investors and their advocates, among others). The division of views was also clear on more specific questions. For example, industry commenters generally thought the amendments would enhance capital formation, while investors and their advocates did not. See id. at 14-15, nn.46, 50. Industry commenters generally thought the proposed amendments would increase the number of public companies, while investors and their advocates did not. See id.at 14-15, nn.49, 52-54. Industry commenters generally thought the removal of the auditor attestation requirement would not reduce investor protection, while investors and their advocates thought the loss of the attestation would harm investor protection. See id. at 16-18 nn.61-65, 74.
[14] We have not gone as far in the final rule as some have advocated. See, e.g., Letters from American Securities Association (July 29, 2019) and National Association of Manufacturers (Jul. 26, 2019) (asking the Commission to exclude all smaller reporting companies from the accelerated filer definition, i.e., raise the public float threshold to $250 million as well as adding the revenue test to the accelerated filer definition). But a balanced approach means more than just declining to go as far as we could. When the changes we do choose to make are, time and again, opposed by investors, that should give us pause.
[15] See SEC Charges Four Public Companies With Longstanding ICFR Failures, Press Release (Jan. 29, 2019) (“‘Adequate internal controls are the first line of defense in detecting and preventing material errors or fraud in financial reporting,’ said SEC Chief Accountant Wesley Bricker. ‘When internal control deficiencies are left unaddressed, financial reporting quality can suffer.’”).
[16] See Letter from Professor Mary Barth, et al. (July 11, 2019) (citing Joseph Schroeder & Marcy Shepardson, Do SOX 404 Control Audits and Management Assessments Improve Overall Internal Control System Quality?, 91 Acct. Rev. 1513-1541 (2016)) (“Academic research suggests that improvements in internal control system quality, and consequently financial reporting quality, do not occur in the Section 404(a)-only regime, but occur only when companies are required to have both a 404(a) assessment and a 404(b) internal control audit.”).
[17] See Adopting Release at 32. (“[W]e believe that the described cost reductions associated with the final amendments could be a positive factor in encouraging additional small companies to register their securities offerings or a class of their securities.”).
[18] See, e.g., Financial Disclosures about Guarantors and Issuers of Guaranteed Securities and Affiliates Whose Securities Collateralize a Registrant’s Securities, Final Rule, Rel. No. 33-10762 (Mar. 2, 2020) (asserting that, as a result of reducing disclosure obligations for registered debt securities, “issuers may be encouraged to offer guaranteed or collateralized securities on a registered basis”); Smaller Reporting Company Definition, Final Rules, Rel. No. 33-10513 (June 28, 2018) (asserting that making smaller reporting company status—and the corresponding reduced disclosure requirements—available to more registrants “could encourage capital formation because companies that may have been hesitant to go public may choose to do so if they face reduced disclosure requirements”).
[19] See Adopting Release at 58 (“[B]ecause these issuers have limited access to internally-generated capital, savings on compliance costs may be more likely to be applied to additional investment, research, or hiring.”).
[20] See Letter from Professor Mary Barth, et al. (July 11, 2019) (“Extant academic research suggests internal control audits serve at least two purposes. First, they provide information to shareholders about the quality of the company’s internal controls. We refer to this as the ‘information role’ of audits. Second, audits detect deficiencies in internal controls. We refer to this as the ‘detection role’ of audits. The combination of these two roles––detection of weak internal controls and corresponding disclosures to stakeholders––provides incentives for managers to adopt best-practice internal control systems. This is the ‘incentive effect’ of internal control audits. These audits do not simply report the state of the company’s internal controls, they also incentivize managers to take actions to implement high quality internal controls (e.g., Schroeder and Shepardson, 2016).”).
[21] I’m grateful for the hard work of the staff across the agency on this rule. In particular, I would like to thank Bill Hinman, Elizabeth Murphy, Felicia Kung, Michael Seaman, John Fieldsend, Kyle Moffatt, Lindsay McCord, Craig Olinger, Jennifer Zepralka, Michael Coco, and Ben Passey from the Division of Corporation Finance; S.P. Kothari, Hari Phatak, Vlad Ivanov, Tara Bhandari, Mattias Nilsson, Mariesa Ho, and Malou Huth from the Division of Economic and Risk Analysis; Bob Stebbins, Bryant Morris, Dorothy McCuaig, and Shehzad Niazi from the Office of the General Counsel; Sagar Teotia, Giles Cohen, Marc Panucci, Duc Dang, Louis Collins, and Ryan Wolfe from the Office of the Chief Accountant; and Dalia Blass, Alison Staloch, Sarah ten Siethoff, Brian Johnson, Mark Uyeda, Angela Mokodean, and Jenson Wayne from the Division of Investment Management.
[22] We should consider whether this approach—adding substantial new analysis to a final rule rather than including it in the analysis at the proposal stage—is consistent with the idea that our economic analysis should be substantially complete at proposal. See SEC Staff Memorandum Re: Current Guidance on Economic Analysis in Rulemakings (Mar. 16, 2012), https://www.sec.gov/divisions/riskfin/rsfi_guidance_econ_analy_secrulemaking.pdf (“The proposing release should include a substantially complete analysis of the most likely economic consequences of the rule proposal.”). There may be instances where substantial new discussion in our economic analysis warrants re-proposal to ensure that there is adequate opportunity for public comment.
[23] See Adopting Release at 160, Figure 7.
[24] With respect to Figure 7, the economic analysis asserts that “[n]one of the cumulative average abnormal returns plotted in the figure, whether for low- or higher-revenue issuers, are statistically differentiable from zero,” indicating the positive market reaction following the disclosure of ineffective controls at low-revenue issuers is statistically insignificant. There is, however, academic research that cautions against conflating statistical and economic significance, and finds that a result may be economically significant even if it is not statistically significant. See, e.g., Deirdre N. McCloskey and Stephen T. Ziliak, The Standard Error of Regressions, 34(1) J. of Econ. Lit. 97 (1996) (“The problem, and our main point, is that a difference can be permanent . . . without being ‘significant’ in other senses, such as for science or policy. And a difference can be significant for science or policy and yet be insignificant statistically, ignored by the less thoughtful researchers.”); see also Stephen T. Ziliak and Deirdre N. McCloskey, Size matters: the standard error of regressions in the American Economic Review, 33(5) J. of Socio-Econ. 527 (2004).