Speech by SEC Commissioner:
Remarks Before the Investment Adviser Association
by
Commissioner Paul S. Atkins
U.S. Securities and Exchange Commission
Boston, Massachusetts
April 27, 2006
Thank you, David, for that kind introduction and for the opportunity to take part in your conference. Let me start by saying that the views that I express here are my own and do not necessarily represent those of the Securities and Exchange Commission or my fellow commissioners.
Your conference brochure quotes Henry David Thoreau's observation that "Success usually comes to those who are too busy to be looking for it." So I am particularly honored to be here because I know that, as successful investment advisors, you have many demands on your time and a lunchtime speech by a regulator might not be exactly high on your agenda.
Thoreau was a noted skeptic of government intervention. His writings such as Walden and Civil Disobedience put great weight on individualism, self-reliance, and moral accountability. He wrote that: "Government is at best but an expedient; but most governments are usually, and all governments are sometimes, inexpedient."1 Now, as a government employee and SEC commissioner, I certainly am working to ensure that government is expedient, at least in the little patch over which I have some influence. In an age when many look reflexively to government for solutions, it is important to maintain an attitude of healthy skepticism about the expediency of the government to solve each and every problem that confronts us. It was Ronald Reagan who famously said that the most terrifying words in the English language are: "I'm from the government and I am here to help."
The experience of the 20th century has shown that a market system is better able to produce creative, timely, and effective solutions than is a centrally planned system focused on decision-making by bureaucrats and technocrats. Government can lay the groundwork for market solutions by setting strong disclosure standards, ferreting out fraud, and keeping barriers to entry low. By contrast, the more interventionist, oft-tried regulatory approaches such as merit regulation, price setting, and selecting between competitors have proven themselves time-and-again to be clumsy, ineffective, costly, and debilitating to our standard of living.
Unfortunately, when problems arise, the business community is sometimes a willing partner in casting about for regulatory intervention rather than looking for effective market-based solutions. Some business people may acquiesce to questionable political solutions in an effort to appear to be good corporate citizens. Others may actively seek new regulations as a convenient way to entrench a particular business model or practice and thus gain an edge over their competitors. This complacency or complicity on the part of business people, who fail to stand up for market-based principles, simply feeds and encourages those who think that regulatory solutions are the best approach to solving problems.
History shows that government, when it tries to substitute its judgment for that of the markets, can cause more harm than good. History also shows that rarely do regulators investigate whether the existing regulatory framework in fact contributed to a problem before they set about to devise a new regulatory solution for the problem. It is interesting that many defenses of government regulations begin with the phrase, "The rule was meant to do such and such." Well, the world is full of good intentions, but results are what matter. How many times does a professor hear a student declare, "I worked so long and hard on that paper that I deserve an A!"? But, if the student completely missed the point, it matters little how long he worked on the paper. The same, of course, applies in any field in the real world, be it business, medicine, investment management, architecture, or engineering. If the bridge collapses, we do not care how long the engineer worked on the design.
I am sorry to report that these points have been illustrated by several rulemakings that I have opposed during my tenure as Commissioner. The Commission three times in particular during in the past few years has chosen to respond to problems, real or imagined, with one-size-fits-all regulatory mandates, which rob market participants of choices and impose heavy costs on investors. Effective alternatives were left on the table. Cost-benefit analyses were not employed as tools in the process of formulating new rules, but were performed after-the-fact to justify regulatory actions that were already set in stone.
Regulation NMS, the new hedge fund adviser registration requirement, and the fund governance rulemaking are examples of such ill-conceived rulemakings. Commissioner Cynthia Glassman and I dissented from all three of these rulemakings, two of which are being challenged in court. The court has yet to weigh in with respect to the hedge fund adviser registration mandate, but just a few weeks ago, the United States Court of Appeals for the District of Columbia Circuit issued its second decision in the fund governance case. Last June, in response to a challenge by the Chamber of Commerce, the court remanded the rule to the Commission. After a majority of the commissioners at the time decided to readopt the rule in a record-setting speed of 8 days of supposed re-consideration, the Chamber sued the Commission a second time. For the second time, the Court found fault with the Commission's process. It took the unusual step of vacating the rule, but gave us ninety days — if we wish — to take another look at the costs of implementing the rules.
To be honest, the tortured history of this rule is quite a curiosity for me. It is an unlikely subject of such a pitched battle. Its proponents have praised it as being the supposed "centerpiece" of the SEC's regulatory scheme for mutual funds. But, as the court of appeals has now pointed out twice to the SEC, the agency has failed to take an honest look at the costs and benefits of the rule, as the law requires us to do. Never mind that some of the more egregious offenses in the late-trading and market-timing scandals occurred at funds with independent chairmen and 75% independent boards. Never mind that the rule is inherently anti-competitive in that its burdens fall especially heavily on start-ups, who have a harder time coaxing and paying non-affiliated people to serve on boards, much less to commit the time necessary to serve as chairman.
Finally, never mind that investors do not seem to care about this provision. It always struck me as odd that this matter would be touted as so important to investors, yet no fund that I know of has ever marketed itself on the basis of who sits on its board or who serves as chairman of the board. Investors tend to be rational people (at least much of the time!). They invest often on the basis of who is the portfolio manager; in fact, some portfolio managers are known to have groupies. Investors also invest often on the basis of who the fund advisor is and what other related funds and features the advisor offers. They often invest in consideration of fees — front-end loads, back-end loads, redemption fees, and so forth. They also often invest on the basis of performance, try as we might to tell them that past performance is no indication of future performance. But, no one that I have ever heard of invests on the basis of the make-up of the board.
I am happy to say that things are different at the SEC now. Under our new Chairman Chris Cox, who started after all of this mess came about, we are busy looking at costs and benefits in a number of contexts. One area in which we and many outside the Commission have been focusing a lot of attention recently is Section 404 of the Sarbanes-Oxley Act. As money managers, you undoubtedly have noticed the substantial costs that the companies in which you invest are bearing as a result of Section 404. Indeed, in a session that I attended some time ago with a large group of portfolio managers not far from this hall, just about the only SEC issue in which they expressed any interest at all was Section 404. They were outraged at the skyrocketing SG&A expenses of their portfolio companies due to 404 compliance. They contended that there was precious little to further their company analyses as a result of all that expense.
I was reminded of their passion by a survey of finance executives in last month's CFO Magazine, in which 67% of the respondents said that Sarbanes-Oxley affected their company's earnings performance — those from companies with more than $500 million in revenue said that it decreased revenues by 2% and those from companies with less than $500 million in revenue said that it decreased revenues by 4½%.2 That's right: 4½%. For that reason, I would like to spend a few minutes discussing Section 404 and some of the steps that we and the Public Company Accounting Oversight Board can take to address the problems.
I submit that the Sarbanes-Oxley Act itself is not the problem. The Act acknowledges the importance of stockholder value as opposed to stakeholder value, strengthens the role of directors as properly inquisitive representatives of stockholders, reinforces the role of management as stewards of the stockholders' interests, sets forth best practices, and largely focuses on ensuring good corporate disclosure rather than dictating particular corporate behavior. The Act generally does not impose one-size-fits-all mandates.
Even Section 404 itself embodies a laudable objective. The Section, with some 20 lines of text, is quite short and straightforward. It requires management to complete an annual internal control report and requires the company's auditor to attest to, and report on, management's assessment. Section 404 embodies the indisputable principle that good controls over financial reporting are important. They are an essential underpinning of any system that relies on disclosure rather than government dictates to shape corporate behavior.
The short and straightforward nature of the statute has not translated neatly into a workable regulatory framework. The problem does not lie with the Commission's implementing regulations. Our rule adopting the internal control provision is grounded in "reasonableness." We stated that the control process must provide "reasonable assurance" regarding its control structures. Records should be maintained in "reasonable detail." A company's policies and procedures should provide "reasonable assurance" that transactions are recorded accurately in accordance with GAAP.
Complaints seem to stem largely from the implementation of the PCAOB's 300-page-long Auditing Standard Number 2. Under AS2, corporate management and auditing firms have been much too conservative in exercising their judgment. People are driven by the impulse to document virtually every process in an effort to appear to be thorough and to avoid being second-guessed by regulators and litigators. In a report that the PCAOB issued last November on the implementation of AS2, the PCAOB found, among other things, that most of the audits reviewed did not use a top-down approach and that the "[a]uditors who used a bottom-up approach often spent more time and effort than was necessary to complete the audit."3 As a result, the Section 404 process consumes far more time and resources than anyone anticipated.
In April 2005, the SEC and the PCAOB held a joint roundtable on Section 404 and we gained much insight into the granularity that has characterized 404 reviews. We heard about a company that anticipated spending 125,000 hours documenting controls.4 Another panelist reported that a Business Roundtable survey found that the number of key internal controls ranged as high as 80,000.5 The CFO of a large European company told me that his company had determined that it had 500 key controls that required documentation, but its outside auditor found 20,000 key internal controls. Regardless of whether the company was right in its assessment, I am confident in saying that the auditor was way off the mark. Subsequently, a CEO told me that he would be happy with 20,000 documented controls — his company has 200,000! Even in a large company, can this many controls be "key"? It is also troubling when auditors suggest that they were making materiality determinations at the segment and interim financials level. This is much too deep in the weeds; materiality assessments need to be made on an enterprise basis at the annual period level.
I have spoken with bio-technology companies with high market capitalization, but no revenues, and whose only products are in the development phase. Their stories are unsettling. I heard from one company that spends more on its audit and 404 compliance than it spends on the personnel that prepare the financial statements — that is, it spends more on fees to outside auditors and consultants than it spends on salaries for its CFO and his direct reports. The result? Section 404 compliance costs trump building their business — the hiring of scientists and engineers. That translates into missed opportunities for investors and sick people.
We are also hearing stories of companies conducting their IPOs outside the U.S. or simply deciding that it is not financially practical to go public. Just 6 years ago, 9 out of 10 dollars raised globally through IPOs were raised in the US capital markets. In 2005, that number was reversed — 9 out of 10 dollars raised globally through IPOs were raised abroad. Last year, not one of the top 10 IPOs was done in the US capital markets and 23 out of 25 of the largest IPOs were registered abroad.
One phenomenon that we are observing is an upsurge in the number of American companies that are deciding to list on the London Stock Exchange's Alternative Investment Market (or AIM), rather than list at home and face Sarbanes-Oxley costs. This also represents a major marketing strategy of the AIM Market. In 2005, the London Stock Exchange attracted a record 19 companies from the US to AIM, raising a combined total of more than $2 billion. That number is about 15% of the total IPOs last year on NASDAQ, but just about equal to the number of international IPOs on NASDAQ last year. That might be a good result for London, but it is not necessarily a good result for the vibrancy of the market place here.
It is not only the actual costs of hiring auditors, but the opportunity costs that are high. As one commentator at last year's roundtable explained, senior management's focus on internal controls "will distract them from things that really are probably much more significant, in terms of operating control strategy, that they really should be focused on."6 Are shareholders well-served when management and corporate board members spend their time on internal control minutiae rather than thinking about how to develop and market the company's products and services or taking steps to strengthen high-level internal controls?
Optimistically, it looks as if the number of reported material deficiencies for year two of 404 effectiveness will be fewer than for year one. Does this reflect at least a more judicious use of the material weakness label? Could it also reflect the improvement of internal control systems to weed out and remediate the weaknesses? I will be very interested to see the analysis. However, I remain skeptical that the marketplace puts much weight in determinations that come out of the 404 process in its current form. Thus, I am very much concerned about applying it in its current form to smaller companies.
People will not dare to rationalize their approach to the internal control process until both the SEC and the PCAOB have given them comfort that we will not continually second-guess their professional judgment. The SEC and the PCAOB, which both issued guidance last May, generally agree that there was overkill by auditors (and management) in the first year. The guidance acknowledges that more needs to be done in this area to encourage companies and their auditors to move away from the excessively granular current approach and towards a risk-based, top-down strategy.
In a couple weeks, on May 10, we will have our second annual Section 404 roundtable to discuss the experiences and observations of issuers, investors, auditors, and others during the second year of compliance with Section 404. I am looking forward to hearing from the roundtable participants, many of whom also participated last year, about their year two experiences. I am also looking forward to reviewing written comments from those that cannot participate.
One of the issues that will be considered is whether the costs have fallen as much as some hoped that they would in year two. First year costs were staggering and exceeded everyone's expectations. A report that was commissioned by the Big Four accounting firms, whose revenues have swelled as a result of Section 404, and released earlier this month found that second year Section 404 costs were down.7 For smaller firms, 404 audit fees fell by an average of 20.6% and internal issuer costs by 15.2%.8 Interestingly, the drop in 404 audit fees was largely offset by a 12.8% increase in non-404 audit fees.9 For larger firms, 404 audit fees fell by 22.3% and internal issuer costs by 47.9%.10 For larger firms, there was an increase in non-404 audit fees of 14.9%.11
These numbers are encouraging, but I am not convinced that they are representative of the experiences of many companies out there. A survey by the Financial Executives International found more moderate decreases with auditor attestation fees falling by only 13% in year two and internal staff hours falling by an average of 11.8%.12 In addition, in advance of the roundtable, I have had the opportunity to talk with a number of companies about their experiences with Section 404 in year two. From what I have heard from the CFOs with whom I have spoken thus far, the costs for external auditors and the time spent internally on 404 are still substantial. It is also important to put the reductions in perspective. Year one figures were breathtakingly high, so even after significant reductions, investors still will be paying a lot for the 404 process without, I fear, commensurate returns.
Judging from the comments that have come in already in advance of the roundtable, there is still a lot of frustration about 404. Commenters have remarked on the undue emphasis on routine controls, which deflects focus from where it should be, on entity level controls, and on the drain on employee time. One CEO described his company's experience as follows:
As a Micro-cap company with less than $100 million in sales and a market capitalization of less than $100 million, we find the expenses of complying with SOX an unparalleled burden, the expenses of which exceed the total of ALL our accounting and legal expenses to comply with the 33 and 34 Act reporting, tax accounting for the IRS, and other related administrative costs. We have had to hire 4 additional in-house accountants, 2 people in IT, re-write software programs, pay additional outside accounting fees, hire a consulting firm specializing in Sarbanes compliance and spend countless management and audit Committee hour[s] dealing with SOX …13
Before the problems surrounding Section 404 can be solved, the PCAOB will have to reopen AS2. We will work with them on revising the standard. New leadership at the SEC and the PCAOB at least ensures that we will take a fresh approach from that of the past. The SEC, for its part, needs to provide more and better guidance for management in carrying out their internal controls assessments. In retrospect, we should have been more explicit on that end. Without that sort of guidance, management has had to look to AS2 for guidance and defer to auditor directives about the steps that they need to take in strengthening, documenting, and testing their internal controls. Our reasonableness standard was trumped by the incredibly detailed accounting directives that followed and the fear of being second-guessed in the current regulatory and litigation environment. The guidance that we provide should facilitate management's use of its own professional judgment. After all, management will always bring to the table a deeper understanding of the unique characteristics of their own company than the auditor has. Any guidance that the Commission provides should be adaptable to companies of different type and sizes.
We also will consider a report issued earlier this week by the Advisory Committee on Smaller Public Companies. The report recommended, among other things, broad exemptive relief from section 404 for microcap and smallcap companies until a framework for assessing internal control over financial reporting is developed for smaller companies. I thank this committee for its thoughtfulness, openness, and courage in contributing to the debate and to our knowledge. Its recommendations illustrate the deep level of concern and the immediacy of the need for 404 reform. Whatever the Commission does in this area, it cannot risk crippling the small companies that sustain the American economy. Again, a new and better framework of strong guidance to management, able to be tailored to different sizes of companies, is key to giving them the tools to build a robust and effective review process that will stay at a reasonable level of detail.
In formulating changes to the way that Section 404 has been implemented, we need to keep in mind the limitations of internal control documentation. It is far from clear, as some have argued, that documentation of internal controls would have been able to prevent the type of collusive fraud by management that we saw in the recent corporate failures. As one commenter at last year's roundtable explained, we need to manage expectations around Section 404:
[I]t's very important that we not oversell investors on what has occurred. Operating controls were not covered by 404. So it is entirely possible that we will very accurately report on an operational disaster. Even the best controls cannot necessarily preclude collusive fraud … We will see some collusive fraud in companies where there are no reported material weaknesses. It will occur.14
Internal controls, which have been required since the 1970s, are a tool to assist financial reporting; they are not a stand-alone goal and they are not an insurance policy against fraud. A willingness to spend money on good internal controls is evidence of a healthy corporate culture and a commitment to long-term success, rather than a preoccupation with hitting short-term targets. That said, resources spent in an excessively granular approach to internal controls might be better devoted to the real business of the corporation.
My hope is that, when properly implemented, Section 404 will assist investors in gauging the level of risk of a company's reporting system by providing them with a window into the company's oversight framework for financial reporting. The rules can help the market to distinguish companies with sound internal controls and aggressive oversight programs from those that devote inadequate attention to internal controls. The former group of companies will be appropriately rewarded with a lower cost of capital. To achieve that end, does 404 need to be mandatory? Would the market not drive companies to that end anyway? Because Congress decided to make 404 mandatory for all public companies, we may never know. But, if we can overhaul the Section 404 regulatory framework to be more reasonable in implementation and serve this purpose, Section 404 could become one of the most valuable parts of the Act.
Even with revised guidance, the implementation of Section 404 will be colored by the same litigation risks that affect auditor and company behavior in other areas. The possibility of a future challenge by someone exercising 20-20 hindsight makes people reluctant to use their professional judgment. We have seen how some class action lawyers have become adept at turning questions of professional judgment into the basis for lucrative lawsuits and self-promotion. The legal system should afford injured investors the opportunity to seek compensation for their losses from the parties responsible for their losses, but if the system works as a "lottery system of justice" then we risk making the United States an unattractive place to invest and to do business. Indeed, along with Sarbanes-Oxley, litigation risk is an issue that Europeans often raise with me when they explain why they are leery about investing in the United States. Unfortunately, the litigation issue may take even longer to solve than Section 404, although I am happy to say that President Bush and Congress are working on it.
Thank you for your attention. I look forward to hearing your questions and concerns on these issues and any others that are on your mind. And, please know that my door is always open. Feel free to stop by or call to discuss new issues as they arise. That is the best way for me to keep abreast of developments in the marketplace.
Endnotes
http://www.sec.gov/news/speech/2006/spch042706psa.htm
