CPA Firms Brace for SOX 404 Small Biz Exemption
Charles Jones, a partner with Marshall Jones & Co. CPA firm in Atlanta and operator of a 404 boutique practice, says that group is already planning to shift its focus from 404 compliance to helping smaller companies with their internal audits. Alyssa Martin, a risk assurance partner and leader of 404 services at Weaver & Tidwell, a regional CPA firm in Dallas said her practice may move some people and resources to fraud prevention services and it may increase its services related to Statement of Auditing Standard 70, which applies to controls of information technology.
The SEC's Advisory Committee on Smaller Public Companies, is scheduled, in April to issue a final report on whether companies of under $125 million in market capitalization and under $125 million in annual revenue should be exempted from SOX’s 404 provision. This provision requires companies to establish and maintain internal controls for financial reporting and prepare annual reports of the control processes. A cottage industry has emerged for CPAs to offer 404 assistance services as third parties because companies’ auditors are prohibited from helping their audit clients in the 404 work, since that work is a non-audit service.
The committee favors exempting smaller companies because the costs of 404 compliance are disproportionately high for smaller entities – more than 2.5 percent of total revenues at companies of under $100 million revenue, versus one or two tenths of a percent at companies with over $1 billion in revenue. After receiving the full committee report in April, the SEC could opt to leave the 404 requirement in tact, eliminate it or reduce its scope for smaller companies.
Jones originally expected some significant volume for the 404 boutique, but he now says that the work “was spotty at best” because the high costs of compliance prompted many smaller public companies to handle all the work on their own.
Martin noted that her practice had, over the past year, helped some 15 larger public companies meet their 404 requirements and was expecting work from the smaller companies to pick up in 2006 when those companies faced their first reporting deadlines. The SEC, last year, extended the deadline for meeting the first wave of 404 reporting requirements to July 15, 2006, for “non-accelerated filer” companies of under $700 million in market cap; this was the second such extension since SOX became law in 2002.
“We thought there might be some work from smaller companies in 2006, but with this (the SEC’s consideration of a 404 exemption for smaller companies), the sense of urgency won’t be there,” Martin said. Jones said the second extension was an indication that the sense of 404 urgency would never be there for smaller companies.
Leaders at JH Cohn, the super-regional firm in Roseland, N.J., say that an exemption for smaller companies would likewise prompt them to shift some resources they had set aside for 404 compliance services. But Anthony Zecca, partner in charge of consulting, noted that the firm’s 404 services have been directed mainly at larger companies.
“We knew all along this would be a price sensitive market for the smaller companies,” Zecca said.