Last month, I mentioned that the SEC's Advisory Committee on Smaller Public Companies was meeting in mid-December and neglected to follow up on their recommendations to the Commission at the meeting. Their key recommendation is right here, and it can best be summarized as: create a protected class of public companies who don't have to follow the same rules as their larger counterparts, simply by virtue of their size.
Former SEC chairman Arthur Levitt opined on that recommendation in this morning's Wall Street Journal op-ed page, and I think he really nailed a few points worth emphasizing:
"The debate until now has centered on who should be exempted, not on how to ensure that companies have the internal controls needed to prepare reliable financial statements. This focus is unproductive since it is clear from a reading of SOX that Congress wanted all public companies to assess internal controls and have an outside auditor test them. Instead of defying Congress and provoking costly litigation, we need to work within the law to find ways to make compliance easier and less expensive for small businesses."
Internal controls are nothing new: Sarbanes-Oxley didn't invent the concept. The concept has been embedded in federal securities law since 1978 with the passage of the Foreign Corrupt Practices Act, and auditors were always supposed to have worked their evaluation of them into their examinations. SOX reiterated their importance, and they're important for all public companies. There's no small irony that much of the enforcement actions of the SEC relate to small companies - and they're the ones petitioning the SEC to be exempted from the internal control provisions. As Levitt accurately points out - the debate has centered on who should be exempt - not how to make the internal controls, and their assessments, work properly.
Levitt suggests that instead of scrapping over who's exempt, energies should be directed at fixing the problems encountered with Section 404 reviews in the first year:
The SEC and PCAOB should encourage accounting and financial executive trade groups and the software industry to develop tools that match the task of internal control evaluation for small companies and small accounting firms. As Levitt puts it, adapting an approach developed for multinationals to a small business is "like diagnosing a cold with an MRI." In Year One of Section 404 reviews, there's no doubt that diagnosis occurred frequently.
The SEC should reconfigure itself to be able to be more responsive to small companies. Levitt suggests that some decentralization of the SEC's enforcement function could accomplish this.
The SEC and PCAOB should ease requirements - but increase enforcement. In short, give companies the benefit of the doubt when controls are found to be working correctly - but if they're not working right and restatements become necessary, expect a visit from your friendly neighborhood SEC examiner.
A good editorial, I think. See for yourself.