Speech on SOX 404 by Corp Fin Chief John White

By:  Cydney Posner

In a recent speech, Corp Fin Chief John White reported that companies should look for improvements in SOX 404 experiences with both the management's assessment and auditor's attestation. He also addressed the need for more input on SOX 404 once the SEC issues its concept release regarding management guidance, which, White announced, should be available "fairly soon."

Significantly, White observed that, to date, smaller public companies have focused their energy on pursuing an exemption from internal control reporting. However, the SEC has made clear that that issue has been settled, and "the Commission has indicated that it does not intend at this time to extend a permanent exemption to smaller companies." Now, White challenged smaller companies to "harness and redirect the energy that has been spent seeking exemption into helping us craft a more efficient, scalable system…"For example, White noted that, at the SEC's last SOX 404 Roundtable, one panelist suggested, notwithstanding expected additional guidance from COSO, that the COSO framework would not be suitable for smaller public companies: "That comment did not have the benefit of reflecting on the substantial revisions COSO has been making since its October exposure draft... In my opinion, based on what we've heard to date, COSO will be able to be applied in a manner such that it is a suitable framework for smaller public companies." COSO "will be helping mark the path," and White encouraged the smaller public company community "to participate fully and provide input that allows us to proceed in a way that achieves the investor protection goals of improving the reliability of financial statements while still achieving cost reductions and efficiencies for smaller public companies."

Management's Assessment.In adopting its original rules regarding management's assessment, the SEC opted for flexibility, anticipating that each company would use informed judgment in documenting and testing its controls to fit its own operations, risks and procedures. In some cases, however, this approach was "overwhelmed by other forces (including often the independent auditor)" that insisted to some extent on uniformity. As a result of the absence of more detailed guidance from the SEC, as a fall-back position, companies have had to conduct their management assessments under the PCAOB's Auditing Standard No. 2, even though AS2 was intended only to govern how the auditor performs its work. The concept release will solicit input on SEC guidance on management's assessment. White also underscored that any guidance issued would be "sensitive to the fact that many companies have already invested substantial resources to establish and document programs and procedures to perform their assessments over the last few years." That is, if companies have already designed processes and procedures that are working well and meeting the objectives of SOX 404, then, in his view, companies should be able to keep following those processes and procedures.

Auditor's Attestation. White announced that the SEC and PCAOB "now agree that the PCAOB should amend AS 2, in part to fully reflect the earlier guidance [from last year] in the standard itself. I expect that the PCAOB's amendments will also clarify that AS 2 is not intended to dictate how management must perform its assessment." He further stated that the amendments to AS 2 "should be in place and effective before non-accelerated filers have to provide their first auditor reports on their internal controls." He did not, however, provide any sense of when those amendments might be effective. White stressed again that companies and their auditors that are already complying with AS2 "need not fear that those amendments... will somehow override the efforts that those companies and their auditors have already made at that point under the existing standard. I do anticipate, though, that any benefits of the amended standard that would work well 'in mid-stream' will be available at the earliest possible date."