Section 404: Time for Small Companies to Suck It Up
from
September/October 2006
by Rob Norton
The Securities and Exchange Commission’s May decision not to exempt smaller public companies from Section 404 of the Sarbanes-Oxley Act is a big blow, especially since the SEC’s own advisory committee had recommended an exemption from the strict internal-controls requirements. Small companies, those with market caps of less than $75 million, still have until 2007 to comply—larger corporations’ compliance began last year—and that leaves the possibility that Congress could save the day for the smaller fry. But with the odds of such intervention slight, they might do best to start planning for the worst.
The way Section 404 affects smaller companies is a good example of the law of unintended consequences—or, as Milton Friedman called it, the “invisible foot” of government. Complying with the new provision is complex. Companies that have gone through the process say that formalizing, stress-testing, and auditing the new control regime has proved time-consuming and costly. Marcum & Kliegman, an accounting firm in Melville, New York, recommends a six-step process to prepare for 404. It includes planning, documentation and evaluation, management testing, interface with external auditors, external-auditor testing, and reporting. Ugh.
For the big companies, the costs of compliance, while they may run into the millions, are small in the larger scheme of business; the SEC’s advisory committee reported that they amount to one or two tenths of a percent of annual revenues. But for companies with revenues of less than $100 million, the committee found that Section 404 compliance could add up to more than 2.5% of revenues.
Consider the case of FlavoRx, a privately held Bethesda, Maryland, company that develops flavoring for medicines. Its motto is “We make medicine a lot less yucky”; its revenues were $8.6 million for the fiscal year that ended June 30. In 2002, with an eye to going public, FlavoRx hired a Big Four accounting firm to help it get ready for Sarbanes-Oxley and Section 404 compliance. Co-founder and CFO Woodie Neiss told the House Small Business Committee in May that the company quickly found itself enmeshed in “adversarial, theoretical debates over revenue-recognition procedures that bore no resemblance to our business practices.” Worse, what had been a $10,000 two-week audit grew to become a $70,000 four-month audit, gobbling up 14% of the firm’s net income. FlavoRx fired its auditors, and for the time being plans to use the savings to invest in marketing or boost returns—though it still hopes to go public someday.
Many small and midsize companies complain that Section 404 compliance costs are putting them at a competitive disadvantage internationally. One of the industry groups that have been leading the lobbying charge for reform, the American Electronics Association, says that skyrocketing implementation costs have had a “devastating effect” on its small and medium-size members and “have put high-tech companies in the position of having to delay major projects at a time when many are struggling to compete with low-cost competition from Asia.”
The SEC did hold out some hope for compromise. At the same time as it turned down the advisory committee’s recommendation for a small-business exemption, the agency announced that it would seek additional comment from smaller companies, promised to issue further guidance, and said it would order “a short postponement” of the final implementation date, although all companies will need to comply by 2007.
“It was a middle-of-the-road, Solomonic decision,” says Steven Bochner, a partner at the Silicon Valley law firm of Wilson Sonsini Goodrich & Rosati who served on the SEC advisory committee. “They said they recognize the problem and will work with us.”
Congress could provide relief. Senator Jim DeMint (R-South Carolina) and Representative Tom Feeney (R-Florida) have introduced legislation that would direct the SEC to let small companies opt out of Section 404 and would relax some of the section’s provisions for companies that continue to comply. Congress-watchers doubt that the legislation will go anywhere this year.
In the meantime, there’s not much for smaller companies to do but suck it up and prepare to comply with Section 404. The best advice from outfits that have already tackled the problem is to use the compliance process to build understanding among management and the board about the material risks the company faces and the controls in place to monitor them. “Focus on the big picture,” says Carol Bernstein, vice president, secretary, and general counsel at Cabot Microelectronics. Cabot, based in Aurora, Illinois, sells polishing products and services related to the production of advanced semiconductors. It had revenues last year of $271 million and a market cap of $673 million as of December 2005—meaning it’s already been complying with Section 404. “What people get disheartened about,” Bernstein says, “is the waste of money on picayune details, checklists, and Kafkaesque things that take one’s focus off the really important areas of risk that we should be concentrating on.”
