|
 |
SMALLER PUBLIC COMPANIES ARE NEXT ON
THE SARBANES-OXLEY HIT LIST
|
By William Poe
This is one of those good news-bad news stories. If you are one of the many small, public companies in the St. Louis area, the bad news is that you’ve got to comply with some tough Sarbanes-Oxley (SOX) provisions.
The good news is that you’ve got extra time to do it.
In fact, July 15 was to have been the date for most public companies to
be in compliance with the so-called Section 404 accounting provisions of
the post-Enron corporate reform legislation, but federal regulators recently extended that deadline until July 15, 2006. That’s more good news. But there’s more bad news, too. It’s probably going to cost your company a
king’s ransom to reach compliance with SOX (as the 2002 federal legislation is called), and, if your company doesn’t, it could be off to the dungeon for corporate officers and directors.
“The legislation is tough enough to have a deterrent effect,” says Paul G. Klug, a business attorney with Polsinelli Shalton Welte Suelthaus PC.
That may be an understatement for a SOX provision, which carries a maximum 20-year prison penalty for convicted violators.
No one is understating the monetary costs of SOX compliance.
“You’ve easily got to expect six-figure fees” for SOX compliance activities, says Mark G. Hinsen, director of Sarbanes–Oxley services, for the accounting firm of Anders, Minkler & Diehl LLP.
 Mark G. Hinsen, director of Sarbanes-Oxley services, Anders, Minkler & Diehl LLP. |
|
According to the most recent survey of Financial Executives International, large companies surveyed reported that they expect to pay more than $800,000 in fees to outside
auditors just to put systems in place so that company executives can attest to internal financial controls. The survey also found that companies anticipate spending hundreds of thousands of dollars more for software and IT consulting related to SOX. Some large companies have reported spending tens of millions of dollars on SOX compliance.
You can blame it on Enron. And Worldcom. And Arthur Andersen. Those and other corporate accounting scandals led to the Sarbanes-Oxley Act of 2002, which requires public company executives, boards of directors and independent auditors to take specific actions to achieve greater corporate accountability and transparency. The intent of the law is to help engender public trust in U.S. business and corporate reporting.
Sarbanes-Oxley, though, applies to more than public companies. According to Klug, larger private companies, too, are required to develop formal document retention policies and to provide protections for whistleblowers and others who might report corporate violations of federal laws. And all public banks and private banks with $500 million or more in assets will have to comply with Section 404 of SOX, adds Klug. Other organizations are voluntarily adopting portions of the law.
“Nonprofit organizations, especially larger ones, that value transparency are using SOX somewhat as a measuring stick to increase transparency and build their internal controls to present a greater level of comfort for their donors,” says Hinsen.
According to Klug, companies that should consider adopting at least portions of SOX include companies that are considering going public, companies that undertake government contracting work, companies seeking acquisition by a publicly traded company, and any vendor to a public company.
| Paul G. Klug, business attorney, Polsinelli Shalton Welte Suelthaus PC. |
|
Large and small public companies alike are now struggling with planning and implementation activities related to SOX Section 404, which requires public companies to verify that their financial reporting systems have proper controls. Most large-cap companies must attest this year that these controls are in place. Most small-cap companies will do so next year even with the deadline extension, says Hinsen.
When asked how far along these smaller companies are with compliance, Hinsen says, “It’s a broad spectrum. Some companies are well on their way; others have yet to start.”
Most smaller companies are turning to outside professionals, such as accounting firms, for the bulk of Section 404 compliance work.
“Compliance is a very difficult and time-consuming process,” says Hinsen. “Most organizations don’t have the internal staff to do it or even know how to find people with the expertise to do it.”
Under Section 404, corporate executives and their auditors are required to certify the effectiveness of the internal controls that are the underpinning of financial reporting. Company management also has to attest that the controls are operating effectively.
A CEO or CFO who knowingly signs and certifies false periodic reports faces the possibility of large fines and up to 20 years in jail, says Klug.
“Now that kind of provision can certainly keep company executives up at night, but top managers of companies that practice best practices in these areas can sleep peacefully enough,” says Klug.
How well can they sleep? Hinsen says no one yet knows. Klug says he knows of only one or two enforcement actions taken so far against companies for violations of Sarbanes-Oxley.
“Smaller companies are waiting to see how the Public Company Accounting Oversight Board handles the big companies,” says Hinsen. “Are they going to come down hard with a hammer, or not? I think it is more likely that they will use the hammer for those that are trying to hide deficiencies rather than for those that disclose significant deficiencies and are working to correct them. But the rules are still evolving; it’s a moving target right now.”
With compliance deadlines also as moving targets, some companies are fully compliant with SOX while others have barely begun compliance activities, says Hinsen.
“I met recently with one potential client, and they were just starting the process even though their fiscal year ends in September,” recalls Hinsen. “Some were hoping they would get an extension, which they did.”
Companies should allow at least six to nine months to bring their financial reporting systems up to speed and test those systems, says Hinsen. For many companies, it takes 12 to 16 months.
Hinsen says the compliance process typically begins with an examination of a company’s existing internal control structure. After that, examiners review the company’s current documentation and select a control framework. The third step, Hinsen says, is the start of actual modifications to documentation controls. After that comes a series of testing, remediation and testing stages.
“We have a team from the firm come in and start testing and evaluating the new internal control structure,” explains Hinsen. “Most of time this is where the rub is because things don’t always work out the way you think they will. We usually find shortcomings in the system, need to revise documentation and do remediation, and then test, revise and test again until everything is in the format you think it needs to be so that the CFO and CEO can sign off. Sometimes, that doesn’t even happen. Occasionally, you attest simply that you have significant deficiencies and get it fixed the next year.”
“The more back and forth remediation activities there are, the higher the cost is going to be,” says Hinsen.
But Hinsen says that SOX means more to companies than just higher costs.
“Sarbanes-Oxley is an opportunity for companies to go through their financial reporting system and to confirm that it is as good as they believe it is,” says Hinsen. “If it is, this won’t be as painful for them.” |
|
|
|
|
- - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - -
|
