CII criticizes dropping smaller company ICFR auditor attestations

The Council of Institutional Investors (CII) has added its voice to those concerned by SEC plans to exempt smaller companies from a key Sarbanes-Oxley Act measure.

The SEC has proposed amending its accelerated filer and large accelerated filer definitions in an effort to reduce compliance costs for certain lower-revenue companies - and potentially spur more of them to launch IPOs.

Specifically, the planned changes would mean that companies with less than $100 million in revenues no longer have to comply with Section 404(b) of Sarbanes-Oxley by having their assessment of the effectiveness of internal control over financial reporting (ICFR) attested to by an independent auditor.

Several smaller companies have filed comment letters supporting the proposal. They argue that the savings from not having to comply will be spent on investments in areas such as research and product development.

But others are worried that the changes would undercut investor protections brought in following a series of high-profile accounting scandals.

‘CII believes the ICFR auditor attestation requirement provides investors with reasonable assurance from the independent auditor that the company maintained effective internal control over financial reporting,’ CII general counsel Jeffrey Mahoney writes in the group’s comment letter. ‘That assurance is an important driver of confidence in the integrity of financial statements and in the fairness of our capital markets.’

He adds: ‘We believe the proposed rule amendments allowing low-revenue issuers to avoid the ICFR auditor attestation requirement could significantly affect the ability of investors to make informed investment decisions because it would substantially impact the quality of financial reporting by those issuers.’

CII also questions the SEC’s economic analysis of the proposal and backs arguments put forward in a separate letter  by professors Mary Barth of Stanford University, Wayne Landsman of the University of North Carolina, Joseph Schroeder of Indiana University and Daniel Taylor of Wharton/University of Pennsylvania. They argue that the SEC’s economic analysis is incomplete because:

• It quantifies the cost of internal control audits but does not quantify the benefits of such audits
• It focuses on the rate of restatements among affected companies and does not consider the size of the restatements. The professors write that a preliminary analysis of restatements announced in 2018 shows that 11 companies that the SEC plans to exempt from internal control audits restated more than $65 million in net income and these restatements destroyed more than $294 million in shareholder wealth – far greater than the SEC’s estimated $75 million in total cost savings across all 358 affected companies
• It does not analyze the historical rate of fraud or SEC accounting and enforcement actions within the group of affected companies.

‘Although it might be socially desirable to encourage investment, and research and development, we believe there are ways to do so without sacrificing oversight,’ the academics write.

SEC member Robert Jackson has criticized the proposal. In a statement when the measure was put forward, he said: ‘While paying auditors isn’t free, neither is fraud. And fraud is more likely when insiders are less careful about controls. That’s why, when we roll back protections like these, we can expect the cost of capital to rise; investors will either diligence the risk of fraud themselves or require higher returns to protect against that risk. There’s a tradeoff; and hard evidence from the market, not ideological intuition, should tell us how to strike that balance.’

He added: ‘The proposal rolls back 404(b) only for smaller companies on the theory that these are the firms for which the costs of attestation are most burdensome. But it’s equally possible that these are the firms - high-growth companies where the risk, and consequences, of fraud are greatest - where the benefits of the auditor’s presence are highest.’

He also complained that the proposal used old data to assess the costs of attestation while making little effort to evaluate the benefits. He presented his team’s own research, saying: ‘While the costs of Section 404(b) might have driven the public float of small firms 15 years ago, there is no evidence of that today.’

Grant Thornton has also raised doubts. ‘[W]e believe the auditor attestation on ICFR is an important element of investor protection that promotes accurate ICFR disclosures by management, increases the effectiveness of ICFR and reduces the rate of material misstatements,’ Bert Fox, national managing partner of professional standards, writes in the audit firm’s comment letter.

Smaller companies often have limited access to resources such as accounting employees and IT systems, which could increase the risk that they have ineffective ICFR, Fox says. He points to figures in the SEC proposal indicating that between 2014 and 2018, 40.1 percent of non-accelerated filers on average reported ineffective ICFR, compared to 8.8 percent and 4.1 percent of accelerated and large accelerated filers.

He adds: ‘We believe the proposal would reduce the level of protection afforded to investors in the impacted issuers that would no longer be required to obtain an auditor attestation on ICFR. Accordingly, we do not support the proposed amendments.’

The SEC, by policy, does not comment on comment letters.