One of the key provisions of the Sarbanes-Oxley Act was that corporate managers inform investors about just how well they were minding the store.That provision, known as Section 404, requires companies' executives and their auditors to assess the state of companies' internal controls. Internal controls are a system of checks and balances over financial accounting that are designed to prevent corporate fraud. But because of a series of delays by the Securities and Exchange Commission, small companies still don't have to comply with the provision, four years after President Bush signed the landmark law. What's more, they may not have to anytime soon if their advocates in Washington, D.C., continue to have their way. That notion has some corporate watchdogs worried. There's a growing buzz in Congress and in other political circles to revise, or even roll back, the internal-controls requirements, says Lynn Turner, managing director of research at Glass Lewis, a firm that advises institutional investors about how to vote corporate proxies. "The real purpose behind the SEC effort is to delay long enough to prevent the law from ever becoming implemented," warns Turner, the commission's former chief accountant. For the most part, small-business advocates who have pushed for the delays insist that repeal of Section 404 is not their goal. It's important not only for small companies to have internal controls but also for them to report on those controls, they say.
The fears about the costs of complying with the internal-controls provisions are largely drawn from the experiences of small and midsize companies that already must comply with it.Presumably, any revisions could mean cost savings for those companies -- and looser requirements. Bochner and other small-companies advocates have found a ready ear at the SEC. Earlier this month, the commission proposed pushing back the deadline to a time when small companies would have to report on their internal controls. Current SEC rules would require U.S. companies that aren't already doing so to report on their controls commencing in their annual reports that cover fiscal years ended after July 15, 2007. The proposed delay pushes that back to years ending after Dec. 15, 2007. What's more, such companies wouldn't have to include their auditors' evaluation of their internal controls until their following year's annual reports. Assuming that the commission approves the delay, it would mark the fourth time the SEC has postponed the need for small companies to report on their internal controls. But the SEC is going beyond just pushing back the deadlines again. The agency is considering whether to give corporate managers guidelines on how to assess the controls at their companies.