During a year in which community banks have had little to cheer about, hundreds got some good news last week when Securities and Exchange Commission Chairman Christopher Cox told a congressional panel he is recommending yet another extension for small, public companies to comply with what is widely viewed as the most onerous provision in the Sarbanes-Oxley Act.
The extension, if approved by the commission, would be the fifth the SEC has granted since 2004, and some community bankers hope this is a sign the SEC might be willing to give small banks a pass entirely on complying with section 404.
But observers say community banks and other small companies should not get their hopes up just yet. Small companies must begin complying with one aspect of section 404 in their 2007 financial reports and observers say it is reasonable to expect that full compliance will eventually be required.
Also, there is no guarantee that the full commission would accept Mr. Cox's recommendation. No meeting date has been set.
Section 404 requires public companies to vouch for their internal controls, and community bankers have long argued that the cost of complying far outweighs the benefits to investors.
For now, community bankers already struggling to keep compliance costs in check are cheering the fact that their auditing costs will be lower than expected in 2008.
Bankers and their trade group representatives also seized on Mr. Cox's comment that he wanted to study the cost of fulfilling section 404's requirements. Such a study could prompt either Congress or the SEC to come up with rules that would lighten the load on small companies, they said. Section 404 compliance is expected to cost small companies a good deal more, proportionally, than large ones, said Chris Cole, a regulatory counsel at the Independent Community Bankers of America.
"The possibilities improve substantially for some sort of tiered system of audit and tiered system of regulation," he said.
Perhaps Congress would consider giving banks a pass altogether on Section 404, given the rigorous supervision under which they already operate, said Jim Conboy, the president and chief executive officer of the $264 million-asset Citizens National Bank in Cheboygan, Mich.
Maybe it would, but not probably, say compliance consultants. First of all, investor groups will continue to lobby for full enforcement of the provisions that small businesses are trying to avoid, the consultants said. In addition, they say the SEC believes that the benefits of improved controls would be widespread and that the law is not nearly as onerous as many executives think it is.
The SEC is likely to find itself a year from now in the same position it is currently in, said Trent Gazzaway, a managing partner for corporate governance at Grant Thornton LLP. Business groups will continue to lean on the commission to do something to cut compliance costs, he said, but the SEC will be hard-pressed to come up with a formula that accomplishes that.
The real problem is that companies are doing far more to scrutinize their controls than they need to under the SEC's most recent risk-based guidance, Mr. Gazzaway said.
"The costs don't need to be excessive," he said. "You could take the guidance that's out there and implement section 404 in an efficient manner without breaking the bank. You're not going to get better guidance over the next year that's going to dramatically change that."
Thus, the only certainty in the wake of Mr. Cox's remarks may be continued sparring over the requirements of section 404.
The section stipulates that public companies must assess their internal controls over financial reporting, that management must report on the effectiveness of those controls and then that an auditor must examine the controls' effectiveness. Companies with more than $75 million of market capitalization — "accelerated filers" in SEC argot and banks in most cases with more than about $500 million of assets — are already following the rules. Implementation has been delayed four times for about 5,000 smaller companies, of an estimated 300 to 400 are banks.
Mr. Cox said that he would recommend requiring small-company managers to report on their controls' effectiveness for the fiscal years just coming to a close. Until last week, the plan was that outside auditors would have to test and report on managers' findings, beginning with the fiscal years ending after Dec. 15, 2008. Mr. Cox said he would recommend rolling that back to 2009.
This would save Citizens National $25,000 in auditor fees in the coming year, Mr. Conboy said, though the bank has already made the effort and borne the expense to prepare its own report on internal controls.
But if the SEC is unlikely to come up with rules that make compliance much easier, it is not clear what Mr. Cox hopes to accomplish by delaying enforcement of part of section 404 one more time, the compliance consultants said. And this makes it tough to guess whether another delay could be proposed a year from now, and it is not even clear that the full commission would accept Mr. Cox's recommendation.
That is because accounting rules require auditors to do the same work that Mr. Cox is suggesting could wait another year, Robert J. Benoit, a principal at Lord & Benoit LLC, an accounting firm in Worcester, Mass.
He added that the SEC understands that many small companies have weak internal controls. And even if banks generally have much stronger controls than other businesses, Grant Thornton's Mr. Gazzaway pointed out that 11% of banks that are accelerated filers have found material weaknesses in their controls. Further delay in enforcing section 404 will mean avoidable errors in financial reports, he said.
"We will be unable to fix internal-control problems that are going to result in misstatements next year," he said.
