Early in the year, Section 404 compliance hung like a weighty yoke around the necks of US listed companies. It sucked up resources, diverted the finance department’s attention and, in some cases, put pressure on earnings. It consumed far more dollars than anyone ever imagined – an average of $4.36 mn per company, according to a survey by Financial Executives International (FEI), a leading professional organization for CFOs and senior financial executives.
On March 16 thousands of companies breathed a sigh of relief. Having completed their first round of internal control certifications on time, their yoke had fallen. However, some companies still bear the awesome weight of impending Sarbanes-Oxley Section 404 compliance. Among them are several hundred companies that requested filing extensions, non-calendar year companies, and those dubiously ‘lucky’ small caps and foreign issuers that won a reprieve from the SEC and don’t have to file until 2006.
Mixed results
Not only does Section 404 require companies to identify, test and certify their internal controls over financial reporting, it also requires their public accounting firms to evaluate and attest to the effectiveness of these internal controls. With companies and auditors bound to report material weaknesses that come to light during their intensive 404 reviews, there was much speculation about how the market would react to such news.
For the many IROs like Don Washington, whose company passed the certification, the experience was almost a non-event. ‘Our investors have had very little curiosity about the results of the certification,’ recalls Washington, director of IR and corporate communications at EnPro Industries, a diversified manufacturer of capital goods. ‘The only question we have gotten has been about the cost of the whole effort. We never had any concern expressed about our ability to meet the requirements.’
Lori Barker, director of IR at SanDisk, a major supplier of flash memory data storage card products, had a similar experience. ‘SanDisk passed 404 and I had very limited questions from Wall Street,’ she reports. Barker says her company spent an ‘enormous’ amount of time and money on the process. ‘For companies that failed, or delayed [their] earnings release due to 404 work, stocks were penalized,’ she adds.
Other companies found their valuation affected after reporting in line with Section 404. Credit Suisse First Boston (CSFB) tracked the stock price performance of 74 companies that announced a material weakness between October 2004 and February 2005.
‘We looked at their stock price performance for the 20 trading days before the announcement and the 20 trading days after the announcement,’ comments David Zion, accounting analyst at CSFB. ‘The day after the announcement was – for this group of companies – the worst-performing day in that entire trading period.’
As many of the companies included in the study were small caps, CSFB compared their relative returns to stocks in the S&P 600 Small Cap Index. ‘If you look at that group of companies, stocks were sort of heading down before,’ Zion points out. ‘With the announcement of the material weakness [stocks in the study] headed down even more the next day, and 20 trading days after did not recover.’
Zion describes what goes through an analyst’s mind when a company says it has trouble with Sox 404 compliance: ‘When a company announces a material weakness in internal controls, the initial thought process is, That’s not a good thing. Analysts wonder, Can it continue to put the same reliance on the numbers in the financial statements?’
Take control
However, Zion warns that the focus should be on the plans a company makes to correct the situation, not on the problems themselves. As he points out, when a company announces a weakness, it usually lays out a remediation plan. ‘You can take that as a positive,’ he stresses. ‘The weakness has been there, but it is getting fixed so, going forward, that’s a positive.’
Barker believes this is where clear communication is absolutely essential. ‘Each circumstance is different, but it is hard for investors to have time to investigate the specifics,’ she notes. ‘IROs owe it to the investor to make sure they clearly articulate the impact of the material deficiency and the fix.’
In evaluating companies’ Sox 404 announcements, investors need to consider the level of risk and uncertainty, according to Zion. ‘Investors should ask themselves a number of questions to try to get a feel for whether or not the company now appears more risky,’ he explains. ‘You need to ask questions like, Has the company had accounting problems in the past? What is the weakness? What line items does it affect? Does it, in fact, affect key performance metrics? Is it company-wide, or is it one item on the balance sheet? Now that it’s been fixed, would you argue that maybe there’s less risk? We would recommend that investors focus on the remediation efforts the company has laid out and how clearly it has laid them out.’
Zion’s approach also involves looking at what a company is saying about the material weakness and thinking about it in terms of how much uncertainty comes along with what it is saying. ‘[The biggest uncertainty is] when a company can’t comply with Section 404 and the auditor disclaims opinion – then the company has an incomplete 10K,’ he points out. ‘[The least uncertainty occurs] when both the company and auditor agree controls are effective and the auditor provides a clean opinion.’
For Zion, market reaction boils down to transparency. ‘The market doesn’t like uncertainty,’ he says. ‘To the extent a company can explain clearly how it is fixing these problems, I think that goes a long way to assuaging investor reaction.’
The bright line
Analysts, credit rating agencies and investors have received praise by some for how they’re approaching 404 results. ‘What I find very encouraging is that the investment community has been broadly sophisticated in its attempt to understand why companies have material deficiencies,’ says Paul Reilly, CFO of Arrow Electronics, which passed its 404 hurdle. ‘Remember, 404 is dealing with your system of internal controls. It does not mean your numbers are incorrect. It may be an indication that you need to invest more time, effort and better resources into a more efficient system of internal controls. But it also means you have the opportunity to ensure your numbers are correct through substantive testing.’
First time around, the learning curve has been pretty steep for everyone involved. There’s been some griping from companies about auditor inflexibility and lack of communication. Auditors have complained about companies getting started too late, or not placing oversight of 404 at a high enough level. And boards, management and investors have scoffed at the astronomical cost of compliance.
After the first round of Sox 404 filings, public company representatives, investor advocates, auditors, audit committee members, US regulators and other experts aired their comments at a roundtable convened by the SEC. Other stakeholders submitted comments for posting to the SEC’s web site. There seems to be a determination on everybody’s part to make the process go more smoothly next time around.
‘I’m encouraged by a sense of everybody understanding that the blame doesn’t fall squarely on any one party,’ says Robert Dohrer, partner in the national office of audit and accounting at McGladrey & Pullen and the firm’s co-national director of auditing services. ‘You know, management could have done a better job. There could have been more implementation guidance. The auditors could have used more judgment and more flexibility in determining the amount of work they had to do. There will be a lot of progress made to make this process more efficient going forward.’
Washington is hopeful his company has everything in place to make Section 404 compliance easier next year. ‘We thought it would probably be a one-person job with maybe a little bit of outside help, and it ended up being pretty much full time for three people with more outside help than we anticipated,’ he recalls. EnPro Industries has since added one person to internal audit. ‘We’ve got the process in place,’ Washington adds. ‘The people are here. It will be a question of continuing the things we did first time around.’
Reilly says that although his company’s Sox champions tested key controls at over 95 percent of the company’s operations around the world, he anticipates doing some streamlining next year. In April, while Sox 404 was still fresh in their minds, 25 high-ranking finance and IT executives at Arrow Electronics participated in a two-day summit for what Reilly calls a ‘did well – do better’ debrief.
The summit also provided a forum for the team to consider how it can be more definitive in identifying key financial controls and reducing the amount of testing.
Integrating 404
‘Sox 404 is not a one-off event, or something that companies can focus on late each year,’ notes Reilly. ‘It’s something you need to live each and every day. We’ve now aligned Section 404 with how we actually operate the company, with how we make strategic decisions around initiatives we’re carrying out in the company to make us better or more effectively streamlined. One of the really important lessons learned is that this really needs to become part of your living culture and how you drive the business forward.’
At the same time, Reilly acknowledges the somber side of Section 404, the side that’s causing the buzz. ‘We have to be very honest with ourselves and recognize that the processes required by Sox, especially Section 404, are a bit burdensome for companies, and a bit costly,’ he concludes. ‘What we are trying to do is drive it forward to ensure we get something more than just an opinion from our auditors. But it will be difficult to get those benefits from a financial point of view [to] be the same amount of money that it costs us to do Sox 404 compliance.’
