SOX 404 continues to be the target of those seeking to introduce further regulation leniencies.
A new bill has been introduced with the aim of reducing regulatory burdens for low-revenue issuers. Currently, companies lose their Emerging Growth Company (EGC) status five years after an initial public offering (IPO). In effect, the Fostering Innovation Act of 2019 would extend SOX 404(b) exemption for companies that cease to be an EGC if their average revenue of the last three fiscal years is less than $50 million.
The Fostering Innovation Act would prove especially beneficial for companies in certain industries, such as biotechnology companies, that typically exhibit minimal revenue during developmental stages that often extends beyond the grace period afforded by EGC status.
With activity already increasing in the IPO market, is further deregulation necessary?
In 2018, initial public offerings reached the highest they have during the past six years, with 229 IPOs filed from companies with market capitalization greater than $75 million, a 61% increase compared to IPOs filed during 2013.
The majority of companies in 2018 are utilizing the exemption afforded by their EGC status and do not provide an auditor attestation. Approximately 7% of 2013 IPOs continue to lack an auditor attestation now that they have passed the five-year mark after which their EGC status would expire, a 31% decrease from our prior blog.
While EGCs are not required to issue an auditor attestation, they are required to have management assess and report on the companies’ internal controls over financial reporting (ICFR).
On average, 12.8% of first-time management assessments have disclosed ineffective ICFR, compared to 22.3% of all management assessments that have disclosed the existence of ineffective controls since 2013.
Compared to first-time management assessments, the average percentage of ineffective ICFR auditor attestations was lower, at 10.1% – almost double the average of 5.8% for all ineffective ICFR auditor attestations since 2013. This indicates that companies subject only to SOX 404(a), which only requires a management report on ICFR effectiveness, are more likely to disclose ineffective controls.
Would introducing further deregulation into SOX 404(b) prompt more companies to go public and lessen the financial burden of compliance?
The question continues to revolve around cost-benefit: does the increased financial burden presented by SOX 404 compliance, especially for smaller companies with limited resources, correlate with higher transparency for investors?
Audit Analytics looked at the potential impact of requiring a minimum threshold for revenue before a company was required to provide an auditor report on internal control effectiveness.
An average of 14% of companies with more than $50 million in revenue had first time management assessments disclosing ineffective controls. This average falls to 10.5% when looking at first time auditor attestations.
For more information on this analysis, please contact us by emailing info@auditanalytics.com or call 508-476-7007.