[This post has been updated primarily to reflect the contents of the proposing release as well as the statement of Commissioner Hester Peirce.]

Those of you who expected the SEC to go big and propose raising the current threshold for status as an "accelerated filer" to be commensurate with the cap for "smaller reporting companies" will be sorely disappointed, as will anyone looking for regulatory simplification and harmonization. Nevertheless, the SEC did address the big elephant in the room—the SOX 404(b) auditor attestation requirement—with a measured, narrowly tailored exception that attempted to thread the needle with regard to the controversy over exempting additional companies from SOX 404(b), viewed by some as a critical investor protection. However, the resulting framework proposed for determining filer categories and requirements adds another layer of complexity to the current labyrinth, including some rather head-spinning new transition provisions. Will anyone—other than low-revenue smaller reporting companies—be happy with the result?

(Here is the press release.) There is a 60-day comment period.

At an open meeting on Thursday morning, the SEC voted (by a vote of three to one, with Commissioner Robert Jackson dissenting) to propose amendments to the accelerated filer and large accelerated filer definitions that provide a narrow carve-out from these definitions for companies that qualify as smaller reporting companies and reported less than $100 million in annual revenues in the most recent fiscal year for which audited financial statements were available. As a result, if the proposal were adopted, those companies would no longer need to comply with the shorter timeframes for filing periodic reports applicable to accelerated filers and large accelerated filers. And, most significantly, the proposed revision would mean that those companies qualifying for the carve-out would no longer be subject to the SOX 404(b) auditor attestation requirement, which has been anathema to many deregulation advocates. In addition, these companies would not have to provide disclosure regarding unresolved staff comments on periodic reports or whether they make their filings available on their websites. Notably, companies with public floats between $75 million and $250 million would still be subject to all of the accelerated filer requirements unless their revenues were under the $100 million revenue cap.

In addition, the proposal would increase from $50 million to $60 million the transition thresholds for accelerated and large accelerated filers to become non-accelerated filers and increase the threshold for exiting large accelerated filer status from $500 million to $560 million. And, the proposal would add more complexity with a new revenue test as part of the transition thresholds for exiting both accelerated and large accelerated filer status.

(Partially based on my notes, so standard caveats apply.)

The loose end after the SRC amendments. You may recall that in June 2018, the SEC approved amendments that raised the SRC cap from "less than $75 million" in public float to "less than $250 million" and also included as SRCs companies with less than $100 million in annual revenues if they also had either no public float or a public float of less than $700 million. Those changes, however, laid waste to the alignment between the categories of "smaller reporting company" and "non-accelerated filer," with the result that some companies are now categorized as both SRCs and accelerated filers or, surprisingly, even large accelerated filers. The SRC adopting release indicated that many commenters took the opportunity to recommend that the SEC increase the public float cap in the accelerated filer definition commensurate with the cap in the new SRC definition, arguing that the costs associated with SOX 404(b) were burdensome and "divert capital from core business needs." Although the SEC elected not to raise the accelerated filer cap at that time, notwithstanding the admitted additional regulatory complexity, Chair Clayton did direct the staff to formulate recommendations "for possible additional changes to the 'accelerated filer' definition that, if adopted, would have the effect of reducing the number of companies that qualify as accelerated filers in order to promote capital formation by reducing compliance costs for those companies, while maintaining appropriate investor protections." Instead of raising the thresholds in the accelerated filer definition altogether (which would have provided the benefit of harmonizing the categories of non-accelerated filer and SRC), the staff crafted a more tailored exception that may perhaps be more palatable to those concerned about the possibility of eliminating the auditor attestation for a subset of SRCs.

Proposed changes to the accelerated filer definition. Under SOX 404(c), companies that are neither large accelerated filers nor accelerated filers are exempt from the auditor attestation requirement for internal control over financial reporting. The new proposal would "amend the accelerated and large accelerated filer definitions in Rule 12b-2 to exclude any issuer that is eligible to be an SRC under the SRC revenue test."

More specifically, under Rule 12b-2, to be an accelerated filer, a company must satisfy three conditions, the first of which is that the company has a public float of $75 million or more, but less than $700 million, as of the last business day of the company's most recently completed second fiscal quarter. A large accelerated filer must have a public float of $700 million or more as of the same date. Under the current rules, an accelerated filer can also be an SRC if it has a public float of $75 million or more, but less than $250 million, regardless of annual revenues; or a public float of more than $250 million, but less than $100 million in annual revenues. The proposal would add a new fourth condition to the definitions of accelerated and large accelerated filer: that the company is not eligible to be an SRC under the revenue test (in paragraphs (2) or (3)(iii)(B), as applicable) of the "smaller reporting company" definition in Rule 12b-2. (By referring to the paragraphs, the SEC intends to add flexibility in the event the thresholds change in the future. Note, however, that paragraph (3)(iii)(B) consists of a complicated table.)

The SEC's two tables below illustrate the change:

Existing Relationships between SRCs and Non-Accelerated and Accelerated Filers
Status Public Float Annual Revenues
SRC and Non-Accelerated Filer Less than $75 million N/A
SRC and Accelerated Filer $75 million to less than $250 million N/A
$250 million to less than $700 million Less than $100 million
Accelerated Filer (not SRC) $250 million to less than $700 million $100 million or more
Proposed Relationships between SRCs and Non-Accelerated and Accelerated Filers
Status Public Float Annual Revenues
SRC and Non-Accelerated Filer Less than $75 million N/A
$75 million to less than $700 million Less than $100 million
SRC and Accelerated Filer $75 million to less than $250 million $100 million or more
Accelerated Filer (not SRC) $250 million to less than $700 million $100 million or more

Because the SEC continues "to believe that the ICFR auditor attestation requirement incrementally can contribute to the reliability of financial disclosures, particularly for issuers that typically have more complex financial reporting requirements and processes," the SEC chose not to eliminate the requirement for all accelerated filers that are SRCs. Rather, the SEC proposed "a more tailored approach that recognizes that the impact of the ICFR auditor attestation requirement on the reliability of an issuer's financial disclosures is not necessarily the same across all issuers, including all SRCs." The SEC views the approach taken as analogous to other past approaches that opted for scaled disclosure.

SEC rationale. The SEC acknowledges that, because one effect of the proposed amendments is to increase the number of companies exempt from the auditor attestation requirement (estimated at 539 additional companies), investors would receive less disclosure about ICFR and material weaknesses regarding low-revenue SRCs. However, because many of the ICFR-related protections would remain in place even without an attestation, the SEC was not convinced that the change would be especially problematic:

"based on our experience with these matters, including in the cases of EGCs, SRCs, and other smaller reporting issuers, we believe it is unlikely there would be a significant effect on the ability of investors to make informed investment decisions based on the financial reporting of those issuers. A non-accelerated filer that meets the SRC revenue test would remain subject to many of the same obligations as accelerated and large accelerated filers with respect to ICFR, including the requirements for establishing, maintaining, and assessing the effectiveness of ICFR and for management to assess internal controls. Additionally, pursuant to the PCAOB's recently adopted risk assessment standards in financial statement audits, in many cases auditors are testing operating effectiveness of certain internal controls even if they are not performing an integrated audit."

That is, an independent auditor would still be required "to consider ICFR in the performance of its financial statement audit of an issuer, if applicable," even if the company were not subject to the ICFR attestation requirement. In addition, "evaluation and communication to management and the audit committee of significant deficiencies and material weaknesses in ICFR are required in both a financial statement audit and an ICFR attestation audit." Further, "auditors may also test operating effectiveness of internal controls in a financial statement audit, such as when the auditor determines to rely on those controls to reduce the substantive testing." The SEC estimated, for companies affected, the proposal would result in an average cost saving of about $210,000 per company annually.

In addition, the SEC suggests, "the benefits of the ICFR auditor attestation requirement may be smaller for issuers with low revenues because they may be less susceptible to the risk of certain kinds of misstatements, such as those related to revenue recognition. Also, it is possible that low-revenue issuers may have less complex financial systems and controls and, therefore, be less likely than other issuers to fail to detect and disclose material weaknesses in the absence of an ICFR auditor attestation. Additionally, we note the financial statements of low-revenue issuers may, in many cases, be less critical to assessing their valuation given, for example, the relative importance of their future prospects."

SideBar

As reported here, MarketWatch enlisted Audit Analytics to identify public companies with revenue under $100 million "that received a negative opinion from their auditors on their internal controls over financial reporting. Audit Analytics counted 176 companies that received adverse opinions on their internal controls since 2014. That represents 70% of all adverse internal control opinions issued for all public companies and 16.5% of the opinions issued for companies with less than $100 million in revenue that were required to do so."

Similarly, the WSJ cites a 2017 academic study that "estimated that 20% of exempted firms had ineffective internal controls from 2007 to 2014. During that same period, just 11% of them actually disclosed such a weakness. They also found that 41% of exempted firms provided insufficient information to identify the causes of the weaknesses in their internal controls, compared with just 7% for firms that were complying with the Sarbanes-Oxley rules. According to the study, the smallest companies not currently exempt from required internal-controls audits would have paid an additional $73,165 a year in audit fees. The SEC estimated that annual costs related to outside audits are higher, around $225,000 per company."

Revisions to the transition provisions. The SEC is also proposing to revise the transition provisions applicable to companies exiting accelerated and large accelerated filer status. Under current rules, an accelerated filer will not become a non-accelerated filer unless it determines at the end of a fiscal year that its public float had fallen below $50 million on the last business day of its most recently completed second fiscal quarter. Similarly, a large accelerated filer will lose its status as a large accelerated filer if its public float had fallen below $500 million on the same date, becoming an accelerated filer if its float is at $50 million or more, and a non-accelerated filer if its public float falls below $50 million. The "proposed amendments would revise the public float transition threshold for accelerated and large accelerated filers to become a non-accelerated filer from $50 million to $60 million. Also, the proposed amendments would increase the exit threshold in the large accelerated filer transition provision from $500 million to $560 million in public float to align the SRC and large accelerated filer transition thresholds." These new public float transition thresholds represent 80% of the initial thresholds, consistent with the approach taken for the transition thresholds for SRC eligibility.

The SEC's tables below show these changes:

Existing Requirements
Initial Public Float Determination Resulting Filer Status Subsequent Public Float Determination Resulting Filer Status
$700 million or more Large Accelerated Filer $500 million or more Large Accelerated Filer
Less than $500 million but $50 million or more Accelerated Filer
Less than $50 million Non-Accelerated Filer
Less than $700 million but $75 million or more Accelerated Filer Less than $700 million but $50 million or more Accelerated Filer
Less than $50 million Non-Accelerated Filer
Proposed Amendments to the Public Float Thresholds
Initial Public Float Determination Resulting Filer Status Subsequent Public Float Determination Resulting Filer Status
$700 million or more Large Accelerated Filer $560 million or more Large Accelerated Filer
Less than $560 million but $60 million or more Accelerated Filer
Less than $60 million Non-Accelerated Filer
Less than $700 million but $75 million or more Accelerated Filer Less than $700 million but $60 million or more Accelerated Filer
Less than $60 million Non-Accelerated Filer

The proposal also includes changes to the transition rules related to the SRC revenue test. For those who want to get granular, see the detail in the SideBar below.

SideBar

This is how the SEC describes the proposed new transition rules related to the new revenue test for an accelerated filer: A company that is already an accelerated filer would remain an accelerated filer unless either its public float falls below $60 million or it becomes eligible to be an SRC under "the revenue test in paragraphs (2) or (3)(iii)(B), as applicable, of the SRC definition. An issuer that is initially applying the SRC definition or previously qualified as an SRC would apply paragraph (2) of the SRC definition. Once an issuer determines that it does not qualify for SRC status, it would apply paragraph (3)(iii)(B) of the SRC definition at its next annual determination." In essence, according to the release, "under the proposed amendments, an accelerated filer would remain an accelerated filer until its public float falls below $60 million or its annual revenues fall below the applicable revenue threshold ($80 million or $100 million), at which point it would become a non-accelerated filer."

The proposal also includes conforming amendments to the large accelerated filer transition provisions covering the transition from large accelerated filer to either accelerated or non-accelerated filer status.

"A large accelerated filer would become an accelerated filer at the end of its fiscal year if its public float fell to $60 million or more but less than $560 million as of the last business day of its most recently completed second fiscal quarter and its annual revenues are not below the applicable revenue threshold ($80 million or $100 million). The large accelerated filer would become a non-accelerated filer if its public float fell below $60 million or it meets the revenue test in paragraph (2) or (3)(iii)(B), as applicable, of the SRC definition. For a large accelerated filer to meet the SRC revenue test, generally [with one exception], its public float would need to fall below $560 million as of the last business day of its most recently completed second fiscal quarter and its annual revenues would need to fall below the applicable revenue threshold ($80 million or $100 million)."

For examples of the application of these transition provisions, see footnote 95 of the release.

Commentary at the open meeting. In his statement at the open meeting, SEC Chair Jay Clayton characterized the proposal as a "retrospective review of one component" of SOX, observing that there are "many components" of SOX, including a number supporting the independent audit committee and enhanced auditor independence requirements, which have made significant contributions to the quality of financial reporting and are not affected by the proposal (a concept that Commissioner Elad Roisman echoed as well in his statement). In addition, Clayton emphasized that these SRCs will continue to be required to "establish, maintain, and assess the effectiveness of their internal control over financial reporting (ICFR)." Off-script, he also noted that, as part of the audit, auditors will continue to be required to assess ICFR. The difference will be the absence of the auditor attestation, which, for this subset of companies, was viewed to add disproportionate costs and was considered "unlikely to enhance financial reporting or investor protection." In his view, the "proposed amendments are intended to reduce costs without harming investors for certain smaller public companies and, importantly, encourage more companies to enter our public markets..."

Clayton also made the point that the "retrospective review in this area" was not novel and, in fact, was also the subject of subject of Congressional review in the JOBS Act, with the determination to eliminate the SOX 404(b) requirement for "emerging growth companies":

"That is, Congress, itself engaging in retrospective review, recognized that the compliance costs of certain aspects of Sarbanes-Oxley requirements do not scale with the size of the business, and those incremental and recurring costs can deter smaller companies from accessing our public capital markets....Notably, [the representation of these smaller companies] in our public markets has disproportionally decreased over the years. The lower-revenue companies affected by the proposed amendments generally have simpler financial statements. In fact, our economists do not expect that exempting these companies from the ICFR auditor attestation requirement would weaken the effectiveness of the ICFR or increase restatement rates compared to those companies that would remain accelerated filers....Investors in these companies will benefit from tailored requirements that will save costs that companies would be able to re-direct into growing their companies by investing in productive areas such as research and human capital."

Corp Fin director Bill Hinman also emphasized that companies subject to the exception would remain subject to the ICFR management's assessment requirement as well as the general requirement to assess ICFR as part of the audit. The low-revenue companies exempted through the carve-out generally have less complex financial statements, he contended, and are less likely to have many of the typical control lapses, such as those related to revenue recognition. As a result, he maintained, the auditor's attestation constituted a disproportionate burden on these companies but was less critical to their evaluation by the market (which would likely evaluate them at this point based more on their prospects and investment outlook than on their financial results). For example, Hinman said, 36% of companies affected by the proposal were in the pharma/medical device space. Although these companies may have larger market caps, they are often in the early stages of product development and, therefore, frequently have no or extremely low revenues. As a result, they typically have less access to internally generated capital for necessary reinvestment in R&D.

In his statement, Jackson took issue with the proposal, which he characterized as a "roll back" of SOX 404(b). In essence, he criticized the proposal's analysis of the costs of attestation as "based on data that's over a decade old, and the proposal makes no real attempt to assess the investor-protection benefits of gatekeepers in our markets." Indeed, Jackson and his staff conducted their own analyses based on more current data, and, as a result, he concluded that "it's clear that this proposal has no apparent basis in evidence." (Might that explain why the DERA representative at the open meeting kept referring to aspects of the economic analysis as "preliminary"?)

Harkening back to the debacles at Enron and WorldCom, Jackson argued that SOX 404(b) was adopted to "deter managers from fudging the numbers.... While paying auditors isn't free, neither is fraud. And fraud is more likely when insiders are less careful about controls. That's why, when we roll back protections like these, we can expect the cost of capital to rise; investors will either diligence the risk of fraud themselves or require higher returns to protect against that risk. There's a tradeoff; and hard evidence from the market, not ideological intuition, should tell us how to strike that balance."

A key reason given for the proposal was to encourage more IPOs, he said, but that type of deregulatory effort has not been successful in the past, and that's because "investors know better than Washington insiders about the value of protections like Section 404(b)." In effect, Jackson was renewing the debate that has been ongoing among the Commissioners and in the public sphere about the reasons for the decline in recent years in the number of IPOs and public companies: is the decline attributable primarily to regulatory burden or is it attributable to any of a variety of other reasons, such as the substantial availability of capital in the private markets. While the companies subject to the proposal may have found the costs of attestation most burdensome, Jackson noted, "it's equally possible that these are the firms—high-growth companies where the risk, and consequences, of fraud are greatest—where the benefits of the auditor's presence are highest."

More specifically, Jackson criticized the economic analysis for relying on data from 2004 showing "that companies with a public float under $75 million—the level under which auditor attestation is not required—seemed to 'bunch' under that threshold," suggesting that they intentionally kept their floats low to avoid SOX 404(b) costs. Jackson's own study using current data showed that the "bunching" phenomenon was no longer true: "That's why, in 2011, the Office of our Chief Accountant examined the costs of the attestation requirement and reported to the Commission that there was no longer any 'specific evidence that [any savings from rolling back 404(b)] would justify the loss of investor protections.'"

Jackson also contended that the proposal was flawed because it made "no serious attempt to evaluate the benefits of attestation." So, his office studied

"how investors react to news of an internal control failure in two groups of companies: those that would receive a rollback of 404(b) under today's proposals and those who would not. The evidence is striking. The data show we are proposing today to roll back 404(b) for exactly the group of companies where investors care about the benefits of auditor attestation most.... That result has many possible explanations, all of which are worth considering. One is that investors are concerned that companies of this size are particularly prone to accounting issues. But whatever the reason, the data show that investors care most about the information produced by the attestation requirement at exactly the firms that today's proposal would exempt from Section 404(b). The views of the ordinary American investors who put their savings at risk in these companies deserve far more weight than this proposal gives them."

SideBar

In 2015, the SEC's Advisory Committee on Small and Emerging Companies (now called the Small Business Capital Formation Advisory Committee) recommended that the SEC attempt to harmonize the jumble of rules applicable to the various categories of small companies and, specifically, that the SEC increase the threshold for "accelerated filers" to include companies with a public float of $250 million or more, but less than $700 million, with the result that the requirement to provide an auditor attestation report under SOX 404(b) would no longer apply to those companies. (See this PubCo post.) However, in the release proposing the change to the SRC definition in 2016, the SEC expressly rejected that Committee recommendation on the basis of the 2011 staff study to which Jackson referred above. That 2011 study found

"no specific evidence that any potential savings from exempting registrants with public floats between $75 million and $250 million from the auditor attestation provisions of Section 404(b) would justify the loss of investor protections and benefits to registrants from such an exemption. Rather, the staff found that accelerated filers (including those with a public float between $75 million and $250 million) that were subject to the Section 404(b) auditor attestation requirements generally had a lower restatement rate than registrants that were not subject to the requirements. Moreover, the staff found that the population of registrants with public floats between $75 million and $250 million did not have sufficiently unique characteristics that would justify differentiating this population of registrants from other accelerated filers with respect to the Section 404 auditor attestation requirements."

The proposing release also observed that subsequent academic research on this topic was mixed. As a result, the SEC did not propose to raise the accelerated filer public float threshold or to modify the SOX 404(b) requirement as part of that proposal. The SEC did, however, request comment on the issue. The Committee's final report in 2017 reiterated its recommendation to amend the "accelerated filer" definition.

On the other hand, in her statement, Commissioner Hester Peirce indicated that, while she supported the proposal, she had reservations about its scope. Although she viewed the proposal as "a step in the right direction," she did not believe that it went "far enough. The complexity remains; there still will be many SRCs that are also accelerated filers. The process of determining whether a company is an SRC and a non-accelerated filer, or an SRC and an accelerated filer, or outside of both categories is so complicated that even we at the SEC need diagrams to figure it out. The fact that we ourselves struggling to understand our own regime does not bode well for smaller companies trying to follow our rules without the benefit of a staff of seasoned securities attorneys." The resulting complexity in the definitions, she said, required a navigation tool to comply. (Taking into account the rather byzantine transition provisions, she may have a point!) She also thought that the SEC was "missing the substantive mark. We are not proposing to exempt all SRCs from 404(b), and the SRCs that are not exempt will continue to receive auditor bills for 404(b)," which the SEC currently estimated to be an increased cost of 25%. While she agreed that the proposal involved trade-offs, she believed that, in many instances, "investors would rather see their money being used for something other than 404(b) compliance, such as research and development or hiring new employees."

SideBar

Since the proposal regarding the definition of SRCs was issued in 2016, many critics have trained their sights on SOX 404(b), arguing that it is a significant contributor to the type of regulatory overload that some argue has deterred companies from conducting IPOs; the attestation audit was just too time-consuming and expensive for many smaller companies.. Moreover, they contend, requiring controls audits for smaller companies did not make much sense, especially for pre-revenue companies such as many smaller biotechs that had little revenue and few employees. In those cases, the cost of the controls audit would divert capital from other more important uses, such as R&D. In one example cited by a critic, the cost of the controls audit for one small public biotech with fewer than 60 employees and a public float of $85 million added 1% to the company's burn rate. In addition, critics have argued that controls audits did not add much value: in one study, 84% of restatements were not preceded by reports of material weaknesses; that is, they contend, the 404(b) audits failed.

Advocates of SOX 404(b), however, have emphasized that internal controls are the backbone of the financial statements, and some auditors view the attestation as more important than the audit itself. According to Audit Analytics, the percentage of adverse internal control auditor attestations decreased from 15.7% in 2004 to 5.3% in 2015. In its 2015 Financial Restatements Report, Audit Analytics "found that after the implementation of SOX there was a massive increase in financial restatements that peaked at 1,851 in 2006. That number declined significantly to just 737 in 2015." In addition, it "found that the financial impact on net income has also declined. Restatements of $3 billion to $6 billion were made in each year between 2002 and 2006. Since 2008 only one year had a restatement that has impacted net income by more than $1 billion." Its 2017 Financial Restatements Report showed that total restatements had dropped for three consecutive years to a 17-year low. Moreover, there were 184 restatements filed by accelerated filers and 236 by non-accelerated filers. An EY report showed a similar result: following the effectiveness of the SOX attestation requirement, from 2005 to 2016, the number of financial restatements declined by 90%, and the aggregate amount of net income involved in restatements declined from $6 billion to $1 billion. Likewise, advocates contend, a GAO study found that companies exempt from controls audits had more restatements, while another study showed that companies that had controls audits had higher valuation premiums and lower cost of debt. Advocates also note that the cost of the attestation audit has declined over time, particularly incremental costs as part of an integrated audit. (See this PubCo post, this PubCo post and this PubCo post.)

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.