SEC's Proposed SOX 404(b) Changes: Impact on Public Company Governance

Understanding the Proposed SOX 404(b) Changes

The U.S. Securities and Exchange Commission (SEC) has put forth proposed amendments that could dramatically alter Sarbanes-Oxley (SOX) reporting requirements, specifically concerning Section 404(b). If adopted, these changes would reclassify a substantial number of public companies as non-accelerated filers, exempting them from the external auditor attestation requirement for internal control over financial reporting (ICFR) under Section 404(b). While these companies would still be responsible for management's assessment of ICFR under Section 404(a), the shift places a heightened focus on the strength of an organization's internal control framework and management's governance responsibilities. This move aims to reduce compliance costs for a broader range of issuers while maintaining stringent requirements for the largest public companies.

Strategic Planning for Public Companies

Even though the proposal is not yet final, public companies are advised to begin evaluating its potential impact on their governance, compliance, and internal audit strategies. Instead of simply dismantling SOX programs, the objective should be optimization. This involves right-sizing SOX activities, potentially reducing testing frequency, rationalizing redundant controls, and leveraging technology like automation and analytics to improve efficiency. However, companies must be cautious not to weaken their control environment, as significantly reducing testing could lead to outdated documentation, unclear control ownership, and increased remediation costs. The goal is to maintain robust controls that support reliable financial reporting and operational discipline, not just regulatory compliance.

Reimagining Internal Audit's Role and Broader Governance

The proposed changes present an opportunity to reimagine the role of internal audit. If compliance efforts are reduced, organizations can reinvest internal audit resources into broader risk management activities that create greater organizational value. This includes focusing on emerging risks such as cybersecurity, artificial intelligence governance, third-party risk, data governance, and enterprise risk management. Technology can further enhance this by making compliance activities more efficient, freeing up capacity. Furthermore, companies must not overlook disclosure controls and procedures (DCPs), which are crucial for ensuring accurate and complete disclosures beyond traditional financial controls. Weakening DCPs could lead to significant regulatory scrutiny and reputational damage.

The Enduring Importance of Strong 404(a) Programs

While the absence of auditor attestation under 404(b) might seem like a cost-reduction opportunity, it does not diminish the importance of effective internal controls or management's responsibilities under 404(a). Companies experiencing control failures may still face financial statement restatements, SEC scrutiny, increased audit costs, and reputational damage. Historically, companies reporting solely under 404(a) have disclosed material weaknesses at significantly higher rates than those subject to 404(b) attestation. The SEC's oversight responsibilities remain, and management is still accountable for assessing and reporting on ICFR effectiveness. Therefore, the focus should be on maintaining a strong governance program that allows for confident operations and meets stakeholder expectations, rather than merely seeking the minimum required compliance.