There is scant evidence that 404(b) is scaring companies away from the public marketplace, but there is evidence that the sort of companies that just got an exception from 404(b) were the ones who needed it most.

The SEC issued a new rule that took effect on April 27th, 2020 that exempted even more companies from the auditor attestation requirement of SOX Section 404(b). The SEC accomplished this by adjusting the definitions of “accelerated” and “large accelerated” filers. We have previously discussed 404(b) when looking at Luckin Coffee, and we decried how the loosening of 404(b) by the JOBS Act allowed Luckin’s fraud to go undetected. But this new regulation merits a deeper discussion of 404(b) and its implications.

Sarbanes-Oxley (SOX) was legislation passed in the wake of the Enron and WorldCom scandals. Its purpose was to end corporate fraud empowering watchdogs and gatekeepers to restrain the impulse of management to manipulate financial reporting. One of the key measures was 404(b), which required every publicly traded company to have an independent auditor attest that the “internal controls” of the company were effective.

The “internal controls” are the first line of defense against fraud and human error. Management is supposed to install a system that aids employees in routinely recording the economic activity of the company in a way that is both accurate and comprehensible. The controls should also ensure that neither employees nor management misuses company assets or manipulates results.

Every Watchdog Report flags potential issues raised with regards to the internal controls raised by the independent auditor or management. We have discussed them before in our examinations of PayPal and HFFG. However, Watchdog Reports do not currently flag companies that are not required to comply with 404(b).

The 404(b) attestation requires the independent auditor to do some due diligence. The auditors must test the internal controls of the company throughout the year, instead of just reviewing financial statements at the end of the year. This is a time-intensive process and estimates by the SEC put the average cost at over $200,000 a year. This process improves internal controls and creates a powerful deterrent against fraud.

Whittling Away at 404(b)

There is no doubt that 404(b) is a significant regulatory burden. When the measures were first passed, Small Reporting Companies, (SRCs) with less than $75 million in public float were not required to implement 404(b) right away but were given an extension. The extension was made permanent by the Dodd Frank Act in 2010 so that SRCs would never be required to get a 404(b)auditor attestation.

In 2012, President Obama signed the bipartisan JOBS Act. This bill created a new classification, the Emerging Growth Company (EGC). A company can qualify as an EGC for up to five years after going public if it has less than 1 billion in revenue and less than 700 million in public float. A company that fits the criteria does not have to comply with certain regulations, including 404(b). According to Audit Analytics, 1,394, or around 20% of the 6,644 publicly registered companies qualify for EGC status.

The GAO put out a paper in 2013 using Audit Analytics’ data to conduct a review of 404(b) and found that the auditor attestation improved internal controls and decreased the chances of damaging restatements.

Now under President Trump, the SEC has changed the definitions of “accelerated” and “large accelerated” filers to reduce the number of companies that must comply with 404(b). This change is commensurate with a change in the definition of Smaller Reporting Companies that was made in 2018. The result of all these rule changes is a complex set of classifications, where the status of a company changes based on its revenue and public float. This table from an article published by Harvard Law is the best representation we have found of the current state of the classifications:

Companies that are classified as Accelerated filers or as Large Accelerated filers are required to comply with 404(b). The companies that are most affected by this new rule change are companies with relatively low revenue, who nevertheless carry up to $700 million in public float, because they no longer need to comply with 404(b). The SEC estimated that 966 companies would be affected by the rule change, with 161 of them having revenues under $100 million but public float between $250-700 million. The SEC Chair Jay Clayton (who recently announced his departure), specifically mentioned bio-tech and healthcare companies as intended beneficiaries of the rule.

The New Rule Defies Good Sense

These new carveouts are designed to encourage more private companies to enter the public market by reducing regulatory burdens that may deter some from entering. However, there is scant evidence that 404(b) is scaring companies away from the public marketplace, but there is evidence that the sort of companies that just got an exception from 404(b) were the ones who needed it most.

CFOs were asked to name the obstacles that were keeping them from going public; the CFOs provided all sorts of answers, however, concerns about regulatory compliance were at the bottom of the list. In contrast, a 2011 survey of CEOs of public companies that found 92% stated that compliance costs were a significant barrier to completing an IPO.

What explains this disparity? Compliance with 404(b) is both expensive and time-consuming, and since these companies were already public, the CEOs may just have been griping. This is a bit like asking a graduate if the loans they took out for their degree was worth it.

There is a strong narrative that burdensome regulations have contributed to a decline in IPOs, but there are other probable explanations. Nor is it reasonable to assume that the high watermark for public companies in 1996 represents a benchmark of a healthy marketplace that we should strive towards.

Francine Mckenna wrote a piece for MarketWatch in 2019 that highlighted data from Audit Analytics indicating that the 404(b) requirement for these soon-to-be-exempted companies provided a lot of value for investors. Companies with revenues under $100 million received 176 adverse opinions on their internal controls from their independent auditors from 2014-2019, that represented 70% of adverse opinions for all public companies.

The main beneficiary of this new rule is pharmaceutical companies that do not have much revenue but are attracting lots of public investment. The losers are investors who have now lost an important watchdog in these pharmaceutical start-ups. This will only enable companies to play fast and loose with investors money as they doll themselves up to spur an acquisition.

Final Note on the SEC

There was a split on this rule, with Commissioner Lee dissenting. She stated, “Eliminating the auditor attestation removes a critical gatekeeping function that we know works to improve the reliability of financial reporting for investors.”

This probably is not the last time the SEC will choose to reduce the scope of 404(b), since there appears to be broad bipartisan support for rolling back the protections it offers for investors. Commissioner Pierce is in favor of making 404(b) optional for all companies. If the SEC continues to strip away the burdens placed on corporations by Sarbanes Oxley, it will strip away the corresponding protections for investors as well. The SEC would do well to remember its job is to enforce the laws passed by Congress, including Sarbanes Oxley, not to minimize them by changing the definitions.

Contact us:

Retail Investors get free access to our Watchdog Reports. Institutional Investors and those interested in our Gray Swan Event Factor can subscribe, or call our subscription manager, at 239-240-9284.

If you have questions about this blog send John Cheffers, our Director of Research, an email at jcheffers@watchdogresearch.com. For press inquiries or general questions about Watchdog Research, Inc., please contact our President, Brian Lawe at blawe@watchdogresearch.com.