THE SARBANES-OXLEY ACT OF 2002:
WHAT IMPACT HAS IT HAD ON SMALL BUSINESS FIRMS?
Stuart Michelson
StetsonUniversity
421 N. Woodland Blvd, Unit 8398
Deland, Florida32723
386-822-7376
Fax: 386-822-7446
Jud Stryker
StetsonUniversity
421 N. Woodland Blvd, Unit 8398
Deland, Florida32723
386-822-7418
Betty Thorne
StetsonUniversity
421 N. Woodland Blvd, Unit 8398
Deland, Florida32723
386-822-7445
THE SARBANES-OXLEY ACT OF 2002:
WHAT IMPACT HAS IT HAD ON SMALL BUSINESS FIRMS?
Abstract
Purpose
Thepurpose of this paper is to explore the impact of the Sarbanes-Oxley Act of 2002 (SOX) on small corporations when compared to large firms and to investigate differences perceived by small and large firmswith respect to costsand internal controls.
Design/methodology/approach
A questionnaire containing 20 questions (five demographic and fifteen addressing issues related to SOX implementation) was mailed to 5,479 board members, CEOs, and CFOs of 676 separate firms with 117 completed surveys returned.
Findings
The results of the study show significant differences in the responses between small and large firms concerning 1) the over-all impact of SOX on the firm; 2) the amount of time dedicated to SOX; 3) the role of the external auditor; the firm’s implementation stage; 4) the most significant challenges due to SOX implementation; 5) the corporate governance reforms instituted; and 6) changes in board compensation.
Research limitations/implications
The basic limitation of this study is the low response rate (slightly more than 2%) which is not surprising since CEOs, CFOs, and Board of Directors have a low tendency to respond to surveys.
Originality/Value
The findings of this paper suggest that 1) recent actions taken by the Securities and Exchange Commission (SEC) are appropriate in providing much needed relief for smaller public firms; and 2) lend support for further actions of assistance by the SEC. This paper is of value to academicians, practioners, and to an international audience engaged in the harmonization of accounting standards.
Keywords: Sarbanes-Oxley, SOX, CFO, Board of Directors, Small Firm, Survey
Paper type Research paper
THE SARBANES-OXLEY ACT OF 2002:
WHAT IMPACT HAS IT HAD ON SMALL BUSINESS FIRMS?
Introduction
Regulatory Agencies and Congress are recognizing both the values and emerging issues for small firmsas the Sarbanes-Oxley Act of 2002is implemented.On April 23, 2006 the Advisory Committee on Smaller Public Companies issued a Final Reportto the Security and Exchange Commission assessing the impact of Sarbanes-Oxley Act of 2002 on smaller public companies (Securities and Exchange Commission, 2006).
In 2007 the SEC issued non-binding guidelines to aid small firms as they address Sarbanes–Oxley implementation(Securities and Exchange Commission, 2007). The most significant concern to smaller firms appears to be the burdensome cost of implementing Section 404 on internal controls. The Financial Executives Institute (FEI) reports that the highest cost for each dollar of revenue is that borne by firms with revenue of $100 million or less (3.57%) (Financial Executives Institute, 2007).
In February 2008 the SEC adopted amendments to its disclosure and reporting requirements when it issued Smaller Reporting Company Regulatory Relief and Simplification to assist these smaller firms (Federal Register, 2008). The regulation attempts to more clearly define smaller public companies and relax disclosure requirements.
In our research we explore the impact of Sarbanes-Oxley Act of 2002 on these smaller firms when compared to larger firms. We investigate the differences perceived in the small firm costs, corporate culture, and internal controls. Before addressing these concerns we first provide some background information to place the study in perspective.
Background
Sarbanes-Oxley has focused primarily on reestablishing investor confidence in the financial markets. The impact on smaller firms has been addressed in few publications. Recent writings have highlighted steps to aid smaller firms as they struggled with the implementation of Sarbanes-Oxley. In March 2005 the SEC chartered the Advisory Committee on Smaller Public Companies to “assess the current regulatory system for smaller companies under the securities laws of the United States, and make recommendations for changes (Securities and Exchange Commission, 2006).”In April 2006 this Advisory Committee’sFinal Report to the SEC assessed the impact of Sarbanes-Oxley Act of 2002 on smaller public companies and included33 recommendations to the SEC. Primary recommendations included (1) development of a new system of scaled regulations based on the size of the public company, (2) exemptive relief from Section 404 for micro-cap and small-cap companies; and (3) scaled disclosure to these small businesses (Securities and Exchange Commission, 2006).
In this Final Report, the Advisory Committee on Smaller Public Companies expressed their concern about the costs of SOX implementation: “The Advisory Committee members generally agree that the costs of SOX are the real issue. The Final Report confirms what we knew coming into this Committee process, that the costs have exceeded all estimates, and they hit small companies much more appreciably (Securities and Exchange Commission, 2006).” In this report The Advisory Committee recognized the significant cost and profitability ramifications for smaller public companies: “Because the costs of Section 404 implementation were underestimated so dramatically (millions of dollars per year, versus $91,000), the pain and loss of value has been significantly greater for a small company (Securities and Exchange Commission, 2006).”
In November 2006, Christopher Cox, Chairman of the SEC, said that new auditing standards are on the way. The goal will be to focus auditor attention on the areas of greatest risk for the company. Every company will still be subject to an audit but the new standard will translate to lower audit fees. He also said that the SEC will likely support the size categories proposed by the Public Accounting Oversight Board (PCAOB). Companies with market capitalization of under $75 million will be required to evaluate their own internal controls but not to have the results audited. According to the Florida Institute of Certified Public Accountants (FICPA), annual audits would be introduced in the third year but those audits will probably focus on the suitability of the design of the internal control though auditors might have to go beyond those controls in the course of conducting the financial audit (FICPA, 2006a). In response, the PCAOB issued an exposure draft entitled An Audit of Internal Control That is Integrated with An Audit of Financial Statements: Guide for Auditors of Smaller Public Companies (Journal of Accountancy, 2007).
In an SECpress release dated November 15, 2007 it is reported that the SEC voted unanimously to adopt “measures to modernize and improve its capital-raising, reporting and disclosure requirements for smaller companies. These measures address some of the key recommendations made by the SEC's Advisory Committee on Smaller Public Companies in its Final Report (Securities and Exchange Commission, 2007).” In that same press release the SEC Chairman, Christopher Cox emphasized the significance of smaller firms:
Smaller businesses are a critical part of our nation's economy…. Although it may seem that largemultinational companies are creating most of the new jobs and innovation, in fact, small business is leading the way in America's economy. Today's rule amendments will enable smaller companies toraise capital more effectively and ease some of the burdens of our reporting and disclosure requirements, and they will ensure that investors in these companies are paying for important investor protections and not red tape.
Other research has addressed the harsh realities of implementation costs for both larger and smaller firms.Marden and Edwardssurveyed readers of the journal,Chief Executive. The primary unknown factor is whether Sarbanes-Oxley's benefits will ultimately outweigh the significant compliance costs. The Johnson Group, a Chicago consulting firm, estimates Sarbanes-Oxley will add $3 million to $8 million in annual compliance costs for Fortune 500 companies(Marden and Edwards, 2005). Another study, by the law firm Foley & Lardner, indicates that medium-size public companies are paying an average of 90% more, or nearly $2.5 million a year, in compliance costs, compared with $1.3 million before Sarbanes-Oxley took effect (Marden and Edwards, 2005). According to the FEIjust complying with Section 404 of the Act will cost an average of 62% more than previously anticipated (Financial Executives International, 2007). This increase includes a 109% rise in internal costs, a 42% jump in external costs, and a 40% increase in the fees charged by external auditors (Marden and Edwards, 2005). The difficulty with trying to determine the costs versus the benefits is that no one will really know for some time if the new law actually prevents fraud.
The high cost of implementation is a primary factor in small firms delaying full compliance with Sarbanes Oxley. According to a study performed by the Kauffman-RANDCenter for the Study of Small Business, small companies were disproportionately affected by the Sarbanes-Oxley Act. The report found that small companies were being purchased by larger companies at an increased rate of 53%. This appears to be a sign that Sarbanes-Oxley creates a burden on entrepreneurship, inefficiently forcing companies out of public capital markets (Insurance Journal, 2006).
Krishnan, Rama and Zhang studied compliance costs and their results indicate that within a sample of small firms, firm size strongly influences the cost associated with section 404 (Krishnan, Rama and Zhang, 2008).
According to a SOX research study by Lord &Benoit, the“average costs of complying with a section 404(a) management assessment for all non-accelerated filers included in the study were $53,724 (ranging from as low as $15,000 to as high as $162,000)….The range of audit fee increases was from as low as $7,500 to as high as $86,000 (Journal of Accountancy, 2008).”
Smaller companies may have received multiple extensions for full compliance with SOX but they don’t appear to be receiving favors when it comes to its costs. "The Cost of Being Public in the Era of Sarbanes-Oxley," an annual study from Foley & Lardner LLP, reported in 2007that “the average cost of compliance for companies with under $1 billion in annual revenue has increased more than $1.7million to approximately $2.8million, representing a 171% overall increase since the adoption of the Sarbanes-Oxley Act (Foley and Lardner, 2007).” This study also revealed that while internal costs have gone down, on average, external audit fees have increased 271 percent between fiscal years 2001 and 2006 for firms with under $1 billion in revenue. For public companies with annual revenue under $1 billion this report found that nearly half (47%) of out-of-pocket costs associated with corporate compliance is associated with audit fees (Foley and Lardner, 2007; Swartz, 2008).
According to a U.S. Survey by SAP America, Inc., almost half of all small companiessay that the Sarbanes Oxley Act has made it more difficult for them to conduct business. The study reveals that more than two thirds of all small businesses favored different sets of compliance standards for small and large companies, while others are outsourcing or cutting back in areas such as marketing ,research, and personnel to meet compliance demands (Swartz, 2006).
Though there seems to be strong evidence that small firms do in fact carry a proportionately heavier cost burden than larger firms, eventually, they too will be required to comply with SOX. Crawford, Klamm and Watson believe that eventually small firms will be required to meet the Sabanes Oxley Act of 2002. They say that small firms will not be able to dodge the triple threat much longer (Crawford, Klamm and Weidenmier, 2007).
Efforts have been made to accommodate troubled small firms. The SEC has permitted extensions and supporters have proposed modifications, or exemptions of some sections of the law for smaller firms. Because of the small firm challenges and the need to gather more information, the SEC approved a one year extension for small business from auditor attestation requirements in June of 2008 (Securities and Exchange Commission, 2008).
Board changes are most significant for firms that are targeted by Sarbanes-Oxley and for firms with large managerial ownership. In addition, director turnover and replacement increased significantly after the passage of Sarbanes-Oxley. Executive directors are less likely to be added to the board in the post-Sarbanes-Oxley period than in the pre-Sarbanes-Oxley period, while non-executive directors are more likely to receive nominations. Linck and Yang provides evidence that Section 404 resulted in increases in numbers of committees and committee meetings (Linck and Yang, 2005). There is also strong evidence that Sarbanes-Oxley has imposed disproportionate burdens on small firms. For example, small firms paid $5.91 to non-employee directors on every $1,000 in sales in the pre-Sarbanes-Oxley period, which increased to $9.76 on every $1,000 in sales in the post-Sarbanes-Oxley period. In contrast, large firms incurred 13 cents in director cash compensation per $1,000 in sales in the pre-Sarbanes-Oxley period, which increased only to 15 cents in the post-Sarbanes-Oxley period (Linck and Yang, 2005).
Each year KPMG’s Audit Committee Institute sponsors two meetings as part of a round table series to help directors enhance their knowledge and maintain their financial literacy. The Institute surveys opinions of the directors on important issues during these sessions. Two issues of importance addressed by the participants were (1) accountability reforms and their legal exposure; and (2) how management is responding to Section 404 of Sarbanes Oxley. When asked about their views of the impact of new corporate accountability reforms, over 90% of the 2,550 Fall 2003 attendees felt that the legal obligation/exposure of directors who served on audit committees had moderately or significantly increased (KPMG, 2003). During the Spring 2004 session, 2,900 round table participants stated they believe management’s current approach to Section 404 of Sarbanes-Oxley is having a positive impact on the overall culture and the “tone at the top.” Seventy-two percent of the respondents said that their management’s approach is having a “positive” or “very positive” impact on the corporate culture (KPMG, 2004).
Not everyone agrees with the value of Sarbanes-Oxley. Some believe the costs out-weigh the benefits while others may have no choice but to adapt. Dalton and Daltonreported that the number of public companies announcing their intentions to privatize has increased 30% in an attempt to avoid the Sarbanes-Oxley guidelines (Dalton and Dalton, 2005). However, federal agencies have started to impose Sarbanes-Oxley provisions on private companies who have contracts with governmental agencies. These private companies will be expected to adopt some aspects of SOX. A recent survey of 1,400 private company CFOs indicate that 58% plan to adopt these guidelines.Dalton and Dalton indicate that private firms may want to evolve toward Sarbanes-Oxley compliance before they have little or no choice in the matter (Dalton and Dalton, 2005).
The challenge of complying with Sarbanes-Oxley becomes apparent in a number of studies. D'Aquila presents a survey of public firms by the professional organization Financial Executives International (D'Aquila, 2004). He reports that audit fees are expected to rise by about 38 % during the first year of compliance with Section 404. The survey also found that total costs of first-year compliance with Section 404 could be greater than $4.6 million for each of the biggest US firms (companies with over $5 billion in revenues).
In 2004 the FEIconducted two surveys of itsmembers to obtain expected estimates of internal and external time in people hours to comply with Section 404/Management Report on Internal Controls(Financial Executives International, 2004). FEI determined that the expected internal costs averaged 12, 265 people hours (ranging from as little as 1,150 people hours to as much as 35,000 people hours depending on the revenue size of the firm).. From the FEI respondents it was determined that these companies expected to pay an average of $732,100 for software, vendor charges, and external consulting. Within approximately a six-month period of obtaining these results, the FEI survey its members again and found that external costs had increased by 41% over the previously expected costs(Financial Executives International, 2004).
Boury and Spruce present a survey of 224 public companies with average revenues of $2.5 billion (Boury and Spruce, 2005). They report that, on average, companies expect to pay an estimated $3.14 million in Section 404 compliance costs, with auditors receiving an average of $823,200 for attestations of internal controls. Another survey (Johnson, 2004) determined that Section 404 compliance costs would reach $5.1 million for the average US company. General Electric (Roberts, 2004)has stated publicly that it expected to pay $30 million to comply with Section 404 in (2004)and the chief executive officer of the New York Stock Exchange (Morris, 2004)has blamed Section 404 compliance for the reduction in new listings from European companies on the exchange.