Upfront: What's Next for Section 404 Enforcement?

The SEC and the PCAOB wasted no time in declaring their intentions for the next phase of Sarbanes-Oxley enforcement after conducting a May 10 roundtable seeking comment on their efforts in implementing Section 404 of the legislation after year two. The SEC already had a firm grasp of public sentiment on the topic after reviewing a mound of documents, including written comments for the roundtable, a report from the SEC's advisory committee on smaller public companies, and feedback submitted by interested groups such as auditors and investors. Many of the roundtable comments echoed the opinion of Michael J. Duffy, president and CEO of OpenPages Inc., a business governance software provider in Waltham, Mass. "Based on my experience, and from what I'm hearing from my customers, the intent of Sarbanes-Oxley is still well-conceived and has benefited companies and shareholders alike with greater controls and visibility into their business," he notes, adding that "recent FEI [Financial Executives International] and CRA [Computing Research Association] surveys show that the costs of SOX are going down."

So where does Sarbanes-Oxley enforcement go from here? On May 17, the SEC announced that it will take the following actions:

• Provide Management Assistance. Many organizations have asked for further management instructions that might help them to shape their process for assessing internal controls over financial reporting. In response, the commission intends to issue guidance that will help companies perform a top-down, risk-based assessment which will scale for smaller businesses.

Before presenting its recommendations, the SEC will issue a concept release that covers a variety of subjects that this guidance might contain, and it will solicit views on the management assessment process. The commission will also consider recommendations by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) for smaller public companies' compliance efforts.