The Dodd-Frank Wall Street Reform and Consumer Protection Act was signed into law on July 21, 2010. Included in the act was a permanent exemption for small business issuers from section 404(b) of the Sarbanes-Oxley Act of 2002, known as the internal control audit requirement. (A small business issuer is defined by the SEC as having a public float less than $75 million.) Although the exemption to section 404(b) was granted, companies and their managers must still comply with Section 404(a), known as the management attestation requirement. What does this mean to small business issuers, their management team, and shareholders?
Section 404(a) Language Section 404(a) of the Sarbanes-Oxley Act of 2002 states: “The Commission shall prescribe rules requiring each annual report required by section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)) to contain an internal control report, which shall—(1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting."
What Section 404(a) Means to Small Business Issuers and Their Executives Many executives of small business issuers believe that compliance with Section 404(a) is too expensive, cumbersome, unattainable, or unnecessary. As a result, they may confess publicly in their annual Form 10K that “…the Company has no system of internal controls…”. However, what they fail to think about are two things: 1)the ultimate consequences of “culpability” due to the lack of a system of internal controls, and 2) the value-added benefit of a system of internal controls to investors and shareholders.
Culpability When company executives publicly state that they have no system of internal controls, that the internal controls are ineffective, or that the cost of compliance is too excessive and burdensome, they are effectively admitting that “the buck stops here”. They have effectively rendered the protections of the “corporate veil” useless in a court of law. If company executives can attest that they have a system of internal controls in place and that they abide by a code of ethics, they can effectively state in a court of law that they relied on that system of internal controls and codes of ethics, and that the system failed them right along with the shareholders. Without a system of internal controls, the executives are exposed to personal liability if and when an action is taken against them by the SEC, IRS, or company shareholders. A system of internal controls adds a safety barrier and layer of protection over the company executives by forcing any plaintiff to prove fraud because the system of internal controls was overridden by them with intent to commit a fraudulent action. This is a task that is far more difficult to prove than culpability due to gross negligence because a system of internal controls was not established in the first place. Company executives also establish a proper “tone at the top”, which lets the public know that they are serious about proper management and oversight of their fiduciary responsibility to company shareholders. This “statement of intent” will serve the executives well and make any regulator or plaintiff attorney think twice about a regulatory action or lawsuit.
Value-Added Benefits Many executives of small business issuers discount the value of a system of internal controls by saying that it adds layers of useless paperwork and processes with no consequential value added to the company. What they don’t think about is that a system of internal controls can add value to investors, reverse merger candidates, and investment bankers. Investor Benefit: If an investor were given the opportunity to analyze two small business issuers both with cash, equity, and expenditures, the decision to invest money would be very difficult. However, if one of the companies has a system of internal controls, the investor would typically prefer to invest her hard-earned dollars with that company because the perception is that the executives will adhere to a strong code of ethics. This gives the investor a sense of security that would not otherwise be provided from a company without the system of internal controls. Reverse Merger Candidates: A reverse merger candidate typically conducts due diligence procedures to evaluate the small business issuer, or shell company, that it wishes to merge into. Merger candidate executives will prefer a shell company with a system of internal controls over a company without internal controls since they can have confidence that the merger candidate does not have any hidden liabilities or hidden equity transactions. The added value to the small business issuer is a higher valuation resulting in an increase in cash paid by the merger candidate to the small business issuer shareholder base. Investment Bankers: Investment banking firms are looking for companies to invest in who will manage their investments. A system of internal controls will give the investment bankers confidence that their investments are being adequately managed. The system of internal controls will give the investment bankers confidence in the board of directors and executives that a company without internal controls cannot provide. The board of directors and executive team are essentially saying, “We adhere to a strong code of ethics and we are accountable to our investors.”