The SEC's Pragmatic Promise - New Guideline Proposed for Section 404

On December 13th, the Securities and Exchange Commission voted to propose for public comment interpretive guidance for management regarding their evaluations of internal control over financial reporting. The Commission also proposed amendments to Rules 13a-15 and 15d-15 that would make it clear that a company choosing to perform an evaluation of internal control in accordance with the interpretive guidance would satisfy the annual evaluation required by those rules.  Although they have yet to release all of the details, the details released as part of the press release indicates that the SEC has taken the initiative to make some material changes yet have not made radical reforms.

Some of the highlights of the December 13th announcement include:

• The evaluation of internal controls will be principles based.  This new approach would be guided by two principles.  The first principle is that of management evaluating controls based on the reasonable possibility that a material misstatement in the financial statements would not be prevented or detected.  The second principle is that controls being evaluated based on the assessment of the risk associated with those control.
• The proposed guidance describes a risk-based approach.  The risk-based approach is targeted to reduce the current problem of excessive documentation and excessive testing
• The new guidance will be coordinated with changes by the PCAOB to Audit Standard 2 which are planned to be announced on December 19.

In addition to the above mentioned guidelines, the proposal addresses four specific areas including:

• Identification of risks to reliable financial reporting and the related controls that management has implemented to address those risks
• Evaluation of the operating effectiveness of controls
• Reporting the overall results of management's evaluation
• Flexibility in approaches to documentation

While is is difficult to understand the full implications of these Sarbanes-Oxley reform proposals without the full report being published and the yet-to-be published PCAOB AS2 revisions, it is encouraging to see the direction that the SEC has taken.   The key messages in the press release regarding flexibility, materiality, and top-down risk disciplines should provide organizations to take a pragmatic, cost effective, and yet meaningful approach to managing their internal controls.  As with the first go-around with Sarbanes-Oxley, the true change of organizational behavior will be significantly influenced on the requirements outlined in the forthcoming revised AS2.