The Securities and Exchange Commission on Wednesday threw its weight behind finalising fresh guidelines aimed at clarifying how companies and auditors should comply with the Sarbanes-Oxley law.
The move signals that work by the US authorities to ease the burden of compliance with the 2002 law is moving into its final stage three months after proposed revisions were first floated.
At issue is how the SEC’s new guidelines for company management on implementing the law’s Section 404 internal controls provisions can be more closely aligned with separate guidance for auditors issued by the Public Company Accounting Oversight Board (PCAOB).
There is also disagreement over the extent to which external auditors should rely on a company’s own reviews of its controls.
This is testing US regulators’ willingness to adopt a more flexible, “principles-based” approach to corporate controls than those prescribed under Sarbox.
Some critics argue that giving companies and auditors more latitude in judging potential accounting risks undermines the rationale for the legislation, passed in the wake of the Enron and WorldCom scandals.
Roel Campos, an SEC commissioner, said: “We should never take for granted that this dichotomy is totally understood.”
The SEC and PCAOB have been wrangling over how to reconcile remaining differences between the SEC’s “management guidance” and the PCAOB’s proposed new auditing standard, known as AS5.
Critics have pointed out that the PCAOB’s guidance for how auditor’s should carry out their inspections of company’s internal control systems are still too prescriptive – relying heavily on words such as “should” and “must”. They are also seen as insufficiently flexible to take account of the differing needs and resources of smaller companies.
This week, Illinois Republican congressman Mark Kirk and Steve Israel of New York proposed legislation that would create new standards to allow small businesses to comply with Sarbox.
The SEC said it expected the final version of AS5 to be submitted for SEC review by the end of May or early June. Christopher Cox, SEC chairman, said: “I think we are getting very close to getting this long process completed in time for the 2006/2007 audits.”
The SEC directed staff to focus on four remaining areas with the PCAOB: aligning AS5 with the SEC’s proposed new management guidance; “scaling” the Section 404 audit to account for the “particular facts and circumstances of companies, particularly smaller companies”; encouraging auditors to use “professional judgment” in the 404 process; and following a “principles-based approach” to determining when and to what extent the auditor can use the work of others.