The Securities and Exchange Commission's (SEC) Chairman Christopher Cox has announced that small to mid-sized enterprises (SMEs) will not be exempt from key provisions of the Sarbanes-Oxley Act. This surprise announcement has an impact on all publicly-traded SMEs, many of which will fail to meet the set deadline.

SEC Doesn't Mince Words

The SEC has stated that it will extend the postponement of final rules for the smallest of publicly-traded enterprises (also known as non-accelerated filers) by a few months. However, all public enterprises must comply with Section 404 by December 16, 2006.

• Section 404 requires enterprises to file reports by management and independent auditors on the effectiveness of the enterprise's internal controls over financial reporting. It is this section of SarbOx that most affects IT operations.
• Any publicly-traded enterprise with a market capitalization or public equity float of less than $75 million is considered a non-accelerated filer.

Predictions

Info-Tech sees that there are several scenarios that could now take place, potentially in combination.

1.Many SMEs will risk non-compliance over money issues. Based on industry analysis and client feedback, Info-Tech has noticed a distinct trend towards non-compliance. Over 60% of SMEs do not expect to be compliant by the December deadline for Section 404 of the Sarbanes-Oxley Act. There are two reasons why:

• Some CxOs of smaller enterprises tend to have a stronger stomach for risk, and will weigh the cost/benefit of compliance.
• Others cannot afford SarbOx's high compliance costs, and will risk non-compliance simply because they have no other choice.

2.Delayed or cancelled IPOs will become the norm. SarbOx compliance for large enterprises costs about 0.1% of revenue. For SMEs that figure jumps to nearly 1% of revenue. The money used to pay for compliance is being drawn predominantly from venture capital that is originally intended for research and development. In many cases, going public will be as limiting to SME near-term growth as staying private. In other words, remaining private could prove more beneficial to long-term growth.

• The main reason for the disproportionately high compliance cost for SMEs is that external auditors take a one-size-fits-all approach to assessing internal controls. Enterprise size just doesn't factor in to audit grading, which was precisely the argument made to the SEC before its announcement.

3.Shareholders simply won't care. Currently-traded enterprises find that their shareholders aren't rattled by negative audit grades. Shareholder confidence is only shaken when something goes wrong. While a poor audit grade is undesirable, it is only a problem if reported results and related disclosures are false. Beyond that, stock performance is the only thing shareholders care about.

4.Mid-year elections will prevent Republican heavy-handedness. SMEs are the backbone of the North American industry. The majority Republican government won't risk votes from business by going after the livelihood of "salt of the earth" SMEs. Compliance costs and rumors of a slowing economy are two factors hampering growth for small enterprises. Stiff penalties for non-compliance would sink many others, further damaging an already fragile economy.

5.Enforcement on SMEs will be lax at best. The SEC currently does not have the manpower or resources to monitor tens of thousands of smaller enterprises. Besides which, the SEC has chosen to pursue large, high-profile enterprises of which to make examples. Public scandals with Fortune 1000 companies yield greater exposure and revenue for the SEC.

Bottom Line

The SEC's announcement puts an end to months of speculation. Risk-averse SMEs must now decide if SarbOx compliance - or the risk of non-compliance - is worth the cost.