SEC report card 2007; The commission tackled proxy access, Sarbanes-Oxley refinements, terrorism ties, securities markets globalization, and other business and financial-reporting developments. How did it measure up?

Directors & Boards, Summer, 2008 by Ralph Ferrara, Riva Khoshaba Parker, Joseph J. Migas

Parallel to the PCAOB's development of AS5, the SEC also issued guidance and rule amendments related to management's evaluation of internal control over financial reporting. The interpretive guidance is organized around two broad principles.

First, that management must evaluate its controls to determine whether there is a risk that a material misstatement of the financial statements would not be prevented or detected in a timely manner. The underlying objective of the interpretive guidance is to address this requirement in an efficient and cost-effective manner.

Towards that end, the second principle is that management's evaluation of evidence about the operation of its controls should be driven by an assessment of risk. Risk-based judgments must be made in order to align the nature and extent of management's evaluation procedures with the areas of financial reporting that present the greatest risk of material misstatement.

Because it recognized the need for clarification, and because it continues its efforts to ease the burden on companies large and small, the SEC earns an "A-".

10. Sarbanes-Oxley reforms II: No more clarity on significant deficiency

CUNDER SECTION 302 of Sarbanes-Oxley, management is required to certify that it has informed its audit committee and external auditors of all "significant deficiencies" in internal controls. On August 3, 2007, the SEC approved a new definition of "significant deficiency." Effective September 2007, a "significant deficiency" is "A deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant's financial reporting." This new definition is equivalent to the definition of "significant deficiency" contained is AS5, approved by the commission on the same day. Notably--and deliberately--the new definition does not contain a probability nexus, meaning that it does not distinguish between "significant deficiencies" that are reasonably likely to occur, likely to occur, or highly unlikely to occur. Without this probability nexus, the new definition doesn't achieve the clarity that the SEC was striving for. A "C" effort at best.

Steering forward ... and clear of overregulation

The SEC has had another busy year with mixed--and better--results. Like 2006, much of 2007 was spent wrestling with the behemoth that is Sarbanes-Oxley, a law passed in haste in response to an economic crisis that many felt was the result of regulators sleeping at the wheel. As the subprime mortgage crises continues to leech into the rest of the economy, there are new calls for increased oversight and heightened regulation--calls that are reminiscent of those that gave us Sarbanes-Oxley, a legacy which, fully six years after its implementation, we still have not quite come to terms with. Although we recognize that the SEC has limited influence over the laws that Congress passes, it should be careful to avoid the bandwagon cries for greater regulation and enforcement, and do its best to stave off any hasty legislation (or rulemaking) that will prove as unwieldy a legacy as Sarbanes-Oxley.