A bipartisan group of senators has introduced a new bill, the Fostering Innovation Act of 2019 (S. 452), that would amend SOX to provide a temporary exemption from the auditor attestation requirements of Section 404(b) for low-revenue issuers, such as biotechs. The bill is designed to help those EGCs that will lose their exemptions from SOX 404(b) five years after their IPOs, but still do not report much revenue. For those companies, proponents contend, the auditor attestation requirement is time-consuming and expensive, diverting capital from other critical uses, such as R&D. According to the press release, the bill would provide “a very narrow fix that temporarily extends the Sarbanes-Oxley Section 404(b) exemption for an additional five years for a small subset of EGCs with annual average revenue of less than $50 million and less than $700 million in public float.” I know it’s Valentine’s Day, but does it also feel a bit like Groundhog Day? That’s because, in 2016, the House passed the Fostering Innovation Act of 2015—the very same bill. That bill went nowhere, but the question is: have we now reached an inflection point for SOX 404(b)?

You’ll recall that SOX 404(b) requires a public reporting company, other than a non-accelerated filer or emerging growth company, to obtain an auditor attestation regarding management’s assessment of the effectiveness of the company’s internal control over financial reporting. The new bill provides an exemption for each former EGC that ceased to be an EGC at the end of the five-year period after its IPO, had average annual gross revenues (defined as the total gross revenues of the company over its most recently completed three fiscal years divided by three) of less than $50 million as of the most recently completed fiscal year and is not a large accelerated filer (that is, a public reporting company that had a public float of $700 million or more, as of the last business day of its most recently completed second fiscal quarter). Under the bill, the company would lose the exemption on the earlier of the end of 10 years after its IPO, the last day of the fiscal year when its average annual gross revenues exceeded $50 million or the date when the company becomes a large accelerated filer.


In 2016, the SEC’s Investor Advocate viewed that earlier bill as “ill-advised” and urged a vote against it. In a letter to Paul Ryan and Nancy Pelosi, he contended that the auditor attestation requirement of SOX was one of the key reforms enacted following “on the heels of the Enron implosion and other accounting scandals that wreaked havoc on American investors…. This ‘second set of eyes’ helps to identify potential risks of material misstatements and is designed to prevent or detect fraud. Unfortunately, H.R. 4139 would chip away further at the requirement for a second set of eyes, even though auditor attestation enhances reliability of financial reporting for investors, which has been shown to reduce the cost of capital for businesses.” The letter cited empirical research that established the benefits for both investors and companies of the auditor attestation, including a 2011 SEC study showing that “companies that do not have an auditor attestation tend to have significantly more material weaknesses in their internal controls and more financial restatements.” In addition, citing academic testimony before a Congressional subcommittee, he contended that “there is a positive correlation between a material weakness in internal control and the future revelation of fraud. Indeed, companies with more serious control problems tend to be smaller, less mature, growing, or rapidly changing.” He also observed that the bill introduces another category of issuers, further compounding the complexity of public company reporting. (See this PubCo post.)

The President of BIO (the Biotech Innovation Organization) observed in the press release that “[m]ost biotechnology companies remain pre-revenue for a decade or more until they receive their first product approval, long past the original five-year exemption from SOX 404(b) granted by the JOBS Act, causing a damaging diversion of capital from science to compliance. By extending this commonsense exemption of the JOBS Act to qualifying companies, emerging biotechnology innovators will be able to devote more of their limited resources to potentially lifesaving research and development activities.”


Echoing the “science or compliance” mantra, a February 2019 white paper prepared by two economists and published by BIO, Science or Compliance: Will Section 404(b) Compliance Impede Innovation by Emerging Growth Companies in the Biotech Industry?, argues in favor of extending the exemption from 404(b) for biotech EGCs. Biotech EGCs, the authors contend, are substantially different from other EGCs in that, although they may have large market caps (most likely based on breakthrough potential), they are often in the early stages of product development and, therefore, frequently have no or extremely low revenues. This early stage requires significant investment in research and clinical trials, which, they report, continues on average for 10 to 15 years before FDA approval of a product. This period of investment in R&D is typically “longer than any other sector, including ‘tech’ start-ups.” However, in light of the absence of revenue, the authors contend, the “benefits from auditor attestation are small due to the relatively straightforward accounting issues that typify Bio-EGCs….Despite generating little to no revenue, the…SEC’s current reporting rules will categorize many of these companies as ‘accelerated’ filers… once they lose EGC status,” or even as “large accelerated” filers. The authors’ analysis showed that the financial characteristics of these biotech EGCs were really much closer to non-accelerated filers, which are exempt from 404(b), because of “the straightforward accounting issues a Bio-EGC must address when preparing its financial statements,” along with the significantly lower chance that these biotechs would have to restate financials or have non-effective ICFR designations, compared with other companies that comply with 404(b).

Moreover, the authors provide “survey evidence” that the annual cost of 404(b) compliance would be an estimated $807,893 per year (approximately $412,143 in auditor fees, $192,000 in external consultant fees and $203,750 in internal labor costs), or approximately $4 million over five years. Biotech EGCs also “overwhelmingly report that they would use incremental compliance savings from extending [the] Section 404(b) exemption to increase annual investments in R&D and hire additional employees. These findings are important because we show that Bio-EGC employment grows by approximately 200% during the five fiscal years after going public—more than double the growth rate of Non-Bio EGCs.” (Note, however, that SEC Chair Jay Clayton has pointed out that some funds would still need to be expended on ICFR even if 404(b) were not applicable: even companies that are not required to obtain a SOX 404(b) auditor attestation must still “establish, maintain and assess the effectiveness of ICFR, and, even if not engaged to report on ICFR, independent auditors are still responsible for considering ICFR in the performance of their financial statement only audits.” (See this PubCo post.)

Obviously, the earlier version of this bill did not make it into law; whether the 2019 version will fare better remains to be seen. One difference might be the recent heightened clamor for relief from SOX 404(b), spurred in part by the deeply held belief of some that the decline in IPOs is attributable to regulatory overload, with the current bête noire of deregulation advocates being SOX 404(b). For example, in a 2018 report about expanding the number of IPOs and public companies, eight organizations—the American Securities Association, BIO, Equity Dealers of America, Nasdaq, National Venture Capital Association, Securities Industry and Financial Markets Association, TechNet and the U.S. Chamber of Commerce—recommended extending the JOBS Act exemption from SOX 404(b) from five years to ten years for EGCs that have less than $50 million in revenue and less than $700 million in public float. The report contended that costs associated with SOX 404(b) “have not been scalable for small and midsize public companies” and that there is “no evidence” that the JOBS Act exemptions from SOX 404(b) “have compromised investor protection or market confidence.” (See this PubCo post) Similarly, at a meeting of the Subcommittee on Capital Markets, Securities, and Investment of the House Financial Services Committee in 2017, witnesses lamented the SOX 404(b) requirement as time-consuming and expensive for smaller companies, diverting capital from other more important uses such as R&D. (On the other hand, another witness characterized internal control as “the backbone of the financial statements,” and observed that some auditors view the attestation as more important than the audit itself.) (See this PubCo post.)

The issue has also been considered at a meeting of the SEC Committee on Small and Emerging Companies, where one biotech CEO provided as an example a small public biotech with fewer than 60 employees and a public float of $85 million, where the cost of the controls audit added 1% to the company’s burn rate. He maintained that SOX 404(b) just did not make sense in those circumstances. (See this PubCo post.) And the Commissioners themselves have been divided on the advisability of retaining the SOX 404(b) requirement for smaller companies. To further consider that issue, Clayton last year directed the staff to come up with potential amendments to reduce the number of companies subject to SOX 404(b), while, of course, maintaining appropriate investor protections. Potential beneficiaries of relief, according to Clayton, are companies with little or no revenue, such as many biotechs. In those cases, he asserted, the money that would otherwise be used for the SOX 404(b) attestation “could instead be used to hire new scientists to advance life-enhancing or life-saving developments.” (See this PubCo post and this PubCo post.)

With so many eyes now trained on SOX 404(b), will it be the same-old same-old, or have we reached an inflection point?