The Securities and Exchange Commission (SEC) recently deferred smaller reporting company compliance with the attestation requirements of
Section 404(b) of the Sarbanes-Oxley Act of 2002 (SOX) for the fourth, and last, time.
According to two SEC announcements issued on October 2, beginning with fiscal years ending on or after June 15, 2010, a public company with less than $75 million in public float will be required to provide an attestation report of an independent auditor about the effectiveness of such company’s internal control over financial reporting. This is the fifth year that auditor attestations have been required for larger public company peers.
Under SOX Section 404, public companies are required to include an “internal control report” of management in their annual reports addressing management’s responsibility for maintaining internal controls over financial reporting, and the company’s independent auditor must report on management’s assessment of the effectiveness of those controls. The attestation requirement provides in part that: “[w]ith respect to the internal control assessment required [in management’s report], each [auditing firm] that prepares or issues the audit report for the issuer shall attest to, and report on, the assessment made by the management of the issuer.”
It is this auditor attestation requirement, and its attendant cost, that elicited much of the public debate and pushback over applying Section 404 of SOX to small public companies. This response was based on a belief that such compliance imposes a disproportionably high cost to small public companies in comparison to large public companies. That debate culminated in a study by the SEC’s Office of Economic Analysis, the results of which were published last month. The SEC’s October 2 announcements, on the heels of publishing the report, implies that the SEC’s past interpretive guidance to company management, the Public Company Accounting Oversight Board’s issuance of Auditing Standard No. 5 to auditors, and other guidance and experience in the marketplace has been effective in controlling small company compliance costs to an extent sufficient to mitigate any disproportionate impact the auditor attestation requirement may have on smaller reporting companies.
To counter possible skepticism that the current SEC extension is actually its last, the SEC’s October 2 announcements included statements by Chairwoman Schapiro and Commissioner Aguilar expressly “assuring investors that there will be no further extensions of the compliance deadline” for small public companies. “[T]he Commission is for the first time resolving that uncertainty by making it clear that all public companies, regardless of size, will be required to comply with Section 404(b) of the Sarbanes-Oxley Act.” The current extension provides small public companies and their auditors an opportunity to “act with deliberate speed to move toward full Section 404 compliance."
The current requirement that company management issue an internal control report remains unaffected by the latest announcements. It also bears noting that, although the current internal control over financial reporting and auditor attestation requirements are a product of SOX, public companies have been required by federal securities law to maintain internal accounting controls since 1977.
This final extension of SOX Section 404(b)’s application to smaller reporting companies was intended to provide time for such companies to further design, implement and document their internal control structure before their auditors become required to attest to their effectiveness.
For More Information
For more information, please contact William E. Quick at (816) 360-4335 or wquick@polsinelli.com.
|
