The Center for Audit Quality has advice for smaller public companies that will soon have to implement Section 404(a) of the Sarbanes-Oxley Act.
The Securities and Exchange Commission has been delaying the SOX 404 requirements for smaller public companies, also known as non-accelerated filers. Under SEC Release No. 33-8760, non-accelerated filers are required to furnish the SEC with management's report on internal control over financial reporting when they file an annual report for the first fiscal year ending on or after Dec. 15, 2007.
However, the auditor's attestation report on the effectiveness of the internal controls mandated by Section 404(b) is not required until the non-accelerated filer files an annual report for fiscal years ending on or after Dec. 15, 2008. The attestation requirement will probably be delayed at least another year after that. SEC Chairman Christopher Cox recently testified that he was in favor of the delay.
The CAQ
The auditor can write, "The company is not required to have, nor were we engaged to perform, an audit of its internal control over financial reporting. Our audit included consideration of internal control over financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the company's internal control over financial reporting. Accordingly, we express no such opinion."
The alert also identifies items that auditors should consider when management furnishes a report on its assessment of internal controls and the auditor's attestation report is not required. Auditors should concentrate on determining whether management has misrepresented any facts, but there is no need to retest management's testing.
