The Securities and Exchange Commission has approved a one-year extension of the compliance date for smaller public companies to meet the Section 404(b) auditor attestation requirement of the Sarbanes-Oxley Act.
The SEC also received approval from the Office of Management and Budget to proceed with data collection for a study of the costs and benefits of Section 404 implementation, focusing on the consequences for smaller companies and the effects of the Section 404 auditor attestation requirements.
The study will help determine whether the new management guidance on evaluating the internal controls over financial reporting issued by the SEC in June 2007 and the Public Company Accounting Oversight Board's Auditing Standard No. 5 are having the intended effect of facilitating more cost-effective internal control evaluations and audits of smaller reporting companies. The results of the study are expected to become available during the extension period.
With the extension, smaller companies will now be required to provide the attestation reports in their annual reports for fiscal years ending on or after Dec. 15, 2009. SEC Chairman Christopher Cox first proposed the one-year delay for small businesses during December 2007 testimony before the House Small Business Committee, and the SEC formally proposed this extension on Feb. 1, 2008.
Section 404 has two provisions: 404(a) requires company management to assess the effectiveness of the company's internal controls over financial reporting, while 404(b) requires an auditor attestation on management's assessment. Larger companies, comprising more than 95 percent of the market capitalization of U.S equity securities markets, have been subject to both provisions since 2004.
The extension of the Section 404(b) compliance date for smaller companies is the latest in a series of SEC efforts to help reduce unnecessary compliance costs for smaller companies while preserving investor protections. In 2007, the SEC issued new guidance for management's Section 404 assessment to help companies focus their reviews on the internal control issues that matter most to investors.
Companies of all sizes, including smaller companies, are filing their first 404(a) reports this year with the benefit of the new guidance. Furthermore, the SEC and the PCAOB voted unanimously to replace the standard for the 404(b) auditor attestation, which is intended to make the process more efficient. This year, larger companies are filing their first 404(b) reports under the new audit standard.
One observer reacted negatively to the announcement. "Once again, the SEC has demonstrated a lack of resolve on the matter of compliance with the Sarbanes-Oxley Act of 2002," said Peter J. Iannone of Mayer Hoffman McCann. "Certainly, early implementation and compliance efforts were overly intensive and expensive for small companies. Since the inception of the act however, a great deal of effort has been expended, to develop a sane, risk-based approach for companies to follow. Compliance costs are better than they have been at any point previous to now."
