SEC Sets Deadline for Smaller Reporting Companies to Provide SOX Independent Auditor Assessment of Internal Control over Financial Reporting

On Friday, October 2, 2009, the Securities and Exchange Commission (“SEC”) announced a new and final deadline for smaller reporting companies to provide independent auditor assessment of their internal control over financial reporting in compliance with Section 404(b) of the Sarbanes-Oxley Act of 2002. The new deadline requires compliance by all public companies for fiscal years ending on or after June 15, 2010. As a result, smaller reporting companies with fiscal years ending on or after June 15, 2010 will be required to include this auditor attestation in their annual report for their 2010 fiscal year.

Section 404 of the Sarbanes-Oxley Act requires a public company and its independent auditors to report to the public on the effectiveness of the company’s internal controls. Section 404(a), with which all public companies already are required to comply, requires that an issuer’s annual report include a statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting, a report by management regarding the effectiveness of the issuer’s internal control over financial reporting, and a statement identifying the method used to evaluate the effectiveness of the issuer’s internal control over financial reporting.

Smaller reporting companies – issuers with a public float below $75 million – had been given extra time to design, implement and document these internal controls before their auditors were required to attest to their effectiveness under Section 404(b). Most recently, auditor attestation had been delayed until December 15, 2009 so that the SEC’s Office of Economic Analysis could complete a study of whether additional guidance provided to company managers and auditors in 2007 was effective in reducing the costs of compliance. However, that study was published in September 2009, less than three months before the December 15, 2009 deadline. As a result, the SEC determined that additional time was “appropriate and reasonable so that small public companies and their auditors can better plan for the required auditor attestation.” In announcing this latest extension, the SEC made clear that there will be no further extensions of the compliance deadline.

Notably, the Office of Economic Analysis study concluded that Section 404 compliance costs vary with company size, compliance history, and compliance regime. Although larger companies incur higher compliance costs, smaller companies incur higher scaled costs relative to their assets, on average. The study found that annual Section 404 compliance involves a fixed cost that is unrelated to the size of the reporting company; however, compliance costs tend to decrease steadily after the first-year of compliance, implying that Section 404 compliance entails start-up costs that dissipate over time.