• SEC Defers SOX 404 Attestation Requirement for Smaller Companies
  • November 11, 2009 | Authors: Craig A. Adoor; James M. Ash; Robert P. Attai; Steven R. Barrett; David E. Gardels; Gary D. Gilson; John D. Mandelbaum
  • Law Firms: Husch Blackwell LLP - St. Louis Office; Husch Blackwell LLP - Kansas City Office; Husch Blackwell LLP - Denver Office ; Husch Blackwell LLP - Chattanooga Office; Husch Blackwell LLP - Omaha Office; Husch Blackwell LLP - Kansas City Office; Husch Blackwell LLP - Chicago Office; Husch Blackwell LLP - St. Louis Office
  • Overview
    Section 404 of The Sarbanes-Oxley Act of 2002 (SOX) requires public companies and their independent auditors to report upon and verify the effectiveness of the companies' internal control over financial reporting in their annual reports filed with the Securities and Exchange Commission (SEC). Large public companies with a public equity float of $75 million or more have been required to satisfy both the management assessment and auditor attestation requirements concerning internal controls since 2004. Reporting companies with a public equity float of less than $75 million, which generally includes "non-accelerated filers" and "smaller reporting companies" as defined by the SEC, have been required to include management's assessment of internal controls in their annual reports for all fiscal years ended on or after December 15, 2007. Prior to the latest extension, these companies were to begin providing their independent auditors' attestation report on internal controls in their first annual report for fiscal years ending on or after December 15, 2009.

    In 2007, the SEC issued additional guidance aimed at reducing the cost for smaller companies to comply with Section 404 and commenced a study to track its effectiveness. At that time, the SEC delayed the auditor attestation compliance requirement for smaller companies until their first annual report for fiscal years ending on or after December 15, 2009, pending release of the findings. In an October 2, 2009, press release announcing the publication of that study, the SEC indicated that, because the study was completed less than three months before the December 15 phase-in date, it was extending that date by an additional six months. Accordingly, small public companies now have until the filing of their first annual report for a fiscal year ending on or after June 15, 2010, to provide the first auditor attestation report on the effectiveness of their internal controls. For most of these companies, including all calendar year-end filers, this extension effectively provides an additional year to prepare for compliance.

    The SEC extended the deadline after determining that, "additional time is appropriate and reasonable so that small public companies and their auditors can better plan for the required auditor attestation." The following passage from the Conclusion to the SEC's study also hinted at a possible future rule-making:

    [T]he survey response data shows that the cost of Section 404 compliance decreased following the [SEC's] reforms introduced in 2007 and is expected to decrease further based on respondents' estimates for the fiscal year in progress at the time of the survey. Moreover, the survey participants perceive the reforms to have been a significant catalyst for these changes. This evidence may prove useful in understanding the effects of the 2007 reforms as well as guiding any subsequent regulatory efforts.

    However, both SEC Chairman Mary Schapiro and Commissioner Luis Aguilar issued separate statements indicating that no further compliance extensions will be granted.

    What This Means to You
    This latest extension should, at a minimum, provide some savings on fiscal 2009 audit fees for many smaller companies. If your company has been concerned about its ability to meet the auditor attestation deadline and the related costs, you now have additional time to review the SEC's findings with your auditors and investigate whether the SEC's 2007 guidance, and the related changes implemented in Public Company Accounting Oversight Board (PCAOB) Auditing Standard No. 5, could help improve your process to further reduce compliance costs. The full text of the SEC's report is available here.