If your company has a market cap of less than 75 million, you may be able to breathe a temporary sigh of relief. The SEC proposed to defer for yet another year the provision¹ for non-accelerated filers that requires auditors to attest to management’s assessment of internal controls over financial reporting. While this gives the PCAOB (Public Company Accounting Oversight Board) and COSO (Committee of Sponsoring Organizations of the Treadway Commission) additional time to draft guidance to help non-accelerated filers comply with these rules, it may also create confusion with investors reading these financial statements and wondering where in the heck is the auditor’s attestation.

Why do we find ourselves in this position six years after enactment of this legislation? Earlier on, we learned that companies spent billions of dollars complying with the rules, due in part to the auditor’s "one-size-fits-all" approach to the audit. This changed several years later as everyone realized a risk-based approach was more feasible and cost-effective. On July 27, 2007, the PCAOB’s AS No. 5, replacing AS No. 2, was approved, providing standards for auditors to attest to and report on management’s assessment of internal controls over financial reporting using a risk-based approach and allowing auditors to scale the audit to a company’s size and complexity.

The SEC feels it needs time to study whether compliance with the new Section 404(b) rules is being implemented in a cost-effective manner for smaller companies. It wants this time to evaluate whether the new management guidance issued along with AS No. 5 is having the intended effect of facilitating cost-effective evaluations and audits.

The SEC also feels it is necessary to "smooth the cost spike" that non-accelerated filers would likely experience in their first year of compliance.

Jeff Mahoney, general counsel of the Council of Institutional Investors, responded to the Proposed Amendments of Temporary Rules (File Number: S7-06-03) in his letter to the SEC of March 10, 2008: "Consistent with the language and intent of Section 404 of SOX, we generally believe any company tapping the public markets to raise capital should be required to have appropriate internal controls in place that have been subject to a meaningful review and attestation by external independent auditors. That is particularly true for the generally riskier smaller public companies that would be the beneficiaries of the Proposal’s deferral… the Council generally believes that the full implementation of the internal control requirements of Section 404 by all public companies is essential to investor protection and is long overdue."

Comments to the proposal to amend the temporary rules published on December 21, 2006, in Release No. 33-8760 [71 FR 76580] were to have been submitted to the SEC no later than March 10, 2008. The temporary rules currently require non-accelerated filers to include an attestation report of their independent auditor on internal control over financial reporting for fiscal years ending on or after December 15, 2008. The proposal, if adopted, will defer this to annual reports filed for fiscal years ending on or after December 15, 2009.

Mary Balmer, CPA
Senior Design Manager

¹In compliance with the rule under Section 404(b) of the Sarbanes-Oxley Act of 2002