SEC Again Extends Sarbanes-Oxley 404(b) Deadline for Smaller Reporting Companies

The Securities and Exchange Commission (SEC) has decided to once again delay the deadline for non-accelerated filers to file an auditor attestation report on internal controls under Sarbanes-Oxley 404(b). Non-accelerated filers include smaller reporting companies, which generally are defined as companies with a public float of less than $75 million as of the last business day of their most recent second fiscal quarter.

Prior to the SEC's extension, a smaller reporting company would have been required to include the auditor's attestation report in its Form 10-K filed for fiscal years ending on or after December 15, 2009. Under the extension, a smaller reporting company is now required to include an auditor's attestation report beginning with its Form 10-K filed for fiscal years ending on or after June 15, 2010.

The extension gives calendar year-end smaller reporting companies an additional year to plan for and obtain the required auditor attestation report.

Section 404 Background

Section 404(a) requires management to assess the effectiveness of internal controls over financial reporting on an annual basis. Section 404(b) adds an independent audit of internal controls requirement. The emphasis on internal controls was considered important in the post-Enron\WorldCom world because weaknesses in internal controls create opportunities for intentional accounting manipulations and unintentional accounting estimation and reporting errors.

In June 2004, the Public Company Accounting Oversight Board adopted an auditing standard, AS 2, to guide the work of external auditors engaged in a Section 404 audit of effectiveness of internal controls. Many companies and commentators believed that AS 2 placed undue reliance on detailed analysis of risk and establishment of controls to address real and perceived risk. Frustrations with AS 2 were exacerbated because independence rules that prohibit external auditors from auditing their own work prevented companies from engaging their auditors to assist in developing and documenting a system of internal controls to comply with Section 404. By 2007, publicly available estimates of annual Section 404 compliance costs ranged from $800,000 to $5.4 million per company.

2007 Reforms

In June 2007, the SEC and the PCAOB adopted changes intended to address some of the shortcomings of AS 2 and reduce the burden of complying with Section 404. The SEC issued Management Guidance and an order approving PCAOB Auditing Standard No. 5, superseding AS 2. Together, these actions were meant to direct management and auditors towards a top-down, risk-based approach to satisfying the requirements of Section 404. This approach was intended to reduce the costs of Section 404 compliance by allowing management to focus on the controls that are needed to adequately address the risk of a material misstatement in the financials and by allowing auditors to exercise judgment and focus on matters they consider to be most important for internal control.

Evaluation of 2007 Reforms

In late September of this year, the PCAOB released a report on the first-year implementation of AS 5. While this report noted that improvements remain to be made, in general auditors were reported to have made progress in exercising judgment as to which areas to focus on, minimizing unnecessary procedures and testing and relying on the work of others.

In early October of this year, the SEC's Office of Economic Analysis issued a study of SOX 404 following the 2007 reforms. For companies with a public float of less than $75 million that complied with both Section 404(a) and (b) (even though they were not required to comply with Section 404[b]), the SEC survey results found that mean compliance costs decreased from just over $769,000 before the reforms to just over $690,000 after the reforms. Median compliance costs for the same companies decreased from just over $579,000 before the reforms to approximately $439,000 after the reforms.

The study noted that despite the reduced costs, respondents with all sizes of companies typically viewed the costs of SOX 404 compliance as outweighing the resulting benefits. The SEC also found that Section 404 compliance as a percentage of assets was five to seven times greater for companies with $50 to $150 million in public float than for companies with over $700 million in public float.

The SEC Says There Will Be No Further Section 404(b) Extensions

The SEC previously had delayed the application of auditors attestation requirement to smaller reporting companies so that it could complete its study on the 2007 reforms. Since that study now has been published, and the SEC apparently finds its results acceptable, the SEC has said that there will be no further extensions of the auditors attestation requirement to smaller reporting companies beyond the June 15, 2010 deadline.

However, citing "undue—and often unbearable—burdens (of Section 404[b]) on small businesses," Rep. Scott Garrett (R-N.J.) has introduced a bill entitled the "Small Business SOX Relief Act" that would permanently exempt smaller reporting companies from the requirements of Section 404(b). The bill has no co-sponsors and has been referred to committee. It remains to be seen whether the bill will advance in Congress.