Is SOX Gonna Hang You out to Dry?

The US Securities and Exchange Commission announced Friday that starting in nine months, it will require the smallest public companies to provide the auditor assessments of internal controls over financial reporting that are required by the Sarbanes-Oxley Act of 2002.

Under Section 404 of Sarbox, public companies and their independent auditors are each required to report to the public on the effectiveness of the companies' internal controls. Companies with a public float below $75 million have been given extra time to design, implement, and document their controls before their auditors must attest to the controls' effectiveness.

That extension will cease starting with the 10-K reports of companies with fiscal years ending on or after June 15, 2010. Formerly, that deadline was for fiscal years ending on or after December 15, 2009. The extension was granted so that the SEC's Office of Economic Analysis could complete a study of whether additional guidance provided to company managers and auditors in 2007 was effective in reducing the costs of compliance.

Because the study was published in September, less than three months before the December 15 deadline, the SEC decided that adding more time was "appropriate and reasonable so that small public companies and their auditors can better plan for the required auditor attestation," according to the SEC.

While the largest U.S. publicly traded companies are in their fifth year of complying with Section 404, smaller companies have yet to fully comply. It was only last year that nonaccelerated filers — defined by the SEC as those with a market capitalization of below $75 million — began filing management's assessments of internal controls with their 10-Ks. Now, such companies that have fiscal years ending June 15 of next year will have to get their auditors' signoff on their internal controls, also known as 404(b) reports, for the first time.

"Since there will be no further Commission extensions, it is important for all public companies and their auditors to act with deliberate speed to move toward full Section 404 compliance," SEC chairman Mary Schapiro said in a release.

The controversial Sarbox provision has long drawn the ire of companies — particularly small public issuers — because of its allegedly high cost of compliance. The act, passed following the wave of corporate accounting scandals that included Enron and WorldCom, requires the SEC to mandate that corporate internal-controls reports state management's responsibility for setting up and maintaining an adequate internal-controls structure and procedures for financial reporting. It also must contain an assessment of the effectiveness of the company's controls structure and procedures for financial reporting, as of the end of the company's most-recent fiscal year.

The part of Section 404 related to the SEC's current action requires a company's auditors to attest to and report on the internal-controls assessments made by the management of the companies the accountants audit.

While the reporting and auditor attestation grew out of the 2002 law passed by Congress, all U.S. public companies have been required to maintain internal-accounting controls since 1977.

Shared via AddThis