SEC Announces Next Steps for SOX Implementation Includes Smaller Companies
The Securities and Exchange Commission (SEC) on Wednesday announced a series of actions intended to improve the implementation of the Section 404 internal control requirements of the Sarbanes-Oxley Act 2002. The statement contains a further postponement of Section 404 requirements for the smallest companies, however, ultimately all public companies, including the smallest company filers, will be required to comply with the internal control requirements.
“The steps we are announcing today are designed to further improve the reliability of financial statements and to better protect investors while making the Section 404 process more efficient and cost effective,” SEC Chairman Christopher Cox said in a prepared statement. “As we go forward, we will consider the special concerns of all companies that fall under our jurisdiction – large and small, foreign and domestic. By providing practical guidance to companies, by working with the Public Company Accounting Oversight Board on their forthcoming revised standard for auditors, and by examining how the PCAOB inspection process is succeeding in increasing the efficiency and cost-effectiveness of the audit process, we will take a giant step toward ‘getting it right’ when it comes to Section 404 compliance.”
The announcement comes after months of gathering comments on the operations and effects of Section 404. The actions the Commission expects to take include:
- Guidance for Companies The Commission has received many requests for additional guidance for management on how to complete its assessment of internal control over financial reporting, as required by Section 404(a) of the Sarbanes-Oxley Act. To prepare for the issuance of management guidance, the Commission intends to take the following steps:
- Concept Release and Opportunity for Public Comment The Commission expects to issue a Concept Release covering a variety of issues that might be the subject of Commission guidance for management. With the Concept Release, the Commission will solicit views on the management assessment process to ensure that the guidance the Commission ultimately proposes addresses the needs and concerns of all public companies. We will also seek input on the appropriate role of outside auditors in connection with the management assessment required by Section 404(a) of Sarbanes-Oxley, and on the manner in which outside auditors provide the attestation required by Section 404(b), to assist in our consideration of possible alternatives to the current approach.
- Consideration of Additional Guidance from COSO The Commission has long been supportive of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) as it works to provide guidance on COSO’s 1992 Internal Control – Integrated Framework to address the needs of smaller companies. The Commission anticipates that this forthcoming guidance will help organizations of all sizes to better understand and apply the control framework as it relates to internal control over financial reporting. As the SEC develops guidance for management on how to assess its internal controls over financial reporting, we will consider the extent to which the additional guidance that COSO provides is useful to smaller public companies in completing their Section 404(a) assessments.
- Issuance of Guidance Commentary submitted to the Commission has suggested that management assessments under Section 404 have not fully reflected the top-down, risk-based approach the Commission intended. Building from the information gathered in response to the Concept Release, and from the anticipated COSO guidance, the Commission currently anticipates that it will issue guidance to management to assist in its performance of a top-down, risk-based assessment of internal control over financial reporting. To ensure that this guidance is of help to non-accelerated filers and smaller public companies, the Commission intends that this future guidance will be scalable and responsive to their individual circumstances. The guidance will also be sensitive to the fact that many companies have already invested substantial resources to establish and document programs and procedures to perform their assessments over the last few years. The form of the guidance has yet to be determined.
- Extension of Compliance for Non-Accelerated Filers In order to permit non-accelerated filers and their auditors to have the benefit of the management guidance that the SEC intends to issue, and to have the opportunity to evaluate and implement the revisions that the PCAOB plans to make AS No. 2, the Commission expects to issue a short postponement of the effective date of the Commission’s rules implementing Section 404 for non-accelerated filers. It is anticipated that any such postponement would nonetheless require all filers to comply with the management assessment required by Section 404(a) of Sarbanes-Oxley for fiscal years beginning on or after December 16, 2006.
On Wednesday, the PCAOB also issued a similar statement including four initiatives the Board plans to undertake.
“During the past year, we have heard nearly unanimous agreement that effective controls of a public company’s system of financial reporting protect investors,” PCAOB Acting Chairman Bill Gradison said in a prepared announcement. “We have also heard, however, that some refinements to the existing requirements would reduce the costs associated with internal control reporting while maintaining the benefits to investors.”
The PCAOB initiatives include:
- Amend Auditing Standard (AS) No. 2 While preserving the principles of AS No. 2, the Board plans to consider amendments that would ensure that auditors’ primary focus during an integrated audit is on areas that pose higher risk of fraud or material error. The amendments proposed would reinforce the Board’s expectation that the integrated audit be conducted in the most efficient manner, while achieving the objective of the standard, by incorporating key concepts contained in the guidance issued by the PCAOB on May 16, 2005. The Board also plans to revisit and clarify the auditor’s role, if any, with respect to evaluation of the process that a company uses to reach its own conclusion about the effectiveness of company controls. Additional amendments by AS No. 2 being considered by the Board include:
- Clarifying the definitions of significant deficiency and material weakness in internal control;
- Reconsidering the “strong indicators of a material weakness” to allow for more judgment in determining whether a deficiency exists;
- Guiding auditors to increase their use of the work of others where appropriate;
- Clarifying materiality and scoping decisions;
- Emphasizing the integration of the audit of internal control with the audit of the financial statements; and
- Allowing for and promoting auditors’ use of experience gained in previous years’ audits to focus and make most efficient work in subsequent years.
- Reinforce Auditor Efficiency Through PCAOB Inspections. As the Board described in a statement issued May 1, 2006, the Board’s 2006 inspections of registered public accounting firms will focus on the firms’ efficiency in conducting internal control audits, as emphasized in the Board’s May 2005 Policy Statement. The Board welcomes the SEC’s announced intention to inspect its inspectors’ implementation of the Board’s May 2006 statement.
- Guidance and Education for Auditors of Small Companies. The Board plans to develop or facilitate development of implementation guidance for auditors of smaller public companies. In addition, the Board plans to explore various means of facilitating opportunities for auditors of smaller public companies to obtain effective training on auditing internal control over financial reporting.
- Continue PCAOB Forums on Auditing in the Small Business Environment As previously announced, the board will hold a total of eight forums during 2006 for the auditors, directors and financial officers of smaller public companies. In addition to providing general education about PCAOB issues, the Board will use these forums to monitor real-time reaction to the various internal control-related implementation changes that are announced throughout the year.
“The actions the Commission is announcing today represent key steps toward addressing issues raised by participants involved in the critical process of reporting to investors on the effectiveness of companies’ internal control of financial reporting,” John White, Director of the Commission’s Division of Corporation Finance. “We will be working on our own, and with the PCAOB, to improve the implementation of Section 404 so that it will work efficiently and effectively for companies and auditors of all sizes and types while still maintaining the important investor protections it provides.”
In other news, MSNBC reports that several lawmakers on Wednesday formally proposed legislation that would exempt companies with a market value of less than $700 million from complying with the requirement.