Introduction The Sarbanes-Oxley Act of 2002 (SOX) was implemented to enhance corporate transparency and accountability, especially in the wake of financial scandals like Enron and WorldCom. A critical provision within SOX is Section 404, which requires companies to assess the effectiveness of their internal controls over financial reporting (ICFR). In particular, Section 404(b) mandates an external auditor’s attestation of the company's internal controls, adding an additional layer of scrutiny to ensure that financial reporting is accurate and reliable.

While the intent of Section 404(b) is laudable, it has presented significant challenges for non-accelerated filers (companies with a public float below $75 million). The compliance costs, combined with auditor fees, have become a considerable burden for smaller public companies, especially those impacted by economic downturns. This blog will discuss the evolution of Section 404(b), the implementation challenges, and the regulatory guidance that has been provided to ease the compliance burden on smaller entities.

The Auditor Attestation Requirement under Section 404(b)

Section 404(b) of SOX requires public companies to include in their annual reports filed with the SEC an auditor’s attestation report on the effectiveness of the company’s ICFR. This process goes beyond the audit of the financial statements themselves and necessitates that the auditor also reviews and attests to the internal control mechanisms that support financial reporting.

The goal of this requirement is to bolster investor confidence by ensuring that the company’s financial processes are secure, transparent, and free from material weaknesses. However, implementing and maintaining effective internal controls is resource-intensive, particularly for smaller companies with limited budgets.

Challenges for Non-Accelerated Filers

Cost Burden: For non-accelerated filers, the cost of complying with Section 404(b) is disproportionately high. These companies must not only pay for the audit of their financial statements but also the additional costs associated with the auditor’s review of their internal controls. The expense of implementing and maintaining the necessary internal control frameworks is significant, and many small companies struggle to afford the ongoing compliance.

Infrastructure Requirements: Smaller companies may not have the same infrastructure as larger corporations, making it difficult to avoid audit comments related to internal controls. For example, a common criticism for smaller companies is having only one officer responsible for financial reporting, which often leads to negative audit remarks, regardless of the internal systems in place to ensure accuracy.

Postponements and Guidance: Recognizing these challenges, the SEC has postponed the implementation of Section 404(b) for non-accelerated filers multiple times to allow smaller companies and their auditors to prepare adequately. In response to industry concerns, the PCAOB issued Auditing Standard No. 5, which provides guidance on how auditors can conduct an integrated audit of internal controls over financial reporting and the financial statements themselves. This standard is designed to be risk-based and scalable, taking into consideration the size and complexity of the company.

Furthermore, in January 2009, the PCAOB published staff guidance specifically for auditors of smaller companies. This guidance outlines how auditors can apply the principles of Auditing Standard No. 5 when working with less complex organizations, thereby reducing the cost and complexity of the audit.

Recent SEC Study on Cost-Effectiveness

In 2009, the SEC directed its staff to conduct a study to assess whether the current guidance for auditors and companies was achieving the goal of making internal control audits more cost-effective for smaller public companies. The results of this study were released in October 2009, and they confirmed that while improvements had been made, compliance with Section 404(b) remained a financial strain for many smaller firms.

No Further Postponements for Non-Accelerated Filers

As of the most recent guidance, the SEC has made it clear that no further postponements for non-accelerated filers will be granted. The expectation is that companies will now begin preparing to comply with Section 404(b) without additional delays. For smaller companies, this means establishing the necessary infrastructure and budgeting for the increased audit costs.

Conclusion

Although the PCAOB and SEC have made efforts to make compliance with Section 404(b) more cost-effective, non-accelerated filers continue to face significant challenges. As the final postponement ends, small public companies must now fully comply with the auditor attestation requirements, despite the financial burden and infrastructure demands.

Smaller companies can benefit from consulting experienced securities attorneys to navigate the compliance requirements of SOX. A legal advisor can assist in preparing the necessary internal controls, conducting audits, and implementing best practices for corporate governance and financial reporting.

For more information on complying with SOX or navigating Section 404(b) requirements, contact qualified securities attornies at Law Offices of Destiny Aigbe to guide your business through the complexities of public reporting and regulatory compliance.