As widely anticipated, last week the Securities and Exchange Commission (“SEC”) announced two steps designed to moderate the burden of compliance with the internal control requirements adopted by the SEC in accordance with Section 404 of the Sarbanes-Oxley Act of 2002 (“SOX”).
These two steps are:
- To extend or alter compliance dates for various categories of issuers along the lines of the SEC’s August 2006 proposal; and
- To vote to propose, for public comment, interpretive guidance and related rule amendments regarding a management’s evaluation of internal control over financial reporting designed to make such evaluations more efficient and cost-effective by permitting management to focus on those areas that are both material and pose a risk to reliable financial reporting.
Both of these actions were taken by unanimous action of the SEC.
Revision of Compliance Dates for Smaller and Newly Public Companies
The first step has three substantive parts:
- A newly public company will not have to comply with the SEC’s internal control-related requirements under Section 404 until it files its second annual report as a public company. This compliance deadline will apply whether a company becomes public through an initial public offering of equity or debt or registration under Section 12 of the Securities Exchange Act without an initial public offering, or otherwise becomes subject to the periodic reporting requirements of the Securities Exchange Act. A company spun off from a Form S-3 issuer that claims Form S-3 status will not be eligible for this extended deadline. A foreign private issuer that had not previously been a reporting company and that lists its equity on a U.S. market for the first time will be able to avail itself of the extended deadline whether it is a large accelerated filer, an accelerated filer or a nonaccelerated filer.
- A non-accelerated filer (whether domestic or foreign) will have to furnish (but not “file”) its first management’s report on internal control over financial reporting in its annual report for its first fiscal year ending on or after December 15, 2007. (Previously, non-accelerated filers were scheduled to begin filing (not furnishing) these management reports in their annual reports for fiscal years ending on or after July 15, 2007.) Such a filer will be required to include in its next annual report (the annual report for its first fiscal year ending on or after December 15, 2008) both a filed management’s report on internal control over financial reporting and its auditor’s attestation report on internal control over financial report. A non-accelerated filer will be required to disclose explicitly that its first annual report does not include its auditor’s attestation.
- A foreign private issuer that is an accelerated filer (but not a large accelerated filer) will be treated in a manner similar to that of a non-accelerated filer, but only in respect to its annual report for a fiscal year ending on or after July 15, 2006 but before July 15, 2007.
These revised compliance dates potentially are subject to further relief, possibly only for non-accelerated filers, once the SEC has reviewed the new auditing standard to supersede Auditing Standard No. 2 (“AS No. 2”) that the Public Company Accounting Oversight Board (“PCAOB”) is expected to consider proposing for public comment tomorrow.
Interpretative Guidance Regarding Management’s Evaluation of Internal Control Over Financial Reporting
(The following summary is based on remarks made at the SEC open meeting on December 13 and SEC press releases in connection with that meeting. The full text of the SEC’s proposal should be posted on the SEC’s website shortly.)
Subject to publication of its proposed guidance and related amendments, the SEC has indicated that it intends to establish principles-based, top-down guidance organized around the principles that management should (i) focus its evaluation of its company’s internal control over financial reporting on those controls that are needed to prevent or detect a material misstatement in the financial statements and (ii) align the nature and extent of its evaluation procedures with the controls in those areas that pose the greatest risk to reliable financial reporting. The SEC has indicated that the interpretive guidance is intended to rebalance the evaluation process by providing management of public companies with its own flexible and scalable guidance, without the need to look to the guidance provided to auditors by the PCAOB. The principal concerns the SEC is seeking to address in adopting this risk-based approach are excessive testing of controls generally, excessive documentation, and the need to scale the requisite evaluation to smaller companies, all of which are expected to result in reduced compliance costs.
The SEC indicated that, to the extent a public company’s management complies with the interpretive advice (if and when adopted), it will have satisfied its annual evaluation requirements under Securities Exchange Act rules implementing the internal control requirements of Section 404. The SEC, however, also has indicated that a company may choose to continue to use its existing procedures, so long as those procedures meet the requirements of Section 404 and the SEC’s other rules. In all events, public companies will remain subject to the longstanding Securities Exchange Act requirement that they have reasonable internal controls and still will have to consider their ongoing disclosure obligations, to the extent that there are material weaknesses in those controls.
The SEC’s interpretive guidance will be subject to a 60-day comment period from the date of publication in the Federal Register.
As noted, tomorrow the PCOAB is expected to propose a new auditing standard to supersede AS No. 2. This proposal (if and when adopted) will govern the standards an auditor must satisfy in its audit in respect to internal controls of a public company. The SEC has indicated that it has worked closely with the PCAOB as it worked to develop a new auditing standard to supersede AS No. 2. The PCAOB’s action will also be quite important to public companies, as SEC action alone in the area of evaluation and reporting on internal controls over financial reporting will not suffice to complete the adjustments being sought by public companies.