In response to the passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act)1 – which among other things, added a new section 404(c) to the Sarbanes-Oxley Act of 2002 (SOX)2 – the U.S. Securities and Exchange Commission (SEC) has amended various of its rules and forms to conform them with section 404(c) of SOX, providing that section 404(b) of SOX does not apply to non-accelerated filers. These filers are neither "accelerated filers" nor "large accelerated filers," as those terms are defined in Rule 12b-2 under the Securities Exchange Act of 1934.
Section 404(c) essentially provides that a non-accelerated filer will not be required to include in the annual reports it files with the SEC an attestation report from its registered public-accounting firm on internal control over financial reporting. Prior to the enactment of the Dodd-Frank Act, a non-accelerated filer would have been required under section 404(b) of SOX to include such an attestation report, beginning with its first annual report filed for a fiscal year ending on or after June 15, 2010.
In addition to dispensing with the auditor attestation requirement for non-accelerated filers, the SEC has adopted new Item 308(a)(4) of Regulation S-K, which provides that disclosure of an attestation report is required only if an attestation report is included in the annual report. Finally, the SEC has amended Rule 2-02(f) of Regulation S-X to clarify that an auditor of a non-accelerated filer is not required to include in its audit report an assessment of the filer's internal control over financial reporting.
It is important to note, however, that all issuers, including non-accelerated filers, remain subject to section 404(a) of SOX and the corresponding rules of the SEC, which require an issuer's annual report to include a report by management – as opposed to an attestation report of the auditor – on the issuer's internal control over financial reporting, including an assessment by management on the effectiveness of such internal control.