On October 2, 2009, the U.S. Securities and Exchange Commission, or the SEC, delayed the requirement for small reporting companies[1] to include in their annual reports an auditor attestation report on internal control over financial reporting.[2] Prior to this announcement, a smaller reporting company was required to include the auditor's attestation report in its annual report filed for fiscal years ending on or after December 15, 2009. Under the extension, a smaller reporting company is now required to begin to include the auditor's attestation report in its annual report filed for fiscal years ending on or after June 15, 2010. This extension gives calendar year-end smaller reporting companies an additional year to plan for the required auditor attestation report.  

Section 404(a) of the Sarbanes-Oxley Act of 2002, or SOX, and related SEC regulations mandate that each company subject to the reporting requirements of the Securities and Exchange Act of 1934 include in its annual report a report of management on the company's internal control over financial reporting. Management's report must contain:  

•a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the company;  

  • a statement identifying the framework used by management to evaluate the effectiveness of the company's internal control over financial reporting; and
  • management's assessment of the effectiveness of the company's internal control over financial reporting as of the end of the company's most recent fiscal year, including a statement as to whether or not internal control over financial reporting is effective.

Under Section 404(b) of SOX and related SEC regulations, reporting companies must also include a report from the registered public accounting firm that audited the company's financial statements attesting to management's assessment of the company's internal control over financial reporting.

Currently, all reporting companies must comply with Section 404(a) and provide management's report on internal control over financial reporting. All reporting companies other than smaller reporting companies are also currently required to provide the auditor's attestation report required under Section 404(b). Smaller reporting companies have been granted multiple extensions as to the auditor attestation report requirement since the internal control rules were first enacted with this most current extension giving calendar year-end smaller reporting companies an additional year to plan for the required auditor attestation.

According to the SEC's press release, the extension was granted so that the SEC's Office of Economic Analysis could complete a study of whether additional guidance provided to company managers and auditors in 2007 was effective in reducing the costs of compliance with Section 404(b) requirements.

In its press release, the SEC stated that there will be no further extensions and "it is important for all public companies and their auditors to act with deliberate speed to move toward full Section 404 compliance."