The U.S. Securities and Exchange Commission (the “SEC”) has proposed to delay the requirement for
non-accelerated filers1 to include an attestation report of the independent auditor in their annual reports.
Under the current internal control over financial reporting (the “ICFR”) requirements, a non-accelerated
filer must provide an auditor’s attestation in its annual report filed for fiscal years ending on or after
December 15, 2008. If the extension is adopted, such companies will be required to begin filing their
auditor attestation reports for fiscal years ending on or after December 15, 2009.

When the original internal control rules were first enacted in 2003, the SEC required each company
subject to the reporting requirements of the Securities and Exchange Act of 1934 (the “Exchange Act”) to
include in its annual report on Form 10-K, 20-F or 40-F (as applicable), an internal control report by
management and a related auditor’s attestation regarding the adequacy of its internal controls. Since that
decision, multiple postponements have occurred in implementation for non-accelerated filers (both
domestic companies and foreign private issuers2).

The management’s report and auditor’s attestation covers:

Management Report

  • Statement of management’s responsibility for establishing and maintaining adequate internal
    control over financial reporting;
  • Statement identifying the framework used by management to evaluate the effectiveness of the
    company’s internal control over financial reporting;
  • Management’s assessment of the effectiveness of the company’s internal control over financial
    reporting as of the end of the company’s most recent fiscal year, including a statement as to
    whether the company’s internal control over financial reporting is effective; and
  • Disclosure of any “material weaknesses” identified by management in the company’s internal
    control over financial reporting (if any material weaknesses in the company’s internal control over
    financial reporting have been identified, management may not conclude that internal control over
    financial reporting is effective).

 Auditor’s Attestation

  • Statement that the registered public accounting firm that audited the financial statements included
    in the company’s annual report has issued an attestation report on management’s assessment;
    and
  • File the accounting firm’s attestation report on internal control over financial reporting as part of
    the annual report.3

Under the original compliance dates, a non-accelerated filer was required to comply with the ICFR
requirements for annual reports filed for fiscal years ending on or after April 15, 2005.4 Since then,
recognizing the substantial time and resources that a non-accelerated filer may endure in implementing
the ICFR requirements and in order to provide companies and their respective auditors with adequate
time to adopt the necessary controls and implement new guidance and standards, the SEC extended the
compliance dates for non-accelerated filers (which includes foreign private issuers that are nonaccelerated
filers) through a series of postponements.5

On February 1, 2008, in the most recent proposal to delay implementation, the SEC proposed to extend,
by one year, the date by which a non-accelerated filer must begin to comply with the auditor’s attestation
report requirement by amending Item 308T of Regulation S-K, Rule 2-02 of Regulation S-X and Forms
10-Q, 10-K, 20-F and 40-F.6 While a non-accelerated filer will still be required to file a management’s
report in its annual report for its first fiscal year ending on or after December 15, 2007, the proposal, if
adopted, would defer the auditor’s attestation report requirement until the company files an annual report for its first fiscal year ending on or after December 15, 2009 from December 15, 2008.7 The SEC wants
to allow non-accelerated filers to benefit from the implementation of certain new standards and guidance
without undue cost. For example, on June 20, 2007, the SEC approved interpretive guidance and
adopted amendments to rules that would assist management in measuring the effectiveness of a
company’s ICFR.8 Further, on July 25, 2007, the SEC approved Auditing Standard No. 5 issued by the
Public Company Accounting Oversight Board (the “PCAOB”) to further implement the ICFR requirements
and replace Auditing Standard No. 2. The new standards provide additional guidance for independent
auditors to attest and report on management’s assessment of the company’s ICFR. On October 17,
2007, the PCAOB also issued preliminary guidance on how auditors can apply Auditing Standard No. 5.
Moreover, the SEC has implemented a study to evaluate whether the auditor attestation requirement is
carried out in a manner that is cost-effective for smaller reporting companies.

Under the proposed extension, non-accelerated filers will benefit from complying with the ICFR
requirements by only filing a management’s assessment for the next two years.
The SEC is soliciting comments until March 10, 2008.