Sarbox 404: The New Feeling-Out Period

While a new SEC plan would give a breather to new compliers, they shouldn't be strangers to their auditors, the commission's corporation finance ch...
Helen ShawSeptember 13, 2006

Next year, many finance executives will likely be able to take a sabbatical to get their companies’ internal controls up to snuff far from the annoying questions of independent auditors. But the executives shouldn’t avoid the auditors either, Securities and Exchange Commission officials says.

An August 9 SEC proposal would let newly public companies and smaller issuers complying with Section 404 of the Sarbanes-Oxley Act for the first time next year off the hook of having to provide a report on internal controls from their auditors in 2007. Larger public companies—those with a public float over $75 million—have had to supply such reports under Sarbox’s internal controls provision for a few years now.

Still, while the auditor’s report would not required for the new compliers in that first year, it would also not be prohibited. At a Sarbanes-Oxley conference in New York City on Tuesday, John White, the SEC’s director of corporation finance, suggested that that the companies use the next year “to come to mutual understandings with your auditors about internal controls, about expectations, and about standards.”

Drive Business Strategy and Growth

Drive Business Strategy and Growth

Learn how NetSuite Financial Management allows you to quickly and easily model what-if scenarios and generate reports.

The presence of the report might even supply a dash of beneficial discipline. “I do not personally believe” said White, “that the absence of the auditor is obligatory, and for some companies, it may not be the right answer.”

The SEC proposal, of course, still would require the newly regulated companies to file a management assessment report on the effectiveness of internal controls over financial report in their first year of compliance. The SEC plan would mandate that they comply with 404 when they file their annual reports for their first fiscal years ending on or after December 15, 2007. (The comment period for the proposal ends on September 14.)

The compliance deadline could end up even looser than that. If the SEC hasn’t issued added guidance for managements on how to do their internal-controls assessments in time to be of help by the December 15, 2007 deadline, it could be postponed. What’s more, if revisions to Auditing Standard No. 2—the Public Company Accounting Oversight Board rule governing auditors’ 404 reports—haven’t been finalized by the December 15, 2008 deadline for the auditors’ reports for new compliers, that deadline could also be put off.

White observed that when the SEC released its plan, it stated that while the proposal would allow smaller companies to omit the auditor’s attestation report from their annual reports, it encourages “frequent and frank dialogue among management, auditors, and audit committees to improve internal controls.”

The dialogue could bear fruit in years to come. “You may even find that doing so will make your second year of compliance, assuming that’s when the auditor attestation report is first required, smoother and less burdensome,” said White.