The Securities and Exchange Commission has postponed the implementation of Section 404 of the Sarbanes-Oxley Act for the second time.
Section 404 directed the SEC to adopt rules regarding internal controls at public companies. It also requires that a company’s independent auditors attest to and report on management’s controls assessments, following standards established by the Public Company Accounting Oversight Board (PCAOB).
Most senior managers will now have to report on — and certify — their companies’ internal financial controls starting with fiscal years ending on or after November 15, 2004. The prior compliance date was June 15, which itself was revised from last September.
The November 15 reporting date applies to “accelerated filers” — U.S. companies with a market cap over $75 million that have filed annual reports with the SEC. All other issuers, including small businesses and foreign private companies, must comply with the new requirements beginning with fiscal years ending on or after July 15, 2005. Their compliance date had been April 15, 2005.
The commission also extended the compliance date for related requirements regarding evaluation of internal control over financial reporting and management certification requirements, including certification and related requirements applicable to registered investment companies.
The SEC gave no rationale for the postponement, but one reason might be that the PCAOB still has not finalized its standard for auditors, which it proposed in October 2003. The oversight board has reviewed some 180 letters regarding the standard, most of which comment on the scope of work involved in compliance.
Yesterday the board scheduled an open meeting on March 9 to adopt a final standard. Speaking at a conference in New York, PCAOB chief auditor Douglas Carmichael stated that the standard would then be posted on the board’s Web site within a few days. After a short comment period, added Carmichael, the standard would have to be approved by the SEC before taking effect.