The U.S. Securities and Exchange Commission yesterday announced a series of actions it intends to take to improve the implementation of internal control reporting requirements, known as section 404 of the Sarbanes-Oxley Act.
The measures include issuing guidance for companies, and working with the Public Company Accounting Oversight Board on revisions of its internal control auditing standard. They will also include SEC inspections of PCAOB efforts to improve Section 404 oversight, and a brief further postponement of the Section 404 requirements for the smallest companies, although ultimately all public companies will be required to comply with the internal control reporting requirements of Section 404.
“The steps we are announcing today are designed to further improve the reliability of financial statements and to better protect investors while making the Section 404 process more efficient and cost effective,” said SEC chairman Christopher Cox. “As we go forward, we will consider the special concerns of all companies that fall under our jurisdiction — large and small, foreign and domestic. By providing practical guidance to companies, by working with the Public Company Accounting Oversight Board on their forthcoming revised standard for auditors, and by examining how the PCAOB inspection process is succeeding in increasing the efficiency and cost-effectiveness of the audit process, we will take a giant step toward ‘getting it right’ when it comes to Section 404 compliance.”
These actions are based on extensive analysis and commentary in recent months from investors, companies, auditors, and others.
The commission expects to issue a concept release covering a variety of issues that might be the subject of guidance for management. The release will solicit views on the management assessment process, it will also seek input on the appropriate role of outside auditors and the manner in which auditors provide the attestation required by Section 404.
The SEC also anticipates that it will issue guidance to management to assist in its performance of a top-down, risk-based assessment of internal control over financial reporting.
The postponement for smaller companies would nonetheless require all companies to comply with the management assessment required by Section 404 for fiscal years beginning on or after Dec. 16.