Smaller public companies have been required to comply with the management assertion requirement of Section 404 of the Sarbanes-Oxley Act for their annual report filings for fiscal years ended on or after December 15, 2007. Now, these companies will be subject to the auditor attestation requirement of Section 404 for their annual reports filed for fiscal years ended on or after December 15, 2009.

For those holding out hope that the Securities and Exchange Commission (SEC) might eliminate, or limit in some way, the attestation requirement for smaller public companies, insights as to the commission’s likely future actions were suggested in written responses by SEC chairwoman, Mary Schapiro, to questions she received from Senator Carl Levin during her confirmation process.

In her letter to Senator Levin, Ms. Schapiro provided insight into how she will differ from her predecessor, Christopher Cox. With respect to Sarbanes-Oxley compliance, she noted that “it’s time we bring uniformity to the system.” This point virtually assures the markets that the auditor attestation of management’s assertion on the effectiveness of internal control over financial reporting (ICFR) eventually will become a reality for smaller public companies.

Many smaller public companies are already reporting on ICFR. AuditAnalytics.com released a report detailing its analysis of Year Four Sarbanes-Oxley filings. The analysis revealed that for filings through September 10, 2008, the SEC received 3,435 annual reports with an unattested management assertion on the effectiveness of ICFR. In other words, an internal control report was filed by management without an accompanying auditor attestation.

Of those management assessments,1,053 provided an adverse assessment regarding the effectiveness of ICFR, an adverse opinion rate of 30.7 percent. This is significantly higher than the 16.9 percent adverse opinion rate for first-year filings by larger accelerated filers several years ago. The higher percentage suggests that smaller public companies are having more difficulty establishing and maintaining effective ICFR than larger companies.

In the first four years of Sarbanes-Oxley filings, the rate of adverse opinions for accelerated filers has declined year-to-year. If nonaccelerated filers were to experience the same trend, a smaller percentage of adverse opinions would occur in future filings. However, an important factor to consider is the potential effect of auditor attestations.

The emergence of the additional Sarbanes-Oxley attestation requirement, which is the context for the Public Company Accounting Oversight Board’s  (PCAOB) Guidance for Auditors of Smaller Public Companies issued in January 2009, all but changes the dynamics of the assessment of ICFR for smaller public companies. The additional scrutiny of the external auditor directed to a company’s ICFR may have an impact on the rate of adverse opinions for smaller public companies, which have now begun filing their second wave of internal control reports.

How Protiviti Is Partnering With Companies to Meet This Challenge

Smaller public companies are a diverse group of organizations. Depending on the industry, countries of operation, and the complexity of operations, the financial control and Sarbanes-Oxley compliance solution required will vary greatly. 

All companies can benefit from a conversation with Protiviti’s Financial Controls and Sarbanes-Oxley (SOX) Compliance professionals, who have experience working with hundreds of other companies and helping them to think longer-term, make the right choices, and create value as sustainability improves.

Our flexible, comprehensive approach is driven by a customized road map that addresses your immediate priorities, planned improvements, longer-term strategic improvements and designated timetable. Also, as a subsidiary of Robert Half International, we can combine our subject-matter experts and proven methodology with qualified project professionals from Robert Half, allowing you to manage costs most effectively.