According to testimony given by SEC Chairman Christopher Cox before the Senate Committee on Small Business & Entrepreneurship on April 18, 2006, the SEC is currently in the midst of a “critical time for small businesses” as it finalizes its analysis of Section 404 of the Sarbanes-Oxley Act of 2002 in the coming weeks.

Section 404 of SOX requires the SEC to prescribe rules mandating that:

  • Management of a publicly-traded company must disclose their own conclusions about the effectiveness of their internal control structure and procedures for financial reporting; and
  • A publicly-traded company’s independent registered public accounting firm must attest to, and report on, management’s assessment.

The SEC complied with this rule-making requirement by creating rules that applied to all issuers, including small businesses; however, implementation for small businesses was delayed due to concerns over the cost of developing procedures to identify, test, and analyze the effectiveness of controls. In the past year the SEC has continued to analyze potential reforms of Section 404 implementation, specifically with regard to small businesses.

Proposed interpretative guidance to assist management in developing a process for evaluating internal controls is no longer open to public comment, and according to Commissioner Cox, the SEC is currently working to provide guidance in time for companies and auditors to use in connection with annual reports to be filed in 2008. Commentators have expressed concerns that the current principles-based SEC guidance is not in line with restrictive auditing standards proposed by the PCAOB. Both organizations are attempting to reconcile the discrepancies.

The SEC rule adopted in December 2006 continues to permit companies with a public float of $75 million or less to postpone their first 404 audit until March 2009 (for calendar year end companies).