Yesterday the SEC extended the deadline by which non-accelerated filers must file auditor attestation reports on internal controls to December 15, 2009 for annual reports filed after that date.
The auditor attestation report is a requirement of Section 404(b) of Sarbanes-Oxley. It correlates with one of the key aspects of Sarbanes-Oxley: the requirement that management must publicly evaluate internal control over financial reporting (ICFR). The independent auditor is charged with evaluating management’s process for assessing ICFR and determining whether ICFR is effective. This requires an evaluation by the auditor that is both detailed and expensive.
It is widely agreed that ICFR compliance costs, specifically auditor fees, will be disproportionately higher for smaller reporting companies. However, there have been attempts to decrease some costs. Last year, the SEC and the Public Company Accounting Oversight Board (PCAOB) issued guidance on how to evaluate the effectiveness of ICFR for management and the independent auditor, respectively, which calls for a less complex review for smaller companies.
The SEC has postponed auditor attestation reports for smaller companies in part because it is waiting on final guidance from the PCAOB, including examples of how to approach specific issues that arise in audits of smaller companies. A second reason for the postponement is the SEC is waiting on results of a study designed to see whether the guidance from last year is actually allowing for more cost-effective ICFR evaluations.
In short, it seems the SEC expects that the auditor’s attestation of ICFR is going to be expensive – especially the first time it must be completed – and is taking steps to make sure effective guidance is in place to decrease the costs.
