News

SEC Proposes to Delay Internal Control Reporting Requirements for Newly Public Companies and Smaller Public Companies

Client Alert

August 2006

SEC Proposes to Delay Internal Control Reporting Requirements for Newly Public Companies and Smaller Public Companies

SEC Adopts Final Rule Regarding Smaller Foreign Private Issuers

On August 9, 2006, the Securities and Exchange Commission issued two releases to delay the Sarbanes-Oxley Section 404 internal control reporting requirements for new public companies, smaller public companies (i.e., companies that are “non-accelerated filers”) [1] and foreign private issuers that are not “large accelerated filers.”[2]  Unlike prior extensions of the Section 404, requirements, the SEC established separate compliance dates for the two major elements of Section 404, i.e., management's assessment of internal control over financial reporting and the auditor's attestation report on management's assessment. 

In announcing the action, SEC Chairman Christopher Cox said the actions taken in the releases “continue the [SEC's] efforts to be sensitive and responsive to the particular needs of smaller public companies and foreign private issuers, and to minimize the burdens Section 404 may impose on them.”

Background

In 2003, the SEC adopted amendments to its rules and forms implementing Section 404 of the Sarbanes-Oxley Act.  Section 404 and the related SEC rules require Exchange Act reporting companies, other than registered investment companies, to include in their annual reports a report of management on the company's internal control over financial reporting and an accompanying auditor's attestation report, and to evaluate, as of the end of each fiscal quarter, or year in the case of a foreign private issuer filing its annual report on Form 20-F or Form 40-F, any change in the company's internal control over financial reporting that occurred during the period that has materially affected, or is reasonably likely to affect, the company's internal control over financial reporting.

The SEC extended the Section 404 compliance dates in February 2004 for all filers to allow companies to implement PCAOB Auditing Standard No. 2. [3]  In March 2005, the SEC approved a further one-year extension of the Section 404 compliance dates for non-accelerated filers and for all foreign private issuers to July 15, 2006.   In September 2005, the SEC approved a one-year extension for all non-accelerated filers, including foreign private issuers, which would be required to comply for annual reports for fiscal years ending on or after July 15, 2007.

Focus on Small Public Companies

The extensions in these recent releases are the SEC's latest response to the outcry by smaller public companies and others regarding the significant costs and efforts required to comply with Section 404.  In March 2005, the SEC chartered an Advisory Committee on Smaller Public Companies to assess the regulatory system for smaller companies, including the internal control reporting regime.  The SEC also convened a task force of the Committee of Sponsoring Organizations (“COSO”) to elaborate on the application of the existing COSO framework to smaller companies.  Following these reports, the SEC sponsored a roundtable on experiences with implementation of the internal control reporting and auditing regime.  On May 17, 2006, following the internal controls roundtable event, the SEC announced a number of initiatives to improve the internal control reporting and auditing process. [4]  In July 2006, the SEC issued a “concept release” outlining the further steps the SEC expects to take regarding internal controls.

Summary of the Releases

• Proposal to Delay Section 404 Compliance Date for Non-accelerated Filers.  The SEC has proposed to bifurcate the compliance dates for the management report on internal control, and the auditor attestation report for non-accelerated filers.  Under the proposed timetable, management of a non-accelerated filer would not be required to provide an evaluation of, or report on, the effectiveness of the company's internal control over financial reporting until the filing of its annual report for its first fiscal year ending on or after December 15, 2007 (a six-month delay from the current rules).  In addition, non-accelerated filers would not be required to provide an auditor attestation report until the filing of its annual report for its first fiscal year ending on or after December 15, 2008 (an 18-month delay from the current rules). 
• Proposed Rule to Provide Relief for New Public Companies.  The SEC has also proposed a transition period before new public companies will be required to comply with the Section 404 internal control reporting requirements until after they have previously filed one annual report.  In the new public company's second annual report, the company would then be required to comply with the Section 404 internal control reporting requirements in accordance with the proposed bifurcated phase-in schedule discussed above. 
• Final Rule to Delay Auditor Attestation Compliance Date for Certain Foreign Private Issuers.  A foreign private issuer that is an “accelerated filer” but not a “large accelerated filer” (i.e., it has a public float of at least $75 million, but less than $700 million), will be required to conduct a management evaluation and report on the company's internal control in its Form 20-F annual report for its first fiscal year ending on or after July 15, 2006, but, similar to the proposed bifurcated approval for smaller public companies, will not be required to provide an auditor attestation report until the filing of the Form 20-F for its first fiscal year ended on or after July 15, 2007.  In contrast to the proposed rules for domestic companies, the delay for these foreign private issuers is a final action.
• CEO and CFO Certifications. The required content of Section 302 CEO and CFO certifications would be adjusted to reflect the delayed requirements to provide a management report on internal control discussed above.  Accordingly, the CEO and CFO certifications may omit language in the introductory sentence in paragraph 4 and in paragraph 4(b) related to internal control over financial reporting until the company is required to provide its first management report on internal controls.

For Further Information

If you have any questions regarding the new rules and proposals and how they may affect your company, please contact one of the following members of our Securities Practice Group or the WTP lawyer with whom you are regularly in contact.

WTP Securities Practice Group

D. Scott Freed (sfreed@wtplaw.com)

Frank S. Jones, Jr. (fjones@wtplaw.com)

George S. Lawler (glawler@wtplaw.com)

Joseph P. Ward (jward@wtplaw.com)

The above outline is intended only as a overview and does not constitute legal advice. 

*                                  *                                  *

© 2006  Whiteford, Taylor & Preston L.L.P.