SOX Compliance Delayed for Small Business

June 24, 2008

On June 20, the U.S. Securities and Exchange Commission (SEC) approved a one-year extension of the compliance date for smaller public companies to comply with auditing and reporting requirements under Section 404 of the Sarbanes Oxley Act of 2002 (SOX).

Under this extension, public companies with $75 million or less in market capitalization will now have until fiscal years ending on or after Dec. 15, 2009 to comply with certain Section 404 requirements. The Commission's decision to extend the Section compliance date for smaller companies is the latest in a series of recent efforts to help reduce unnecessary costs of compliance for smaller companies, without diminishing investor protections.

This announcement comes a day after the SEC received approval from the Office of Management and Budget (OMB) to proceed with data collection for a study on the "real world" costs and benefits of Section 404 in light of new rules put in place in May 2007. The study includes gathering new data from a broad array of companies about the costs and benefits of compliance with the Section 404 requirements. It also pays close attention to those companies currently complying—for the first time—with Section 404 under the newly-issued guidance for companies and auditors.

With OMB approval, and the key financial data for annual reports becoming available to companies this summer, the SEC staff is moving forward with a web-based survey of companies that are subject to Section 404, and is conducting in-depth interviews with companies that are just now becoming compliant. The dual approach will enable the SEC to gather data from a large cross-section of companies and analyze more detailed information about what drives costs and where companies and investors derive the benefits. SEC staff expects to complete the study by late summer or early fall.

As part of the Sarbanes-Oxley Act of 2002, Congress ordered closer scrutiny on corporate managers to make an annual assessment of the effectiveness of the company's internal controls over financial reporting, while also requiring an auditor attestation on management's assessment.

To reduce Section 404 costs while preserving its benefits, the SEC last year issued new guidance for management's Section 404 assessment. The guidance helps companies focus their reviews on the internal control issues that matter most to investors. Companies of all sizes, including smaller companies, have already had to submit a management report on their company’s internal controls for fiscal years ending on or after Dec. 15, 2007.

At the same time, the SEC and the Public Company Accounting Oversight Board voted unanimously to replace the standard for the auditor attestation, which is intended to make the process more efficient. Larger companies are now filing their first reports under the new audit standard.

The full text of the final amendments for the extension of the auditor attestation requirement for small companies will be posted on the SEC website: www.sec.gov and the amendments will take effect 60 days after the release is published in the Federal Register.