Recent SEC Pronouncements on SOX Section 404

Since the provisions of the Sarbanes-Oxley Act (the Act) became effective in 2002, smaller public companies have struggled to timely satisfy the requirements imposed by the Act, in particular those requirements imposed by Section 404 that relate to internal controls over financial reporting. The time, effort and expense necessary to comply with the testing and certification of such internal controls impose significant financial and administrative burdens on smaller public companies. On August 9, 2006, the Securities and Exchange Commission (SEC) issued two releases: (1) an adopting release covering certain foreign private issuers and (2) a proposing release covering smaller non-accelerated filers and newly public companies. These actions by the SEC are intended to provide certain smaller public companies and some foreign private issuers with relief from the provisions of Section 404, by providing additional time for them to implement the Section 404 internal compliance reporting programs.

The first release is an adopting release that relates to certain foreign private issuers. These companies will not need to provide an auditor’s attestation on internal controls over financial reporting until they file their annual reports for fiscal years ending on or after July 15, 2007. The second release proposes to extend the date for compliance with the Section 404 management report requirements from July 15, 2007, to December 15, 2007, for non-accelerated filers (both U.S. companies and foreign private issuers). In addition, the Commission also proposes to extend the date by which non-accelerated filers must comply with the Section 404(b) requirement to provide an auditor’s attestation report on internal controls to the first annual report for fiscal years ending on or after December 15, 2008. Thus, during the first year in which they must comply with the Section 404 requirements, smaller public companies would only be obligated to include the management report portion of the internal controls requirements. If this proposal is not adopted, non-accelerated filers would have to begin filing their Section 404 reports for fiscal years ending on or after July 15, 2007.

The management report is a letter signed by senior management addressing the existence and effectiveness of a system of internal controls over a company’s financial reporting. The internal control report must include: a statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting for the company; management’s assessment of the effectiveness of the company’s internal control over financial reporting; and a statement identifying the framework used by management to evaluate the effectiveness of the company’s internal control over financial reporting. The management report may not be subject to qualifications or exclusions; rather, management must simply state whether or not their internal controls over financial reporting are effective.

In addition, the SEC has proposed a transition period for newly public companies in order to ease the burden of compliance with the Act. This transition relief applies to any company that has become public through an IPO or registered exchange offer or that otherwise becomes subject to the Exchange Act reporting requirements, including foreign private issuers that are listing on a U.S. exchange for the first time. The SEC has proposed that such companies would not be required to provide either a management assessment or auditor attestation report until the company has filed at least one annual report with the SEC.

These proposals by the SEC have been submitted for public comment, and comments should be submitted within 30 days of publication of the proposing release in the Federal Register. Assuming that the SEC adopts these proposals, smaller public companies and foreign private issuers that benefit from these commission releases should use the additional time granted to establish effective Section 404 compliance and internal control programs.