Problem:
On July 21, 2010, President Obama signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank). Among the vast number of changes, there is good news. Dodd- Frank permanently relieves smaller public companies from the requirement of providing auditor attestation under Section 404 of the Sarbanes-Oxley Act (SARBOX or SOX).
Section 404(a) of SARBOX requires all public companies to include in their annual reports on Form 10-K a report from management on the effectiveness of the company's internal control over financial reporting. Section 404(b) requires the company's independent auditor to attest to management's assessment of the effectiveness of those internal controls.
Due to the high costs of complying with SARBOX Section 404(b), the Securities and Exchange Commission (SEC) has postponed the obligation of "non-accelerated filers" to comply with the attestation requirements of Section 404(b), the most recent extension expiring June 30, 2010. A "non-accelerated filer" is an Exchange Act reporting company that does not meet the definition of either an accelerated filer or a large accelerated filer. It includes, but is not limited to, "smaller reporting companies" that are generally those companies with less than $75 million in worldwide public float.
Dodd-Frank adds a new Section 404(c) to SARBOX that is effective immediately and provides that the auditor attestation requirement of Section 404(b) will apply only to accelerated filers and large accelerated filers. Although non-accelerated filers will continue to provide the report from management in their annual reports, the permanent exemption from 404(b) should significantly reduce the ongoing costs of being a public company.
What are some other important requirements of SOX that are applicable to public companies, and do you think these have any real impact on internal controls and fraud risk management.