SEC Extends SOX Compliance Reporting Date, PCAOB Takes First Steps

Information Management Journal, May/Jun 2004 by Swartz, Nikki

News, Trends & Analysis

The Securities and Exchange Commission (SEC) has extended compliance dates for amendments to its rules under the Securities and Exchange Act of 1934 for companies with a market capitalization of more than $75 million that have filed at least one annual report with the SEC. Those companies do not have to document their internal controls pursuant to Section 404 of the Sarbanes-Oxley Act (SOX) - originally required by June 15, 2004 - until the end of their first fiscal year, ending on or after November 15, 2004. The amendments require a company to include in its annual report a report by management on the company's internal control over financial reporting and the accompanying auditor's report.

Similarly, the SEC has extended the compliance date for related requirements regarding evaluation of internal control over financial reporting and management certification requirements, including certification and related requirements applicable to registered investment companies.

More recently, the Public Company Accounting Oversight Board (PCAOB) took one of its first regulatory steps, voting that financial statement auditors should also conduct annual audits of companies' internal controls. The same firm that audits a firm's financial statements would also be responsible for auditing its internal controls.

According to SOX, corporate managers must report on the effectiveness of internal controls, and auditors have to vouch for the accuracy of management's statements. The PCAOB's action goes beyond this, however, calling for outside auditors to do more than just take management's word they would be required to conduct annual "walkthroughs," tracing sample transactions through a company's system until they are reflected in the financial statements, according to The Washington Post. The standard also requires auditors to assess the effectiveness of hoards of directors' audit committees. The Post reported that auditors must disclose whether a company had "material weaknesses" in internal controls at the end of the fiscal year. If a company corrects serious problems by the end of the year, the public would not necessarily be informed.

For publicly traded companies, the Post said, the requirement would pose an additional cost. Financial Executives International, a group of corporate financial officers, reported last month that a survey of member companies found that compliance with SOX's internal control requirements could increase audit costs by an average of 38 percent.

The requirement, adopted unanimously by the PCAOB, first must be approved by the SEC before it is implemented.