The massive Dodd-Frank Wall Street Reform and Consumer Protection Act (“Dodd-Frank”), signed by President Obama on July 21, 2010, provides significant relief to non-accelerated filers in at least one area–those filers are now exempted from the requirement to include in their annual reports an attestation report by their auditors on the filer’s internal control over financial reporting. The auditor attestation requirement was originally contained in Section 404(b) of the Sarbanes-Oxley Act of 2002. Implementation of Section 404(b) was delayed several times by the Securities and Exchange Commission (the “SEC”), which found that the costs of compliance were significant and fell disproportionately heavily on smaller public reporting companies.
The exemption is applicable only to public reporting companies that are neither “accelerated filers” nor “large accelerated filers,” as defined by SEC rules. Accelerated and large accelerated filers are those companies that (i) have an aggregate worldwide market value of the voting and non-voting common equity held by its non-affiliates of $75 million or more; (ii) have been subject to the requirements to file reports with the SEC for 12 months or more; (iii) have filed at least one annual report with the SEC; and (iv) are not eligible to file annual and quarterly reports as a “smaller reporting company” under SEC rules. Dodd-Frank requires the Comptroller General to conduct a study of the effects of this change and to report to Congress within three years after the enactment of Dodd-Frank. Accordingly, Congress may revisit the exemption, and public companies will need to follow developments in this area for further changes, if any, that Congress may pass.
All public reporting companies, including non-accelerated filers, are still required to comply with Section 404(a) of Sarbanes-Oxley. Section 404(a) requires filers to include in their annual reports a report of management on the effectiveness of the company’s internal control over financial reporting (“ICFR”) as of the end of its most recent fiscal year. This report must contain, among other items, a statement as to whether the company’s ICFR is effective. The discussion must include disclosure of any material weaknesses in the company’s ICFR identified by management. Management is not permitted to conclude that the company’s ICFR is effective if there are one or more material weaknesses in the company’s ICFR.
“Internal Control over Financial Reporting” is defined as the process designed by (or under the supervision of) management by which the filer can provide reasonable assurance regarding the reliability of its financial reporting and the preparation of its financial statements. The requirement to include management’s report on ICFR became applicable to all non-accelerated filers for their annual reports for fiscal years ending on or after December 15, 2007. Dodd-Frank did not amend this requirement.