|
|
||||
|
08/2006 |
||||
SEC Proposed Extension of Compliance Dates for Reporting on Internal Control Over Financial Reporting
Frank C. Bonaventure
Penny Somer-Greif
To Our Clients and Friends: As you may have heard, the Securities and Exchange Commission (SEC) has proposed further extensions for non-accelerated filers, including small business issuers, for compliance with the internal control over financial reporting requirements mandated by Section 404 of the Sarbanes-Oxley Act of 2002. Under the proposal, the date non-accelerated filers must begin to include the management's annual report on internal control over financial reporting (Management's Report) will be extended from fiscal years ending on or after July 15, 2007 to fiscal years ending on or after December 15, 2007. For calendar-year end companies (i.e., the majority of non-accelerated filers), this proposal would have no impact on when they must begin including Management's Report. This deadline may be extended if the SEC does not issue its anticipated guidance to assist management's performance of a top-down, risk-based and scalable assessment of internal control over financial reporting in time to assist non-accelerated filers with their annual reports for years ending on or after December 15, 2007. The proposal would also extend the compliance date for non-accelerated filers regarding the required auditor's attestation report on management's assessment of the company's internal control over financial reporting to years ending on or after December 15, 2008. This delays the implementation of the auditor's attestation requirement by a year for most non-accelerated filers, and by two years for non-accelerated filers with a fiscal year-end between July 15 and December 14. This deadline may be extended if the PCAOB's auditing standard number 2 ("AS2") has not been revised as anticipated, including to clarify the auditor's role in evaluating a company's process for assessing the effectiveness of its internal control over financial reporting, in time to be of assistance in connection with auditor attestation reports for years ending on or after December 15, 2008. The proposal would also provide that newly-public companies would not have to comply with Management's Report and auditor attestation requirements until their second annual report for a fiscal year ending on or after December 15, 2007 and December 15, 2008, respectively. The SEC's release proposing the extensions (the "Proposing Release") confirms that non-accelerated filers must begin to include the required language with respect to the design and operation of the internal control over financial reporting in the Exhibit 31 certifications of their principal executive and financial officers beginning with the first annual report that includes Management's Report. In other words, a non-accelerated filer's certifying officers (generally its chief executive and chief financial officers) will be required to certify as to their company's internal control over financial reporting before the company's auditor is required to perform its assessment of the company's internal control over financial reporting and its attestation of management's assessment of internal control over financial reporting. Further, non-accelerated filers should note that pursuant to Item 308(c) of Regulation S-K and Regulation S-B, they will be required to disclose any material changes to their internal control over financial reporting that they may make in response to the auditor's first review and assessment in fiscal year 2008. In its release proposing the extensions (the "Proposing Release"), the SEC acknowledges the concern that a company that files only Management's Report during its first year of compliance with the Section 404 requirements might become subject to second-guessing as a result of the proposed separation of the reports than under the current requirements. The SEC's proposed solution is to make Management's Report in fiscal 2007 be "furnished" instead of "filed," unless the company states otherwise in its report. While this will relieve the Company from the potential liability under Section 18 of the Securities Exchange Act of 1934 (the "Exchange Act"), it would not affect the certifications required by the company's principal executive and principal financial officers. In addition, any disclosure about material changes to the company's internal control over financial reporting would still be subject to Section 18 liability. Finally, it is conceivable that the SEC could use alternative theories of civil liability in connection with the provision of Management's Report without auditor review and attestation, including failure to maintain adequate internal control over financial reporting as required by Rules 13a-15 and 15d-15 under the Exchange Act. Therefore, while the auditor's attestation might not be required until fiscal year 2008 if the proposals are adopted (and we have no reason to suspect that they might not be), non-accelerated filers should at a minimum keep their auditors apprised of their progress and consult with them during the process of implementing and documenting their internal control over financial reporting while preparing for the inclusion of Management's Report in their 2007 annual reports. Non-accelerated filers may also want to consider having the auditors conduct some kind of a review of the internal control over financial reporting even if they do not conduct a full review and attestation in compliance with AS2. This should provide some comfort that the company is on the right track, especially to the officers signing the required certifications, and may give companies a head start on the auditor attestation process that will be required in 2008. Hopefully, this will also help avoid or at least reduce instances of disclosable material changes to the company's internal control over financial reporting that a company has to make as a result of the auditor's review and attestation taking place a year after Management's Report is required. We note that in the Proposing Release, the SEC encourages "frank dialogue among management, auditors and audit committees to improve internal controls and the financial reports on which investors rely." In addition, non-accelerated filers should consult with their certifying officers to confirm that they would be comfortable signing the required certifications without a full auditor's review and assessment, and discuss what, if any, level of auditor review they may feel is necessary in order to execute the required certification. Any decisions in this regard should be discussed with the company's auditor as soon as practicable. Finally, we believe that non-accelerated filers should assume that there will not be any further postponements in the implementation of the internal control over financial reporting provisions. The Proposing Release makes clear that the SEC anticipates that the proposed extensions will be adequate to allow the SEC and PCAOB to issue the anticipated guidance and changes to AS2 in time to assist with the internal control requirements as proposed. Companies that delay this process in anticipation of further extensions might find themselves without adequate time to complete the work required to implement and document their internal control over financial reporting and otherwise prepare to include Management's Report in 2007. You can access the Proposing Release at http://www.sec.gov/rules/proposed/2006/33-8731.pdf. This Alert is only a general summary of the proposed extension of compliance dates for the internal control over financial reporting requirements mandated by Section 404 of the Sarbanes-Oxley Act of 2002 and should not be construed as providing legal advice. If you have any questions about the information in this Alert, please contact Frank C. Bonaventure at 410-347-7305 or Penny Somer-Greif at 410-347-7341. |
||||
|
Ober, Kaler, Grimes & Shriver
Maryland Washington, D.C. Virginia |
