On June 16, 2010, the conference committee reconciling the House and Senate versions of the federal financial reform bill agreed to include in the final reform legislation the House provision that provides an exemption on compliance with Sarbanes-Oxley Act (SOX) Section 404(b) for companies with less than $75 million in market capitalization.

Under the provisions of SOX 404, publicly reporting companies and their independent auditors are each required to report on the effectiveness of internal control over financial reporting.  Section 404(a) requires all public companies to assess the effectiveness of their internal control over financial reporting, while Section 404(b) requires independent auditors to report on management’s assessment.  On October 2, 2009, the Securities and Exchange Commission (SEC) granted its latest deferral for compliance with SOX 404(b), providing non-accelerated filers, those companies with a public float below $75 million, with a reprieve from the auditor attestation until annual reports for fiscal years ending on or after June 15, 2010 are filed.  At the time of that deferral, the SEC was adamant that it would not be granting any further extensions for compliance with SOX 404(b).

The inclusion of the exemption in the final reform legislation would permanently exempt the auditor attestation requirement and significantly reduce the anticipated compliance burdens of smaller reporting companies.  Disclosure of management attestations on internal control over financial reporting would continue to be required for smaller reporting companies.

(more…)

On October 2, 2009, the Securities and Exchange Commission (SEC) announced a nine-month deferral on Sarbanes-Oxley Act (SOX) Section 404(b) compliance for the smallest publicly reporting companies. Under the provisions of SOX 404, public companies and their independent auditors are each required to report on the effectiveness of company internal controls.  All publicly reporting companies are currently required to disclose a report on management’s assessment of internal controls; however, only reporting companies with a public float of $75 million or above are required to disclose an attestation report provided by an independent auditor.  The extension granted by the SEC will provide non-accelerated filers, those companies with a public float below $75 million, with a reprieve from independent auditor attestations until annual reports for fiscal years ending on or after June 15, 2010 are filed.  Although the SEC has not published the final rule providing for the extension, based on prior extensions, we believe the extended deadline only applies to independent auditor attestations.  Consequently, disclosure of management attestations on internal control continues to be required.

Prior to the October 2 announcement, the deadline for the independent auditor disclosure in annual reports for the smallest publicly reporting companies was fiscal years ending on or after December 15, 2009.  The previous extension, granted in January 2008, was put in place to allow the SEC’s Office of Economic Analysis to complete a study of whether additional guidance provided to company managers and auditors in 2007 was effective in reducing the costs of compliance.  This study was published recently, less than three months before the December 15 deadline, and, as a result, the SEC determined that additional time was appropriate and reasonable so the smallest publicly reporting companies and their auditors could better plan for the required attestation.

(more…)

On June 23, 2009, the FDIC issued Financial Institutions Letter FIL-33-2009, which contains final amendments to Part 363 of the FDIC’s regulations regarding annual independent audit and reporting requirements for insured institutions with $500 million or more in total assets.   The amendments are intended to clarify what must be included in a Part 363 Annual Report.  The reporting obligations differ between institutions with total assets, as of the beginning of the fiscal year, between $500 million and less than $1 billion, and of $1 billion or more.   Unless otherwise noted the amendments became effective on August 6, 2009.  We summarize the main elements of Part 363, as amended, below.

Audit Report Requirements

Part 363 requires the following to be included in the Part 363 Annual Report:

For institutions with total assets between $500 million and less than $1 billion

1. Audited comparative financial statements;
2. The independent public accountant’s report on the audited financials; and
3. A management report containing (i) a statement of management’s responsibilities for preparing annual financial statements, establishing and maintaining adequate internal controls, and complying with safety and soundness laws and regulations pertaining to insider loans and dividend restrictions, and (ii) a management assessment of the institution’s ability to comply with laws and regulations relating to insider loans and dividend restrictions, stating management’s conclusion on compliance with the laws and regulations.

For institutions with total assets of $1 billion or more

In addition to the items required for institutions with total assets between $500 million and less than $1 billion, institutions with total assets of $1 billion or more must provide the following:

1. The management report must also contain an assessment by management on the effectiveness of the institution’s internal controls over financial reporting that identifies the internal control framework, states that the assessment included controls to ensure financial statements were prepared in accordance with regulatory instructions, states management’s conclusion whether this internal control is effective, and discloses any material weaknesses in these internal controls; and
2. The independent public accountant’s attestation report concerning the effectiveness of the institution’s internal controls over financial reporting.

(more…)