On July 21st, 2010, President Obama signed into law the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Reform Act") which, among other things, amends Section 404(b) of the Sarbanes-Oxley Act of 2002 ("SOX 404") and permanently exempts non-accelerated, publically traded companies (companies with a market cap of under $75 million) from the Section’s requirement to have auditors opine on their internal controls over financial reporting.
Section 989G of the Reform Act also calls for the SEC to study how the Commission could reduce the burden of complying with Section 404(b) for companies with market capitalization between $75 million and $250 million while maintaining investor protection for such companies. As part of this SEC study, the Commission will also need to address whether or not reducing the compliance burden or providing complete exemption for these companies would increase the number of initial public offerings in the United States. The Act requires the Commission to deliver its findings to Congress within nine months.
Furthermore, under Section 989I of the Reform Act, the GAO is required to prepare a study within three years of enactment addressing the impact of the exemption for non-accelerated filers. Among other things, this study is to examine comparisons in the number of restatements and cost of capital and investor confidence between those companies subject to Section 404(b) and those who are not. The study will also examine whether exempted companies should be required to disclose to investors the absence of SOX 404(b) attestations, as well as the costs and benefits of voluntary compliance with 404(b).
SOX 404(a) Still Required
While the requirement for auditors to attest to the design and operating effectiveness of internal controls no longer exists for companies with a market cap of under $75M, the Reform Act does not, however, eliminate the SOX 404(a) requirement. SOX 404(a) is still in effect for all publically traded companies and it stipulates that each annual report required by section 13(a) or 15(d) of the Securities Exchange Act of 1934 must contain an internal control report, which shall a) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and b) contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting.