SEC and PCAOB Change Rules on 404 Reporting

This week, the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB) revised the rules governing reporting on internal control over financial reporting under Section 404 of the Sarbanes-Oxley Act of 2002. Under Section 404, a public company must conduct an annual evaluation of the effectiveness of its internal controls and include in its annual report the results of the evaluation and a report of its auditors on its internal controls. These requirements have applied to large U.S. issuers for three reporting seasons and apply this year to large foreign private issuers for the first time.

The changes adopted this week are the culmination of a coordinated effort by the SEC and the PCAOB, beginning in early 2005, to improve the implementation of Section 404. The changes respond to the widespread criticism that the internal control reporting process has been unnecessarily complex and costly. The broad themes are (a) to allow management to develop its evaluation process independently of the rules applicable to auditors and (b) to authorize both management and auditors to apply a “top-down, risk-based” approach to develop a process tailored to each company’s specific circumstances. Both the SEC and the PCAOB describe their regulatory approach as “principles-based.”

The SEC’s rule changes and interpretive guidance are expected to become effective by early July, and the PCAOB’s new Auditing Standard No. 5 will be effective with respect to fiscal years ending on or after November 15, 2007. Early adoption of AS No. 5 is also permitted.

For smaller issuers, the effectiveness of these requirements has been repeatedly delayed, but the SEC said this week that there will be no further delay. As a result, the requirement to present a management report will apply to “non-accelerated filers” for years ending on or after December 15, 2007, and the requirement to present an auditors’ opinion will apply one year later.

SEC Interpretive Guidance

The core of the SEC’s action was to adopt interpretive guidance, not in the form of a rule, on how management should evaluate the effectiveness of internal control. A major criticism of the Section 404 reporting process has been that management’s approach to assessing its controls has been driven by the documentation and testing requirements applicable to external auditors under PCAOB standards. The SEC guidance is intended to allow management to develop its own process in light of its own assessment of risks in the financial reporting process.

The final text of the guidance is not yet available, but the SEC staff described it as being largely consistent with the December 2006 proposal. Apparently, as in the proposal, there will be very little that is specifically addressed to foreign private issuers.

SEC Rule Changes

The SEC also made three changes to its rules. First, it adopted a safe harbor under which management’s obligation to evaluate internal control is met if the evaluation is performed in accordance with the SEC’s interpretive guidance. Some commentators on the proposal were skeptical about the utility of this safe harbor, since principles-based guidance does not by it nature fix clear compliance standards.

The second change relates to the auditors’ report on internal control. Under the current regime, the report must express two opinions: whether internal control is effective and whether management’s assessment of internal control is fairly stated. The amendments eliminate the second opinion.

Third, the SEC adopted as part of its rules a definition of the key term “material weakness.” The current definition, which is in the PCAOB standards but not the SEC’s rules, provides that a control deficiency is a material weakness if the likelihood of a material financial misstatement is “more than remote.” Critics of the Section 404 process argued that this definition led to an unnecessary search for low-probability flaws. The new definition adopted by both the SEC and the PCAOB changes the standard from “more than a remote likelihood” to “a reasonable possibility” of a material misstatement. Commentators have questioned whether the new threshold represents a meaningful change and urged the SEC and the PCAOB to use “reasonably likely,” but that suggestion has now been rejected.

New PCAOB Standard

AS No. 5 completely replaces Auditing Standard No. 2, which has been in effect since June 2004 and which has been widely criticized as requiring excessive procedures and encouraging an unnecessarily demanding approach to reviewing internal controls. This is the most important of the changes adopted this week, but the practical effects will depend on how the new standard is implemented by the auditing profession.

AS No. 5 is intended to focus the audit on the most important matters, eliminate unnecessary procedures, allow the audit to be “scaled” for smaller companies and simplify the standard’s requirements. It is also designed to be aligned with the related SEC rules. There are few changes from the December 2006 proposal.

The PCAOB also approved Rule 3525, relating to auditor independence, under which auditors must comply with specified documentation and other procedures when requesting audit committee pre-approval of internal control-related services. These requirements parallel the auditors’ responsibility in seeking pre-approval to perform tax services for an audit client under PCAOB Rule 3524, and similar requirements currently appear in AS No. 2.

The text of AS No. 5 and the new PCAOB rules can be viewed at the following link:

http://www.pcaob.org/Rules/Docket_021/2007-05-24_Release_No_2007-005.pdf

The PCAOB news release summarizing the new rules can be viewed at the following link:

http://www.pcaob.org/News_and_Events/News/2007/05-24.aspx

The SEC’s press release describing its guidance and rule changes can be viewed at the following link:

http://www.sec.gov/news/press/2007/2007-101.htm

Please feel free to contact any of your regular contacts at the firm or any of our partners and counsel listed under Corporate Governance or under Capital Markets in the “Our Practice” section of this website if you have any questions.