It appears the time has come for non-accelerated filers to obtain an audit of internal controls over financial reporting from their external auditor, likely in the form on an integrated audit with the filer’s financial statements.
To date, the SEC has not updated its most recent rules release on the requirement for non-accelerated filers to include an attestation report of their independent auditor on internal controls over financial reporting for fiscal years ending on or after December 15, 2009 (with certain exceptions for new registrants).
Recent remarks by both SEC Commissioner Luis Aguilar and SEC Chairman Mary Schapiro seem to indicate no additional extension will be granted, absent the SEC’s on-going cost-benefit study of SOX Section 404 indicating costs significantly out of line with the benefits.
In preparing for obtaining an audit report, which is as of the annual balance sheet date, it is a good idea to be familiar with a couple of different pieces of guidance. The first of which is the COSO ICFR guidance for smaller reporting companies to ensure appropriately designed and implemented controls to detect and prevent material misstatement of financial information. Secondly, to get an idea of the auditor’s approach, review the PCAOB’s Auditing Standard No. 5 and further the PCAOB’s staff views issued January 23, 2009.