On May 24, 2007, the Public Company Accounting Oversight Board (PCAOB or the Board) adopted Auditing Standard No. 5 (AS 5), An Audit of Internal Control Over Financial Reporting That is Integrated with An Audit of Financial Statements, which supersedes PCAOB Auditing Standard No. 2. AS 5 establishes requirements and provides direction to auditors engaged to perform an audit of management's assessment on the effectiveness of internal control over financial reporting (ICFR) that is integrated with an audit of the financial statements.
AS 5 is principles-based and is designed to increase the likelihood that material weaknesses in internal control will be found before they result in material misstatement of a company’s financial statements, and, at the same time, eliminate procedures that are unnecessary. The standard also focuses the auditor on the procedures necessary to perform a high quality audit that is tailored to the company’s facts and circumstances.
AS 5 became effective for audits of accelerated filers beginning in 2004 and was scheduled to become effective for audits of non-accelerated filers for fiscal years ending on or after June 15, 2010 under Section 404(b) of the Sarbanes-Oxley Act of 2002 (SOX Section 404(b)). However as a result of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the Act) non-accelerated filers - issuers with market capitalizations of less than $75 million - are permanently exempt from complying with SOX Section 404(b). The Act amends SOX Section 404 by adding Section 404(c), which provides that Section 404(b) “shall not apply with respect to any audit report prepared for an issuer that is neither a ‘large accelerated’ nor an ‘accelerated’ filer as defined in Rule 12b-2 of the Commission.”
In response to the Act the SEC issued a final rule adopting amendments to its rules and forms to conform them to Section 404(c) of SOX, including:
- Removing the requirement for a non-accelerated filer to include in its annual report an attestation report of the filer’s registered public accounting firm;
- Adopting a conforming change to the rules concerning management’s disclosure in the annual report regarding inclusion of an attestation report to provide that the disclosure only applies if an attestation report is included; and
- A conforming change to Rule 2-02(f) of Regulation S-X to clarify that an auditor of a non-accelerated filer need not include in its audit report an assessment of the issuer’s ICFR.
All issuers, including non-accelerated filers, continue to be subject to the requirements of SOX Section 404(a). Section 404(a) and its implementing rules require that an issuer’s annual report include a report of management on the issuer’s ICFR. Accelerated and large accelerated filers continue to be subject to the requirements of SOX Section 404(b). Section 404(b) and its implementing rules require that an issuer’s independent auditor that prepares or issues the audit report for the issuer also attest to and report on management's assessment of ICFR.
In an effort to assist auditors of public companies that are required to comply with SOX Section 404 the CAQ has created this Web resource, Resources For Integrated Audits of Accelerated Filers and Audits of Non-Accelerated Filers, to provide member firms with information on SOX Section 404(a) and (b) from a variety of sources, including regulators, standards-setting authorities, and the CAQ itself in one central location.
