Regulators offer plan for internal control reporting.

On May 17, both the U.S. Securities and Exchange Commission (SEC) and Public Company Accounting Oversight Board (PCAOB) announced plans for next steps in terms of Sarbanes-Oxley Section 404. This followed comment letters, the report of the SEC Advisory Committee on Smaller Public Companies and the previous week's (May 10) roundtable on Second-Year Experiences with Internal Control Reporting and Auditing Provisions, comprised of various constituents.

The SEC stated that it intends to issue further guidance for companies on how to apply a top-down, risk-based approach that would be scalable, and also issue a concept release for public comment.

The SEC plans to work with PCAOB on revisions of Auditing Standard No. 2 (AS2), as well as SEC inspections of PCAOB efforts to improve Section 404 oversight. There will be a brief further postponement of the Section 404 requirements for the auditor's attestation on internal control for the smallest company filers, but it's anticipated that "any such postponement would nonetheless require all filers to comply with the management assessment ... for fiscal years beginning on or after Dec. 16, 2006."

Finally, the SEC stated that "ultimately, all public companies will be required to comply with the internal control reporting requirements of Section 404," signaling that there is more guidance for smaller companies to come.

In a press release, SEC Chairman Christopher Cox said, "As we go forward, we will consider the special concerns of all companies that fall under our jurisdiction--large and small, foreign and domestic. By providing practical guidance to companies, by working with the Public Company Accounting Oversight Board on their forthcoming revised standard for auditors, and by examining how the PCAOB inspection process is succeeding in increasing the efficiency and cost-effectiveness of the audit process, we will take a giant step toward 'getting it right' when it comes to Section 404 compliance."

Concurrently, the PCAOB announced a "Four Point Plan to Improve Implementation of Internal Control Reporting Requirements." The plan includes: amending AS2; reinforcing auditor efficiency through PCAOB inspections, as previously announced; guidance and education for auditors of smaller companies (which PCAOB will develop or assist in developing); and continuation of PCAOB's Forums on Auditing in the Small Business Environment.

Amendments to AS2 being considered include clarifying the definitions of "significant deficiency and material weakness in internal control;" reconsidering the "strong indicators of a material weakness" to allow for more judgment in determining whether a deficiency exists; guiding auditors to increase their use of the work of others, where appropriate; clarifying materiality and scoping decisions; emphasizing the integration of the audit of internal control with the audit of the financial statements; and allowing for and promoting auditors' use of experience gained in previous years' audits to focus and make most efficient the work in subsequent years.

Acting PCAOB Chairman Bill Gradison said in a press release that the board's "mission is to protect the interests of investors and the public in the reliability of audited financial statements. Internal control over financial reporting plays a significant role in enhancing this reliability. Now that many companies have had two years of experience implementing the Act's internal control reporting requirements, the board is in a good position to evaluate how to make the auditor's involvement as efficient as possible, without sacrificing the benefits we have already begun to see."