Sarbanes-Oxley Section 404 consulting services for you?

• Author: McFadden, John

All publicly traded companies are subject to compliance deadlines applicable to management reporting on internal controls over financial reporting under the Sarbanes-Oxley Act of 2002 ("SOX"). Those deadlines are now right around the corner.

Many companies are well on their way in addressing SOX requirements. Of immediate concern is the SOX Section 404 requirement that public companies subject to the reporting requirements of the Securities Exchange Act of 1934 (other than registered investment companies) include in their annual reports a report of management on the company's internal controls over financial reporting.

Companies meeting the definition of an "accelerated filer" in Exchange Act Rule 12b-2 (generally companies with $75 million or more in common equity), other than foreign private issuers, are required to comply for their fiscal years ending on or after November 15, 2004. All other issuers (including small business issuers and foreign private issuers) must comply for the fiscal years ending on or after July 15, 2005.

Most companies meeting the "accelerated filer" definition are making substantial progress in meeting these requirements. However, there always are those that procrastinate, underestimate the extent of work needed, or don't have the internal resources to accomplish the task. Smaller registrants subject to the 2005 compliance deadline have fewer internal resources and may not be qualified to determine or accomplish with existing personnel what needs to be done to comply with Section 404.

The SEC's principles of independence indicate that "an auditor cannot function in the role of management [and] an auditor cannot audit his or her own work." Additional SEC guidance states that "... auditors may assist management in documenting internal controls...however, we remind companies and auditors that management cannot delegate this responsibility to assess its internal controls over financial reporting to the auditor."

As a result, both large and small companies increasingly are turning to external service providers for internal controls consulting services and the purchase, installation and implementation of internal controls documentation systems rather than relying on their existing internal resources and external auditors.

Consider this scenario: You're one of five partners in a 40-person CPA firm. Your firm's revenue is derived primarily from personal and business tax services, as well as financial statement work (a few audits, reviews and compilations), computer consulting services and bookkeeping services.

The CFO of a $50-million public company (not a client) calls and seeks your assistance with SOX 404 compliance. The company recently changed auditors and the new CPA firm, in doing preliminary audit work, identified several areas for improvement in internal controls. The CFO thinks the company has good controls...