SOX lives: continuing risks and opportunities for companies and auditors.

• Position: Regulatory update

the quip "rumors of my death have been greatly exaggerated" is attributed to Mark Twain responding to his premature obituary, It can also be aptly applied in the Sarbanes-Oxley Act of 2002.

Despite a Supreme Court challenge for SOX and heavy business lobbying for congressional repeal, the key provisions of Sec. 10 1 internal control over (financial reporting law on for public companies.

One event of note is the Dodd-Frank Financial Reform Act of 2010, which suspended only die pending requirement dial auditors of smaller public companies report separately on die effectiveness of their client's internal control over financial reporting. Since dial provision was never implemented, this hardly constitutes a major change from existing practice.

The requirement remains for accelerated filer companies dagger public companies: and their auditors to each issue annual internal control reports under SOX See. KM. Smaller non-accelerated filer: public company managements still have to assess, test and attest to the effectiveness of their internal controls under Sec. 404a.

There air risks for companies and auditors who might be temples to believe that SOX is "old business." The SEC guidance and requirements, as well as expectations of die effectiveness of company assessments of internal controls, is unchanged. The penalties to corporate officials associated with false certifications as a result of not following various SRC and SOX regulations are still in place. Financial statement restatements due lo errors detected after reports are issued have implications for companies and auditors. Missed opportunities for efficiency and perpetuation of inefficient practices create unnecessary costs.

One risk that can arise when the assessment process falls short of the intended effectiveness is a late and nasty surprise. Suppose a company failed to identify a control weakness, but the auditor later identified the weakness through tests. This would call into question the effectiveness or the company process, and since many auditor tests are performance near or after the year-end--the discovery may he too late to permit weakness remediation.

[ILLUSTRATION OMITTED]

In such a case, management will publicly report that their controls are ineffective. Had an effective client process been in place to identify the issue in advance, remediation might have be possible before the "as of '" report kite on the controls such that an "effective controls" assertion be made.

...