After several extensions, the Securities and Exchange Commission (the "SEC") has finally settled on a compliance date for non-accelerated filers with respect to Section 404 of the Sarbanes-Oxley Act of 2002 ("Sarbanes-Oxley").

What is Required?

In order to comply with Section 404 there are two reports that are required. One is prepared by management of the company, and the other is prepared by the company's independent auditor.

Management's Report on Internal Control over Financial Reporting

A company that is a reporting company under the Securities Exchange Act of 1934 (the "Exchange Act") is required to include in their Annual Report on Form 10-K or 10-KSB, a report on the effectiveness of the company's internal control over financial reporting (its "ICFR"). In addition, management is required to evaluate, as of the end of each fiscal quarter, any change in the company's ICFR that occurred during the period that has materially affected, or is reasonably likely to materially affect (emphasis added), the company's ICFR. Additional information regarding management's evaluation obligation is detailed later in this article.

Management's report is contained in Item 9A and 9A(T) of Form 10-K, and Item 8A and 8A(T) of Form 10-KSB. Item 308 of Regulation S-K provides the instructions.

There are two important considerations with respect to management's report. First, management's report included in a non-accelerated filer's annual report during the filer's first (emphasis added) year of compliance will be deemed to be "furnished" rather than "filed." This relieves management of liability under Section 18 of the Exchange Act and is designed to relieve any initial tension between management and the independent auditor should their conclusions differ. If, however, the issuer subsequently incorporates by reference its report into a filing under the Exchange Act of the Securities Act of 1933, it will be deemed to be filed.

Second, if the annual report filed for this first year contains management's report but does not contain an attestation report by the independent auditor (see Auditor's Attestation Report on Internal Control over Financial Reporting, below), management's report must contain a statement in substantially the following form:

This annual report does not include an attestation report of the company's registered public accounting firm regarding internal control over financial reporting. Management's report was not subject to attestation by the company's registered public accounting firm pursuant to temporary rules of the Securities and Exchange Commission that permit the company to provide only management's report in this annual report.

Auditor's Attestation Report on Internal Control over Financial Reporting

In addition to management's report, the company's independent auditor is required to issue a report attesting to management's report on the company's ICFR. The auditors we have talked with have indicated that they will want to review the company's internal controls, and then review management's report, before they issue this attestation.

Changes to Certifications

Non-accelerated filers have been allowed to omit the portion of the introductory language in paragraph 4, as well as language in paragraph 4(b) of the certification required by Exchange Act Rules 13a-14(a) and 15d-14(a) that refers to the certifying officers' responsibility for designing, establishing, and maintaining ICFR for the company. These omissions must be re-inserted when the certifications are filed with an annual report that includes a report by management on the effectiveness of the company's ICFR.

The language that has been allowed to be omitted is underlined:

4. The registrant's other certifying officers and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-14 and 15d-14) for the registrant and have:
a) designed such disclosure controls and procedures to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this annual report is being prepared;
b) evaluated the effectiveness of the registrant's disclosure controls and procedures as of a date within 90 days prior to the filing date of this annual report (the "Evaluation Date"); and

When is it Required?

Management's Report

Non-accelerated filers are required to provide management's report on ICFR in its annual report for its first fiscal year ending on or after December 15, 2007.

Auditor's Attestation Report

Non-accelerated filers are required to provide the auditor's attestation report in its annual reports for its first fiscal year ending on or after December 15, 2008.

Changes in Certifications

Non-accelerated filers are allowed to omit the referenced language until it files its first annual report that includes a Management's Report.

What is Management's Evaluation Obligation?

Management is responsible for maintaining a system of ICFR that provides reasonable assurance (emphasis added) regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Management is further responsible for maintaining evidential matters, including documentation, to provide reasonable support for its assessment.

Exchange Act Section 13(b)(7) defines "reasonable assurance" as "such level of detail and degree of assurance as would satisfy prudent officials in the conduct of their own affairs."

Although there are numerous ways for management to conduct an evaluation of its ICFR, SEC Release No. 34-55929 establishes an evaluation method that is a safe harbor for management.

One of the key definitions in the Releases is that of "material weakness" as "a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis."

Newly Public Companies

It is important to highlight that there is a transition period for newly reporting companies. A company will not become subject to the ICFR requirements until it either (i) had been required to file an annual report for the prior fiscal year with the SEC, or (ii) had filed an annual report with the Commission for the prior fiscal year. However, newly public companies are required to include a statement in its first annual report that the annual report does not include either management's assessment on the company's ICFT or the auditor's attestation report. The extra year of filing a management's report without an auditor's attestation does not apply, they must both be filed in the second year.

The Effect of Deficiencies

One of the most common questions we anticipate is "what is effect of having deficiencies in our ICFR?"

None of the NASDAQ exchanges, the American Stock Exchange, nor the Over the Counter Bulletin Board will de-list or negatively identify a company that has reported deficiencies in its ICFR.

On a macro-economic level, the cost of money should be higher for a company that reports deficiencies than for a similar company that does not. Ratings agencies such as Fitch's and Standard & Poor's have published guidance as to how they intend to handle the reports. It remains to be seen whether hedge funds and other PIPE-financing funds will increase the cost of money to issuers that report deficiencies.

All of the auditors we have talked to have said that deficiencies in ICFR will increase the cost of an audit because they have to do extra sampling and follow other time-consuming processes.