Internal control over financial reporting is further defined in the SEC  regulations implementing Section 404 of the Sarbanes-Oxley Act.regulations define internal control over financial reporting as a means of  providing reasonable assurance regarding the reliability of financial  reporting and the preparation of financial statements, including those  policies and procedures that: pertain to the maintenance of records that, in reasonable detail,  accurately and fairly reflect the transactions and dispositions of the  assets of the company; provide reasonable assurance that transactions are recorded as  necessary to permit preparation of financial statements in conformity  with generally accepted accounting principles, and that receipts and  expenditures of the company are being made only in accordance with  authorizations of management and directors of the company; and provide reasonable assurance regarding prevention or timely  detection of unauthorized acquisition, use, or disposition of the  company’s assets that could have a material effect on the financial  statements. On July 21, 2010, the Dodd-Frank Act  permanently exempted nonaccelerated filers from the auditor attestation  requirement. The Percentage of Exempt Companies with Financial Restatements Was Generally Greater Than the Percentage of Nonexempt Companies from 2005 through 2011

Since the implementation of the Sarbanes-Oxley Act, the number and  percentage of exempt companies restating their financial statements has  generally exceeded the number and percentage of nonexempt companies  restating. Exempt and nonexempt  companies restated their financial statements for similar reasons, and the  majority of these restatements produced a negative effect on the  companies’ financial statements. Views on the Costs and Benefits of Auditor Attestation Vary among Companies and Others

Companies and others identified various costs of the auditor attestation  requirement. However, determining  whether auditor attestation compliance costs outweigh the benefits is  difficult because many costs and benefits cannot be readily quantified. Auditor Attestation Costs Can Be Significant, Especially for Small Companies, but Costs Are Declining

A number of studies and surveys show that the estimated costs of  obtaining an external auditor attestation on internal control over financial  reporting are significant for companies of all sizes. Moreover, in response to a  2010 Center for Audit Quality (CAQ) survey of individual investors, almost  two-thirds of investors said they were concerned about exempting  companies with annual revenues of under $75 million from the  independent auditor attestation requirement, suggesting that the  requirement has a positive effect on individual investors’ confidence in the  financial information generated by smaller companies. Currently, exempt companies are  not required to disclose in their annual reports whether they have  voluntarily obtained an auditor attestation on their internal controls. SEC officials said that it is not common for the agency to require a  company to disclose compliance status for requirements that are not  applicable to the company—which, according to SEC officials, could  potentially influence a company’s behavior. Although information on voluntary  compliance with the auditor attestation requirement is determinable,  having the information explicitly disclosed could benefit investors. Federal  securities laws require public companies to disclose relevant information  to investors to aid them in their investment decisions. Although  information on a company’s exempt status is available to investors,  explicit disclosure would increase transparency and investor protection by  making investors readily aware of whether a company has obtained an  auditor attestation on internal controls. Recommendation for Executive Action

To enhance transparency and investor protection, we recommend that  SEC consider requiring public companies, where applicable, to explicitly  disclose whether they obtained an auditor attestation of their internal  controls. Appendix I: Objectives, Scope, and Methodology

This report discusses: (1) how the number of financial statement  restatements compares between exempt and nonexempt companies; (2)  the costs and benefits for nonexempt companies as well as exempt  companies that voluntarily comply with the auditor attestation  requirement; and (3) what is known about the extent to which investor  confidence in the integrity of financial statements is affected by whether  or not companies comply with the auditor attestation requirement. We  define exempt companies as those with less than $75 million in public  float (nonaccelerated filers) and nonexempt companies as those with $75  million or more in public float (accelerated filers). GAO. GAO. GAO. U.S. Securities and Exchange Commission. Study of the Sarbanes-Oxley  Act of 2002 Section 404 Internal Control over Financial Reporting  Requirements.
Why GAO Did This Study

Section 404(b) of the Sarbanes-Oxley Act requires a public company to have its independent auditor attest to and report on management's internal control over financial reporting; this is known as the auditor attestation requirement. In July 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act exempted companies with less than $75 million in public float from the auditor attestation requirement. The act mandated that GAO examine the impact of the permanent exemption on the quality of financial reporting by small public companies and on investors. This report discusses (1) how the number of financial statement restatements compares between exempt and nonexempt companies (i.e., those with $75 million or more in public float), (2) the costs and benefits of complying with the attestation requirement, and (3) what is known about the extent to which investor confidence is affected by compliance with the auditor attestation requirement. GAO analyzed financial restatements and audit fees data; surveyed 746 public companies with a response rate of 25 percent; interviewed regulatory officials and others; and reviewed laws, surveys, and studies.

What GAO Found

Since the implementation of the auditor attestation requirement of the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act), companies exempt from the requirement have had more financial restatements (a company's revision of publicly reported financial information) than nonexempt companies, and the percentage of exempt companies restating generally has exceeded that of nonexempt companies. Exempt and nonexempt companies restated their financial statements for similar reasons (e.g., revenue recognition and expenses), and the majority of these restatements produced a negative effect on the companies' financial statements.
Views on the costs and benefits of auditor attestation vary among companies and others. Although companies and others reported that the costs associated with compliance can be significant, especially for smaller companies, GAO's and others' analyses show that these costs have declined for companies of all sizes since 2004. Companies and others reported benefits of compliance, such as improved internal controls and reliability of financial reports. However, measuring whether auditor attestation compliance costs outweigh the benefits is difficult and views among companies and others were mixed as to whether the costs exceeded the benefits of compliance.
A majority of empirical studies GAO reviewed suggest that compliance with the auditor attestation requirement has a positive impact on investor confidence in the quality of financial reports. Some interviewees said the independent scrutiny of a company's internal controls is an important investor protection safeguard. The Securities and Exchange Commission (SEC) does not require exempt companies to disclose in their annual report whether they voluntarily obtained an auditor attestation. SEC officials said it is not common for SEC to require a company to disclose voluntary compliance with requirements from which it is exempt. However, federal securities laws require companies to disclose relevant information to investors to aid in their investment decisions. Although information on auditor attestation status is available to investors, requiring a company to explicitly state whether it has obtained an auditor attestation on internal controls could increase transparency and investor protection.

What GAO Recommends

GAO recommends that SEC consider requiring public companies, where applicable, to explicitly disclose whether they obtained an auditor attestation of their internal controls. SEC responded that investors could determine attestation status from available information. But without clear disclosure, investors may misinterpret a company's status; therefore, this warrants SEC's further consideration.