SOX 404 Disclosures: First-Time Auditor Attestations

In 2017, the administration proposed raising the bar to permanently exempt companies with market cap of less than $250 million from the audit attestation requirement – up from $75 million. The major goal of the proposal is to spur growth in the number of public companies, which have declined sharply since the late 1990s.

Currently, the SEC permits recent IPOs to wait until the second annual report before providing an assessment of internal controls. Public companies with a market cap of less than $75 million are permanently exempt and emerging growth companies (EGCs) are exempt from the auditor attestation of internal controls over financial statements (ICFR). Companies qualify as EGCs for the first five years after becoming public or until total annual gross revenues are greater than $1.07 billion or the companies becomes a “large accelerated filer.”

Ineffective internal controls are associated with poor quality of financial reporting and indicate that material errors may go undetected. The key question, however, is cost-benefit: how much valuable new information do investors receive in the ICFR attestation report?

To understand this question, Audit Analytics looked at companies having a market capitalization of more than $75 million that filed an IPO in the last 5 years.

Lacking the EGC status, these companies would be required to have an auditor report on the effectiveness of internal controls. While nearly 40% of companies that filed for an IPO in 2013 did not provide an auditor attestation, this number more than doubled in 2017 to 99%. The exemption affords companies the ability to gradually establish controls while expending resources on growth.

While EGCs are not required to issue an auditor attestation, they are required to have management assess and report on the companies’ internal controls.

As seen above, the percentage of ineffective first management assessments’ of ICFR have fluctuated over the past five years. On average, 12% of first time management assessments have been ineffective for IPOs, compared to the more than 20% of all management assessments’ over the past five years disclosed as ineffective.

Though fewer companies have filed an auditor’s attestation, the percentage of ineffective first time ICFR auditor attestations are fairly similar to management assessments. On average, nearly 15% of first time auditor attestations have been ineffective for IPOs, which is much higher than the 6% of toal auditor assessments over the past five years that have been ineffective.

To learn more about SOX 404 disclosures or to request a demo of this dataset, e-mail or call 508-476-7007.