GAO advises SEC to require disclosure of auditor attestation of ICFR

The U.S. Government Accountability Office (GAO) is recommending that the SEC consider requiring public companies to disclose whether they obtained an auditor attestation of their internal controls over financial reporting (ICFR).

In a report to congressional committees, the GAO said attestation reports increase investor confidence. Requiring disclosure of whether a company voluntarily included an attestation report in its annual report would increase transparency for investors, according to the GAO.

Many public companies are required to have an independent auditor attest to and report on management’s internal control over financial reporting to comply with Section 404(b) of the Sarbanes-Oxley Act of 2002.

But many companies are exempt from the attestation requirement. The Dodd-Frank Wall Street Reform and Consumer Protection Act, P.L. 111-203, enacted in July 2010 exempted companies with less than $75 million in public float from the auditor attestation requirement.

The Jumpstart Our Business Startups (JOBS) Act, P.L. 112-106, passed in 2012, defers the effective date of Section 404 compliance for the first five years after an initial public offering for companies that do not exceed certain market capitalization or revenue thresholds.

Before 2010, when certain companies were temporarily exempt from the auditor attestation requirement, the SEC required explicit disclosure of exemption status in companies’ annual reports, according to the GAO. That disclosure requirement was eliminated in 2010, the GAO report says.

Information on a company’s exempt status is available to investors, but requiring explicit disclosure would increase transparency and investor protection, according to the GAO. Required disclosures about whether a company voluntarily obtained auditor attestation over its internal controls would provide investors with important information, the GAO wrote.

“The disclosure could serve as an important indicator of the reliability of a company’s financial reporting, which may influence investors’ decisions,” the GAO wrote.

Research performed by the GAO found that the percentage of restatements for companies exempt from the auditor attestation requirement was generally higher than the percentage of restatements for nonexempt companies from 2005 to 2011.

In addition, empirical studies reviewed by the GAO suggested that auditor attestations appear to have a positive effect on investor confidence.

In a response included in the GAO report, SEC Chief Accountant Paul Beswick and Lona Nallengara, who’s now the SEC’s chief of staff, wrote that they believe investors already can easily determine whether a company has received auditor attestation over its internal controls based on information currently available.

Beswick and Nallengara wrote that an SEC rule requires issuers that include an attestation in their annual reports also include a statement explaining that the attestation is contained in the report. This helps investors easily identify companies that voluntarily include this information, according to Beswick and Nallengara.

—Ken Tysiac (ktysiac@aicpa.org) is a JofA senior editor.