The Dodd-Frank Wall Street Reform and Consumer Protection Act has today been signed into law in the United States, and section 989G permanently exempts non-accelerated filers from Sarbanes-Oxley section 404(b).
Key points
- Smaller public companies no longer need an external auditor’s attestation on internal control over financial reporting.
- Management must still assess and report on internal controls under section 404(a).
- IT general controls, such as access management, change management and backup, remain central to that assessment.
- Larger accelerated filers remain subject to full auditor attestation.
UK service providers supporting US-listed clients should continue to expect requests for SOC 1 reports and evidence of strong IT general controls.
Source: Dodd-Frank Wall Street Reform and Consumer Protection Act, H.R.4173 (congress.gov)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
