The Securities and Exchange Commission voted in favor of four staff recommendations to work with the Public Company Accounting Oversight Board (PCAOB) to help change Sarbanes-Oxley.

Currently, Sarbanes-Oxley requires companies to monitor and test internal controls over financial reporting. (Notice I didn’t say the company actually has to have good internal controls. As long as they check on whatever they have.) Companies have said this provision is expensive and doesn’t make sense.

The SEC is trying to make Sarbanes-Oxley compliance more cost-effective for companies nad investors. Congress suggested exempting smaller companies from SarbOx all together, but that was rejected by the SEC.

One current suggestion is changing the law to make the process more of a risk-based review of internal controls over financial statements. It’s thought that this would be more cost effective because the implementation (and therefore the cost) is scalable for companies of different sizes.

PCAOB has proposed a new auditing standard, AS-5. Some in the SEC think AS-5 doesn’t go far enough, and since the SEC has the final say over auditing standards for public companies, it remains to be seen what the final form will be.