Smaller public companies looking for yet another deferral of the internal control auditing requirements of Sarbanes-Oxley should focus their efforts instead on getting ready for the audit.

That’s the message from the Center for Audit Quality as it continues a three-part Webcast next week to help smaller companies’ auditors get up to speed on performing an audit of internal controls integrated with an audit of financial statements under Sarbanes-Oxley. In the first of CAQ’s planned three-part series, Executive Director Cindy Fornelli said there are no indications from the Securities and Exchange Commission that smaller companies will be given yet another deferral on complying fully with Section 404b of Sarbanes-Oxley, which requires an audit of internal control.

“We should all assume a deferral will not happen this year and we should all start preparing for implementation of 404b,” said Fornelli. If the SEC were to defer again, an announcement would have to come “sooner rather than later,” she said. “I don’t think we have information that leads us to believe there will be another deferral.”

Greg Wilson, deputy director of inspections for the Public Company Accounting Oversight Board, said he doesn’t believe there should be any further deferral. “We’d be losing a lot of momentum if the SEC did defer,” he said.

There’s been a great deal learned since internal control reporting and auditing first began under Sarbanes-Oxley in 2004, and smaller companies have already made progress in producing their own management reports on internal control. “Those experiences all serve to make the audit more effective. I’d hate to see them defer it.”

The CAQ’s first Webcast focused on the fundamentals of Auditing Standard No. 5, which tells auditors how to audit internal controls while also auditing financial statements. The Webcast, which is still available for viewing online, covered all the basics for first-time auditors, with a special focus on how to implement the standard in a smaller-company environment.

Wilson said auditors who are doing their first-ever audit of internal control should be careful not to become intimidated by AS5. “You’re already thinking about risk when you look at the financial statements,” he said. “If you’ve done an audit of the financial statements, you’ve already looked at the risk areas. Just transition that over to the control side of the business. Don’t over-think this.”

Next week’s Webcast, scheduled for June 24, will focus on performing tests of controls. Part three of the series on Sept. 16 will cover evaluation of control deficiencies.

Topics