Small companies with a market cap of less than $75 million and a fiscal year that ends in December must perform their first external auditor attestation of internal financial reporting controls. Since 2007, smaller companies have been required to comply only with the 404(a). AS5 has made things easier and clearer, but 404(b) is not something you can get around. New SEC Chairman Linda Shapiro thinks small company compliance with 404(b) may be a good idea.