Requires the attestation and report by a registered public accounting firm on an issuer's management assessment of its internal control structure and procedures to focus upon the process and system used by management to identify and manage risks, identify and implement key controls, and come to a conclusion on the effectiveness of the internal controls over financial reporting.

Prohibits an auditor's attestation and report from including a separate (pass/fail) opinion on the effectiveness of such internal controls.

Requires such attestation and report to be performed at three-year intervals.

Prescribes standards for such attestations and reports, including a risk-based evaluation.

Permits attestations and reports to rely on examinations and inspections by federal and state regulatory agencies.

Instructs the Securities and Exchange Commission (SEC) to develop a standard of materiality for such assessments and reports based upon the relationship of the internal control to the reasonably possible effects on the financial statements of the issuer, and its significance to the overall financial status of the issuer.

Exempts a smaller public company from the requirements for management assessment of internal controls, unless it voluntarily elects to comply with them.

Directs the SEC and the Public Company Accounting Oversight Board to jointly conduct studies: (1) examining the lack of, and impediments to, robust competition for the performance of audits for issuers; and (2) comparing and contrasting the principles-based Turnbull Guidance under the British securities laws to the implementation of section 404 of Sarbanes-Oxley (concerning management assessment of internal controls).