September 8, 2003 --  On June 5, 2003, the Securities and Exchange Commission (“SEC”) issued its final rules on Management’s Reports on Internal Control over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports.  Such rules were effective as of August 14, 2003 , except for the requirement of an annual report on internal controls over financial reporting by management, which is required for fiscal years ending after June 15, 2004 for accelerated filers and for fiscal years ending after April 15, 2005 for companies which are not accelerated filers.  

In its final rules, the SEC defined certain terminology and clarified management’s reporting obligations, as required by Sections 302 and 404 of the Sarbanes-Oxley Act (“the Act”).  Described below are some of the key points in the SEC’s final rules.  

Internal Control over Financial Reporting vs. Disclosure Controls and Procedures  

Within its final rules, the SEC defined internal control over financial reporting, the focus of Section 404 of the Sarbanes-Oxley Act, as:  

A process designed by, or under the supervision of, the registrant’s principal executive and principal financial officers, or persons performing similar functions, and effected by the registrant’s board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:  

·         Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant;  

·         Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the registrant are being made only in accordance with authorizations of management and directors of the registrant; and

·         Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the registrant’s assets that could have a material effect on the financial statements.

In differentiating internal controls over financial reporting from disclosure controls and procedures, which management is required under Section 302 of the Sarbanes-Oxley Act to evaluate and issue a report on in each quarterly report, the SEC referred to its definition of disclosure controls and procedures as provided in the Exchange Act Rule 13a-15(d) which defines disclosure controls and procedures as controls and procedures of a company that are designed to ensure that information required to be disclosed by the company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms.  

Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that the information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions as appropriate to allow timely decisions regarding required disclosure.  

While the SEC acknowledged that there is logically a great deal of overlap between internal controls over financial reporting and disclosure controls and procedures, it maintains that there are some elements of both that are not included in the other.  Certain components of internal control over financial reporting pertaining to the accurate recording of transactions and disposition of assets or to the safeguarding of assets need not be included in a company’s designed disclosure controls and procedures.  An example of this would be where dual signature requirements are designed as a component of internal controls over financial reporting in order to safeguard assets, while such a designed control might not be a part of the company’s disclosure controls and procedures.  

Annual Internal Control Report by Management  

As required by Section 404 of the Sarbanes-Oxley Act, the SEC adopted rules which require companies subject to the reporting requirements of the Securities Exchange Act of 1934 (other than registered investment companies) to include in their annual reports a report by management on the company’s internal control over financial reporting.

The report must include the following:  

• A statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting for the company;

• Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year;
• A statement identifying the framework used by management to evaluate the effectiveness of the company’s internal control over financial reporting; and

• A statement that the company’s registered public accounting firm that audited the company’s financial statements included in the annual report has issued an attestation report on management’s assessment of the company’s internal control over financial reporting.

Quarterly Evaluations and Reporting  

As part of its final rules, the SEC modified the timeframe for the conclusions of the company’s principal executive and financial officers about the effectiveness of disclosure controls and procedures, from as of a date within 90 days of the filing date of the quarterly or annual report, to an evaluation date as of the end of the period covered by the quarterly or annual report.  The SEC previously issued rules regarding the adoption of evaluations and disclosures required by Section 302 of the Sarbanes-Oxley Act, which were effective on August 29, 2002 .

Additionally, as part of its final rules, the SEC also requires that a company disclose any change in its internal control over financial reporting that occurred during the fiscal quarter covered by the quarterly report, or the last fiscal quarter in the case of an annual report, that has materially affected, or is reasonably likely to materially affect, the company’s internal control over financial reporting.  Such reporting will be required with the first quarterly reporting by a company after it is required to provide an annual report on internal controls over financial reporting.

* * * * *

The purpose of this article is to provide an overview of the SEC’s recent rules regarding amendments to its adoption of Section 302 of the Sarbanes-Oxley Act, and adoption of Section 404 of the Act.  Companies should consult qualified advisors as a part of their implementation process for these reporting standards.

Back to 2003 News