Is a listed company, in the United States

15 U.S.C. 78m(b)(2)(B) · Read the law's page

• It reaches you if you are an issuer that has a class of securities registered under section 12 of the Securities Exchange Act of 1934, or an issuer that is required to file reports under section 15(d) of that Act (section 13(b)(2)).
• Devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that transactions are executed in accordance with management's general or specific authorization (section 13(b)(2)(B)(i)).
• Make that system sufficient to provide reasonable assurances that transactions are recorded as necessary to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and to maintain accountability for assets (section 13(b)(2)(B)(ii)).
• Make that system sufficient to provide reasonable assurances that access to assets is permitted only in accordance with management's general or specific authorization (section 13(b)(2)(B)(iii)).
• Make that system sufficient to provide reasonable assurances that the recorded accountability for assets is compared with the existing assets at reasonable intervals and that appropriate action is taken with respect to any differences (section 13(b)(2)(B)(iv)).

18 U.S.C. 1519 · Read the law's page

• It reaches you if you are any person (the text says "whoever"), not only an issuer or its auditor: any record, document or tangible object is covered when the conduct is in relation to or in contemplation of a matter within the jurisdiction of any department or agency of the United States, or of a case filed under title 11.
• Do not knowingly alter, destroy, mutilate, conceal, cover up, falsify, or make a false entry in a record, document or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of such a matter or case, or in relation to or in contemplation of one.

18 U.S.C. 1520; 17 CFR 210.2-06 · Read the law's page

• The duty is the auditor's: it binds the accountant who conducts an audit or review of the financial statements of an issuer of securities to which section 10A(a) of the Securities Exchange Act of 1934 applies (Rule 2-06 takes the meaning of issuer from section 10A(f) of that Act), and Rule 2-06 also reaches an audit or review of a registered investment company. It reaches you if you operate as that accountant.
• Maintain all audit or review workpapers for 5 years from the end of the fiscal period in which the audit or review was concluded (section 1520(a)(1)).
• Retain for seven years after you conclude the audit or review (Rule 2-06) the records relevant to it, including workpapers and other documents that form the basis of the audit or review, and the memoranda, correspondence, communications, other documents and records, including electronic records, that you create, send or receive in connection with it and that contain conclusions, opinions, analyses, or financial data related to it.
• Retain those records whether they support your final conclusions or contain information or data, relating to a significant matter, that is inconsistent with your final conclusions regarding that matter or the audit or review, including records of a consultation on or resolution of differences in professional judgment.

15 U.S.C. 7241; 17 CFR 240.13a-14 · Read the law's page

• It reaches you if you operate as a company that files periodic reports under section 13(a) of the Securities Exchange Act of 1934 on Form 10-Q, Form 10-K, Form 20-F or Form 40-F: your principal executive officer and principal financial officer, or the persons performing similar functions, at the time of filing must each sign the certification. A report filed by an asset-backed issuer is certified under a separate paragraph of Rule 13a-14, and a report on Form 20-F filed under Rule 13a-19 is outside Rule 13a-14(a).
• Include the certifications as an exhibit to each annual and quarterly report, in the form the report's exhibit requirements specify, with each certifying officer signing personally: a certification may not be signed on an officer's behalf under a power of attorney or other form of confirming authority.
• Have each signing officer certify that he or she has reviewed the report; that, based on his or her knowledge, the report contains no untrue statement of a material fact and omits no material fact necessary to make the statements, in light of the circumstances under which they were made, not misleading; and that the financial statements and other financial information in the report fairly present in all material respects the financial condition and results of operations of the issuer.
• Have the signing officers certify that they are responsible for establishing and maintaining internal controls; that they have designed those controls to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to them by others within those entities, particularly while the periodic reports are being prepared; that they have evaluated the effectiveness of the controls as of a date within 90 days before the report; and that they have presented in the report their conclusions about that effectiveness.
• Have the signing officers certify that they have disclosed to your auditors and the audit committee of your board of directors, or persons fulfilling the equivalent function, all significant deficiencies in the design or operation of internal controls that could adversely affect your ability to record, process, summarize and report financial data; that they have identified for your auditors any material weaknesses in internal controls; and that they have disclosed any fraud, whether or not material, that involves management or other employees who have a significant role in your internal controls.
• Have the signing officers indicate in the report whether or not there were significant changes in internal controls, or in other factors that could significantly affect internal controls, after the date of their evaluation, including any corrective actions regarding significant deficiencies and material weaknesses.

15 U.S.C. 7262; 17 CFR 240.13a-15; 17 CFR 229.308 · Read the law's page

• It reaches you if you operate as an issuer: a company with a class of securities registered under section 12 of the Securities Exchange Act of 1934, a company required to file reports under section 15(d) of that Act, or a company with a pending registration statement under the Securities Act of 1933 that it has not withdrawn. Rule 13a-15 excludes an asset-backed issuer, a small business investment company registered on Form N-5 and a unit investment trust, and its evaluation of internal control over financial reporting does not reach a registered investment company. The auditor's attestation under subsection (b) of section 7262 of title 15 reaches you only if you are a large accelerated filer or an accelerated filer and not an emerging growth company.
• Maintain internal control over financial reporting: a process designed by or under the supervision of your principal executive and principal financial officers, and effected by your board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles, including policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect your transactions and dispositions of assets.
• Maintain disclosure controls and procedures, and have management evaluate their effectiveness, with the participation of your principal executive and principal financial officers, as of the end of each fiscal quarter (each fiscal year for a foreign private issuer; for a registered investment company, within the 90-day period before the filing date of each report requiring certification under Rule 30a-2).
• Have management evaluate the effectiveness of your internal control over financial reporting as of the end of each fiscal year, with the participation of your principal executive and principal financial officers, against a suitable, recognized control framework established by a body or group that has followed due-process procedures, including broad distribution of the framework for public comment.
• Evaluate any change in your internal control over financial reporting that occurred during each fiscal quarter and has materially affected, or is reasonably likely to materially affect, that control, and disclose any such change that occurred in your last fiscal quarter (your fourth fiscal quarter in an annual report).
• Include in each annual report a report of management on your internal control over financial reporting: a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting, a statement identifying the framework management used, management's assessment of effectiveness as of the end of the most recent fiscal year with a statement whether it is effective, and disclosure of any material weakness management identified. Management may not conclude that the control is effective if there are one or more material weaknesses.
• Maintain evidential matter, including documentation, to provide reasonable support for management's assessment of the effectiveness of your internal control over financial reporting.
• If you are a large accelerated filer or an accelerated filer and not an emerging growth company, include in the annual report the attestation report of the registered public accounting firm that audited your financial statements on your internal control over financial reporting. The firm makes that attestation in accordance with standards for attestation engagements issued or adopted by the Public Company Accounting Oversight Board, as part of the audit and not as a separate engagement.
• In the first annual report you file, if you have not yet been required to file an annual report for the prior fiscal year and have not filed one, state in substantially the form Instruction 1 to Item 308 gives that the report omits management's report and the attestation report due to a transition period for newly public companies.

17 CFR 229.106; 17 CFR 249.308 (Form 8-K Item 1.05) · Read the law's page

• This instrument reaches your organization only if it is an SEC reporting company that files on the domestic forms (a United States public company, or an issuer that has registered a class of securities with the Securities and Exchange Commission and files current reports on Form 8-K); a foreign private issuer owes the same two duties on Form 6-K and in item 16K of Form 20-F instead. Declare is_listed_company where that status holds; the role is the fact itself, and no activity stands in for it.
• If your organization is an SEC reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
• If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
• Separately, describe in your annual report, under Regulation S-K Item 106, your processes for assessing, identifying and managing material cybersecurity risks and your board's and management's oversight of those risks.
• An incident disclosure described above may be delayed where the United States Attorney General determines it would pose a substantial risk to national security or public safety and notifies the Commission of that determination in writing; the delay is a capped exception and not a second reporting duty on its own timeline.