Sarbanes-Oxley Act title IV: management's report on internal control over financial reporting and the auditor's attestation

For this purpose an issuer is an issuer whose securities are registered under section 12 of the Securities Exchange Act of 1934, one that is required to file reports under section 15(d) of that Act, or one that files or has filed a registration statement under the Securities Act of 1933 that has not yet become effective and that it has not withdrawn.

Subsection (a) of section 7262 of title 15 requires each annual report of an issuer to contain an internal control report that states the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting. The same report must contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting.

Rule 13a-15 requires an issuer's management, with the participation of the principal executive and principal financial officers, to evaluate the effectiveness of internal control over financial reporting as of the end of each fiscal year. The evaluation is required of an issuer that either had been required to file an annual report for the prior fiscal year or previously had filed one with the Commission, other than a registered investment company.

The framework on which that evaluation is based must be a suitable, recognized control framework established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment. An evaluation conducted in accordance with the interpretive guidance the Commission issued in release 34-55929 satisfies the evaluation the rule requires.

Internal control over financial reporting is a process designed by or under the supervision of the issuer's principal executive and principal financial officers, and effected by its board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

That definition includes policies and procedures that pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer. Rule 13a-15 also requires the issuer to maintain disclosure controls and procedures.

Disclosure controls and procedures are controls and other procedures of an issuer that are designed to ensure that information required to be disclosed in its Exchange Act reports is recorded, processed, summarized and reported within the time periods the Commission's rules and forms specify.

Management must evaluate the effectiveness of those disclosure controls and procedures as of the end of each fiscal quarter, except that a foreign private issuer does so as of the end of each fiscal year and a registered investment company does so within the 90-day period before the filing date of each report requiring certification under Rule 30a-2. Rule 13a-15 does not reach an asset-backed issuer, a small business investment company registered on Form N-5, or a unit investment trust.

Item 308(a) of Regulation S-K requires management's annual report to contain a statement identifying the framework used by management to evaluate the effectiveness of the issuer's internal control over financial reporting. It must also contain management's assessment of effectiveness as of the end of the most recent fiscal year, including a statement whether or not internal control over financial reporting is effective, and disclosure of any material weakness identified by management.

Management is not permitted to conclude that internal control over financial reporting is effective if there are one or more material weaknesses. The issuer must maintain evidential matter, including documentation, to provide reasonable support for management's assessment of the effectiveness of its internal control over financial reporting.

Subsection (b) requires each registered public accounting firm that prepares or issues the audit report for the issuer to attest to, and report on, the assessment made by the management of the issuer. The Board is the Public Company Accounting Oversight Board established under section 7211 of title 15. The firm makes that attestation in accordance with standards for attestation engagements issued or adopted by the Board, and the attestation is not the subject of a separate engagement.

Subsection (b) does not apply to an issuer that is an emerging growth company. Public Law 112-106 added that exclusion to subsection (b) in 2012. Subsection (b) does not apply to an audit report prepared for an issuer that is neither a large accelerated filer nor an accelerated filer as the Commission's Rule 12b-2 defines those terms. Public Law 111-203 added that exemption as subsection (c) in 2010.

Item 308(b) of Regulation S-K requires an accelerated filer or a large accelerated filer that is not an emerging growth company to provide the registered public accounting firm's attestation report on its internal control over financial reporting in its annual report. Item 308(c) requires the issuer to disclose any change in its internal control over financial reporting during its last fiscal quarter that has materially affected, or is reasonably likely to materially affect, that control.

A newly public issuer need not comply with Item 308(a) and (b) until it either had been required to file an annual report for the prior fiscal year or had filed one with the Commission for the prior fiscal year. The Commission's rules took effect on August 14, 2003. An accelerated filer first had to comply with the management report and the registered public accounting firm report requirement for its first fiscal year ending on or after November 15, 2004.

A violation of the Act or of a rule of the Commission under it is treated for all purposes in the same manner as a violation of the Securities Exchange Act of 1934. A person who commits such a violation is subject to the same penalties, and to the same extent, as for a violation of the Securities Exchange Act of 1934 or the rules and regulations issued under it.