United States: Financial and Disclosure Controls and Reporting Under Sections 302 And 404 Of The Sarbanes-Oxley Act

Section 404 of the Sarbanes-Oxley Act of 2002 requires that the Securities and Exchange Commission adopt disclosure requirements for a periodic "internal control report." The report must describe management's responsibility for establishing and maintaining a series of internal controls and must contain an assessment of those controls as of the end of the preceding fiscal year. The auditor's report for those financial statements must "attest to, and report on," management's assessment.

As directed, on June 5, 2003, the SEC issued final rules requiring companies subject to the reporting requirements of the Securities Exchange Act, other than registered investment companies, to include in their annual reports, in addition to other reporting obligations, a management report on the company's internal controls over financial reporting.

On our website, please find an advisory bulletin prepared to assist issuers in evaluating or redesigning their internal control systems and procedures to comply with the new Section 404 regulations. Issuers should also note that the requirements to evaluate, report and certify internal controls under Section 404 are in addition to the senior officer certification requirements for "disclosure controls and procedures" currently in effect under Section 302 of the Act. As a result, this bulletin also discusses the certification requirement under section 302 as it relates to Section 404 compliance and recommends a few practical guidelines for designing working controls and achieving reporting compliance.