SEC Final Rule: Section 404 Internal Controls

On May 27, 2003, the Securities and Exchange Commission (the "SEC") voted to adopt a final rule (the "Final Rule") implementing Section 404 of the Sarbanes-Oxley Act of 2002 (the "Act")1 concerning management's report on internal control over financial reporting and the related attestation by a company's outside auditors. Thankfully, the SEC pushed back the required date for compliance with the Final Rule's provisions concerning management reporting and auditor attestation until, at the earliest, fiscal years ending on or after June 15, 2004. The Final Rule also amends the content of, and the filing requirements relating to, certifications by a company's CEO and CFO of disclosure in periodic reports required by the Securities Exchange Act of 1934.

Management's Report on Internal Control over Financial Reporting

Under the Final Rule, a public company (other than a registered investment company) is required to include in its annual report a report by management of the company's internal control over financial reporting and an assessment by management of the effectiveness of the company's internal control over financial reporting. Management's internal control report must contain the following items:

• a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the company;
• a statement identifying the framework used by management to conduct the required evaluation of the effectiveness of the company's internal control over financial reporting;
• management's assessment, as of the end of the company's fiscal year, of the effectiveness of the company's internal control over financial reporting, including a statement as to whether or not the company's internal control over financial reporting is effective. The assessment must include disclosure of any material weakness in the company's internal control over financial reporting identified by management and management may not conclude that the company's internal control over financial reporting is effective if there is one or more material weaknesses in the internal control; and
• a statement that the company's public accounting firm has issued an attestation report on management's assessment of the effectiveness of the company's internal control over financial reporting.

The Final Rule defines "internal control over financial reporting" to mean "[a] process designed by, or under the supervision of, the registrant's principal executive and principal financial officers, or persons performing similar functions, and effected by the registrant's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

• pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant;
• provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the registrant are being made only in accordance with authorizations of management and directors of the registrant; and
• provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the registrant's assets that could have a material effect on the financial statements."

Quarterly Evaluations

The Final Rule requires companies to perform quarterly evaluations of changes that have materially affected, or are reasonably likely to materially affect, the company's internal control over financial reporting, and requires that the certifications of the CEO and CFO included in periodic reports that contain financial statements be expanded to include certifications regarding internal controls over financial reporting in addition to the current certifications regarding disclosure controls and procedures. In addition, the existing requirement that the CEO and CFO evaluate the effectiveness of disclosure controls and procedures has been revised to specify that such evaluation must be as of the end of the period covered by the report, rather than as of a date within 90 days of the filing of the report.

Compliance Deadlines

Recognizing the substantial time and resources that companies will expend in order to properly implement the Final Rule, the SEC delayed the compliance deadline of the management report requirement of the Final Rule. Companies (other than foreign private issuers) that meet the definition of an "accelerated filer" will be required to comply with that requirement for fiscal years ending on or after June 15, 2004. All other companies, including small business issuers and foreign private issuers, will be required to comply with the management report requirement for fiscal years ending on or after April 15, 2005. Compliance with the quarterly evaluation requirement is required commencing with the first quarterly report after the first annual management report. Companies may voluntarily comply with the Final Rule prior to the deadline for compliance.

The additional time will provide the SEC, the Public Company Accounting Oversight Board, reporting companies and outside auditors with the opportunity to establish the rules and related procedures for attestations by the outside auditors. Many have been concerned about the likely substantial internal time and resource commitment and cost to outside auditors for these required Section 404 attestations.

Amendment to CEO/CFO Certification Requirements

The Final Rule also revises the forms and rules that are applicable to the certifications by a company's CEO and CFO of that company's periodic reports that are required by Sections 302 and 906 of the Act. The Final Rule amends the exhibit requirements for periodic reports to add such certifications to the list of required exhibits. The form of Section 302 certification has been changed in certain respects, principally to reflect the changed date for the required evaluation of disclosure controls and procedures and to include the new certifications regarding internal controls over financial reporting. The amendments concerning certifications generally will become effective for filings that become due on or after 60 days after the date of the publication of the amendments in the Federal Registrar; however, the Final Rule states that certifying officials may modify the prescribed form of certification, as revised by the Final Rule, to delete references to internal controls over financial reporting until such time as the requirements regarding the management report become effective.

1-The complete text of the Act is available to the public at the Library of Congress' website, http://thomas.loc.gov. The Final Rule is available to the public at the SEC's website, http://www.sec.gov/rules/final/33-8238.htm.

This newsletter has been prepared for general informational purposes and does not constitute legal advice.