SEC posts final rule amendments regarding management's report on internal control

By Cydney Posner

In a companion piece to the SEC's new interpretive guidance for management on internal control over financial reporting ("ICFR"), the SEC has also amended the rules regarding management’s report on ICFR to clarify that an evaluation that complies with the interpretive guidance "is one way to satisfy the requirement for management to evaluate the effectiveness of the issuer’s internal control over financial reporting." The SEC also amended the rules to define the term "material weakness" and to revise the requirements regarding the auditor’s attestation report on the effectiveness of ICFR. At the same time, the SEC proposed for public comment a new definition of the term "significant deficiency."

The new final amendment become effective on August 27, 2007, except the amendment to Rule 2-02T of Reg S-X will be effective from August 27, 2007 until June 30, 2009

Safe Harbor

In implementing SOX 404, the SEC adopted amendments to Rules 13a-15 and 15d-15 to require management of each company to evaluate the effectiveness, as of the end of each fiscal year, of the company’s ICFR and to require companies to include in their annual reports a report by management on ICFR along with an attestation on ICFR from their registered public accounting firms. The new amendments will state that, although there are many different ways to conduct an evaluation of the effectiveness of ICFR, an evaluation conducted in accordance with the interpretive guidance would satisfy the evaluation requirement in those rules. Compliance with the guidance is entirely voluntary, and companies with an established process need not change those processes. (However, as noted in my email of 6/22/07, the safe harbor may provide little comfort because the lack of specificity in the guidance may make it difficult for companies to determine whether or not they have complied.)

Rules 1-02 and 2-02 of Reg S-X and Item 308 of Regs S-B and S-K

The new revisions to Rules 1-02(a)(2) and 2-02(f) of Reg S-X require the expression of a single opinion directly on the effectiveness of ICFR by the auditor in the attestation report on ICFR; the opinion does not address the efficacy of the process followed by management to arrive at its conclusion. The change is intended to clarify that an auditor is not responsible for issuing an opinion on management’s process for evaluating ICFR, while conveying whether management’s assessment is fairly stated. Nevertheless, auditors are required under current auditing standards to evaluate whether management has included in its annual ICFR assessment report all of the disclosures required by Item 308 of Regs S-B and S-K.

Definition of Material Weakness

Under the new amendments to Rule 12b-2 and Rule 1-02 of Reg S-X, a material weakness is defined as "a deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis." This definition is consistent with that adopted by the PCAOB. The SEC determined, notwithstanding comments to the contrary, to retain the "reasonably possible" standard and the reference to interim financial statements. While the "reasonably possible" standard hasessentially the same meaning as the current "more than remote" standard, it is more commonly used in the accounting literature (and certainly sounds less severe). The SEC believes that the judgments about whether a control is adequately designed or operating effectively should take quarterly financial reports into account. Moreover, if management’s annual evaluation identifies a deficiency that poses a reasonable possibility of a material misstatement in the company’s quarterly reports, the SEC believes management should disclose the deficiency to investors and not assess ICFR as effective.

Proposed Definition of Significant Deficiency

In a separate release, the SEC has proposed for public comment a definition of "significant deficiency." Under the SEC's rules, management is required to report significant deficiencies in ICFR to the external auditor and to the audit committee so that they can evaluate them and otherwise carry out their responsibilities with regard to financial reporting. However, companies do not need to report significant deficiencies to investors. As a result, the SEC takes the position that the focus of the term "significant deficiency" should be the underlying communication requirement. Therefore, under the proposal, "significant deficiency" would be defined as "a deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of a registrant’s financial reporting."

Transition Issues

Although the amendments to Rules 1-02 and 2-02 of Reg S-X will no longer require the auditor to separately express an opinion concerning management’s assessment of the effectiveness of ICFR, audits conducted under AS 2 will continue to result in a separate opinion until AS 5 becomes effective and is required for all audits. Until then, companies may file whichever report they receive from their independent auditors (that is, either one that contains both opinions under AS 2 or the single opinion under the expected new auditing standard).

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction, and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may have been generated with the assistance of artificial intelligence (AI) in accordance with our AI Principles, may be considered Attorney Advertising and is subject to our legal notices.