Client Publication June 19, 2003 SEC Adopts Final Rules Relating to Internal Control Reports The Securities and Exchange Commission (the SEC ) has adopted final rules under Section 404 of the Sarbanes-Oxley Act of 2002 (the Act ) that will require both U.S. and non-u.s. reporting companies to include in their annual reports a report of management on the company s internal control over financial reporting. The company s independent auditor will be required to issue an attestation report on management s assessment of the company s internal control over financial reporting and the attestation report will be required to be filed as part of the annual report. Finally, management will be required to evaluate and disclose on a quarterly basis any change in the company s internal control over financial reporting that occurred during a fiscal quarter that has materially affected, or is reasonably likely to materially affect, the company s internal control over financial reporting. The final rules under Section 404 do not apply to assetbacked issuers or registered investment companies. The final rules also make conforming changes to the form of certification under Section 302 of the Act. In addition, to facilitate monitoring by the SEC and the public, new rules require that the certifications required by Sections 302 and 906 of the Act be filed as exhibits to the periodic reports to which they relate. The adopting release, Management s Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, Release No. 33-8238 (June 5, 2003), is available at http://www.sec.gov/rules/final/33-8238.htm. Required framework for management s evaluation of the effectiveness of internal control; Adoption of a specific standard on which management should base its conclusion that the company s internal control over financial reporting is effective; Less onerous quarterly evaluations of internal control over financial reporting; and Significantly later compliance dates. Compliance Dates Management Internal Control Report The SEC originally proposed to require companies to include a management internal control report in their annual reports for fiscal years ending on or after September 15, 2003. The SEC has delayed the compliance date as follows: Companies that are accelerated filers 1 as of the end of their first fiscal year ending on or after June 15, 2004 must comply beginning with their annual reports for that fiscal year. Non-U.S. companies and companies that are not accelerated filers must comply beginning with their annual reports for fiscal years ending on or after April 15, 2005. Quarterly Evaluation U.S. companies must comply with the quarterly evaluation requirements in their first quarterly report on Form 10-Q due after the first annual report required to include a management report on Significant Changes from Proposals The following are some of the more significant changes from the proposal regarding internal control reports: Adoption of a new, more narrowly defined term for internal control; 1 A company is an accelerated filer if it has (i) a common equity float of at least $75 million as of the last business day of its most recently completed second fiscal quarter; (ii) been subject to the periodic reporting requirements of the Securities Exchange Act of 1934 (the Exchange Act ) for at least twelve months; and (iii) previously filed at least one annual report on Form 10-K.
2 internal control over financial reporting. Non-U.S. companies must comply with this requirement in their next annual report after the first annual report required to include a management report on internal control. Modifications to Section 302 Certification Companies must comply with the new rules requiring modifications to the Section 302 certification beginning with their first quarterly, semi-annual or annual report due on or after August 14, 2003. Modifications that relate to internal control over financial reporting may be omitted until the first annual report required to contain a management internal control report, as described above. Exhibit Requirements for Sections 302 and 906 Certifications Companies must file their Sections 302 and 906 certifications as exhibits beginning with their first quarterly, semi-annual or annual report due on or after August 14, 2003. Management s Internal Control Report The final rules add new Item 308 of Regulation S-K, which requires an annual report of management regarding the company s internal control over financial reporting. The report must include: A statement of management s responsibility for establishing and maintaining adequate internal control over financial reporting for the company; A statement identifying the framework used by management to evaluate the effectiveness of the company s internal control over financial reporting; Management s assessment of the effectiveness of the company s internal control over financial reporting as of the end of the company s most recent fiscal year, including a statement as to its effectiveness; and A statement that the auditor has issued an attestation report on management s assessment. Management is precluded from determining that a company s internal control over financial reporting is effective if there are any material weaknesses in such control. The term material weakness has the meaning given such term under the AICPA s Codification of Statements on Auditing Standards AU 325. It means a significant deficiency in the control system where there is more than a relatively low risk of material error or fraud in the financial statements going undetected by company employees in the normal course of performing their assigned tasks. The SEC notes that some companies have been indicating in their disclosure controls and procedures disclosure (under Item 307 of Regulation S-K, Item 15 of Form 20-F and General Instruction B(6) to Form 40-F) that controls and procedures are designed only to provide reasonable assurance that they will meet their objectives disclosure to which the SEC has not objected. 2 The SEC clarifies that the concept of reasonable assurance is built into the definition of internal control over financial reporting and suggests that, if management decides to include a discussion of reasonable assurance in the internal control report, the discussion must be presented in a manner that neither makes the disclosure in the report confusing nor renders management s assessment concerning the effectiveness of the company s internal control over financial reporting unclear. Meaning of Internal Control over Financial Reporting The final rule substitutes the term internal control over financial reporting for the term internal control and procedures for financial reporting and defines it more narrowly than proposed. It means: A process designed by, or under the supervision of, the registrant s principal executive and principal financial officers, or persons performing similar functions, and effected by the registrant s board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles ( GAAP ) and includes those policies and procedures that: Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the company; Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures of the company are being 2 The SEC staff has, however, requested companies including that type of disclosure to set forth, if true, the conclusions of the chief executive and chief financial officer that the disclosure controls and procedures are, in fact, effective at the reasonable assurance level; disclosure that there is no assurance that the disclosure controls and procedures will operate effectively under all circumstances would not be acceptable.
3 made only in accordance with authorizations of management and directors of the company; and Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company s assets that could have a material effect on the financial statements. Framework for Management s Evaluation The final rules require management to base its evaluation of the effectiveness of the company s internal control over financial reporting on a suitable, recognized control framework that has been subject to public comment and that, among other things, is free from bias, permits reasonably consistent qualitative and quantitative measurements of a company s internal control, and is relevant to an evaluation of internal control over financial reporting. While the final rules do not mandate the use of any particular framework, the SEC explicitly recognizes the following frameworks as satisfying these criteria: The framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (the COSO Report ); 3 The Turnbull Report, published by the Institute of Chartered Accountants in England and Wales; and Guidance on Assessing Control, published by the Canadian Institute of Chartered Accountants. The COSO framework has been used by federally insured depository institutions and bank holding companies in connection with internal control requirements under Federal Deposit Insurance Corporation regulations since 1993 and is expected to become the dominant framework in the United States. Auditor Involvement Because the independent auditor will be required to attest to management s assessment of internal control 3 The Treadway Commission, established in 1987 to examine fraudulent financial reporting, was sponsored by the American Institute of Certified Public Accountants, the American Accounting Association, the Financial Executives International (formerly Financial Executives Institute), the Institute of Internal Auditors and the Institute of Management Accountants (formerly the National Association of Accountants). An executive summary of the COSO Report, Internal Control Integrated Framework (1992) and Addendum to the Reporting to External Parties (1994) is available at http://www.coso.org. over financial reporting, management and the company s independent auditor will be required to coordinate their documentation and testing of internal control. While the independent auditor may assist management in documenting internal controls, the SEC states that management must be actively involved in the process and cannot delegate its responsibility in the process. In determining the auditors level of involvement, consideration should be given to preserving the auditor s independence. SEC rules prohibit an auditor from providing certain non-audit services to an audit client 4 on the grounds that they may conflict with the SEC principle that an auditor should not audit its own work. Thus, while an auditor may evaluate, assist, review and comment, it may not design or implement the system because the system will later be subject to the auditor s own audit procedures. Documentation and Testing A company must maintain evidence, including documentation, to provide reasonable support for management s assessment of the effectiveness of the company s internal control over financial reporting. The evidence should provide reasonable support to show that: The control is designed to prevent or detect material misstatements or omissions; Tests were appropriately planned and performed; and Test results were appropriately considered. Location of Internal Control Report The final rules do not specify where management s internal control report must appear in the company s annual report. However, the SEC states that it is important for the report to be close to the corresponding attestation report issued by the company s independent auditor. The SEC expects that many companies will choose to place the internal control report and attestation report in proximity to the MD&A disclosure or in a portion of the document immediately preceding the financial statements. 4 See Strengthening the Commission s Requirements Regarding Auditor Independence, Release No. 33-8183 (Jan. 28, 2003), available at http://www.sec.gov/rules/final/33-8183.htm.
4 Quarterly Evaluations To give companies greater flexibility in the design of their controls and to accommodate differences in operations, the requirement for a quarterly evaluation is less extensive than for an annual evaluation. Rather than require the disclosure of any significant changes in internal controls, as was proposed, under the final rules, new Item 308 of Regulation S-K requires management to evaluate and disclose: Any change in the company s internal control over financial reporting that occurred during a fiscal quarter that has materially affected, or is reasonably likely to materially affect, the company s internal control over financial reporting. The SEC has revised Item 307 of Regulation S-K to require the evaluation to be made as of the end of the period covered by the Form 10-Q and contained in the Form 10-Q. Non-U.S. companies are subject to this requirement only annually. Although the final rules do not explicitly require companies to disclose the reasons for any change, companies will have to determine whether the reasons for the change, or other information about the circumstances surrounding the change, constitute material information that must be disclosed to make the disclosure about the change not misleading. Overlap with Disclosure Controls and Procedures The SEC went to great length in the adopting release to distinguish between a company s disclosure controls and procedures and its internal control over financial reporting. The SEC noted that, while there is substantial overlap between the two concepts, there are differences, and many companies are expected to design their disclosure controls and procedures so that they do not include all components of internal control over financial reporting. Exhibit Requirement The SEC has amended the exhibit requirements of Forms 20-F and 40-F and Item 601 of Regulation S-K to require the Sections 302 and 906 certifications to be filed as exhibits. 5 5 As directed by the Act, the SEC adopted new Exchange Act Rules 13a-14 and 15d-14, which require a company s principal executive officer(s) and principal financial officer(s) (or persons performing similar functions) each to certify the disclosure in each of the company s annual and quarterly reports. Notably, the SEC has decided to permit companies to furnish rather than file the Section 906 certification on the basis that the statutory language requires the Section 906 certification to accompany the periodic report to which it relates. (This is in contrast to Section 302, which requires that the certification be included in the report.) Information that is furnished to the SEC is not subject to liability under Section 18 of the Exchange Act or to automatic incorporation by reference into a registration statement of the company under the Securities Act of 1933, which would subject it to Section 11 liability. Amended Form of Section 302 Certification The final rules amend the form of certification under Section 302 of the Act, effective as of August 14, 2003. The modified form of certification is attached to this publication. The amendments make conforming changes to the certification, such as clarifying that: disclosures about changes in internal controls and procedures for financial reporting be made with respect to the period covered by the quarterly or annual report, rather than the period subsequent to the required evaluation; and all evaluations be conducted as of the end of the period covered by the report, rather than at any time within 90 days prior to filing. Because the amendments to the certification become effective significantly in advance of the rules relating to internal control over financial reporting, companies are permitted to modify the certification temporarily to eliminate certain references to internal control over financial reporting. (The temporary modifications are indicated in the attached form of certification.) Application of Section 302 Rules to Investment Companies The SEC has made certain technical changes to its rules implementing Section 302 of the Act for registered investment companies to conform to the rule changes made for operating companies and to require issuers to provide the certifications required by Sections 302 and 906 of the Act as exhibits to certain periodic reports. Registered investment companies must comply with the rule and form amendments applicable to them effective from August 14, 2003. Registered investment companies must comply with the amendments to Exchange Act Rules 13a-15(a) and 15d-15(a) and Investment Company Act Rule
5 30a-3(a) that require them to maintain internal control over financial reporting with respect to fiscal years ending on or after June 15, 2004. In addition, a registered investment company s certifying officers may temporarily modify the contents of their Section 302 certifications to eliminate certain references to internal control over financial reporting. Registered investment companies may voluntarily comply with the rule and form amendments before the compliance dates. This memorandum is intended only as a general discussion of these issues. It should not be regarded as legal advice. We would be pleased to provide additional details or advice about specific situations if desired. For more information on the topics covered in this issue, please contact: New York Stephen T. Giove Lisa L. Jacobs Linda C. Quinn Antonia E. Stolper Ottilie L. Jarmel (212) 848-4000 Washington, D.C. Abigail Arms Thomas J. Friedmann (202) 508-8000 San Francisco John D. Wilson (415) 616-1100 Menlo Park Bruce Czachor (650) 838-3600 London James M. Bartos David J. Beveridge Pamela M. Gibson Bonnie Greaves Richard B. Vilsoet (44 20) 7655-5000 Paris Manuel A. Orillac Sami L. Toutounji (33 1) 5389-7000 Frankfurt Stephan Hutter (49 69) 9711-1000 Rome Michael S. Bosco Robert Ellison (39 06) 697-6791 Hong Kong Matthew D. Bersani Hsiao-Chiung Li (852) 2978-8000 Singapore Oren B. Azar Richard J.B. Price (65) 6230-3800 Tokyo Masahisa Ikeda (81 3) 5251-1601 Beijing Lee Edwards (86 10) 6505-3399 Toronto Brice T. Voran Leslie McCallum (416) 360-8484 www.shearman.com 2003 SHEARMAN & STERLING LLP 599 Lexington Avenue, New York, NY 10022 Shearman & Sterling LLP is a limited liability partnership organized under the laws of the State of Delaware.
NEW FORM OF SECTION 302 CERTIFICATION The bolded text may be omitted until the new rule on internal control over financial reporting is effective (i.e., for companies that are accelerated filers as of the end of their first fiscal year ending on or after June 15, 2004, beginning with their annual reports for that fiscal year and for non-u.s. companies and companies that are not accelerated filers, beginning with their annual reports for fiscal years ending on or after April 15, 2005). I, [identify the certifying individual], certify that: 1. I have reviewed this [specify report] of [identify registrant]; 2. Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report; 3. Based on my knowledge, the financial statements, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the registrant as of, and for, the periods presented in this report; 4. The registrant s other certifying officer(s) and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) and internal control over financial reporting (as defined in Exchange Act Rules 13a-15(f) and 15d-15(f)) for the registrant and have: a. designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared; b. designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under our supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles; c. evaluated the effectiveness of the registrant s disclosure controls and procedures and presented in this report our conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by this report based on such evaluation; and d. disclosed in this report any change in the registrant s internal control over financial reporting that occurred during the registrant s most recent fiscal quarter (the registrant s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant s internal control over financial reporting; and 5. The registrant s other certifying officer(s) and I have disclosed, based on our most recent evaluation of internal control over financial reporting, to the registrant s auditors and the audit committee of the registrant s board of directors (or persons performing the equivalent functions): Date: a. all significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the registrant s ability to record, process, summarize and report financial information; and b. any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant s internal control over financial reporting. [Signature] [Title]