The SEC today voted to publish interpretative guidance to assist the management of an Exchange Act reporting company in planning and performing its annual evaluation of internal control over financial reporting pursuant to Section 404 of the Sarbanes Oxley Act of 2002.
The guidance (which is intended to clarify and tailor the SOX 404 reporting process to individual companies' circumstances and give separate guidance to management, who have up till now been relying on guidance originally issued for auditors) covers the following areas:
-
identifying risks to financial statement account and disclosure accuracy and the related internal controls that address the risks, including how management might use company-level controls to address the risks. This process focuses on information material to shareholders;
-
objectives of the evaluation procedure and approaches available to management to gather evidence to support management's assessment;
-
factors management should consider to determine the nature, timing and extent of its evaluation procedures; and
-
documentation requirements, including overall objectives of the documentation and factors that might influence documentation requirements.
In addition, the SEC is proposing amendments to rules under the Exchange Act making it clear that a company choosing to perform an evaluation of internal controls in accordance with the interpretative guidance would satisfy the annual evaluation required by those rules.
The SEC also proposes to combine into one location the auditors' assessments of internal controls, and require that auditors focus on the effectiveness of internal controls rather than management's evaluation of those controls.
We will distribute a memorandum describing the interpretative guidance in detail as soon as its text is published. The Public Accounting Oversight Board will issue confirming guidance to auditors next week.