At yesterday's open Commission meeting, the biggest surprise was the SEC's acknowledgement of the massive workload required for internal control attestations - the SEC moved back the effective date of the Section 404 internal control report from this fall to the middle of next year. "Accelerated filers" will file their first report for fiscal years ending after June 15, 2004 - all others can wait until their fiscal years ending after April 15, 2005.
Here are some significant components of the final rules under Section 404 of Sarbanes-Oxley:
- clarification that quarterly report unnecessary; rather, only material changes to internal controls needs to be disclosed quarterly
- the definition of "internal control over financial reporting" is not defined by referring to defintion under AU Section 319 - rather, the definition relies on the one in the COSO Report - and the SEC has built the COSO definition into the rules. In addition, the definition includes language from Section 103 of Sarbanes-Oxley (i.e. the specific assertions about internal control matters that registered
public accounting firms must make) - and includes the component of internal control over the safeguarding of assets.
- foreign private issuers and financial institutions that are under other regulatory internal control regimes will be "accommodated" by the SEC - but will not be exempted from the new rules
The SEC adopted the CEO/CFO certification proposal substantially as proposed.The SEC's press release on these actions is at http://www.sec.gov/news/press/2003-66.htm.
For TheCorporateCounsel.net subscribers, we have provided 3 new disclosure analyses: which companies have adopted QLCCs; how companies are disclosing their pre-approval of non audit service policies; and which companies have suspended/terminated split dollar arrangements. These analyses are in our "Disclosure" Practice Area at http://www.thecorporatecounsel.net/member/FAQ/Disclosure/.