TheCorporateCounsel.net

Last month, EY announced the results of a survey it conducted with the Society for Corporate Governance on the use of sub-certifications, which (for any new securities lawyers out there) are “attestations from personnel across the organization regarding the accuracy and completeness of information provided for disclosure purposes.” Here are some of the key findings:

– Sub-certifications are used by 92% of surveyed companies on a quarterly basis. 84% require over 11 employees to provide sub-certifications, with the largest group (31%) reporting that 11 to 20 employees are included in the process. 

– 57% of companies have automated the process, and 26% took a hybrid approach. (Examples of a “manual” process were email, Word, Excel, etc.) 

– 38% provided a formal summary or compilation to the disclosure committee, while 44% treat it separately from the disclosure committee process. 62% report the results to the Audit Committee in some form. 

– The CAO or Controller is most often responsible for administering the process, and the Finance or Accounting Department is typically tasked with vetting concerns.

– Most respondents (68%) that use sub-certifications used one form for all functional areas, roles and organizational levels, and most (78%) distribute them after the end of the reporting period. EY notes that they are often distributed late in the reporting cycle, sometimes when books are substantially closed but before disclosure committee review, so certifiers can “reflect on period-complete information.”

EY shares three recommended best practices based on common gaps in sub-certification programs identified by the survey responses. Those include:

1. Strengthen the connective tissue between sub-certifiers and the disclosure committee

Build tighter, more consistent linkages so insights flow upstream earlier, gaps surface faster and those charged with governance gain clearer visibility into emerging issues. If processes are separately managed (between finance and legal or the sub-certification process and disclosure committee, as examples), confirm productive teaming and open lines of communication exist.

2. Evaluate questionnaires periodically and expand questions to capture emerging risks

Sub-certifications should evolve in tandem with the risk landscape. Treat questionnaires as living tools, periodically pressure-test them and add coverage for new technologies, operational shifts and regulatory developments.

3. Regularly educate sub-certifiers

Even brief refreshers reinforce expectations, sharpen judgment and prevent outdated assumptions from prevailing. Continuous micro-teach-ins keep the process accurate, efficient and audit-ready.

– Meredith Ervine