Management of companies, which are not "accelerated
filers"1 can breathe a sigh of relief that they are not
required to comply with the Securities and Exchange Commission's internal
controls reporting rules until their first fiscal year ending on or after July
15, 2006. Management would be wise to use this additional time to prepare for
these disclosures and learn from the experiences of accelerated filers, which
were required to comply with these disclosure requirements in their 2004 Annual
Reports on Form 10-K.
Section 404(a) of the Sarbanes-Oxley Act of 2002 mandated that the SEC
prescribe rules requiring each Annual Report on Form 10-K to contain a
management report acknowledging the responsibility of management for
establishing and maintaining an adequate internal control structure and
procedures for financial reporting and containing an assessment, as of the end
of the most recent fiscal year, of the effectiveness of the internal control
structure and procedures.
Section 404(b) of the Sarbanes-Oxley Act of 2002 requires each registered
public accounting firm that prepares or issues an audit report to attest to, and
report on, the assessment made by management in accordance with Section 404(a).
The SEC adopted rules to implement these required disclosures. The annual
report on Form 10-K requires disclosure of the conclusions of the principal
executive officer and principal financial officer regarding the effectiveness of
a company's disclosure controls and procedures based on management's evaluation.
The rules also require that the annual report on Form 10-K contain management's
report concerning the company's internal control over financial reporting and
the attestation report of the registered public accounting firm. The management
report and the attestation report by the registered public accounting firm have
been termed the "404 disclosures."
The SEC somewhat belatedly recognized the significant resources, primarily
time and money, that accelerated filers were expending in trying to comply with
these new requirements. On November 30, 2004, just one month before the fiscal
year-end of many companies, the SEC issued an exemptive order granting certain
smaller accelerated filers a 45-day extension to make the new 404 disclosures
through an amendment to the 10-K. The exemptive order pertained only to the
filing of management's report on internal controls and the related attestation
report by the company's registered public accounting firm. However, many
companies were informed that the registered public accounting firm could not (or
would not) issue their report on the company's financial statements if the
management report on internal control over financial reporting and/or the
registered public accounting firm's attestation report were not completed.
Management was faced with a dilemma. The annual report on Form 10-K could not
be filed without the registered public accounting firm's report on the financial
statements, and the SEC's exemptive order provided an extension only for filing
the attestation report by the registered public accounting firm (or management's
report over financial reporting) and not for filing the registered public
accounting firm's report on the financial statements. The SEC has previously
stated that a 10-K without a report on the financial statements is incomplete.
The result was that many companies were required to file their entire 10-K late,
even though management and the board of directors believed the 10-K was complete
except for the 404 disclosures. Delays in getting the information contained in
the 10-K to the investing public usually is something management and the board
seek to avoid, and, presumably, the SEC does not want to encourage.
The best advice for management and in-house counsel who will be going through
this process for the first time in the coming months is to start preparing for
making 404 disclosures as early as possible. If management and the audit
committee determine that an outside consultant is required to review the
company's internal control procedures and assist the company in designing and
implementing improvements, the consultant should be engaged as soon as possible.
(Remember that the registered public accounting firm cannot provide these
consulting services because if they did, they would not been deemed
"independent.")
Obviously, the audit committee should discuss with the company's registered
public accounting firm and management on a quarterly basis any concerns that
they may have about the company's internal control procedures. Additional
meetings should be held, if necessary, to address any issues that may arise
during the year.
Even with careful planning, it is likely that the chief financial officer and
his or her staff will be required to expend a significant amount of time during
the fourth quarter of the fiscal year and the first few months of the next
fiscal year in complying with the 404 disclosure requirements. Other projects
involving the same personnel should be scheduled for other times during the
year.
When budgeting for expenditures, management should recognize that the first
year of compliance with the internal control reporting requirements is likely to
be expensive. Even if a consultant is not engaged, the registered public
accounting firm's fees are likely to be significantly higher than the prior
year.
The chief financial officer should establish and disseminate early in the
year, to all those employees who report to him or her, a detailed timeline of
what reports are required and when. Many companies have implemented a system
requiring internal certifications by members of the financial staff who report
to the chief financial officer. Staff are required to "certify" the information
they provide to the chief financial officer in the same way that the chief
financial officer and the chief executive officer are required to provide
certifications as exhibits to each Annual Report on Form 10-K and quarterly
report on Form 10-Q filed by the company.2 Whether this
procedure improves the accuracy and completeness of financial reporting, and is
"right" for a particular company depends on the complexity of the company's
business, the size and experience of the company's financial staff and the
nature of the financial issues management faces.
Those who report to the chief financial officer should be encouraged to
discuss with their superiors any concerns they have about the company's
financial reporting. SEC rules promulgated under the Sarbanes-Oxley Act of 2002
require the audit committee to have in place specific procedures for the
receipt, retention and treatment of complaints received by the company regarding
accounting, internal accounting controls, or auditing matters, and for the
confidential, anonymous submission by employees of concerns regarding accounting
or auditing matters. While the chief financial officer should encourage open
communication by those employees involved in financial matters, management may
want to remind employees that concerns may be expressed anonymously, if an
employee would feel more comfortable doing so, and that all issues that are
raised concerning financial matters will be investigated by the audit committee
and its designees, in accordance with SEC regulations.
One of the goals of Congress in enacting the Sarbanes-Oxley Act of 2002 is to
restore public confidence in the integrity of the financial statements contained
in the periodic reports filed by companies with the SEC. Many of the rules
adopted to implement the Sarbanes-Oxley Act establish a system of checks and
balances among the audit committee, the chief financial officer and his or her
internal financial staff, and the registered public accounting firm. While the
company is ultimately responsible for its financial statements, the process
leading to a company's dissemination of financial statements, that the public
can rely on to fairly present a company's financial position, results of
operations and cash flows, should remain a cooperative effort by all of these
groups.
The general counsel has the opportunity to play a significant role in setting
the tone that will prevail during this process - both internally at the company
and in the interactions among management, the audit committee and the registered
public accounting firm. An atmosphere which encourages full discussion of issues
affecting financial disclosure at all levels within the company will likely
result in the identification of concerns earlier rather than later. The earlier
issues are identified, the sooner they can be addressed and ultimately resolved.
If material weaknesses in internal controls over financial reporting are
identified, management's response should be to discuss these weaknesses openly
with the registered public accounting firm and the audit committee and focus on
developing new systems and procedures to eliminate those weaknesses. By
assisting in the development of timelines and reporting procedures and
encouraging honest communication of concerns about financial reporting, the
general counsel can play an important role in making compliance with the 404
disclosure requirements as smooth and painless as possible for all
involved.
1SEC rules define an accelerated filer as a public
company that (i) has a public float of at least $75 million, (ii) has been
subject to the SEC's periodic reporting requirements for at least 12 months,
(iii) has filed at least one Annual Report on Form 10-K and (iv) is not eligible
to use the SEC's small business reporting forms.
2 The
principal executive and principal financial officers must certify that the
applicable report does not contain any untrue statement of a material fact or
omit to state a material fact necessary to made the statements made, in light of
the circumstances under which they were made, not misleading. Once a company is
subject to the 404 disclosure requirements, these officers also must certify
that they have disclosed to the company's public accounting firm and the audit
committee all significant deficiencies and material weaknesses in the design or
operation of internal control over financial reporting, which are reasonably
likely to adversely affect the company's ability to record, process, summarize
and report financial information and any fraud, whether or not material, that
involves management or other employees who have a significant role in the
company's internal control over financial
reporting.
Published May 1, 2005.
