Moreover, under Section 404 of the
Sarbanes Oxley Act, management is required to produce an
“internal control report” as part of each annual Exchange Act report.
See 15 U.S.C. § 7262. The report must affirm “the responsibility of
management for establishing and maintaining an adequate internal control
structure and procedures for financial reporting.” 15 U.S.C. § 7262)a).
The report must also “contain an assessment, as of the end of the most
recent fiscal year of the Company, of the effectiveness of the internal
control structure and procedures of the issuer for financial reporting.”
Id.
Finally, under both Section 302 and Section 404 of
the Sarbane Oxley Act, Congress directed the SEC to promulgate
regulations enforcing these provisions.
SOX 404
Compliance
has had serious effects on those found
to have material weaknesses in internal control. Under the
Sarbane Oxley Act companies must, for the first time, provide
attestation of internal control assessment. This presents new challenges
to businesses, specifically, documentation of control procedures related
to information technology.
Additionally, PCAOB has issued guidelines on how management should
render their opinion. The main point of these guidelines is that
management should use an internal control framework such as COSO (which
describes how to assess the control environment, determine control
objectives, perform risk assessments, and identify controls and monitor
compliance). Companies have almost uniformly elected COSO as the
standard when choosing an internal control framework.
|