Management's Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports

Q: Financial Accounting Standards Board (FASB) Interpretation No. 46 (revised December 2003), Consolidation of Variable Interest Entities — An Interpretation of ARB No. 51, requires that registrants apply that guidance and, if applicable, consolidate entities based on characteristics other than voting control no later than the period ending March 15, 2004, or December 15, 2004 for small business issuers. In instances where the registrant lacks the ability to dictate or modify the internal controls of an entity consolidated pursuant to Interpretation No. 46, it may not have legal or contractual rights or authority to assess the internal controls of the consolidated entity even though that entity's financial information is included in the registrant's financial statements. Similarly, for entities accounted for via proportionate consolidation in accordance with Emerging Issues Task Force Issue No. 00-1 (EITF 00-1), management may not have the ability to assess the internal controls. How should management's report on internal control over financial reporting address these situations?

A: We would typically expect management's report on internal control over financial reporting to include controls at all consolidated entities, irrespective of the basis for consolidation. However, in a situation where the entity was in existence prior to December 15, 2003 and is consolidated by virtue of Interpretation No. 46 (i.e., would not have been consolidated in the absence of application of that guidance) and where the registrant does not have the right or authority to assess the internal controls of the consolidated entity and also lacks the ability, in practice, to make that assessment, we believe management's report on internal control over financial reporting should provide disclosure in the body of its Form 10-K or 10-KSB regarding such entities. For example, a registrant could refer readers to a discussion of the scope of management's report on internal control over financial reporting in a section of the annual report entitled "Scope of Management's Report on Internal Control Over Financial Reporting." The registrant should disclose in the body of the Form 10-K or 10-KSB that it has not evaluated the internal controls of the entity and should also note that the registrant's conclusion regarding the effectiveness of its internal control over financial reporting does not extend to the internal controls of the entity. The registrant should also disclose any key sub-totals, such as total and net assets, revenues and net income that result from consolidation of entities whose internal controls have not been evaluated. The disclosure should note that the financial statements include the accounts of certain entities consolidated pursuant to FIN 46 or accounted for via proportionate consolidation in accordance with EITF 00-1 but that management has been unable to evaluate the effectiveness of internal control at those entities due to the fact that the registrant does not have the ability to dictate or modify the controls of the entities and does not have the ability, in practice, to evaluate those controls.

Q: Is a registrant required to evaluate the internal control over financial reporting of an equity method investment?

A: The accounts of an equity method investee are not consolidated on a line-by-line basis in the financial statements of the investor, and as such, controls over the recording of transactions into the investee's accounts are not part of the registrant's internal control structure. However, the registrant must have controls over the recording of amounts related to its investment that are recorded in the consolidated financial statements. Accordingly, a registrant would have to consider, among other things, the controls over: the selection of accounting methods for its investments, the recognition of equity method earnings and losses, its investment account balance, etc. For example, a registrant might require that, at least annually, its equity method investees provide audited financial statements as a control over the recognition of equity method earnings and losses. However, nothing precludes a registrant from evaluating the control over financial reporting of an equity method investment, and there may be circumstances where it is not only appropriate but also may be the most effective form of evaluation. For purposes of applying this guidance, we make no distinction between those equity method investments for which the registrant is required to file audited financial statements pursuant to Rule 3-09 of Regulation S-X and those where no such requirement is triggered.

Q: If a registrant consummates a material purchase business² combination during its fiscal year, must the internal control over financial reporting of the acquired business be included in management's report on internal control over financial reporting for that fiscal year?

A: As discussed above, we would typically expect management's report on internal control over financial reporting to include controls at all consolidated entities. However, we acknowledge that it might not always be possible to conduct an assessment of an acquired business's internal control over financial reporting in the period between the consummation date and the date of management's assessment. In such instances, we would not object to management referring in the report to a discussion in the registrant's Form 10-K or 10-KSB regarding the scope of the assessment and to such disclosure noting that management excluded the acquired business from management's report on internal control over financial reporting. If such a reference is made, however, management must identify the acquired business excluded and indicate the significance of the acquired business to the registrant's consolidated financial statements. Notwithstanding management's exclusion of an acquired business's internal controls from its annual assessment, a registrant must disclose any material change to its internal control over financial reporting due to the acquisition pursuant to Exchange Act Rule 13a-15(d) or 15d-15(d), whichever applies (also refer to the last two sentences in the answer to question 7). In addition, the period in which management may omit an assessment of an acquired business's internal control over financial reporting from its assessment of the registrant's internal control may not extend beyond one year from the date of acquisition, nor may such assessment be omitted from more than one annual management report on internal control over financial reporting.

Q: If management, the accountant, or both conclude in a report included in a timely filed Form 10-K or 10-KSB that the registrant's internal control over financial reporting is not effective, would the registrant still be considered timely and current for purposes of Rule 144 and Forms S-2, S-3, and S-8 eligibility?

A: Yes, as long as the registrant's other reporting obligations are timely satisfied. As has previously been the case, the auditor's report on the audit of the financial statements must be unqualified.

Q: If management's report on internal control over financial reporting does not identify a material weakness but the accountant's attestation report does, or vice versa, does this constitute a disagreement between the registrant and the auditor that must be reported pursuant to Item 304 of Regulation S-K or S-B?

A: No, unless the situation results in a change in auditor that would require disclosure under Item 304 of Regulation S-K or S-B. However, such differences in identification of material weaknesses could trigger other disclosure obligations.

Q: Is a registrant required to provide management's report on internal control over financial reporting, and the related auditor attestation report, when filing a transition report on Form 10-K or 10-KSB?

A: Yes. Because transition reports filed on Forms 10-K or 10-KSB (whether by rule or by election) must contain audited financial statements, they must also include management's report on internal control, subject to the transition provisions specified in Release No. 34-47986. The transition provisions relating to management's report on internal control should be applied to the transition period as if it were a fiscal year. Transition reports on Form 10-Q or 10-QSB are not required to include a management report on internal control.

Q: Is a registrant required to disclose changes or improvements to controls made as a result of preparing for the registrant's first management report on internal control over financial reporting?

A: Generally we expect a registrant to make periodic improvements to internal controls and would welcome disclosure of all material changes to controls, whether or not made in advance of the compliance date of the rules under Section 404 of the Sarbanes-Oxley Act. However, we would not object if a registrant did not disclose changes made in preparation for the registrant's first management report on internal control over financial reporting. However, if the registrant were to identify a material weakness, it should carefully consider whether that fact should be disclosed, as well as changes made in response to the material weakness.

After the registrant's first management report on internal control over financial reporting, pursuant to Item 308 of Regulations S-K or S-B, the registrant is required to identify and disclose any material changes in the registrant's internal control over financial reporting in each quarterly and annual report. This would encompass disclosing a change (including an improvement) to internal control over financial reporting that was not necessarily in response to an identified material weakness (i.e. the implementation of a new information system) if it materially affected the registrant's internal control over financial reporting. Materiality, as with all materiality judgments in this area, would be determined upon the basis of the impact on internal control over financial reporting and the materiality standard articulated in TSC Industries, Inc. v. Northway, Inc. 426 U.S. 438 (1976) and Basic Inc. v. Levinson, 485 U.S. 224 (1988). This would also include disclosing a change to internal control over financial reporting related to a business combination for which the acquired entity that has been or will be excluded from an annual management report on internal control over financial reporting as contemplated in Question 3 above. As an alternative to ongoing disclosure for such changes in internal control over financial reporting, a registrant may choose to disclose all such changes to internal control over financial reporting in the annual report in which its assessment that encompasses the acquired business is included.

Q: In many situations, a registrant relies on a third party service provider to perform certain functions where the outsourced activity affects the initiation, authorization, recording, processing or reporting of transactions in the registrant's financial statements, such as payroll. In assessing internal controls over financial reporting, management may rely on a Type 2 SAS 70 report³ performed by the auditors of the third party service providers. If the auditors of the third party service provider are the same as the auditors of the registrant, may management still rely on that report? Additionally, may management rely on a Type 2 SAS 70 report on the third party based on a different year-end?

A: In situations where management has outsourced certain functions to third party service provider(s), management maintains a responsibility to assess the controls over the outsourced operations. However, management would be able to rely on the Type 2 SAS 70 report even if the auditors for both companies were the same. On the other hand, if management were to engage the registrant's audit firm to also prepare the Type 2 SAS 70 report on the service organization, management would not be able to rely on that report for purposes of assessing internal control over financial reporting. Management would be able to rely on a Type 2 SAS 70 report on the service provider that is as of a different year-end. Note, however, that management is still responsible for maintaining and evaluating, as appropriate, controls over the flow of information to and from the service organization.

Q: If a Form 10-K or Form 10-KSB is incorporated into a 1933 Securities Act filing, is a consent required related to the auditor's report on management's assessment of internal control over financial reporting?

A: Yes. Securities Act Rule 436 (17 CFR 230.436) requires filings under the 1933 Act to include a consent for all accountants' reports included or incorporated into that filing. This includes a consent for the auditor's report on management's assessment of internal control over financial reporting as well as the auditor's report on the financial statements. A new consent for the auditor's report on management's assessment of internal control over financial reporting is required in an amendment to the registration statement (a) whenever a change, other than typographical is made to the audited annual financial statements and (b) when facts are discovered that may impact the auditor's report on management's assessment of internal control over financial reporting.

Q: Is an annual report to shareholders that meets the requirements of Exchange Act Rules 14a-3(b) or 14c-3(a) required to include management's report on internal control over financial reporting and the auditor's report on management's assessment of internal control over financial reporting?

A: We believe that the intent of Section 404 of the Sarbanes-Oxley Act and the Commission's rules is that a registrant's audited financial statements with an accompanying audit report that are contained in or accompany a proxy statement or consent solicitation statement also be accompanied by management's report on internal control over financial reporting and the auditor's report on management's assessment of internal control over financial reporting. We encourage issuers to include both management's report on internal control over financial reporting and the auditor's report on management's assessment of internal control over financial reporting in the annual report to shareholders when their audited financial statements are included. If management states in their report that internal control over financial reporting is ineffective or the auditor's report takes any form other than an unqualified opinion and these reports are not included in the annual report to shareholders, our view is that an issuer would have to consider whether the annual report to shareholders contained a material omission that made the disclosures in the annual report misleading.

Q: The Commission's rules implementing Section 404, announced in Release No. 34-47986, require management to perform an assessment of internal control over financial reporting which includes the "preparation of financial statements for external purposes in accordance with generally accepted accounting principles." Does management's assessment under the Commission's rule specifically require management to assess internal control over financial reporting of required supplementary information? Supplementary information includes the financial statement schedules required by Regulation S-X as well as any supplementary disclosures required by the FASB. One of the most common examples of such supplementary information is certain disclosures required by the FASB Standard No. 69, Disclosures about Oil and Gas Producing Activities.

A: Adequate internal controls over the preparation of supplementary information are required and therefore should be in place and assessed regularly by management. The Commission's rules in Release No. 34-47986 did not specifically address whether the supplementary information should be included in management's assessment of internal control over financial reporting under Section 404. A question has been raised as to whether the supplementary information included in the financial statements should be encompassed in the scope of management's report on their assessment of internal control over financial reporting.

The Commission staff is considering this question for possible rulemaking. Additionally, the Commission staff is evaluating broader issues relating to oil and gas disclosures and will include in its evaluation whether rulemaking in this area may be appropriate. Should there be any proposed changes to the current requirements in this area, they will be subject to the Commission's standard rulemaking procedures, including a public notice and comment period in advance of rulemaking. As a result, internal control over the preparation of this supplementary information need not be encompassed in management's assessment of internal control over financial reporting until such time that the Commission has completed its evaluation of this area and issues new rules addressing such requirements.

Until then, registrants are reminded that they must fulfill their responsibilities under current requirements including Section 13(b)(2) of the Exchange Act and Exchange Act Rules 13a-14, 13a-15, 15d-14, and 15d-15.

Q: Should a foreign private issuer that files financial statements prepared in accordance with home country generally accepted accounting principles (GAAP) or IFRS, with a reconciliation to U.S. GAAP, plan and conduct its evaluation process based on the primary financial statements, or the amounts disclosed in the reconciliation to U.S. GAAP?

A: Management of foreign private issuers should plan and scope their evaluations based upon the primary financial statements (i.e. home country GAAP or IFRS). However, management's evaluation should consider controls related to the preparation of the U.S. GAAP reconciliation because the reconciliation is a required element of the financial statements.

Q: In evaluating the severity of identified deficiencies, how should a foreign private issuer apply the reference to "interim financial statements" in the definition of material weakness?

A: Since home country requirements regarding the preparation of interim financial information vary significantly and there are no uniform requirements under the Exchange Act for foreign private issuers to file periodic interim financial information with the Commission, the reference to "interim financial statements" in that definition is not applicable to foreign private issuers. However, foreign private issuers filing on domestic forms are subject to the same requirements with respect to interim information as domestic issuers.

Q: How should a registrant that is a foreign private issuer treat an entity that is accounted for differently in the primary financial statements (prepared in accordance with home country GAAP or IFRS) than in the reconciliation to U.S. GAAP (e.g. consolidated in primary financial statements, but accounted for under the equity method in reconciliation to U.S. GAAP) for purposes of management's evaluation of the effectiveness of internal control over financial reporting?

A: As stated in Question 12 above, management should determine the scope of its evaluation based on the primary financial statements. Therefore, determinations as to how entities subject to these differences should be included in management's evaluation of the effectiveness of internal control over financial reporting should be based on how those entities are accounted for in the primary financial statements. However, as discussed in Question 12 above, management's evaluation should consider controls related to the preparation of the of the U.S. GAAP reconciliation.

Q: Some foreign private issuers, based on their home country GAAP requirements, account for certain entities on a proportionate consolidation basis. How should those entities be treated for purposes of management's report on the effectiveness of internal control over financial reporting?

A: We would typically expect management's report on internal control over financial reporting to include all consolidated entities, even if those entities are consolidated on a proportionate basis.

However, there may be circumstances where the registrant does not have the right or authority to evaluate the internal controls of the entity consolidated on a proportionate basis, and also lacks the access necessary, in practice, to make that evaluation. In such circumstances, management should evaluate its controls over the recording of the amounts related to the proportionately consolidated entity recorded in the consolidated financial statements. Accordingly, if the foreign private issuer determines that the entity is within the scope of its assessment, the issuer would have to consider, among other things, the controls over the selection of accounting method for its investment and the recognition of the proportionate balances of the entity in the consolidated financial statements, including the proper elimination of intercompany balances and transactions. For example, a registrant might require that, at least annually, such entities provide audited financial statements as one of its controls over the recognition of proportionate balances in the consolidated financial statements.

In these circumstances, we believe management's report on internal control over financial reporting should provide disclosure that it has not evaluated the internal controls of the applicable proportionately consolidated entity and should also note that the registrant's conclusion regarding the effectiveness of its internal control over financial reporting does not extend to the internal controls of such entities. The registrant should also disclose any key sub-totals, such as total and net assets, revenues and net income that result from the proportionate consolidation of entities whose internal controls have not been evaluated.⁴ Further, the disclosure should note that the financial statements include the accounts of certain entities accounted for via proportionate consolidation but that management has been unable to evaluate the effectiveness of internal control at those entities due to the fact that the registrant does not have the right or authority to evaluate the internal controls and does not have the access necessary, in practice, to evaluate those controls.