KMPG LLP

November 27, 2002

Mr. Jonathan G. Katz, Secretary
U. S. Securities and Exchange Commission
450 Fifth Street, NW
Washington, DC 20549-0609

File No. S7-40-02
Disclosure Required by Sections 404, 406 and 407 of the Sarbanes-Oxley Act of 2002
Release Nos. 33-8138; 34-46701; IC-25775

Dear Mr. Katz:

KPMG LLP is pleased to provide our comments on the Commission’s proposed rule, Disclosure Required by Sections 404, 406 and 407 of the Sarbanes-Oxley Act of 2002, Release Nos. 33-8138; 34-46701; IC-25775 (the Proposed Rule). The Commission’s rulemaking process for implementing the corporate governance reforms and financial disclosure enhancements prescribed by the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley) provides us with a unique opportunity to help improve the quality of financial reporting.

The Proposed Rule generally provides a workable framework for strengthening corporate governance and financial disclosure. Focused attention on the audit committee’s financial knowledge and experience will likely improve that body’s ability to exercise effective oversight of issuers’ financial reporting and controls. Employee adherence to a code of ethics is a relatively simple and effective means of informing covered individuals, and their company’s current and prospective shareholders, of the importance of integrity and honesty to financial reporting. The quality of a company’s financial reporting can be improved with a more structured and expanded focus on its internal controls, and the added credibility provided by annual auditor attestation of management’s assessment of those controls. All of these initiatives will help regain investor confidence in financial reporting.

While drafting final rules to meet the mandates of Sarbanes-Oxley, the Commission should also consider the practicalities faced by companies, their audit committees, independent auditors, and other professional advisors in complying with the new rules. For example, individuals with the attributes necessary to meet the proposed definition of a “financial expert” may be limited, thus leading to boilerplate disclosure instead of meeting the intent of Sarbanes-Oxley. Also, to maximize the impact of the Proposed Rule on the quality of financial reporting, the Commission should standardize the definitions and objectives used for evaluating internal controls, which will allow investors to assess issuers against a consistent set of standards. In short, we believe that the Proposed Rule could be enhanced by:

  • revising the definition of “financial expert” to provide additional flexibility for qualifying an audit committee member as an expert in finance, accounting and auditing matters and encouraging consistent definitions of “independent” audit committee members for listed companies;

  • requiring that all individuals who may significantly impact or influence a company’s financial reporting, disclosure controls and procedures, and internal controls and procedures for financial reporting be covered by a code of ethics; and

  • standardizing the definitions and objectives used for evaluating and reporting on internal controls and procedures for financial reporting.

Our specific recommendations to satisfy the legislative intent of Sarbanes-Oxley and improve the practicality and effectiveness of the Proposed Rule follow.

For simplicity, throughout the remainder of this document we use the term internal control to refer to internal controls and procedures for financial reporting (the term proposed by the Commission) and internal control over financial reporting (the term currently used by the auditing profession to refer to the subset of internal controls that pertain to financial reporting objectives), unless use of the latter two terms is pertinent to our observation or recommendation.

Proposed Disclosure About Financial Experts Serving on a Company’s Audit Committee (Section 407 of Sarbanes-Oxley)

We are supportive of the Commission’s efforts to ensure that audit committees include members who are knowledgeable in financial accounting and reporting matters. We believe that enhancing an audit committee’s collective knowledge about accounting measurement issues, financial reporting and disclosure, and auditing matters will enable the committee to carry out its important financial oversight responsibilities. However, we believe that certain aspects of the Proposed Rule would be detrimental to attracting or retaining qualified “financial experts” to audit committees.

Our recommendations with respect to the provisions of the Proposed Rule related to Section 407 of Sarbanes-Oxley include the following suggestions:

  • the required attributes included in the proposed definition of “financial expert” should be broadened, including attributes specific to registered investment companies;

  • the term “financial expert” should be modified;

  • the definition of “independent” with respect to directors should be consistent with that of the national securities exchanges and national securities association;

  • “financial expert” disclosure should be included in registration statements;

  • the proxy statement is a proper location for “financial expert” disclosure;

  • any changes in the designation of a “financial expert” should be reported on Form 8-K; and

  • a transition period should be considered for the “financial expert” disclosure requirement.

The required attributes included in the proposed definition of “financial expert” should be broadened.

Our primary concern is that the proposed definition of “financial expert” may be too narrow and may disqualify many experienced, knowledgeable board members from being a “financial expert.” Based on a strict reading of the proposed definition, it is not inconceivable to conclude that an individual with the prescribed experience, who has been out of the work force for a brief period, would not be considered a “financial expert” due to changes in generally accepted accounting principles or reporting requirements during that period. Without further broadening the definition, those in academia, chief executive and operating officers, general counsels, etc., who may have years of financial accounting and reporting background, may not qualify as a “financial expert” as currently defined. We believe that, in many situations, the core skill sets of such individuals would meet the intent of “financial expert” as prescribed by Sarbanes-Oxley. We suggest that the Commission consider making the changes in wording discussed below.

In proposed Instruction 1 to Item 309 of Regulations S-K and S-B, we suggest striking “education and” in the definition of financial expert. The Commission includes education as a “factor” to consider when evaluating an audit committee member’s background, and we believe that the type of higher education degree earned by the board member should be only one element of the board’s consideration in making this designation.

We also suggest that the Commission consider the following changes in italics to the “attributes” included in the “financial expert” definition:

  1. An understanding of financial statements and financial reporting and an understanding of generally accepted accounting principles.

  2. Experience in or knowledge of applying such generally accepted accounting principles….

  3. Experience preparing, auditing, reviewing or analyzing financial statements…

In summary, the proposed definition of “financial expert” may result in many issuers concluding that they are unable to identify an individual who meets both the criteria for board of directors membership and qualifies as a financial expert. In such instances, the Proposed Rule would require that these issuers disclose that their audit committees do not include a financial expert and the reasons why. If the definition of financial expert is overly restrictive, causing a significant number of companies to reach such a conclusion, we believe that the disclosure will evolve to boilerplate and the intent of Sarbanes-Oxley will not be met. We believe that our proposed changes to the attributes of a “financial expert” will result in the Commission meeting the intent of Sarbanes-Oxley with respect to the definition of a financial expert, which in turn will be consistent with the intent of Sarbanes-Oxley that the failure to designate a member of the audit committee as a financial expert is a circumstance requiring disclosure.

The term “financial expert” should be modified.

We suggest that the term “financial expert” be changed as it may suggest an oversight responsibility and potential liability beyond that of other audit committee members.

We recognize the stated purpose of the audit committee in Section 2 of Sarbanes-Oxley—“overseeing the accounting and financial reporting processes of the issuer and audits of the financial statements of the issuer”—and agree with the Commission’s statements that the “mere designation of the financial expert should not impose a higher degree of individual responsibility or obligation on a member of the audit committee,” and that this designation is not intended to “decrease the duties and obligations of other audit committee members or the board of directors” as they carry out their collective level of oversight. We believe that each member has a responsibility to contribute to the audit committee process and the use of the term “expert” in this context may suggest greater responsibility than intended. Additionally, as indicated in the proposing release, the use of “expert” will likely create confusion in reference to “expert” as discussed under Section 11 of the Securities Act of 1933 (the Securities Act).

We suggest that an alternate term be selected such as “Audit Committee Member—Financial Lead” or “Audit Committee Member—Financial Experience Resource.”

The definition of “independent” with respect to directors should be consistent with that of the national securities exchanges and national securities association.

We support the proposed disclosure that the “financial expert(s)” are independent and concur with the Commission’s stated intention to “propose rules directing the national securities exchanges and national securities association to require a company to have a completely independent audit committee as a condition to listing,” as contemplated by Section 301 of Sarbanes-Oxley. However, we suggest that the definition of “independent” in this context be based on a uniform definition applied across the national securities exchanges and the national securities association. We encourage the Commission to work with these groups to develop a standard definition of “independent” with respect to directors to eliminate confusion, especially for directors who may serve public companies listed on more than one exchange.

“Financial expert” disclosure should be included in registration statements; the proxy statement is a proper location for “financial expert” disclosure; any changes in the designation of a “financial expert” should be reported on Form 8-K.

We concur with the Commission’s statement that “disclosure of the names of the company’s financial expert or experts would assist investors in evaluating the company’s annual report and proxy or information statement disclosure that describes the background and business experience of the company’s directors.” Accordingly, where applicable, we believe that the annual proxy filing is the most appropriate location for the disclosure of the “financial expert” and that such disclosure also should be included in registration statements filed under the Securities Act and the Securities Exchange Act of 1934 (the Exchange Act).

For those issuers required to file an annual proxy statement, if the required disclosure is made in such statement, we suggest that it may be incorporated by reference into an issuer’s annual report on Form 10-K/10-KSB. Foreign registrants, for which annual proxy statements are not available, should include such disclosures in their annual reports on Forms 20-F or 40-F.

Companies also should report any changes in the designation of a “financial expert” on Form 8-K. Though an addition or departure of a director would require Form 8-K disclosure under the Commission’s proposed rule Release No. 33-8106, specifically indicating in the Form 8-K whether the director is/was designated as a “financial expert” would assist investors in evaluating the company’s disclosures regarding the background and experience of the company’s directors on a timely basis—rather than waiting for additional information in an annual filing. Similarly, investors would likely find useful the timely reporting on Form 8-K of changes in audit committee members designated as “financial experts.”

For registered investment companies, the Commission should tailor the attributes of a “financial expert” to include those individuals who have experience preparing, auditing, reviewing or analyzing financial statements of issuers in industries in which the investment company may invest.

For registered investment companies, we believe the Commission should consider tailoring the “attributes” included in the definition of “financial expert” in order for individuals such as chief financial officers, controllers, investment analysts, or certified financial analysts (CFA’s), who have direct experience in preparing, auditing, reviewing or analyzing the financial statements of companies in industries in which the investment company maintains significant investments, to qualify as “financial experts,” in addition to those individuals who would otherwise qualify as “financial experts” under the Proposed Rule. The “attributes” included in the proposed definition of “financial expert” could disqualify certain individuals who have significant expertise in financial reporting relative to the industries in which the investment company invests. We recommend the Commission consider direct experience in preparing, auditing, reviewing or analyzing financial statements of companies consistent with the type of investments made by the registered investment company as appropriate “attributes,” even though an individual may have no direct experience preparing, auditing, reviewing or analyzing financial statements of registered investment companies.

A transition period should be considered for the "financial expert” disclosure requirement.

We believe that the Commission should consider allowing a reasonable transition period for implementing the "financial expert" disclosure after issuance of the final rule. Companies will need ample time for the board of directors to evaluate the qualifications of existing audit committee members and, if necessary, to identify and recruit an individual that possesses the required attributes as described in the final rule.

Proposed Code of Ethics Disclosure
(Section 406 of Sarbanes-Oxley)

The proposed code of ethics disclosure should promote honest and ethical conduct and provide investors information about another aspect of corporate governance that may be used in distinguishing one investment opportunity from another. To maximize these positive impacts, we believe that the applicability of certain provisions of the Proposed Rule should be broadened.

Our recommendations with respect to the provisions of the Proposed Rule related to Section 406 of Sarbanes-Oxley include the following suggestions:

  • the code of ethics disclosure requirement should be expanded to cover all executive officers and should be consistent with the use of such term in the proposed rules relative to Section 303(a) of Sarbanes-Oxley;

  • code of ethics disclosures should be required in registration statements; and

  • the code of ethics disclosure requirements for investment companies should be expanded to include affiliated administrators.

The code of ethics disclosure requirement should be expanded to cover all executive officers and should be consistent with the use of such term in the proposed rules relative to Section 303(a) of Sarbanes-Oxley.

The proposing release regarding Section 406 of Sarbanes-Oxley (note 65) encourages “companies to apply the code of ethics to as broad a spectrum of personnel and affiliates as practicable.” We suggest that the code of ethics disclosure requirement be expanded beyond an entity’s “principal executive officer, principal financial officer, principal accounting officer or controller, or person performing similar functions,” to include officers, without limitation to the “principal executive officer, principal financial officer…,” consistent with the definition of such terms in the proposed rules relative to Section 303(a) of Sarbanes-Oxley, Improper Influence on Conduct of Audits, (Release No. 34-46685).[1] We believe that conforming the population of individuals subject to the provisions of Section 303(a) of Sarbanes-Oxley and the code of ethics disclosure requirements pursuant to Section 406 of Sarbanes-Oxley is consistent with the overall intent of Sarbanes-Oxley.

Code of ethics disclosures should be required in registration statements.

Because of the importance investors may place on a company’s code of ethics, we suggest that the scope of disclosure requirements be expanded to include registration statements filed under the Securities Act and the Exchange Act, in addition to annual reports.

The code of ethics disclosure requirements for investment companies should be expanded to include affiliated administrators.

The Commission has proposed that investment companies disclose whether each of the registrant, its investment adviser, and its principal underwriter (in certain cases) has adopted a written code of ethics that applies to its principal executive officer, principal financial officer, principal accounting officer or controller, or persons performing similar functions of, respectively, the registrant, its investment adviser, and its principal underwriter. While the administrator for the registrant is not included in the scope of the proposed disclosure requirements, we believe that the administrator should be included when it is affiliated with the investment adviser and employs the registrant’s officers who are subject to the code of ethics.

Internal Control
(Section 404 of Sarbanes-Oxley)

Heightened attention to the financial reporting discipline embodied in effective internal control should improve the quality of financial reporting by public companies. However, without providing clear guidelines for satisfying the Commission’s expectations for “effective” internal control, the benefits offered by the Proposed Rule may be diminished. Our comments and recommendations for implementing Section 404 of Sarbanes-Oxley address:

  • the need for stated objectives of internal control;

  • the need for established internal control criteria to perform the required assessment;

  • the need for a stated objective of management’s assessment and a threshold for reporting;

  • the proposed change to the requirement that management disclose changes to internal control subsequent to management’s evaluation;

  • the need for clarification regarding the interrelationship of disclosure controls and procedures and internal controls and procedures for financial reporting;

  • the definition of internal control and related terminology;

  • the need for a change in the term accountant’s attestation to auditor’s report on internal control;

  • the need for clarification relative to transition reports for changes in fiscal year;

  • the timing of management’s evaluation of disclosure controls and procedures for registered investment companies;

  • the proposed transition period;

  • the need for specification of standards for attestation engagements prior to issuance or adoption of standards by the Public Company Accounting Oversight Board; and

  • the need for certain technical changes to the final rule and instructions to various SEC forms.

The final rule should specify a common set of internal control objectives to be addressed by management’s assessment of the effectiveness of internal control and the independent auditor’s examination of management’s assessment, and require that the internal control objectives, along with other information pertinent to management’s assessment and the independent auditor’s examination, be included in both management’s and the independent auditor’s reports.

The proposed amendments of Item 307 of Regulations S-K and S-B, and Forms 20-F and 40-F, do not specify the objectives of internal control that should be addressed in management’s assessment and report. However, Section 103 of Sarbanes-Oxley requires that the independent auditor’s report include an evaluation of whether certain internal control objectives have been met.[2] We believe this situation may result in issuers adopting inconsistent internal control objectives that do not satisfy the intent of Sarbanes-Oxley, do not meet the purpose of internal control specified by the Commission, prohibit independent auditors from examining and reporting on management’s assessment, and create confusion on the part of management, independent auditors, and users of management’s and the independent auditor’s reports.

The proposing release addresses various internal control definitions and objectives, including those in Statement on Auditing Procedure Nos. 29 and 54, the Foreign Corrupt Practices Act, and Internal Control—Integrated Framework, a report published by the Committee of Sponsoring Organizations (COSO) of the Treadway Commission. Existing Section 13(b)(2) of the Exchange Act also provides internal control objectives that registrants are required to observe. In addition, in the proposing release, the Commission indicates that it believes that the purpose of internal control is:

    to ensure that companies have processes designed to provide reasonable assurance that:

    • the company's transactions are properly authorized;

    • the company's assets are safeguarded against unauthorized or improper use; and

    • the company's transactions are properly recorded and reported

    to permit the preparation of the registrant’s financial statements in conformity with generally accepted accounting principles.

The Commission indicates in the proposing release that it believes the foregoing purpose of internal control is consistent with Section 103 of Sarbanes-Oxley. This may be the Commission’s belief; however, this purpose and the other sources of internal control objectives we cite above are not entirely consistent. For example, the internal control objectives included in Section 103 of Sarbanes-Oxley do not appear to be in complete agreement with the internal control objectives included in Section 13(b)(2) of the Exchange Act.

In the absence of internal control objectives specified in the final rule, issuers may adopt various and inconsistent internal control objectives. A significant risk is that these other objectives may neither satisfy the intent of Sarbanes-Oxley, meet the purpose of internal control specified by the Commission, nor satisfy the needs of shareholders or other stakeholders. We believe that all issuers should be held to a consistent and high standard for the effectiveness of internal control. To achieve this consistency, the Commission should establish clear and consistent objectives that internal control is expected to achieve.

The objectives that form the basis of management’s assessment and the independent auditor’s examination also must be aligned. The independent auditor cannot effectively evaluate an entity’s internal control against objectives that the internal control is not designed to achieve. To illustrate, this situation is similar to requiring an independent auditor to perform an audit to determine whether an entity’s financial statements are prepared in conformity with U.S. generally accepted accounting principles (U.S. GAAP) when the financial statements are prepared in conformity with International Financial Reporting Standards (IFRS) issued by the International Accounting Standards Board. Although there are similarities between U.S. GAAP and the IFRS, they currently are not in alignment; such an audit would result in a qualified or adverse opinion that would be of limited use to investors, regulators and other interested parties. Similar results would occur in examinations of the effectiveness of internal control if the internal control objectives adopted by management and referred to by the auditor are not in alignment.

The Commission indicates in the proposing release that to specify the content of management’s report would result in boilerplate responses of little value. We disagree. To appropriately understand management’s and the independent auditor’s reports, users of those reports must be informed about certain matters. Without unduly restraining issuers from providing additional meaningful information, the Commission can and should require in its final rule that certain minimum information be provided by issuers and their independent auditors. This information includes the objectives the entity’s internal control is designed to achieve, the internal control criteria used to assess effectiveness (this matter also is addressed in the following section of our letter), management’s responsibilities with regard to internal control and the assessment of its effectiveness, and information regarding the limitations of internal control. Management and the independent auditor also need to clearly express their respective conclusions about the effectiveness of the entity’s internal control. The independent auditor also needs to describe its responsibilities in the examination of management’s assessment.

We have an additional recommendation with regard to which set of internal control objectives the Commission should require issuers to use. We believe the purpose of internal control identified by the Commission in the proposing release and referred to above is an appropriate description of the objectives of internal control. With the exception of the condition in the following paragraph, we recommend that the Commission recognize this internal control purpose in the final amendments to Item 307 of Regulations S-K and S-B, and Forms 20-F and 40-F.

As noted above, our principal concern is that the internal control objectives used by management and the independent auditor be in alignment. We believe that it would be detrimental to the public interest if the Commission does not specify the objectives of internal control that should be addressed in management’s assessment and report. Section 103 of Sarbanes-Oxley is clear on the content of the independent auditor’s report. If the Commission concludes that it does not have the authority to establish that independent auditors also may use and make reference to the purpose of internal control specified by the Commission in the proposing release and referred to above to satisfy the objectives of Sections 103 and 404 of Sarbanes-Oxley, we believe the Commission should specify in the final rule that the Section 103 internal control objectives are required to be used by management.

The final rule should require management to assess the effectiveness of internal control using suitable internal control criteria established through due process. We also recommend that the final rule recognize that the internal control criteria developed by COSO is acceptable to the Commission.

We agree with the Commission that AU section 319, “Consideration of Internal Control in a Financial Statement Audit,” of the AICPA Professional Standards includes an appropriate definition of internal control. However, AU section 319 does not address internal control criteria, an essential element of management’s assessment and report and the related independent auditor’s examination of management’s assessment.

Criteria are an essential component of any internal control evaluation because, as indicated in AT section 101.24 of the AICPA Professional Standards, “Criteria are the standards or benchmarks used to measure and present the subject matter and against which the practitioner evaluates the subject matter.” In other words, criteria are to internal control what generally accepted accounting principles are to financial reporting. An objective of financial reporting is to present fairly the financial position and results of operations of an entity. It is generally recognized that this objective is not achievable without the more specific rules and principles provided by generally accepted accounting principles. Internal control criteria provide the specific principles that underlie and enable management to implement the internal control objectives and evaluate whether the objectives are being achieved. Internal control criteria also introduce a rigor and consistency to management’s assessment of the internal control and the independent auditor’s evaluation.

Criteria also must be suitable, as that term is used in the AICPA attestation standards. Suitable criteria are free from bias, permit reasonably consistent measurements, are sufficiently complete so that those relevant factors that would alter a conclusion about subject matter are not omitted, and are relevant to the subject matter (see AT section 101.24 for a complete discussion of the characteristics of suitable criteria). AT section 101.25 indicates that, “Criteria that are established by groups composed of experts that follow due-process procedures, including exposure of the proposed criteria for public comment, usually should be considered suitable.” Footnote 6 of AT section 501, “Reporting on an Entity’s Internal Control Over Financial Reporting,” further indicates that, “For example, the Committee of Sponsoring Organizations (COSO) of the Treadway Commission's report, Internal Control—Integrated Framework, provides suitable criteria against which management may evaluate and report on the effectiveness of the entity's internal control.”

Criteria developed by others, such as individual entities and industry associations that do not follow due process, also may be suitable pursuant to the AICPA attestation standards. However, internal control is a very broad and complex subject matter. Dozens of experts from the financial reporting community directly participated in the development of the COSO report, and many more studied the exposure draft of the proposed report and provided their thoughtful comments. We believe it would be very difficult for an individual entity or a non-accounting industry trade group to secure the necessary expertise and resources to develop suitable internal control criteria. Furthermore, bodies such as COSO are more likely to maintain and update their criteria as conditions change and additional needs arise. For example, the COSO report, originally issued in 1992, was amended in 1994 to incorporate guidelines on controls pertaining to safeguarding of assets; in 1996, COSO issued an additional report, Internal Control Issues in Derivatives Usage; recently, COSO undertook a study to determine the need for guidance on assessing and managing enterprise risks.

For these reasons, we recommend that the Commission require the use of internal control criteria established by a group composed of experts that follows due-process procedures, including exposure of the proposed criteria for public comment.

We also recommend that the Commission, in its final rule, indicate that the internal control criteria developed by COSO are acceptable to the Commission for management’s assessment and the independent auditor’s examination required by Sarbanes-Oxley. The COSO report outlines a comprehensive internal control framework. It describes five interrelated components that comprise internal control, provides in-depth conceptual discussion of each component, and provides numerous factors that may be considered in evaluating the effectiveness of each component. As indicated above, the COSO report is recognized by the AICPA as providing suitable internal control criteria and is updated and supplemented from time-to-time as needs arise. The COSO report also is the de-facto standard used in connection with internal control reporting pursuant to the Federal Deposit Insurance Corporation Improvement Act. Finally, the COSO report is the basis for the definition of internal control included in AU section 319, to which the Commission makes reference in the proposing release, and the detailed discussion of the components of internal control included in AU section 319.

The final rule should establish the principal objective of management’s assessment and the overall threshold for concluding whether internal control is effective. In doing so, the final rule should indicate that the existence of a material weakness in internal control should preclude an unqualified assessment that internal control is effective.

We believe that management should plan and perform the process it uses to assess the effectiveness of internal control with the objective of identifying significant deficiencies in internal control, rather than the higher threshold of identifying only material weaknesses. This objective will provide management with sufficient information to be able to evaluate and conclude on whether deficiencies in internal control, either individually or in the aggregate, represent material weaknesses.

Consistent with AT section 501, the existence of a material weakness should preclude an overall assessment that internal control is effective. Depending on their number and significance, material weaknesses should result in a qualification of the assessment, or the conclusion that internal control is not effective (an “adverse” conclusion).

The proposed requirement regarding management’s disclosure of changes in internal control is inconsistent with Sarbanes-Oxley, and should be modified to require public disclosure of information that will be more useful to understanding management’s assessment of the effectiveness of internal control.

The Commission proposes to change the Section 302 disclosure requirements of Sarbanes-Oxley to require registrants to disclose on a quarterly and annual basis any significant changes to the registrant's internal control made during the period covered by the quarterly or annual report, including any actions taken to correct significant deficiencies and material weaknesses in the registrant's internal control. We believe this proposed disclosure requirement is inconsistent with Sarbanes-Oxley, and may result in issuers reporting a large volume of disclosures that have limited value.

Organizations make changes to internal control all the time. The proposed change in the requirement to report all significant changes to internal control may result in a large volume of disclosures that have little value to readers of the information as they will have no basis to understand the information, its relevance, or importance.

Section 302(a)(6) of Sarbanes-Oxley requires the certifying officers to “indicate in the report whether or not there were significant changes in internal controls or in other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses” [emphasis added]. We believe the disclosure requirements in Section 302(a)(6) of Sarbanes-Oxley provide for the most appropriate and relevant disclosure with regard to deficiencies and changes in internal control and recommend that they be retained in the final rule.

We believe internal controls and procedures for financial reporting are entirely encompassed within disclosure controls and procedures and recommend that the Commission clarify this interrelationship in the final rule.

On November 8, 2002, the Division of Corporation Finance (the Division) issued a Frequently Asked Questions (FAQ) document pertaining to Sarbanes-Oxley. In several instances, the Division addresses the relationship between disclosure controls and procedures and internal controls and procedures for financial reporting. However, this relationship is not clear. For example, in response to question number 22 in the FAQ, the Division states that, “some elements of internal controls are included in the definition of disclosure controls and procedures,” but does not identify those elements.

In the response to question 22 in the FAQ, the Division notes its assumption that all companies periodically evaluate internal control to check compliance with Section 13(b) of the Exchange Act and to prepare the financial statements. Taking the Division’s assumption without necessarily agreeing with it, and that the quarterly certifications must state that the report fully complies with the law and contains no material omission or material inaccuracy, and the financial statements and other financial information fairly present in all material respects the entity’s financial condition, results of operations and cash flows, we believe that the quarterly evaluation should include an evaluation of whether the company’s internal controls and procedures for financial reporting permit the preparation of financial statements that meet these standards.

We believe internal controls and procedures for financial reporting are entirely encompassed within disclosure controls and procedures and recommend that the Commission clarify this interrelationship in the final rule. This clarification is necessary for entities to understand their responsibilities with respect to internal controls and procedures for financial reporting during the transition period leading to the time Section 404 becomes operational, and for investment companies that will not be subject to Section 404.

The final rule should use the term internal control over financial reporting rather than the term internal controls and procedures for financial reporting.

Sarbanes-Oxley uses the term internal control structure and procedures, while the Proposed Rule uses the term internal controls and procedures. Additionally, the AICPA’s auditing and attestation literature and the COSO report use the term internal control to discuss internal control concepts generally and the term internal control over financial reporting to refer to that subset of controls that pertain to financial reporting objectives. The Commission correctly notes that there have been a variety of definitions of the term internal controls, its meaning has changed over time, and there continues to be some confusion. However, further changes to the terminology of internal control concepts that currently are addressed in practice and in the auditing profession’s literature are not likely to clarify this matter. We believe the term internal control over financial reporting is the most modern and universally recognized term relevant to the subset of internal control that pertains to financial reporting objectives, encompasses the internal control objectives specified in Sarbanes-Oxley, and is well understood by the user community. Therefore, we recommend that the final rule use the term internal control over financial reporting rather than the term internal controls and procedures for financial reporting.

The term accountant’s attestation should be changed to auditor’s report on internal control, or a similarly specific term.

The term accountant’s attestation has a very broad meaning. Independent auditors currently perform attest engagements on a variety of subjects. Rather than using a term with such broad meaning and defining it in the context of a specific type of attest engagement, a more specific term, such as auditor’s report on internal control, would avoid confusion and therefore should be used. The Commission should clarify how the proposed internal control report and proposed certification and disclosure provisions concerning disclosure controls and procedures and internal controls and procedures for financial reporting apply to transition reports for changes in a fiscal year-end.

The Commission is proposing that management certify that it has evaluated the effectiveness of disclosure controls and procedures and internal controls and procedures for financial reporting as of the end of the period covered by the report. In previous rulemaking, the Commission stated that certifications are required for transition reports on Form 10-Q and Form 10-K. We are unclear how the certification requirements, and the requirements of Item 307 of Regulations S-K and S-B, would be applied in certain circumstances dependent on the timing of a decision to change a company’s fiscal year. For example, if in November a company changes its fiscal year-end from December 31 to August 31, it will be required to file a transition report on Form 10-K with audited financial statements covering the period January 1 through August 31. The transition report on Form 10-K would be due the following February. To provide the required certification disclosures, and management’s internal control report and related auditor’s attestation report, it appears that a company and its auditors would be required to assess and report on internal control at a point in time that precedes both the time the decision to change fiscal year is made and the most recent management evaluation and certification. We question the usefulness or feasibility of those proposed requirements, particularly if evaluations have been performed and certified by management for quarterly reporting periods during the period between the new fiscal year-end and the date a decision is made to change fiscal years.

The Commission should retain the current requirement for registered investment company certifications that the evaluation of disclosure controls and procedures be performed within 90 days of the date of the certified report.

When the Commission originally adopted the certification rules implementing Section 302 of Sarbanes-Oxley requiring that the evaluation of disclosure controls and procedures be performed within 90 days prior to the filing date of the certified report, it indicated that for investment companies, a single evaluation for a series fund or family of investment companies could be used in multiple certifications for funds within the series or family, as long as the evaluation is performed within 90 days of the date of the certified report. Recognizing the unique structure of investment companies, the Commission adopted a framework allowing for certifying officers of large mutual fund families with multiple reporting periods to perform quarterly evaluations of disclosure controls and procedures. Under the new proposal that the evaluation of disclosure controls and procedures be performed as of the end of the period covered by the report, certifying officers of large mutual fund families could be required, in some cases, to perform monthly evaluations of disclosure controls and procedures. The existing framework that allows the evaluation to be completed “within 90 days prior to the filing date” is a practical approach for investment companies; accordingly, we recommend that the Commission consider retaining this current requirement with respect to investment companies.

The transition period for compliance with these new requirements is acceptable. Standards for attestation engagements prior to issuance or adoption of standards by the Public Company Accounting Oversight Board (PCAOB) should be specified.

We believe the Commission’s proposed transition period is acceptable. It allows time for independent auditors to prepare for the attestation engagements and for management to implement appropriate mechanisms to evaluate and assess the effectiveness of internal control and report on the results.

An engagement to examine the effectiveness of an entity’s internal control over financial reporting differs from the auditor’s consideration of internal control in a financial statement audit. The extent of auditing procedures relative to internal control in an examination of effectiveness of internal control exceeds that required in a financial statement audit. Companies and their independent auditors will require the proposed transition period to develop processes under relevant standards and to train appropriate personnel to ensure compliance with the requirements imposed by Sarbanes-Oxley.

Finally, the Proposed Rule does not specify the standards under which independent auditors would perform attestation engagements. Until the PCAOB issues or adopts standards for attestation engagements as required by Section 404(b) of Sarbanes-Oxley, the final rule should specify that such engagements are performed in accordance with AT section 501.

Certain technical changes should be considered to the final rule and instructions to various SEC forms.

We suggest technical corrections for the following items:

  • Proposed Item 307(c)(4) of Regulation S-K indicates that management’s internal control report include the “attestation report of the…firm that audited or reviewed the financial statements included in the annual report…[emphasis added].” We are not aware of any situation in which the financial statements included in an issuer’s annual report would be reviewed. We suggest that the Commission delete the words or reviewed in the final rule. Similar conforming changes should be made to Regulation S-B and the instructions to Forms 20-F and 40-F.

  • Proposed Instruction 4 to Item 15(a) of Form 20-F includes a reference to “paragraph (c)(2) of this Item…[emphasis added].” We believe that the reference should be to paragraph (3)(ii).

* * * *

If you have any questions about our comments please contact Sam Ranzilla at (212) 909-5837 Melanie Dolan at (202) 533-4934, or Darryl Briley at (212) 909-5680.

Very truly yours,

/s/ KPMG LLP


[1] Rule 3b-2 of the Exchange Act, referred to in Release No. 34-46685, indicates that an officer includes the company’s “president, vice president, secretary, treasurer or principal financial officer, comptroller or principal accounting officer, and any person routinely performing corresponding functions with respect to any organization whether incorporated or unincorporated.” The term "officer" includes an issuer's chief executive officer and other executive officers. Rule 3b-7 of the Exchange Act indicates that the “term `executive officer,' when used with reference to a registrant, means its president, vice president of the registrant in charge of a principal business unit, division or function (such as sales, administration, or finance), any other officer who performs a policy making function or any other person who performs similar policy making functions for the registrant. Executive officers of subsidiaries may be deemed executive officers of the registrant if they perform such policy making functions for the registrant.”
[2] Section 103 of Sarbanes-Oxley requires the independent auditor to present in the audit report or a separate report on internal control the findings of the independent auditor from the independent auditor’s testing of internal control, and an evaluation of whether such internal control—

  • includes maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer; and

  • provides reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer.