Sarbanes-Oxley Act Compliance: Internal controls, audit committee requirements, certification of financial reports

Introduction

The Sarbanes-Oxley Act of 2002 (SOX) was enacted in response to major corporate and accounting scandals, including those affecting Enron, Tyco International, and WorldCom. These scandals resulted in significant financial losses for investors and shook public confidence in the securities markets. SOX aims to enhance corporate governance and strengthen the accuracy and reliability of corporate disclosures. This guide will provide a comprehensive overview of SOX compliance, focusing on internal controls, audit committee requirements, and the certification of financial reports.

Internal Controls

Definition and Importance

Internal controls are processes designed to provide reasonable assurance regarding the reliability of financial reporting, the effectiveness and efficiency of operations, and compliance with applicable laws and regulations. Under SOX, internal controls are crucial for preventing and detecting fraud, ensuring the accuracy of financial statements, and maintaining investor confidence.

Section 404: Management Assessment of Internal Controls

Section 404 of SOX requires management to assess and report on the effectiveness of the company's internal control over financial reporting (ICFR). This section has two main components:

1. Management's Report: Management must include a report on the effectiveness of the company's ICFR in the annual report. This report should state the responsibility of management for establishing and maintaining adequate ICFR and provide an assessment of the effectiveness of these controls as of the end of the fiscal year.
2. External Auditor's Attestation: An external auditor must attest to and report on the assessment made by management. This attestation is not a separate evaluation but rather an opinion on the accuracy of management's assessment.

Official Source: Management's Report on Internal Control Over Financial Reporting

Section 302: Corporate Responsibility for Financial Reports

Section 302 requires the principal executive and financial officers to certify the accuracy and completeness of financial reports. This certification includes:

1. Review of Reports: Officers must certify that they have reviewed the quarterly and annual reports.
2. Fair Presentation: Officers must certify that, based on their knowledge, the reports do not contain any material misstatements or omissions and fairly present the financial condition and results of operations.
3. Internal Controls: Officers must certify that they are responsible for establishing and maintaining ICFR, have designed such controls to ensure that material information is made known to them, have evaluated the effectiveness of these controls, and have presented their conclusions about the effectiveness of these controls in the report.

Official Source: Certification of Disclosure in Companies' Quarterly and Annual Reports

Section 906: Corporate Responsibility for Financial Reports

Section 906 requires that each periodic report containing financial statements filed with the SEC must be accompanied by a written statement from the CEO and CFO certifying that the report fully complies with the requirements of the Securities Exchange Act of 1934 and that the information contained in the report fairly presents, in all material respects, the financial condition and results of operations of the company.

Official Source: Sarbanes-Oxley Act of 2002

Audit Committee Requirements

Definition and Role

An audit committee is a subset of a company's board of directors responsible for overseeing the financial reporting process, the audit process, the company's internal controls, and compliance with laws and regulations. The audit committee plays a critical role in ensuring the integrity of financial reports and the effectiveness of internal controls.

Section 301: Public Company Audit Committees

Section 301 of SOX outlines the requirements for public company audit committees, including:

1. Independence: Each member of the audit committee must be a member of the board of directors and must otherwise be independent. Independence means that the member does not accept any consulting, advisory, or other compensatory fee from the company and is not an affiliated person of the company or any subsidiary.
2. Responsibility for External Auditors: The audit committee is directly responsible for the appointment, compensation, and oversight of the work of any registered public accounting firm employed by the company for the purpose of preparing or issuing an audit report or related work.
3. Complaint Procedures: The audit committee must establish procedures for the receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, or auditing matters, and the confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters.
4. Authority to Engage Advisors: The audit committee must have the authority to engage independent counsel and other advisors, as it determines necessary to carry out its duties.
5. Funding: The company must provide appropriate funding, as determined by the audit committee, for payment of compensation to the external auditors and any advisors employed by the audit committee.

Official Source: Standards Relating to Listed Company Audit Committees

Audit Committee Financial Expert

SOX requires that at least one member of the audit committee be a financial expert. A financial expert is defined as someone who has:

1. An understanding of generally accepted accounting principles (GAAP) and financial statements.
2. Experience in preparing, auditing, analyzing, or evaluating financial statements that present a breadth and level of complexity of accounting issues generally comparable to those that can reasonably be expected to be raised by the company's financial statements.
3. An understanding of internal controls and procedures for financial reporting.
4. An understanding of audit committee functions.

Official Source: Sarbanes-Oxley Act of 2002

Certification of Financial Reports

Section 302: Certification Requirements

As previously mentioned, Section 302 requires the CEO and CFO to certify the accuracy and completeness of financial reports. This certification includes:

1. Review of Reports: Officers must certify that they have reviewed the quarterly and annual reports.
2. Fair Presentation: Officers must certify that, based on their knowledge, the reports do not contain any material misstatements or omissions and fairly present the financial condition and results of operations.
3. Internal Controls: Officers must certify that they are responsible for establishing and maintaining ICFR, have designed such controls to ensure that material information is made known to them, have evaluated the effectiveness of these controls, and have presented their conclusions about the effectiveness of these controls in the report.

Official Source: Certification of Disclosure in Companies' Quarterly and Annual Reports

Section 906: Certification Requirements

Section 906 requires that each periodic report containing financial statements filed with the SEC must be accompanied by a written statement from the CEO and CFO certifying that the report fully complies with the requirements of the Securities Exchange Act of 1934 and that the information contained in the report fairly presents, in all material respects, the financial condition and results of operations of the company.

Official Source: Sarbanes-Oxley Act of 2002

Penalties for Non-Compliance

SOX imposes severe penalties for non-compliance with the certification requirements. If a CEO or CFO certifies a report knowing that it does not meet the requirements, they can face fines of up to $1 million and imprisonment for up to 10 years. If the certification is made willfully, the penalties increase to fines of up to $5 million and imprisonment for up to 20 years.

Official Source: Sarbanes-Oxley Act of 2002

Conclusion

The Sarbanes-Oxley Act of 2002 has significantly impacted corporate governance and financial reporting. By establishing stringent requirements for internal controls, audit committees, and the certification of financial reports, SOX aims to enhance the accuracy and reliability of corporate disclosures, prevent and detect fraud, and restore investor confidence in the securities markets. Compliance with SOX is essential for public companies to ensure the integrity of their financial reporting and maintain the trust of their investors and stakeholders.

For further information and official resources, please refer to the following links:

• Management's Report on Internal Control Over Financial Reporting
• Certification of Disclosure in Companies' Quarterly and Annual Reports
• Sarbanes-Oxley Act of 2002
• Standards Relating to Listed Company Audit Committees

By adhering to these requirements, companies can ensure compliance with SOX and contribute to the overall transparency and accountability of the financial markets.