THE SARBANES–OXLEY ACT AND CORPORATE GOVERNANCE BASIC INFORMATION AND TUTORIALS

Section 404 of the Sarbanes–Oxley Act—‘‘Enhanced Financial Disclosures, Management Assessment of Internal Control’’—mandates sweeping changes.

Section 404, in conjunction with the related Securities and Exchange Commission (SEC) rules and Auditing Standard No. 2 established by the Public Company Accounting Oversight Board (PCAOB), requires management of a public company and the company’s independent auditor to issue two new reports at the end of every fiscal year.

These reports must be included in the company’s annual report filed with the SEC.  Management must report annually on the effectiveness of the company’s internal control over financial reporting.

In conjunction with the audit of the company’s financial statements, the company’s independent auditor must issue a report on internal control over financial reporting, which includes both an opinion on management’s assessment and an opinion on the effectiveness of the company’s internal control over financial reporting.

In the past, a company’s internal controls were considered in the context of planning the audit but were not required to be reported publicly, except in response to the SEC’s Form 8-K requirements when
 elated to a change in auditor.

The new audit and reporting requirements have drastically changed the situation and have brought the concept of internal control over financial reporting to the forefront for audit committees, management, auditors, and users of financial statements.

The new requirements also highlight the concept of a material weakness in internal control over financial reporting, and mandate that both management and the independent auditor publicly report any material weaknesses in internal control over financial reporting that exist as of the fiscal-year-end assessment date.

Under both PCAOB Auditing Standard No. 2 and the SEC rules implementing Section 404, the existence of a single material weakness requires management and the independent auditor conclude that internal control over financial reporting is not effective.