Introduction
In September 2007, we published a Memorandum announcing and describing the SEC’s long-awaited compliance date for non-accelerated filers with respect to Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”). On June 26, 2008, the Securities and Exchange Commission (the “SEC”) extended the deadline for issuers to file the Auditor’s Attestation Report on Internal Control over Financial Reporting from its annual report for its first fiscal year ending on or after December 15, 2008, to the annual report for its first fiscal year ending on or after December 31, 2009. These new dates are reflected in this revised Memorandum.
After several extensions, the Securities and Exchange Commission (the “SEC”) has finally settled on a compliance date for non-accelerated filers with respect to Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley”). If you are a non-accelerated filer, and the SEC has stated that approximately 44% of domestic companies filing periodic reports are non-accelerated filers, and you have not already taken significant steps to begin to evaluate your internal control over financial reporting, the time to start is now.
Your auditing firm is going to be the best source of detailed guidance as to what steps are required in order to do an evaluation of your internal control over financial reporting. The purpose of this Memorandum is to provide an overview of the filing dates and requirements, the effect of deficiencies in your internal controls, and to emphasize that you must take action prior to the end of this fiscal year.
What is Required?
In order to comply with Section 404 there are two reports that are required. One is prepared by management of the company, and the other is prepared by the company’s independent auditor.
Management’s Report on Internal Control over Financial Reporting
A company that is a reporting company under the Securities Exchange Act of 1934 (the “Exchange Act”) is required to include in their Annual Report on Form 10-K or 10-KSB, a report on the effectiveness of the company’s internal control over financial reporting (its “ICFR”). In addition, management is required to evaluate, as of the end of each fiscal quarter, any change in the company’s ICFR that occurred during the period that has materially affected, or is reasonably likely to materially affect (emphasis added), the company’s ICFR. Additional information regarding management’s evaluation obligation is detailed later in this article.
Management’s report is contained in Item 9A and 9A(T) of Form 10-K, and Item 8A and 8A(T) of Form 10-KSB. Item 308 of Regulation S-K provides the instructions.
The following is a copy of management’s report for Apple Computer, Inc. for September 30, 2006, which concludes that the company’s internal control is effective:
Management’s Annual Report on Internal Control Over Financial Reporting
The Company’s management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) under the Securities Exchange Act of 1934, as amended). Management conducted an evaluation of the effectiveness of the Company’s internal control over financial reporting based on the criteria set forth in Internal Control—Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Based on this evaluation, management has concluded that the Company’s internal control over financial reporting was effective as of September 30, 2006. The Company’s independent registered public accounting firm, KPMG LLP, has issued an attestation report on the Company’s assessment of its internal control over financial reporting. The report on the audit of internal control over financial reporting appears on page 119 of this Form 10-K.
Changes in Internal Control Over Financial Reporting
There were no significant changes in the Company’s internal control over financial reporting identified in management’s evaluation during the fourth quarter of fiscal 2006 that have materially affected, or are reasonably likely to materially affect, the Company’s internal control over financial reporting.
By comparison, the following is a copy of management’s report for General Motors Corp. for December 31, 2006, which concludes that the company’s internal control is not effective:
Management’s Report on Internal Control over Financial Reporting
Management is responsible for establishing and maintaining effective internal control over financial reporting of the Corporation. This system is designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.
The Corporation’s internal control over financial reporting includes those policies and procedures that (i) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the Corporation; (ii) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the Corporation are being made only in accordance with authorizations of management and directors of the Corporation; and (iii) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the Corporation’s assets that could have a material effect on the financial statements.
A material weakness is a significant deficiency, or combination of significant deficiencies, that results in there being a more than remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. In its assessment of the effectiveness of internal control over financial reporting as of December 31, 2006, the Corporation determined that there were control deficiencies that constituted material weaknesses, as described below.
1. The Corporation lacked the technical expertise and processes to ensure compliance with SFAS No. 109, Accounting for Income Taxes, and did not maintain adequate controls with respect to (a) timely tax account reconciliations and analyses, (b) coordination and communication between Corporate Accounting and Tax Staffs, and (c) timely review and analysis of corporate journals recorded in the consolidation process. This material weakness resulted in a restatement of prior financial statements, as described in Note 2 to the Consolidated Financial Statements, and, if not remediated, has the potential to cause a material misstatement in the future.
2. The Corporation in certain instances lacked the technical expertise and did not maintain adequate procedures to ensure that the accounting for derivative financial instruments under SFAS No. 133, Accounting for Derivative Instruments and Hedging Activities, was appropriate. Procedures relating to hedging transactions in certain instances did not operate effectively to (a) properly evaluate hedge accounting treatment (b) meet the documentation requirements of SFAS No. 133, (c) adequately assess and measure hedge effectiveness on a quarterly basis, and (d) establish the appropriate communication and coordination between relevant GM departments involved in complex financial transactions. This material weakness resulted in a restatement of prior financial statements, as described in Note 2 to the Consolidated Financial Statements and, if not remediated, has the potential to cause a material misstatement in the future.
3. The Corporation did not maintain a sufficient complement of personnel with an appropriate level of technical accounting knowledge, experience, and training in the application of generally accepted accounting principles commensurate with the Corporation’s complex financial accounting and reporting requirements and low materiality thresholds. This was evidenced by a significant number of out-of-period adjustment noted during the year-end closing process. This material weakness contributed to the restatement of prior financial statements, as described in Note 2 to the Consolidated Financial Statements and, if not remediated, has the potential to cause a material misstatement in the future.
4. Due to the previously reported material weaknesses, as evidenced by the significant number and magnitude of out-of-period adjustments identified during the year-end closing process and the resulting restatements related to deferred taxes and hedging activities, management has concluded that the controls over the period-end financial reporting process were not operating effectively. Specifically, controls were not effective to ensure that significant non-routine transactions, accounting estimates, and other adjustments were appropriately reviewed, analyzed, and monitored on a timely basis. A material weakness in the period-end financial reporting process could result in the Corporation not being able to meet its regulatory filing deadlines and, if not remediated, has the potential to cause a material misstatement or to miss a filing deadline in the future.
Management performed an assessment of the effectiveness of the Corporation’s internal control over financial reporting as of December 31, 2006, utilizing the criteria described in the “Internal Control — Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). The objective of this assessment was to determine whether the Corporation’s internal control over financial reporting was effective as of December 31, 2006.
Based on our assessment, and because of the material weaknesses described above, management has concluded that our internal control over financial reporting was not effective as of December 31, 2006.
Management’s assessment of the effectiveness of the Corporation’s internal control over financial reporting has been audited by Deloitte & Touche LLP, an independent registered public accounting firm, as stated in their report which is included herein.
Changes in Internal Control over Financial Reporting
During the fourth quarter of 2006, GM sold a 51% interest in our wholly-owned subsidiary General Motors Acceptance Corporation (GMAC), which is described in more detail in Note 4 of the Notes to the Consolidated Financial Statements. Accordingly, GMAC’s controls were not part of management’s assessment of internal control over financial reporting as of December 31, 2006; however, the Corporation has designed and implemented controls to ensure the appropriate recognition of equity method earnings and losses for GMAC and the effective monitoring of its investment account balance.
Certain of the personnel changes described below in “Remediation of Material Weaknesses” occurred during the fourth quarter of 2006. Other than as described above, there have not been any other changes in the Corporation’s internal control over financial reporting during the quarter ended December 31, 2006, that have materially affected, or are reasonably likely to materially affect, the Corporation’s internal control over financial reporting.
There are two important considerations with respect to management’s report. First, management’s report included in a non-accelerated filer’s annual report during the filer’sfirst (emphasis added) year of compliance will be deemed to be “furnished” rather than “filed.” This relieves management of liability under Section 18 of the Exchange Act and is designed to relieve any initial tension between management and the independent auditor should their conclusions differ. If, however, the issuer subsequently incorporates by reference its report into a filing under the Exchange Act of the Securities Act of 1933, it will be deemed to be filed.
Second, if the annual report filed for this first year contains management’s report but does not contain an attestation report by the independent auditor (see Auditor’s Attestation Report on Internal Control over Financial Reporting, below), management’s report must contain a statement in substantially the following form:
This annual report does not include an attestation report of the company’s registered public accounting firm regarding internal control over financial reporting. Management’s report was not subject to attestation by the company’s registered public accounting firm pursuant to temporary rules of the Securities and Exchange Commission that permit the company to provide only management’s report in this annual report.
Auditor’s Attestation Report on Internal Control over Financial Reporting
In addition to management’s report, the company’s independent auditor is required to issue a report attesting to management’s report on the company’s ICFR. The auditors we have talked with have indicated that they will want to review the company’s internal controls, and then review management’s report, before they issue this attestation.
The following is a copy of the attestation report for Apple Computer, Inc. for September 30, 2006:
The Board of Directors and Shareholders
Apple Computer, Inc.:We have audited management’s assessment, included in the accompanying Management’s Annual Report on Internal Control over Financial Reporting, that Apple Computer, Inc. and subsidiaries maintained effective internal control over financial reporting as of September 30, 2006, based on criteria established in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Apple Computer, Inc.’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on management’s assessment and an opinion on the effectiveness of the Apple Computer, Inc.’s internal control over financial reporting based on our audit.
We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, evaluating management’s assessment, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinion.
A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.
Because of inherent limitations, internal control over financial reporting may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
In our opinion, management’s assessment that Apple Computer, Inc. maintained effective internal control over financial reporting as of September 30, 2006, is fairly stated, in all material respects, based on criteria established in Internal Control-Integrated Framework issued by COSO. Also, in our opinion, Apple Computer, Inc. maintained, in all material respects, effective internal control over financial reporting as of September 30, 2006, based on criteria established in Internal Control-Integrated Framework issued by COSO.
We also have audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the consolidated balance sheets of Apple Computer, Inc. as of September 30, 2006 and September 24, 2005, and the related consolidated statements of operations, shareholders’ equity, and cash flows for each of the years in the three-year period ended September 30, 2006, and our report dated December 29, 2006 expressed an unqualified opinion on those consolidated financial statements.
By comparison, enclosed is a copy of the auditor’s attestation report for General Motors Corp. for December 31, 2006:
General Motors Corporation, its Directors, and Stockholders:
We have audited management’s assessment, included in the accompanying Management’s Report on Internal Control over Financial Reporting in Item 9A, that General Motors Corporation and subsidiaries (the Corporation) did not maintain effective internal control over financial reporting as of December 31, 2006, because of the effect of the material weaknesses identified in management’s assessment, based on criteria established in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. The Corporation’s management is responsible for maintaining effective internal control over financial reporting and for its assessment of the effectiveness of internal control over financial reporting. Our responsibility is to express an opinion on management’s assessment and an opinion on the effectiveness of the Corporation’s internal control over financial reporting based on our audit.
We conducted our audit in accordance with the standards of the Public Company Accounting Oversight Board (United States). Those standards require that we plan and perform the audit to obtain reasonable assurance about whether effective internal control over financial reporting was maintained in all material respects. Our audit included obtaining an understanding of internal control over financial reporting, evaluating management’s assessment, testing and evaluating the design and operating effectiveness of internal control, and performing such other procedures as we considered necessary in the circumstances. We believe that our audit provides a reasonable basis for our opinions.
A company’s internal control over financial reporting is a process designed by, or under the supervision of, the company’s principal executive and principal financial officers, or persons performing similar functions, and effected by the company’s board of directors, management, and other personnel to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.
Because of the inherent limitations of internal control over financial reporting, including the possibility of collusion or improper management override of controls, material misstatements due to error or fraud may not be prevented or detected on a timely basis. Also, projections of any evaluation of the effectiveness of the internal control over financial reporting to future periods are subject to the risk that the controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.
A material weakness is a significant deficiency, or combination of significant deficiencies, that results in more than a remote likelihood that a material misstatement of the annual or interim financial statements will not be prevented or detected. The following material weaknesses have been identified and included in management’s assessment resulting from deficiencies in the design or operation of the respective controls:
(1) The Corporation lacked the technical expertise and processes to ensure compliance with Statement of Financial Accounting Standards (SFAS) No. 109,Accounting for Income Taxes, and did not maintain adequate controls with respect to (a) timely tax account reconciliations and analyses, (b) coordination and communication between Corporate Accounting and Tax Staffs, and (c) timely review and analysis of corporate journals recorded in the consolidation process. This material weakness resulted in a restatement of prior financial statements, as described in Note 2 to the consolidated financial statements and, if not remediated, could result in a material misstatement in the future.
(2) The Corporation, in certain instances, lacked the technical expertise and did not maintain adequate procedures to ensure that the accounting for derivative financial instruments under SFAS No. 133, Accounting for Derivative Instruments and Hedging Activities (SFAS No. 133), was appropriate. Procedures relating to hedging transactions in certain instances did not operate effectively to (a) properly evaluate hedge accounting treatment, (b) meet the documentation requirements of SFAS No. 133, (c) adequately assess and measure hedge effectiveness on a quarterly basis, and (d) establish the appropriate communication and coordination between relevant GM departments involved in complex hedging transactions. This material weakness resulted in a restatement of prior financial statements, as described in Note 2 to the consolidated financial statements and, if not remediated, could result in a material misstatement in the future.
(3) The Corporation did not maintain a sufficient complement of personnel with an appropriate level of accounting knowledge, experience, and training in the application of generally accepted accounting principles commensurate with the Corporation’s complex financial accounting and reporting requirements. This material weakness contributed to the restatement of prior financial statements, as described in Note 2 to the consolidated financial statements and, if not remediated, has the potential to cause a material misstatement in the future.
(4) Due to the previously reported material weaknesses, as evidenced by the significant number and magnitude of out-of-period adjustments identified during the year-end closing process and the resulting restatement related to deferred taxes, and derivatives and hedging activities, management has concluded that the controls over the period-end financial reporting process were not operating effectively. Specifically, controls were not effective to ensure that significant non-routine transactions, accounting estimates, and other adjustments were appropriately reviewed, analyzed, and monitored on a timely basis. This material weakness contributed to the restatement of prior financial statements, as described in Note 2 to the consolidated financial statements and, if not remediated, has the potential to cause a material misstatement in the future.
Management has restated previously reported 2005 and 2004 consolidated financial statements due to these matters. These material weaknesses were considered in determining the nature, timing, and extent of audit tests applied in our audit of the consolidated financial statements and the financial statement schedule listed at Item 15 as of and for the year ended December 31, 2006 (collectively, the financial statements and financial statement schedule). This report does not affect our report on such consolidated financial statements and financial statement schedule.
In our opinion, management’s assessment that the Corporation did not maintain effective internal control over financial reporting as of December 31, 2006, is fairly stated, in all material respects, based on the criteria established in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Also in our opinion, because of the effect of the material weaknesses described above on the achievement of the objectives of the control criteria, the Corporation has not maintained effective internal control over financial reporting as of December 31, 2006, based on the criteria established in Internal Control — Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission.
We have also audited, in accordance with the standards of the Public Company Accounting Oversight Board (United States), the Consolidated Balance Sheet and the related Consolidated Statements of Operations, Cash Flows, and Stockholders’ Equity (Deficit) of the Corporation as of and for the year ended December 31, 2006. Our audit also included the financial statement schedule listed at Item 15 as of and for the year ended December 31, 2006. Our report dated March 14, 2007 expressed an unqualified opinion on those financial statements and financial statement schedule and included explanatory paragraphs concerning (1) the adoption of the funded status recognition provisions of SFAS No. 158, Employers’ Accounting for Defined Benefit Pension and Other Postretirement Plans — an amendment of FASB Statements No. 87, 88, 106, and 132(R) and (2) the Corporation’s sale of a controlling interest in GMAC LLC.
Changes to Certifications
Non-accelerated filers have been allowed to omit the portion of the introductory language in paragraph 4, as well as language in paragraph 4(b) of the certification required by Exchange Act Rules 13a-14(a) and 15d-14(a) that refers to the certifying officers’ responsibility for designing, establishing, and maintaining ICFR for the company. These omissions must be re-inserted when the certifications are filed with an annual report that includes a report by management on the effectiveness of the company’s ICFR.
The language that has been allowed to be omitted is underlined:
4. The registrant’s other certifying officers and I are responsible for establishing and maintaining disclosure controls and procedures (as defined in Exchange Act Rules 13a-14 and 15d-14) for the registrant and have:
a) designed such disclosure controls and procedures to ensure that material information relating to the registrant, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this annual report is being prepared;
b) evaluated the effectiveness of the registrant’s disclosure controls and procedures as of a date within 90 days prior to the filing date of this annual report (the “Evaluation Date”); and
When is it Required?
Management’s Report
Non-accelerated filers are required to provide management’s report on ICFR in its annual report for its first fiscal year ending on or after December 15, 2007.
Auditor’s Attestation Report – Updated
Non-accelerated filers are required to provide the auditor’s attestation report in its annual reports for its first fiscal year ending on or after December 15, 2009.
Changes in Certifications
Non-accelerated filers are allowed to omit the referenced language until it files its first annual report that includes a Management’s Report.
What is Management’s Evaluation Obligation?
Management is responsible for maintaining a system of ICFR that provides reasonable assurance (emphasis added) regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Management is further responsible for maintaining evidential matters, including documentation, to provide reasonable support for its assessment.
Exchange Act Section 13(b)(7) defines “reasonable assurance” as “such level of detail and degree of assurance as would satisfy prudent officials in the conduct of their own affairs.”
Although there are numerous ways for management to conduct an evaluation of its ICFR, SEC Release No. 34-55929 establishes an evaluation method that is a safe harbor for management.
One of the key definitions in the Releases is that of “material weakness” as “a deficiency, or a combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the registrant’s annual or interim financial statements will not be prevented or detected on a timely basis.”
What Published Materials Should I Review?
E. COSO – Internal Control over Financial Reporting – Guidance for Smaller Public Companies – Executive Summary;
F. COSO – Internal Control over Financial Reporting – Guidance for Smaller Public Companies – Order Form;
Newly Public Companies
Because The Lebrecht Group, APLC often represents companies with respect to their initial public offering and/or their initial public listing, it is important to highlight that there is a transition period for newly reporting companies. A company will not become subject to the ICFR requirements until it either (i) had been required to file an annual report for the prior fiscal year with the SEC, or (ii) had filed an annual report with the Commission for the prior fiscal year. However, newly public companies are required to include a statement in its first annual report that the annual report does not include either management’s assessment on the company’s ICFT or the auditor’s attestation report. The extra year of filing a management’s report without an auditor’s attestation does not apply, they must both be filed in the second year.
The Effect of Deficiencies
One of the most common questions we anticipate is “what is the effect of having deficiencies in our ICFR?”
None of the NASDAQ exchanges, the American Stock Exchange, nor the Over the Counter Bulletin Board will de-list or negatively identify a company that has reported deficiencies in its ICFR.
On a macro-economic level, the cost of money should be higher for a company that reports deficiencies than for a similar company that does not. Ratings agencies such asFitch’s and Standard & Poor’s have published guidance as to how they intend to handle the reports. It remains to be seen whether hedge funds and other PIPE-financing funds will increase the cost of money to issuers that report deficiencies.
All of the auditors we have talked to have said that deficiencies in ICFR will increase the cost of an audit because they have to do extra sampling and follow other time-consuming processes.
We are not aware of any other direct consequences of reporting deficiencies in your ICFR.
The Lebrecht Group, APLC provides comprehensive advice on a variety of corporate, securities, and employment law matters. Please contact us if you have any questions.
Brian A. Lebrecht, Esq. is an attorney with The Lebrecht Group, APLC, located in Irvine, California and Salt Lake City, Utah. He can be reached at (801) 983-4948 orblebrecht@thelebrechtgroup.com with questions or comments.
Please visit our website at www.thelebrechtgroup.com for further information.
