New SEC Rules On Internal Control Reports
This week the SEC approved new rules requiring public companies to include in their 10-Ks a report of management of the company's internal controls over financial reporting. The rules also require the independent auditor of each public company to issue an attestation report on management's assessment of the company's internal controls-also to be included in the 10-K.
The good news is that the SEC extended the transition period for compliance. Instead of requiring these reports for the 2003 10-Ks, accelerated filers will not have to include them until the first 10-K filed after June 15, 2004. For calendar year filers, the reports must be included in the 2004 10-K.
The SEC also said that the definition of "internal controls and procedures for financial reporting" will be established by the newly-formed Public Company Accounting Oversight Board and that CEOs and CFOs will have to certify on a quarterly basis whether any change has occurred in the company's internal financial reporting. Management's evaluation of internal controls will also be based on a uniform framework with minimum disclosure standards and criteria.
Significantly for banks, the SEC did say that the final rules will provide some accommodation for depository institutions that must file internal control reports with their banking agencies (banks with $500 million or more in assets) by allowing them to base their evaluations using the framework required by the banking agencies.