How to Comply With Sarbanes-Oxley Section 404: Assessing the Effectiveness of Internal Control

8.3. ANNUAL AND QUARTERLY REPORTING REQUIREMENTS

Chapter 1 summarizes the SEC rules regarding management's internal control reporting requirements on both a quarterly and an annual basis. The chapter also summarizes the corresponding certifications regarding internal control that the entity's chief executive officer and chief financial officer are required to provide.

When, as a result of management's testing and evaluation process, it determines that no material weaknesses in internal control exist as of year-end, management may conclude that internal control is effective. If one or more material weaknesses do exist at year-end, then management is precluded from stating that internal control is effective.

Exhibit 8.3 provides an example report that complies with the SEC reporting requirements listed in Chapter 1. The third paragraph of this report states management's conclusion about internal control. The SEC has stated that management must state whether internal control is functioning effectively. Negative assurance, in which management states "Nothing has come to its attention that would lead it to believe that internal control was not functioning effectively" is not acceptable.^[]

^[] See footnote 62 to the SEC's final rule "Management's Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports (release numbers 33-8238 and 34-47986).

Management should state its assessment in an unqualified manner, that is, without qualification ...