Exchange Act Section 13(b)(2): Books and Records and Internal Accounting Controls Explained

Before Sarbanes-Oxley added management's ICFR report, the Securities Exchange Act already required every issuer to keep accurate books and to maintain a system of internal accounting controls. Those requirements are in Section 13(b)(2), codified at 15 U.S.C. 78m(b)(2). They apply to each issuer with a class of securities registered under Section 12 or required to file reports under Section 15(d), whatever its size or filer status. They are the legal source of four control objectives that map directly to the process audits internal audit and CPA firms perform.

The text

Books and records, 13(b)(2)(A). Each issuer must make and keep books, records and accounts which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer.

Internal accounting controls, 13(b)(2)(B). Each issuer must devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that:

1. Transactions are executed in accordance with management's general or specific authorization.
2. Transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets.
3. Access to assets is permitted only in accordance with management's general or specific authorization.
4. The recorded accountability for assets is compared with the existing assets at reasonable intervals, and appropriate action is taken with respect to any differences.

No knowing circumvention, 13(b)(5). No person shall knowingly circumvent or knowingly fail to implement a system of internal accounting controls, or knowingly falsify any book, record or account described in paragraph (2).

Reasonable assurances, 13(b)(7). The terms "reasonable assurances" and "reasonable detail" mean such level of detail and degree of assurance as would satisfy prudent officials in the conduct of their own affairs.

The SEC's interpretive guidance on management's ICFR report draws on this language: it refers to the prudent officials standard when explaining how management should consider whether a deficiency might prevent prudent officials from concluding they have reasonable assurance that transactions are recorded as GAAP requires.

Mapping the four objectives to processes

The fourth objective is the easiest to miss. Periodic inventory counts, fixed asset tagging and verification, and bank reconciliations are the usual ways to meet it. If a company has never compared its fixed asset register to the physical assets, it has no evidence that it meets the objective as the statute words it.

Worked example

Hypothetical example: internal audit at an issuer reviews fixed assets. The register shows $42 million of equipment. The policy requires an annual physical verification. The last one was four years ago and covered only the largest plant. Under the fourth objective, the company must compare the recorded accountability with existing assets at reasonable intervals and act on differences. A four-year gap with partial coverage is hard to defend as a reasonable interval, and it breaches the company's own annual policy. The finding states criteria (Section 13(b)(2)(B)(iv) and the company's own policy), condition, cause (no owner assigned after a reorganization), and effect (potential for recorded assets that no longer exist). See /us/blog/fixed-asset-controls-capitalization-verification-and-disposals-internal-audit-rcm.

Private companies

Section 13(b)(2) applies to issuers. Private companies are not bound by it, but the four objectives are a sensible benchmark in lender-required control reviews and for companies preparing to go public. COSO's framework covers the same ground.

How this differs from SOX 404

Section 13(b)(2)(B) is a continuing requirement on the system of internal accounting controls. Section 404 adds the reporting and attestation layers on ICFR. The statute's standard is reasonable detail and reasonable assurance, defined by what would satisfy prudent officials in the conduct of their own affairs, and the 404 assessment is organized around a different question, whether a material weakness exists. Rule 13a-15(f), which defines ICFR, reproduces the three policy elements about records, authorization and safeguarding. See /us/blog/rule-13a-15-quarterly-evaluations-disclosure-controls-and-changes-in-icfr.

Mistakes to avoid

• Treating authorization as a policy statement without system enforcement.
• Counting inventory only at year-end for the auditor.
• Ignoring the "appropriate action on differences" element: a count variance that is never investigated does not meet the objective.
• Believing that 13(b)(2) applies only to bribery cases. The accounting provisions apply to all issuers.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• Securities Exchange Act of 1934, section 13(b)(2), (5) and (7), 15 U.S.C. 78m(b): https://www.law.cornell.edu/uscode/text/15/78m
• SEC, 17 CFR 240.13a-15(f): https://www.ecfr.gov/current/title-17/section-240.13a-15
• SEC, Release No. 33-8810, Section II.B.1: https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error