Rule 13a-15: Quarterly Evaluations, Disclosure Controls and Changes in ICFR

Rule 13a-15 under the Exchange Act is the operating rule behind the Sarbanes-Oxley certifications. It requires issuers to maintain two different control systems, disclosure controls and procedures and internal control over financial reporting, to evaluate them on different schedules, and to report on them differently. Confusing the two is the most common error in quarterly filing work. This post follows the rule's structure.

Who and what

Paragraph (a) requires an issuer with a class of securities registered under Section 12 to maintain disclosure controls and procedures, and, if it was required to file or previously filed an annual report for the prior fiscal year, internal control over financial reporting. The rule excludes asset-backed issuers, certain small business investment companies and unit investment trusts. Issuers that report only under Section 15(d) are covered by the parallel Rule 15d-15.

Disclosure controls and procedures

Paragraph (e) defines them as controls and other procedures designed to ensure that information the issuer must disclose under the Exchange Act is recorded, processed, summarized and reported within the time periods the SEC's rules and forms specify, and that the information is accumulated and communicated to management, including the principal executive and financial officers, to allow timely decisions about required disclosure.

Paragraph (b) requires management, with the participation of the principal executive and financial officers, to evaluate the effectiveness of disclosure controls and procedures as of the end of each fiscal quarter. Foreign private issuers evaluate as of fiscal year-end.

Disclosure controls are broader than ICFR in subject matter, since they cover all required disclosure including non-financial items like risk factors and legal proceedings, and narrower in some respects since they focus on timely capture and communication of information.

Internal control over financial reporting

Paragraph (f) defines ICFR as a process designed by, or under the supervision of, the principal executive and financial officers and effected by the board, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and preparation of external financial statements in accordance with GAAP. It includes policies and procedures that:

1. Pertain to maintaining records that in reasonable detail accurately and fairly reflect transactions and dispositions of assets.
2. Provide reasonable assurance that transactions are recorded as necessary to permit GAAP financial statements, and that receipts and expenditures are made only with management and director authorization.
3. Provide reasonable assurance about prevention or timely detection of unauthorized acquisition, use or disposition of assets that could have a material effect on the financial statements.

Paragraph (c) requires management to evaluate ICFR effectiveness as of the end of each fiscal year using a suitable, recognized control framework established by a body that has followed due-process procedures. An evaluation performed in accordance with the SEC's interpretive guidance (Release No. 34-55929) satisfies the requirement.

The quarterly change evaluation

Paragraph (d) requires management to evaluate any change in ICFR that occurred during each fiscal quarter and that has materially affected, or is reasonably likely to materially affect, ICFR. Item 308(c) of Regulation S-K requires disclosure of such changes identified in the evaluation for the last fiscal quarter (the fourth quarter for annual reports).

This applies every quarter. Typical changes that qualify for evaluation: an ERP implementation or upgrade, a new revenue system, a shared services migration, outsourcing of payroll, an acquisition integrated into the close, remediation of a material weakness, or the departure of the controller.

Quarterly checklist

Worked example

During the third quarter a company moved accounts payable invoice processing from an in-house team to an outsourced provider using the same ERP, with the provider keying invoices and the company approving payments. Management's change memo notes: the change affects the invoice-entry and three-way-match controls; vendor master maintenance stays in-house; the provider's controls are reported in a service organization report that management obtained and reviewed; a transition period showed two weeks of dual processing with tie-out. Management concludes the change is reasonably likely to materially affect ICFR and discloses it in the controls and procedures section of the Form 10-Q, describing the outsourcing and the controls added to monitor the provider. See /us/blog/third-party-and-service-organization-risk-in-icfr-and-internal-audit.

If the change were a swap of one AP clerk for another with no change in process, management documents the assessment and concludes it did not materially affect ICFR. The memo is the evidence that the evaluation took place.

Documenting the annual evaluation

Management must keep reasonable support for its annual assessment, including documentation of control design and of the methods and procedures it used to gather and evaluate evidence. See /us/blog/icfr-documentation-what-management-must-keep-under-sec-guidance.

Pitfalls

• Treating the quarterly change evaluation as unnecessary because the annual assessment is done.
• Equating disclosure controls with ICFR in the filing language.
• Making the change inventory from memory rather than from a log kept all quarter.
• Describing remediation as complete before testing.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, 17 CFR 240.13a-15, Controls and procedures, paragraphs (a) to (f): https://www.ecfr.gov/current/title-17/section-240.13a-15
• SEC, 17 CFR 229.308(c), Changes in internal control over financial reporting: https://www.ecfr.gov/current/title-17/section-229.308

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error