SOX 302 and 906 Certifications Versus Section 404 Reporting: What Each One Covers

Three Sarbanes-Oxley provisions are often grouped together and often confused: the Section 302 certification, the Section 906 certification, and the Section 404 internal control report. They answer different questions. This post separates them and shows how a deficiency found in a 404 evaluation travels to a 302 disclosure.

Section 302: the officer certification

Section 302 (15 U.S.C. 7241) requires the principal executive and principal financial officers to certify in each periodic report that:

• The signing officer has reviewed the report.
• Based on the officer's knowledge, the report does not contain any untrue statement of a material fact or omit a material fact needed to make the statements not misleading.
• The financial statements and other financial information fairly present in all material respects the financial condition and results of operations.
• The signing officers are responsible for establishing and maintaining internal controls, have designed them so material information reaches them, have evaluated their effectiveness as of a date within 90 days before the report, and have presented their conclusions in the report. (The statute says 90 days. The certification the SEC prescribes in its rules and exhibits is framed around disclosure controls and procedures evaluated as of the end of the period covered by the report. Follow the exhibit text when drafting.)
• The officers have disclosed to the auditors and the audit committee all significant deficiencies in the design or operation of internal controls, any material weaknesses identified for the auditors, and any fraud, whether or not material, that involves management or other employees who have a significant role in internal controls.
• The report states whether there were significant changes in internal controls or other factors that could significantly affect them after the evaluation, including corrective actions.

Rule 13a-14(a) implements this for Forms 10-K, 10-Q and others: the certifications follow the form in the exhibit filing requirements, are filed as an exhibit and are signed by the principal executive and financial officers at the time of filing.

Section 906: the criminal certification

Rule 13a-14(b) requires periodic reports containing financial statements to be accompanied by certifications under 18 U.S.C. 1350. They are furnished as an exhibit and signed by the principal executive and financial officers. This is a separate certification from Section 302, with its own statutory basis. Rule 13a-14(b) allows one certification signed by both officers to satisfy the requirement.

Section 404: the control report

Section 404(a) requires management's annual assessment of ICFR effectiveness as of year-end, and 404(b) requires the auditor's attestation for registrants that are not exempt. Item 308 of Regulation S-K sets the content: responsibility statement, framework, assessment, material weaknesses, and a statement about the attestation report. See /us/blog/sox-404-b-exemption-non-accelerated-filers-and-emerging-growth-companies.

Comparison

How a deficiency flows

A deficiency that management concludes is a material weakness must be disclosed in management's annual report on ICFR under Item 308(a)(3). A significant deficiency is reported to the audit committee and the external auditor through the Section 302 certification, and Item 308 does not require it in the annual ICFR report.

Hypothetical example: in the third quarter, internal audit finds that manual journal entries can be posted and approved by the same person in the ERP. Management evaluates the finding as a significant deficiency because compensating review by the CFO covers entries over $50,000, which addresses the largest exposure but not entries below that amount. Because a significant deficiency exists, the quarter's Section 302 certification process requires management to disclose it to the auditors and audit committee. Nothing about the finding goes into the public report unless management concludes at year-end that it is part of a material weakness. If the CEO or CFO learns that an employee with a significant role in internal controls committed fraud of any size, the Section 302 disclosure applies even if no deficiency is a material weakness.

See /us/blog/control-deficiency-aggregation-memo-sec-guidance-and-written-conclusion for the evaluation and /us/blog/fraud-risk-assessment-for-icfr-override-and-antifraud-controls for fraud considerations.

Sub-certification practice

Officers rely on a chain of sub-certifications from process owners and subsidiary controllers. The statute does not prescribe that process, but a documented one supports the officers' basis for signing. A workable sub-certification includes: the period covered, a statement that the process owner has reported all control changes and known deficiencies, a statement on fraud or suspected fraud, and the owner's signature. Retain the forms with the quarter's close file.

What to tell the audit committee

At each quarter-end, the package should list deficiencies identified by management, internal audit and the external auditor, their severity evaluation, compensating controls, remediation status, and any fraud allegations. This is also where the CAE's results under IIA Standard 8.1 fit. See /us/blog/what-the-chief-audit-executive-must-report-to-the-board-standard-8-1.

Errors to avoid

• Treating 302 as a once-a-year exercise.
• Equating "no material weakness" with "no deficiencies to disclose." Significant deficiencies still go to the auditors and audit committee.
• Skipping the fraud question in sub-certifications.
• Describing the 906 certification as a duplicate of 302.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• Sarbanes-Oxley Act section 302, 15 U.S.C. 7241(a): https://www.law.cornell.edu/uscode/text/15/7241
• SEC, 17 CFR 240.13a-14, Certification of disclosure in annual and quarterly reports: https://www.ecfr.gov/current/title-17/section-240.13a-14
• SEC, 17 CFR 229.308, Item 308: https://www.ecfr.gov/current/title-17/section-229.308
• SEC, Release No. 33-8810, Section II.B.1 and footnotes 46 and 52: https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error