SOX Sections 302, 404(a) and 404(b): what each one requires

• Identify the six certification elements in 15 U.S.C. 7241(a)
• Distinguish the 404(a) management report from the 404(b) auditor attestation
• Explain how the 302 deficiency disclosures connect to the 404 evaluation
• Determine which companies are exempt from 404(b)

Section 302: the officer certifications

Section 302 of the Sarbanes-Oxley Act (15 U.S.C. 7241) directed the SEC to require the principal executive officer and principal financial officer to certify each annual and quarterly report. Under 7241(a), the signing officers certify that:

1. they have reviewed the report;
2. based on their knowledge, the report does not contain an untrue statement of a material fact or omit a material fact needed to make the statements not misleading;
3. based on their knowledge, the financial statements and other financial information fairly present in all material respects the financial condition and results of operations;
4. they are responsible for establishing and maintaining internal controls, have designed them so that material information is made known to them, have evaluated their effectiveness as of a date within 90 days before the report, and have presented their conclusions about effectiveness in the report;
5. they have disclosed to the auditors and the audit committee all significant deficiencies in the design or operation of internal controls that could adversely affect the ability to record, process, summarize and report financial data, identified any material weaknesses for the auditors, and disclosed any fraud, whether or not material, involving management or other employees with a significant role in internal controls;
6. they have indicated in the report whether there were significant changes in internal controls after the evaluation, including corrective actions on significant deficiencies and material weaknesses.

Section 302 applies every quarter. That is why the quarterly close needs a deficiency roll-up: the officers cannot make the disclosure in item 5 unless someone tells them what deficiencies exist.

Section 404(a): management’s annual report

15 U.S.C. 7262(a) requires each annual report to contain an internal control report that:

• states management’s responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and
• contains an assessment, as of the end of the most recent fiscal year, of the effectiveness of that structure and those procedures.

The assessment is as of a point in time: fiscal year-end. Item 308(a) of Regulation S-K sets the report content, and both Item 308(a)(3) and Release 33-8810 say management is not permitted to conclude that ICFR is effective if there are one or more material weaknesses. It also says that if all material weaknesses found during the year are remediated by year-end, management may conclude ICFR is effective, while considering whether the remediated weaknesses should be disclosed.

Section 404(b): the auditor’s attestation

15 U.S.C. 7262(b) requires the registered public accounting firm that audits the financial statements to attest to and report on management’s assessment, under PCAOB standards. The attestation may not be a separate engagement. The PCAOB standard is AS 2201, under which the ICFR audit is integrated with the financial statement audit.

Two exemptions apply:

• 7262(b) does not apply to an emerging growth company (added by the JOBS Act of 2012).
• 7262(c), added by Section 989G of the Dodd-Frank Act in 2010, says (b) does not apply to an issuer that is neither a large accelerated filer nor an accelerated filer under Rule 12b-2.

So a non-accelerated filer files a 404(a) management report but no auditor attestation. Lesson 8 covers how filer status is determined.

How the pieces connect

The quarterly 302 process and the annual 404 evaluation share one deficiency log. A deficiency found in Q2 testing feeds the Q2 certification sub-certifications and the year-end severity evaluation.

Practical points for staff

• Keep a dated deficiency log that rolls up every quarter with severity, owner and status.
• Track significant changes in internal control (system conversions, reorganizations, new processes) each quarter so the officers can make the item 6 statement.
• Fraud involving anyone with a significant role in internal control goes to the auditors and audit committee whether or not it is material.

Quarterly certification support at Pinecrest Medical Devices, Inc.