5.2.3 SOX - the 'in-control' requirement

SOX was enacted in 2002. This was the American response to a number of major corporate and accounting scandals (e.g. Enron, Tyco International, Adelphia, Peregrine Systems and WorldCom). When the share prices of the affected companies collapsed, investors lost billions of dollars and the public confidence in the nation's securities markets had also been affected. SOX was named after the sponsors Senator Paul Sarbanes, the Democrat Senator of Maryland, and Representative Michael G. Oxley, a Republican from Ohio. SOX was approved by an overwhelming majority (House: 334-90;

Senate 99-0).1

SOX established improved standards for boards, management, and public accounting firms of public companies regulated by the US Securities Exchange Act of 1934 (US Securities Exchange Act). It does not apply to privately held companies. SOX contains 11 titles, or sections, dealing with subjects ranging from additional corporate board responsibilities to criminal penalties. It required the SEC to introduce rulings to implement SOX. SOX and subsequently implemented SEC rules now require public companies to evaluate their internal controls and to publish those findings together with their SEC filings. Management and external auditors are held to evaluate the effectiveness of a company's internal control over financial reporting based on a suitable control framework. For this evaluation, the framework developed in the COSO Report 1992 is generally used.

Although SOX is directed at public companies, many privately owned companies and non-profit organisations are also electing to evaluate their systems of internal control using COSO's framework. The manner in which the components of the COSO framework are applied to an organisation will depend on the nature and size of the organisation. Presently, the debate continues over the perceived benefits and costs of SOX. Supporters contend that the legislation was necessary; opponents argue that SOX imposes too big a burden on US industry.

Section 404 of SOX directed the SEC to implement rules that require public companies to include in their annual reports ' a report of management on the company's internal control over financial reporting'.2 Both US and non-US companies listed in the US are subject to compliance with these requirements.3 The SEC issued a "Final Rule on Management's Reports on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports" (the SEC Rule on Internal Control).4 This Rule contains provisions regarding the format and the substance of the internal control report. Concerning the format, the following elements are mentioned that have to be included:

The last-mentioned element requires that the company files the accounting firm's attestation report as part of the annual report. Additionally, management should evaluate any change in the company's internal control over financial reporting that occurred during a fiscal quarter that has materially affected, or is reasonably likely to materially affect, the company's internal control over the annual financial reporting.

As regards the substance, the SEC Rule on Internal Control defines 'internal control over financial reporting' as:

This definition of Internal control encompasses the subset of internal controls addressed in the COSO Report 1992 in so far as they pertain to financial reporting objectives. However, the SEC's definition does not include those elements that relate to the effectiveness and efficiency of a company's operations (compare definition used in the COSO Report 1992 under 1. section 5.2.2, supra). Neither does it refer to a company's compliance with applicable laws and regulations (compare definition used in the COSO Report 1992 under 3. - section 5.2.2, supra), with the exception of compliance with the applicable laws and regulations directly related to the preparation of financial statements, such as the SEC's financial reporting requirements.8

Interestingly, the SEC's definition also creates an implicit link to the US prohibition on corrupt practices as defined in the FCPA by referring to the COSO Addendum 1994 (see section 5.2.2 supra)9In order to achieve the desired result and to provide consistency with the COSO Addendum, the SEC has explicitly included the words 'disposition of assets' under (1) and (3) of its definition. In its explanation to the text, the SEC pointed to the fact that the SEC definition will be used for purposes of public management reporting, and that the companies that will be subject to section 404 SOX requirements are also subject to the FCPA requirements.10 It certainly seems practical to combine the information required for both purposes in one internal control statement. However, the SEC Rule on Internal Control prescribes that the framework on which management's evaluation is based will have to be a suitable, recognised control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment.11 This means that the COSO framework is one eligible framework, but that others could also be used.

Under the SEC rules, management must disclose any problems that could have a material effect on the financial statements. Management will be unable to conclude that the company's internal control over financial reporting is effective if there are one or more material weaknesses in such control. Any uncertainties concerning company employees engaging in corrupt practices could therefore in the view of the author and based on the explanatory text to the SEC Rule on Internal Control be qualified as such a material weakness.