The SEC has taken several steps to help issuers comply more cost-effectively with the internal control rules under section 404 of the Sarbanes-Oxley Act of 2002. The new measures include the following:

  • The SEC has provided guidance for management on how to evaluate a company’s internal controls using a top-down, risk-based approach. This new guidance is voluntary, so issuers that are already complying with section 404 will not be compelled to alter their existing procedures.
  • The SEC has eliminated the requirement for auditors to provide an attestation of management’s assessment. Instead, auditors will have to provide only an opinion on the actual effectiveness of the issuer’s internal controls. (Under the prior rules, the auditors had to provide both the attestation and the opinion.)
  • A new definition of the term "material weakness" has been adopted. A material weakness in internal control means a deficiency or combination of deficiencies that create a reasonable possibility that a material misstatement in the financial statements will not be prevented or detected on a timely basis. Under the previous definition, the threshold was "more than a remote possibility." As under the current rules, all material weaknesses must be publicly disclosed.

Cross-border companies that comply with the SEC’s internal control requirements will not have to comply with the internal control rules recently proposed by Canadian securities regulators.

The Canadian proposals differ from the U.S. rules in several respects, including that (i) they do not include any auditor opinion requirement; (ii) they would permit management to exclude an acquired business from its internal control evaluation if the acquisition occurred within 90 days of the relevant period, whereas the SEC rules permit acquired businesses to be excluded for an entire year; and (iii) instead of requiring disclosure of material weaknesses, the Canadian proposals would require disclosure of "reportable deficiencies," defined as deficiencies in the design or operation of internal controls that would cause a reasonable person to doubt the reliability of the issuer’s financial statements.

The proposed Canadian rules are silent on whether a reportable deficiency under Canadian law is the same as a material weakness under U.S. law. However, OSC staff stated at a recent securities law conference that the definition of a reportable deficiency incorporates a reasonableness standard that is intended to be less granular and aimed at avoiding the excessive costs and inefficiencies that issuers have faced in complying with the U.S. rules.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.