Are regulations changing management reports? A recent Financial Executives Research Foundation (FERF) survey reviews year-one disclosure practices for management's reports on internal controls, and looks at trends likely for year two.

• Author: Holtzman, Mark P.

One of the provisions of the Sarbanes-Oxley Act of 2002 led to new regulations over internal control disclosures. But the resulting U.S. Securities and Exchange Commission (SEC) rules provide companies with discretion when writing and disclosing their Management's Reports on Internal Controls. This report on internal controls was not required prior to Section 404. However, certain companies voluntarily chose to provide management's report on the financial statements.

What practices are most common and what interesting approaches did specific companies develop?

In order to find out about the emerging trends in management reports, Financial Executives Research Foundation (FERF) studied companies' reports, released during the spring 2005 reporting season. The study provides a portrait of these trends and techniques that can serve as a guide for practitioners preparing year two disclosures.

The report addresses a number of areas where there is variation in practice--for example, companies disclosing two separate management reports (one on internal control and another on the financial statements); the location of management reports within Form 10-K; specific statements provided by some, but not all, companies in their reports; and the issuance of a single "integrated" audit report.

SEC Regulations

Section 404 of Sarbanes-Oxley directs the SEC to require annual reports (in Forms 10-K) to contain an internal control report that includes: 1) a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and 2) an assessment of the effectiveness of the company's internal control structure and financial reporting procedures.

Section 404 also requires the company's independent registered public accounting firm to attest to and report on management's assessment.

In response to Section 404, the SEC issued its final rule: Management's Reports on Internal Control over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports, setting forth specific requirements for Management's Reports on Internal Control Over Financial Reporting.

The SEC final rule requires four statements to be included in the report: 1) management's responsibility for internal control over financial reporting; 2) the internal control framework used; 3) management's assessment; and 4) reference to the auditor's attestation report. Domestic accelerated filers--companies with equity market capitalization exceeding $75 million (among other criteria)--are required to meet the requirements for fiscal years ending on or after Nov. 15, 2004.

In addition, the...