(The news featured below is a selection from the news covered in the Federal Securities Report Letter, which is distributed to subscribers of the Federal Securities Law Reports.)

SEC Staff Provides Guidance on Management's Report on Internal Controls

In the wake of SEC approval of the PCAOB's audit standard on internal controls over financial reporting, the Commission staff has interpreted a number of key concepts and provisions regarding management's report on the effectiveness of the company's internal controls. The guidance represents the joint views of the SEC chief accountant and the Division of Corporation Finance, and is available on the SEC Web site at http://www.sec.gov/info/accountants/controlfaq0604.htm.

Section 404 of the Sarbanes-Oxley Act requires management to assess the effectiveness of the company's internal control over financial reporting and include in the annual report management's conclusion as a result of that assessment about whether the company's internal controls are effective.

Generally, the SEC expects management's report on internal control over financial reporting to include controls at all consolidated entities, irrespective of the basis for consolidation. The staff recognizes, however, that a company consummating a business combination during its fiscal year might not always be able to conduct an assessment of the acquired business's internal controls in the period between the consummation date and the date of management's assessment.

In such instances, the staff would not object to management referring in the report to a discussion in the Form 10-K regarding the scope of the assessment and to the disclosure noting that management excluded the acquired business from its report on internal controls. If such a reference is made, however, management must identify the acquired business being excluded and indicate the significance of the business to the consolidated financial statements.

The SEC staff has also assured that a company would still be considered timely and current for purposes of Rule 144 and for eligibility for using the short-form registration even if management or the accountant conclude that the company's internal control over financial reporting is not effective.

The staff has warned, however, that management cannot qualify its conclusions by saying that the company's internal controls are effective subject to certain qualifications or exceptions. In addition, management may not conclude that the internal control over financial reporting is effective if a material weakness exists in the internal controls.

If management's report on internal controls does not identify a material weakness but the accountant's attestation report does, or vice versa, the staff would not view the situation as constituting a disagreement between the company and the auditor that must be reported pursuant to Item 304 of Regulation S-K.

As a general matter, the SEC expects periodic improvements in internal controls and welcomes disclosure of all material changes to such controls. The staff would not object if a company did not disclose changes made in preparation for its first management report on internal controls.

The staff cautioned that a company should carefully consider whether identification of a material weakness should be disclosed, as well as changes made in response to the material weakness. The staff also noted that, after the first management report on internal controls, the company is required to identify and disclose any material changes in internal controls in each quarterly and annual report.

While Section 404 and the SEC rules do not distinguish between large and small companies, the Commission recognizes that many smaller companies might encounter difficulties in evaluating their internal control over financial reporting. Thus, the SEC staff said it would support efforts by bodies such as COSO to develop an internal control framework specifically for smaller companies.

In developing an assessment process and documentation process in preparation for issuing management's report on internal controls, the staff allows the auditor to provide limited assistance to management in documenting internal controls and making recommendations for changes to internal controls. The staff reminded auditors that management has the ultimate responsibility for the assessment, documentation and testing of the internal controls over financial reporting.