Sarbanes-Oxley Section 404
A Guide for Small Business
July 14, 2017
For 2007 annual reports, smaller public companies need to assess their internal control over financial reporting.
It doesn't have to be a chore.
Beginning Your Evaluation
Step 3 — Reporting Your Conclusions on Overall Effectiveness, and Deficiencies
Your company's 2007 annual report will include your assessment of the overall effectiveness of your internal controls. In making your determination of whether the company's internal controls are effective, you should begin by assessing any control deficiencies. Is any of them — alone or in combination — serious enough to be a material weakness? If so, you can't conclude that the company's controls are effective. This puts a significant premium on knowing what constitutes a material weakness.
Simply put, a material weakness is one or more control deficiencies that create a reasonable possibility of a material misstatement in your company's annual or interim financial statements. This does not necessarily mean that a material misstatement has occurred, but only that the controls might not be good enough to detect or prevent a material misstatement on a timely basis.
The SEC's new guidance highlights the factors that you should consider in deciding whether a control deficiency is a material weakness. For example:
- How susceptible is the related financial reporting element to loss or fraud?
- How significant are the financial statement amounts or the transaction totals that are exposed to the deficiency?
If you identify any material weaknesses, you must describe them in your assessment of the internal controls that appears in your annual report. You should also consider including the following in your assessment:
- A analysis of how the material weakness affects the company's financial reporting and internal controls
- Your current plans (or the actions you've already taken) to address the material weakness
Finally, you should describe these material weaknesses to the audit committee and your external auditor, along with any control deficiencies you've found that didn't rise to the level of a material weakness, but which you think are important enough to merit their attention. Control deficiencies of this kind are defined as "significant deficiencies" in the SEC's rules.