This week, we explain SOX 404, and what the 2010 Dodd-Frank financial reform legislation added to the mix.

Section 404 of SOX originally contained two related requirements. Section 404(a) dealt with management’s assessment of internal control, while Section 404(b) covered the auditor’s attestation report on management’s assessment. Dodd-Frank added a new Section 404(c), which we explain below.

In its rulemaking under Section 404, the SEC chose the term “internal control over financial reporting,” or ICFR.¹  We will spare you the considerable complexity underlying the ICFR definition, but if you ever need to dig into this topic, have a look at the discussion starting at FN 35 in Release No. 33-8238.

Section 404(a)—Management’s Assessment

The SEC has implemented Section 404(a) via Exchange Act Rules 13a-15(c) and (d) (Rules 15d-15(c) and (d) for Section 15(d) reporting companies such as debt-only filers). Those rules require public companies to evaluate, with the participation of the CEO and CFO:

• the effectiveness of ICFR as of the end of the fiscal year; and
• any change in its ICFR that occurred during the fiscal quarter that has materially affected, or is reasonably likely to materially affect, the company’s ICFR.²

(Newly public companies are exempt from these requirements—more about that in a minute.)

Form 10-K and Form 10-Q flesh out these requirements. First, each annual report on Form 10-K must include a report on internal control that contains:

• a statement of management’s responsibility for establishing and maintaining adequate ICFR;
• a statement identifying the framework used by management to evaluate the effectiveness of ICFR;
• management’s assessment of the effectiveness of ICFR as of the end of the most recent fiscal year, including a statement whether ICFR is effective. The statement must also include disclosure of any material weakness in ICFR identified by management. Management is not permitted to conclude that the issuer’s ICFR is effective if there are one or more material weaknesses; and
• a statement that the auditor has issued an attestation report on management’s assessment.

See Item 9A of Form 10-K, referring to Reg S-K Item 308.

Second, each Form 10-K and Form 10-Q must disclose any change in ICFR identified in connection with management’s assessment that occurred during the last fiscal quarter (the fourth fiscal quarter in the case of a 10-K) that has materially affected, or is likely to materially affect, ICFR. See Form 10-K, Item 9A and Form 10-Q, Item 4, both of which refer to Reg S-K Item 308(c).

So, to recap, public companies need:

• an annual assessment of ICFR; and
• a quarterly assessment of changes in ICFR.

Section 404(b)—auditor’s attestation

Each Form 10-K must also include an auditor’s attestation report, unless the company benefits from one of the exemptions we discuss below. See Item 9A of Form 10-K, referring to Reg S-K Item 308. No auditor’s attestation is needed for a quarterly report. The PCAOB has provided the ground rules for the 404(b) attestation report in Auditing Standard No. 5.

Are there any exemptions from Sections 404(a) and 404(b)?

Yes. Newly public companies get a pass from the SEC’s rules implementing SOX 404(a) and 404(b) until they have filed one annual report on Form 10-K. This exemption is baked into the text of Rules 13a-15(c) and 15d-15(c), as well as Reg S-K Item 308 (see Instruction (a)). Bear in mind that the company will have to include a specific statement in its first 10-K in lieu of the management’s assessment. 

In addition, the Dodd-Frank Act gave permanent relief from SOX 404(b) to smaller public companies. Section 989G of Dodd-Frank added a new Section 404(c) to Sarbanes-Oxley, exempting companies that are not large accelerated filers or accelerated filers from the requirement to provide a Section 404(b) auditor’s attestation.  See also the SEC’s rule implementing 989G. 

The terms “large accelerated filer” and “accelerated filer” are defined in Exchange Act Rule 12b-2. For these purposes, a large accelerated filer is a company that, as of the end of its fiscal year:

• has an aggregate worldwide market value of voting and non-voting common equity held by non-affiliates (i.e, market capitalization) of $700 million or more (measured as of the last business day of its most recently completed second fiscal quarter);
• has been subject to SEC reporting under the Exchange Act for a period of at least 12 calendar months;
• has filed at least one annual report under the Exchange Act with the SEC; and
• is not eligible to use the requirements for smaller reporting companies in Regulation S-K.

An accelerated filer is a company meeting the same conditions, except that it has a market capitalization of $75 million or more but less than $700 million (measured as of the last business day of its most recently completed second fiscal quarter).   

1   The definition is contained in Rules 13a-15(f)/15d-15(f).
2   Foreign private issuers need only make this evaluation yearly.

SOX 301 requires that audit committees of issuers listed on U.S. exchanges “establish procedures” for (i) receipt, retention, and treatment of complaints regarding accounting, internal accounting controls, or auditing matters; and (ii) confidential, anonymous submission by employees of concerns regarding questionable accounting or auditing matters.  SOX 301 was codified as Exchange Act Section 10A(m), which the SEC implemented with Rule 10A-3(b)(3).  (See also Nasdaq Rule 5605(c)(3) and Section 303A.06 of the NYSE Listed Company Manual.) 

Pemrose’s earnest and ambitious GC, Brantley Foster, calls.  “We operate all over the world and are worried that our whistleblower hotline runs afoul of local law requirements.  What can we do?”

The short answer is that there is no short answer:  multinational companies and foreign private issuers subject to SOX 301 (i.e., SEC registrants) may have difficulty reconciling the SOX requirement to non-U.S. local law.  In particular, some non-U.S. jurisdictions have laws that forbid the adoption of an anonymous whistleblower hotline.  For example, the French data protection authority (CNIL) in 2005 restricted the use of anonymous whistleblower hotlines by French subsidiaries of two U.S. companies.  As noted in our Client Alert on this topic here, CNIL indicated that the hotlines “could lead to an ‘organized system of denunciation’” and carry the risk that “employees may be ‘stigmatized.’”

It’s not just France – Spain and Portugal expressly prohibit anonymous whistleblowing, while certain other EU countries have established non-binding guidelines.  (The SEC Staff has been in contact with EU member states regarding these issues, and its correspondence is available here.)  The issue also arises in countries outside the EU.  For example, Argentina has a data protection law modeled on the EU’s laws, and certain other non-EU jurisdictions in Eastern Europe have similar data protection laws. 

The bottom line is that  you will need to analyze this issue on a country-by-country basis, and get local advice on how to maintain a hotline in those jurisdictions.

Can Pemrose operate two types of hotlines, one tailored for local jurisdictions and one for the United States (and other jurisdictions where anonymity is not an issue)? 

Probably.  Although the SEC has never addressed this question directly, we think the better answer under SOX 301 and Rule 10A-3 is “yes.”  Recall that SOX 301 requires companies to establish procedures for confidential, anonymous submission of information.  Neither SOX 301 nor Rule 10A-3 says that this must be the sole and exclusive channel for whistleblowers, or that alternate whistleblowing procedures that are not anonymous must be discarded. Don’t forget, though, that local law may make it problematic if the U.S. hotline is available locally.  If you find yourself experiencing this collision between local law and SOX 301, let’s talk.

Let’s start with the Section 404(a) management’s assessment.  The good news for Green Goo is that the SEC has adopted a transition period permitting a newly public company to wait until its second annual report to comply with Section 404(a).  In particular, the various ICFR requirements — to maintain ICFR; to evaluate the effectiveness of ICFR annually; and to evaluate certain ICFR changes — apply only to a company that was required to (or filed) one prior annual report with the SEC.  See Rules 13a-15(a), (c) and (d); Form 10-K Item 9A; and Instruction 1 to Item 308 of Regulation S-K (for domestic U.S. companies); see also Instructions to Form 20-F Item 15 (for foreign private issuers). 

Similarly, as a newly public company Green Goo can delay its SOX 404(b) auditor’s attestation until its second annual report.  See Form 10-K Item 9A and Instruction 1 to Item 308 of Regulation S-K (for domestic U.S. companies); and Instructions to Form 20-F Item 15 (for foreign private issuers).  After that point, issuers that are not large accelerated filers or accelerated filers are exempt from the requirements SOX 404(b) by virtue of the 2010 Dodd-Frank Act, which added new Section 404(c) to SOX.  See Release 33-9142 (implementing Section 989G of Dodd-Frank). 

Does Green Goo need to say something in its first annual report to explain why the ICFR report is missing?

Yes.  Green Goo will need to include the following statement in its first annual report:

This annual report does not include a report of management's assessment regarding internal control over financial reporting or an attestation report of the company's registered public accounting firm due to a transition period established by rules of the Securities and Exchange Commission for newly public companies.

See Instruction 1 to Item 308 of Regulation S-K (for domestic U.S. companies); Item 15 of Form 20-F (for foreign private issuers.)

What about certifications from Green Goo’s management?

The SEC has provided transition relief for the SOX 302 certification that is required from a newly public company’s CEO and CFO.  (For the text of the certification, see Regulation S-K Item 601, Exhibit 31 and, for foreign private issuers, Form 20-F Item 19, Exhibit 12.)  In that case, Rule 13a-14(a) allows Green Goo to omit:

• the portion of the introductory language in paragraph 4 of the certification referring to ICFR; and
• the language in paragraph 4(b) of  the certification that refers to the certifying officers’ responsibility for designing, establishing and maintaining internal control over financial reporting for the company. 

Note that a company normally is not allowed to change any aspect of the wording of the certification.  And another thing — see the last bullet point at the end for a trap to avoid.

Some additional things to bear in mind

Just because the ICFR rules do not apply during the transition period, there still are some related issues to keep on the radar screen:

• If Green Goo uncovers a material weakness in ICFR during the transition period, let’s talk – disclosure may well be needed.  See Question 7 of the SEC Staff’s IFRS FAQ.
• A newly public company must comply with the SEC’s requirements relating to disclosure controls and procedures — which is a cousin of ICFR — from the get go; there is no DC&P transition period.  See Rule 13a-15(a).
• Similarly, a newly public company does not enjoy a transition period for the requirement to maintain an appropriate “system of internal accounting controls” under Exchange Act Section 13(b)(2).

What about the future?

Looking down the road to Green Goo’s second fiscal year and annual report: 

• it must maintain ICFR (Rule 13a-15(a));   
• its management must evaluate the effectiveness of ICFR as of the end of the fiscal year (Rule 13a-15(c));
• its management must evaluate any changes that have materially affected (or are reasonably likely to materially affect), the company’s ICFR (Rule 13a-15(d));
• it must provide the required auditor’s attestation (assuming SOX 404(c) does not apply); and
• it must provide the SOX 302 certification in full — WARNING TO FORM CHECKERS EVERYWHERE:  a company that is newly compliant with SOX 404(b) might miss this requirement (e.g., in its first Form 10-Q filing after its first fully compliant Form 10-K) because of the temptation to cut and paste the certifications from a pre-compliance Form 10-Q.  This can result in an SEC Staff comment forcing you to amend the filing to include proper certifications.

Members of the nominating/corporate governance and compensation committees do not need to meet Sarbanes-Oxley requirements for independence, but must meet independence (and certain other) requirements under the NYSE/Nasdaq rules. 

Considerations for companies that have recently completed an IPO

Note that newly listed companies that have just closed an IPO generally must comply with the NYSE/Nasdaq listing standards as soon as they are listed. However, except as noted below with regard to Nasdaq, newly public companies are allowed to phase-in compliance with committee (audit, nominating and compensation) and majority board independence requirements. (Rule 10A-3 also provides a phase-in period for audit committees.):

• Upon initial listing – one independent director required on each committee.
• 90 days after initial listing – majority of independent directors required on each committee.
• One year after initial listing – full compliance with committee independence requirements required and majority of independent directors on the full board required.

(See NYSE Rule 303A.00 “Effective Dates/Transition Periods and Nasdaq Rule 5615(b)(1).) Under the Nasdaq Rules, a company may decide not to have independent compensation and nominating committees, but rather to carry out these functions via a majority independent board of directors.

Considerations regarding “controlled companies”

Generally, under the NYSE/Nasdaq Rules, “controlled companies” – those where more than 50% of the voting power for the election of directors is held by an individual, a group or another company (see NYSE Rule 303A.00 “Controlled Companies” and Nasdaq Rule 5615(c)) – are exempt from certain of the board and committee independence and other listing requirements. (See NYSE Rule 303A.00 “Effective Dates/Transition Periods” and Nasdaq Rules 5615(b), 5605(d) and 5605(e)) and IM-5615-5.) Companies that are no longer “controlled companies” (and companies emerging from bankruptcy, which we don’t cover here) have similar phase-in periods under the NYSE/Nasdaq Rules as those discussed above for companies that have recently completed IPOs. 

Under the NYSE and Nasdaq Rules, a company that ceases to be a controlled company is permitted to phase in compliance with the independence requirements for the nominating and compensation committees and has twelve months to comply with the majority independent board requirement.

We tackle today independence requirements for board members of companies listed on the NYSE and Nasdaq.  (You can reassure prospective board members that experience fighting hostile extra-terrestrials bent on inter-planetary mayhem is thankfully not one of the required attributes.)

Here’s how the independence landscape looks:

Listed companies must have a majority of independent directors

The NYSE and Nasdaq generally require that a listed company’s full board is composed of a majority of independent directors (see NYSE Rules 303A.01 and 303A.02 and Nasdaq Rules 5605(a)(2) and 5605(b)(1)).  There are exceptions for a number of entities you might typically encounter, including foreign private issuers, “controlled companies,” companies in bankruptcy and limited partnerships.

What does “independence” mean in this context?  The answer differs for the NYSE and Nasdaq:

Note that we have abbreviated these standards. If you encounter an independence question this chart will get you started, but is not a substitute for a careful review of the detailed rules. For example, “company,” “family member” etc. are defined more broadly than you may think. If you have any questions on the independence standards, let’s talk.

NYSE/Nasdaq and SOX independence requirements for members of the audit committee

Members of the audit committee must meet two sets of standards – those imposed by Rule 10A-3, and those imposed by the NYSE/Nasdaq rules. The upshot of this is that audit committee members need to be analyzed differently than members of other board committees. It’s not enough, for example, to conclude that a prospective director is independent just because he or she meets the NYSE/Nasdaq definition of independence; you have to think about the Rule 10A-3 definitions as well.

• SOX independence requirements. Each member of the audit committee must be a member of the board of directors and be independent.  An independent director is one who does not accept any compensation from the company (other than for being a director) and is not an affiliated person of the company or any of its subsidiaries.  The definition of an “affiliated person” looks to the familiar securities law definition of affiliate – i.e., one who controls, is controlled by or is under common control with the issuer.
• NYSE/Nasdaq additional requirements. Under the NYSE Rules, each member of the audit committee must be independent under SOX and the NYSE’s listing standards (discussed above) and be financially literate (see NYSE Rules 303A.06 and .07). Under the Nasdaq Rules, each member of the audit committee must be independent under SOX and the Nasdaq’s listing standards (discussed above) and members may not have participated in the preparation of the financial statements of the company or its subsidiaries in the past three years and must be able to read and understand financial statements (see Nasdaq Rule 5605(c)(2)). The NYSE and Nasdaq both require a company’s audit committee to be composed of at least three members.

When must a Section 906 certification accompany an amendment to a periodic report (Form 10-K/A, Form 20-F/A or Form 10-Q/A)?

A Section 906 certification must accompany each periodic report that contains financial statements. As a result, “amendments to periodic reports that do not contain financial statements would not require a new Section 906 certification.” Release No. 33-8238 (text accompanying FN 154).

What about a Section 302 certification?

A Section 302 certification must accompany all amended periodic reports, although the form of certification (set out in Regulation S-K Item 601(b)(31)) may be modified as follows depending on the amendment’s contents:

• Paragraphs 1 (CEO/CFO have read the report) and 2 (no material misstatements or omissions) must accompany every amendment.
• Paragraph 3 (financial statements/information fairly present financial condition) may be omitted if the amendment includes no financial statements or other financial information.
• Paragraphs 4 (controls and procedures) and 5 (disclosure to auditors and audit committee) may be omitted if the amendment includes no disclosure under Regulation S-K Item 307 (regarding disclosure controls and procedures) or Item 308 (regarding internal control over financial reporting). 

C&DI 161.01; see also Release No. 33-8238 (FN 154 and accompanying text).

Does a Form 8-K require SOX certifications when the report includes financial statements or financial information?

No. Current reports, such as those on Form 8-K and Form 6-K, unlike periodic (i.e., quarterly and annual) reports, “are not covered by the certification requirement.” Release No. 33-8124 (text accompanying FN 50); see also Release No. 33-8238 (text accompanying FN 142).