Section 404 of the Sarbanes-Oxley Act of 2002 mandated the inclusion in a public company’s annual report of an assessment by management of the company’s internal control over financial reporting. This assessment must generally be made with respect to all entities required to be consolidated in a company’s financial statements.
The Problem
Following an acquisition, a company attempting to comply with the new rules may find itself unable to report on the internal control of an acquired business because the controls and systems of that business are not yet fully understood, or because they are different from the company’s existing internal control and must be integrated or altered over time. The acquirer may also discover flaws with the potential to be identified as material weaknesses.
How, then, can a company meet its reporting obligation with respect to internal control before it is able completely and adequately to assess the internal control of an acquired business?
The Solution
Recognizing that a business might often be acquired too late in the year for management to conduct a proper assessment of the internal control of the acquired business (or certainly to address material weaknesses, should any be identified), the SEC will allow an acquiring company’s management to omit an assessment of the internal control of the acquired business from the first annual management report following the acquisition, provided the date of such report is not more than one year after the date on which the acquisition is completed.
If management excludes an acquired business from the assessment contained in its report, the report must reference, and the company must provide, elsewhere in its Form 10-K or Form 10-KSB disclosure setting forth the scope of management’s assessment, the acquired business excluded from the assessment, and the significance of the acquired business to the company’s financial statements.
Disclosure of Changes in Internal Control over Financial Reporting
In addition to their annual reporting requirements, companies are under a continuing obligation to disclose, in both quarterly and annual reports, any material changes in internal control over financial reporting, including improvements, for all consolidated entities during the quarter preceding the report. As an alternative to providing such ongoing disclosure with respect to acquired businesses, the SEC will permit a company to disclose such changes in the first annual report to include the acquired business in management’s assessment of internal control.
Consistent with its willingness to allow a company to defer the disclosure of material changes in internal control relating to an acquired business until the business is first included in management’s Section 404 assessment, the SEC says that the scope of the Section 302 certification provided with annual and quarterly reports will be considered not to extend to an acquired business if the company has elected not to disclose changes relating to the acquired business on an ongoing basis. However, if a company has elected to disclose changes relating to the acquired business, the certification will be considered to speak to the internal controls of the acquired business.