JUNE 2003
The SEC has adopted final rules, available at www.sec.gov/rules/final/33-8238.htm, required under
Section 404 of the Sarbanes-Oxley Act of 2002 (the
“Act”). The final rules set forth the requirements implementing the internal control provisions of
Section 404 of the Act (the “Internal Control
Provisions”). Each accelerated filer (generally a company that is subject to the reporting requirements of Section 13(a) or 15(d) of the Exchange Act and has an aggregate market value of common equity of
$75 million or more) must comply with the adopted
Internal Control Provisions as of the end of its fiscal year ending on or after June 15, 2004 (April 15,
2005 for non-accelerated filers, including foreign private issuers and small business issuers) (the
“Extended Compliance Period”).
The final rules also (a) make certain amendments to current disclosure requirements relating to internal control and disclosure controls and procedures and related amendments to the Section 302 certification and (b) require the Section 302 and Section 906 certifications to be filed as exhibits to each reporting company’s periodic reports. Each reporting company must comply with these amendments with respect to reports due on or after August 14, 2003.
INTERNAL CONTROL PROVISIONS
As part of the Internal Control Provisions, each reporting company must include in its annual report under the Exchange Act a report of management on the company’s “internal control over financial reporting” that includes: n A statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting for the company; n n n
A statement identifying the framework used by management to conduct the required evaluation of the effectiveness of the company’s internal control over financial reporting (under new
Exchange Act Rules 13a-15(c) and 15d-15(c), management, with the participation of the company’s CEO and CFO, must evaluate the effectiveness of the company’s internal control over financial reporting as of the end of each of the company’s fiscal years);
Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year, including a statement as to whether or not the company’s internal control over financial reporting is effective. (A negative assurance statement indicating that nothing has come to management’s attention to suggest that the company’s internal control over financial reporting is not effective will not be acceptable.) The assessment must include disclosure of any “material weaknesses” in the company’s internal control over financial reporting identified by management.
Management is not permitted to conclude that the company’s internal control over financial reporting is effective if there are one or more material weaknesses in the company’s internal control over financial reporting; and
A statement that the registered public accounting firm that audited the financial statements included in the company’s annual report has issued an attestation report on management’s assessment of the company’s internal control over financial reporting (under
LLP

new Item 308(b) of Regulations S-K and S-B, each company must file the registered public accounting firm’s attestation report as part of the annual report).
The final rules define “internal control over financial reporting” as a process designed by, or under the supervision of, the reporting company’s CEO and
CFO and effected by the company’s board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with
GAAP and includes those policies and procedures that: n n n
Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the company;
Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with
GAAP, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and
Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the company’s assets that could have a material effect on the financial statements.
The final rules also provide guidance with respect to the framework used by management to conduct the required evaluation of the effectiveness of the company’s internal control over financial reporting and the meaning of the term “material weakness.”
The final rules state that management must base its evaluation of the effectiveness of the company’s internal control over financial reporting on “a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment.”
In the final rules, the SEC further sets forth criteria for suitable frameworks and acknowledges that the framework set forth by the Committee of Sponsoring
Organizations of the Treadway Commission
(“COSO”) in its 1992 publication Internal Control—
Integrated Framework satisfies the criteria for a suitable framework.
When the SEC proposed to require management of each reporting company to make periodic evaluations of the company’s internal control, the SEC did not propose a specific standard upon which management would base its conclusions. The final rules remedy this omission and now preclude management from determining that the company’s internal control over financial reporting is effective if it identifies one or more material weaknesses in the company’s internal control over financial reporting. A “material weakness” is defined in Statement on Auditing
Standards No. 60, which is codified in Codification of Statements on Auditing Standards AU § 325.
Under such standard, a “material weakness” is a reportable condition in which the design or operation of one or more of the internal control components does not reduce to a relatively low level the risk that misstatements caused by errors or fraud in amounts that would be material in relation to the financial statements being audited may occur and not be detected within a timely period by employees in the normal course of performing their assigned functions.
Also as part of the Internal Control Provisions, under new Exchange Act Rules 13a-15(d) and 15d-15(d), management, with the participation of the company’s
CEO and CFO, must evaluate, as of the end of each fiscal quarter, any change in the company’s internal control over financial reporting that has materially affected, or is reasonably likely to materially affect, the company’s internal control over financial reporting. These new rules represent a retreat from the SEC’s proposal to require full quarterly evaluations by management of the effectiveness of the company’s internal control over financial reporting.
AMENDMENTS
Material Changes in Internal Control Over
Financial Reporting.
New Item 308(c) of
Regulation S-K and S-B will require disclosure of any change in a reporting company’s internal control over financial reporting that occurred during the company’s last fiscal quarter and that has materially affected, or is reasonably likely to materially affect, the company’s internal control over financial reporting. The new item amends current Item
307(b), which requires disclosure of whether or not there were significant changes in the company’s internal controls or in other factors that could significantly affect these controls.
Period for Reporting Effectiveness of Disclosure
Controls and Procedures.
The final rules further amend Item 307 of Regulation S-K and S-B.
Whereas Item 307 currently requires each reporting company to disclose conclusions of the company’s
CEO and CFO about the effectiveness of the
LLP 2

company’s disclosure controls and procedures as of a date within 90 days of the filing of the report, amended Item 307 requires disclosure of such conclusions as of the end of the period covered by the periodic report. The final rules do not require that the evaluation of the effectiveness of the company’s disclosure controls and procedures take place on the last day of the period; rather, the effectiveness of the issuer’s disclosure controls and internal control over financial reporting must be evaluated as of the end of the period.
Certifications with Respect to Disclosure Controls and Procedures and Internal Control Over Financial
Reporting.
Although, as is the case with all of the
Amendments, the amended Section 302 certification is effective as of August 14, 2003, the introductory language in paragraph 4 of the amended certification referring to the certifying officers’ responsibility for establishing and maintaining internal control over financial reporting and paragraph 4(b) are subject to the Extended Compliance Period for consistency with the delayed effective date for the Internal
Control Provisions.
Certifications as Exhibits.
The final rules require the
Section 302 and Section 906 certifications to be filed as exhibits to each reporting company’s periodic reports. The Act requires that the Section 302 certification be included “in” the applicable periodic report; however, the Act requires that the Section 906 certification “accompany” the report. In recognition of this difference, the SEC is permitting a reporting company to “furnish,” rather than “file,” the Section
906 certification. Furnished Section 906 certifications will not be subject to liability under
Section 18 of the Exchange Act and will not be subject to automatic incorporation by reference into the company’s Securities Act registration statements, which are subject to liability under Section 11 of the
Securities Act, unless the company takes steps to include the Section 906 certification in a registration statement.
In the adopting release for the final rules, the SEC discussed Senator Biden’s April 11, 2003 statement asserting that Section 906 “is intended to apply to any financial statement filed by a publicly-traded company, upon which the investing public will rely to gauge the financial health of the company,” which includes financial statements included in current reports on Forms 6-K (applicable to foreign issuers) and 8-K and annual reports on Form 11-K
(applicable to employee stock purchase savings and similar plans). The SEC is concerned that extending
Section 906 certifications to Forms 6-K and 8-K may have a chilling effect on disclosure. Also, commentators argued that Section 906 should not apply to Form 11-K. The SEC is consulting with the
Department of Justice and considering the application of Section 906 to these reports.
FOREIGN PRIVATE ISSUERS
The final rules’ requirements relating to the management report on internal control over financial reporting apply to foreign private issuers (but with the later compliance date described above). With respect to the disclosure requirements relating to material changes to a reporting company’s internal control over financial reporting under new Item
308(c) of Regulations S-K and S-B, however, the final rules clarify that a foreign private issuer need only disclose in its annual report the material changes to its internal control over financial reporting that have occurred in the period covered by the annual report.
REGISTERED INVESTMENT COMPANIES
Section 405 of the Act expressly states that registered investment companies are not subject to the provisions of Section 404 of the Act and, accordingly, the SEC has excluded registered investment companies from the internal control provisions adopted in the final rules. Registered investment companies, however, must generally comply with the Amendments adopted under
Sections 302 and 906 of the Act as of August 14,
2003. K&L is separately publishing a client alert specifically addressing the impact of the final rules on registered investment companies.
ASSET-BACKED ISSUERS
Recognizing the special nature of asset-backed issuers, including the fact that such entities are subject to substantially different reporting requirements than those that apply to other reporting companies, the SEC has excluded asset-backed issuers from the new disclosure requirements adopted in the final rules.
DIANE E. AMBLER
202.778.9886
dambler@kl.com
CARY J. MEER
202.778.9107
cmeer@kl.com
SEAN R. HUNT
202.778.9268
shunt@kl.com
LLP 3

K&L is a national law firm with approximately 700 lawyers in its 10 offices around the country. K&L currently represents or recently has performed projects for over half of the Fortune 100; 21 of the 25 largest mutual fund complexes or their investment managers; and 23 of the 25 largest U.S. bank holding companies or their affiliates.
Our practice is national and international in scope, cutting edge, complex, and dynamic.
Our corporate and securities lawyers represent companies, investment banks, underwriters, placement agents, investors and investment groups in a wide range of transactional, compliance, and regulatory matters. For public company clients, our lawyers advise on a continuing basis about disclosure and other compliance and corporate governance issues and assist in the preparation of periodic SEC reports as well as filings triggered by special circumstances and extraordinary transactions. These include insider transactions, option and other equity-based compensation plans, spin-offs, going private transactions, tender offers, proxy contests, corporate restructurings, change in control efforts and other transformative (M&A) events.
Our securities enforcement practice is among the largest and most experienced in the country. We have many years of experience representing organizations and individuals who have become subjects of investigations or enforcement proceedings by the Securities and Exchange Commission, the Commodity Futures Trading
Commission, state securities regulators, or industry self-regulatory organizations, like National Association of
Securities Dealers Regulation, Inc. and the New York Stock Exchange. Our clients have included securities brokerdealers, investment advisors, investment companies, publicly held companies, banks, insurance companies, accounting firms, commodities firms and law firms.
FOR MORE INFORMATION
about our securities capabilities, please contact one of the attorneys listed below.
Boston
Dallas
Los Angeles
Miami
Newark
New York
Pittsburgh
San Francisco
Washington
Stephen L. Palmer
Norman R. Miller
Mark A. Klein
Thomas J. Poletti
Clayton E. Parker
Stephen A. Timoni
John D. Vaughan
Stephen R. Connoni
Janice C. Hartman
Michael C. McLean
Mark H. Davis
Peter W. Sheats
Alan J. Berkeley
Cary J. Meer
617.951.9211
214.939.4906
310.552.5033
310.552.5045
305.539.3306
973.848.4020
212.536.4006
212.536.4040
412.355.6444
412.355.6458
415.249.1020
415.249.1030
202.778.9050
202.778.9107
spalmer@kl.com
nmiller@kl.com
mklein@kl.com
tpoletti@kl.com
cparker@kl.com
stimoni@kl.com
jvaughan@kl.com
sconnoni@kl.com
jhartman@kl.com
mmclean@kl.com
mdavis@kl.com
psheats@kl.com
aberkeley@kl.com
cmeer@kl.com
LLP
® www.kl.com
®
BOSTON n DALLAS n HARRISBURG n LOS ANGELES n MIAMI n NEWARK n NEW YORK n PITTSBURGH n SAN FRANCISCO n WASHINGTON
...........................................................................................................................................................
This publication/newsletter is for informational purposes and does not contain or convey legal advice. The information herein should not be used or relied upon in regard to any particular facts or circumstances without first consulting a lawyer.
© 2003 KIRKPATRICK & LOCKHART LLP . ALL RIGHTS RESERVED.