Securities Law Advisory
June 12, 2003
SEC Adopts Final Rules Regarding Reports on
Internal Controls and Filing Requirements for
Section 302 and 906 Certifications
The Securities and Exchange Commission (SEC) recently adopted final rules implementing the requirements
of Section 404(a) of the Sarbanes-Oxley Act of 2002 (the Act) and amended the current rules and imposed
new filing requirements for the certifications required by Sections 302 and 906 of the Act.1
Section 404 Rules
The SEC’s new rules implementing the requirements of Section 404 of the Act impose a number of new
reporting requirements on public companies, require the accounting firm that audited the company’s financial
statements to provide a new attestation, and modify certain of the certification requirements under Section
302 of the Act.
What are the general requirements of the new Section 404 rules?
The new rules2 impose four general requirements:
• Each public company, other than a registered investment company, will be required to include in its
annual report a report by management on the company’s internal control over financial reporting.
• The registered public accounting firm that audited the company’s financial statements included in
the annual report will be required to issue an attestation report on management’s assessment of the
company’s internal control over financial reporting.
• The company will be required to file the accounting firm’s attestation report as part of the company’s
annual report.
1
See Final Rule: Management Reports on Internal Control over Financial Reporting and Certification of Disclosure in Exchange
Act Periodic Reports, Securities Act Rel. No. 33-8238, Exchange Act Rel. No. 34-47986, Investment Company Act Rel. No. IC26068, http://www.sec.gov/rules/final/33-8238.htm (Jun. 5, 2003).
2
These rules are implemented through (among other conforming changes) amendments to Exchange Act Rules 13a-15 and 15d-15
and Investment Company Act Rule 30a-3, the creation of a new Item 308 of Regulations S-K and S-B, and amendments to Forms
10-K, 10-KSB, 10-Q, 10-QSB, 20-F, 40-F, and N-CSR.
www.alston.com
• Management must evaluate, as of the end of each fiscal quarter, any change in the company’s internal
control over financial reporting that occurred during the quarter that has materially affected, or is
reasonably likely to materially affect, the company’s internal control over financial reporting.
How do the final rules differ from the proposed rules?
The final rules differ from the proposed Section 404 rules in four significant ways:3
• The definition of “internal control over financial reporting” has been clarified to exclude operational
areas or compliance with laws and other similar regulatory matters (other than laws relating to the
preparation of financial statements);
• The final rules require that management’s evaluation of the company’s internal control over financial
reporting be performed using an evaluation framework that meets certain requirements, which, in the
case of foreign private issuers, may be a framework used in its home country;
• The requirement for a quarterly report on internal controls was curtailed and the SEC in its own words
“took a step back” and clarified that the requirement is only to discuss any material changes in the
company’s internal controls; and
• Given a number of concerns about preparation for the Section 404 requirements, the SEC extended
the transition period – for “accelerated filers,” the new rules are effective beginning with fiscal years
ending after June 15, 2004; for all others, including foreign private issuers, the rules are effective
beginning with fiscal years ending on or after April 15, 2005.
What is the definition of “internal control over financial reporting”?
The SEC had originally proposed to define and use the term “internal controls and procedures for financial
reporting.” After considering comments on the proposed definition, the SEC adopted in the final rules a new
defined term “internal control over financial reporting,” which it viewed as the “predominant term” used by
companies and auditors. The final rules define “internal control over financial reporting” as:
A process designed by, or under the supervision of, the issuer’s principal executive and principal financial officers, or persons performing similar functions, and effected by the registrant’s
board of directors, management and other personnel, to provide reasonable assurance regarding
the reliability of financial reporting and the preparation of financial statements for external
purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:
(1) Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect
the transactions and dispositions of the assets of the registrant;
3
See Proposed Rule: Disclosure Required by Sections 404, 406 and 407 of the Sarbanes-Oxley Act of 2002, Securities Act Rel.
No. 33-8138, Exchange Act Rel. No. 34-46701, Investment Company Act Rel. No. IC-25775, http://www.sec.gov/rules/proposed/
33-8138.htm (Oct. 22, 2002). For background and more information, see Alston & Bird LLP Securities Law Advisory, “SEC Proposes Regulations Regarding Corporate Codes of Ethics, Audit Committee Financial Experts and Internal Controls Reports,” http:
//www.alston.com/articles/Corporate%20Codes%20of%20Ethics.pdf (Nov. 4, 2002).
2
(2) Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles,
and that receipts and expenditures of the registrant are being made only in accordance with
authorizations of management and directors of the registrant; and
(3) Provide reasonable assurance regarding prevention or timely detection of unauthorized
acquisition, use or disposition of the registrant’s assets that could have a material effect
on the financial statements.
The foundation of this definition is the phrase “provide reasonable assurance regarding the reliability of
financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.” The SEC noted that the term “internal controls” has evolved over
time to include a wide range of elements that only indirectly affect the reliability of financial reporting and
the preparation of financial statements.
In 1992, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) published its
Internal Control – Integrated Framework. COSO defined internal control as “a process, effected by an entity’s
board of directors, management and other personnel, designed to provide reasonable assurance regarding the
achievement of objectives” in three categories:
• effectiveness and efficiency of operations;
• reliability of financial reporting; and
• compliance with applicable laws and regulations.
In 1994, COSO expanded its definition to include “internal control over safeguarding of assets against
unauthorized acquisition, use or disposition.” The SEC noted that the purpose of clause (3) of the definition
of “internal control over financial reporting” is to ensure that this element of the COSO framework is captured
in the definition.
The SEC acknowledged that the “efficiency and effectiveness of operations” and “compliance with laws
and regulations” elements of internal control described in the original COSO definition are not included in the
SEC’s definition of “internal control over financial reporting” (other than compliance with laws and regulations relating to the preparation of financial statements). Finally, the SEC indicated that clauses (1) and (2)
of the definition are intended to capture the matters required by Section 103(a)(2)(A)(iii)(II) of the Act to be
included in the auditor’s report.4
4
On April 16, 2003, the PCAOB adopted interim professional auditing standards under Section 103 of the Act. See Establishment
of Interim Professional Auditing Standards, PCAOB Rel. No. 2003-006, http://www.pcaobus.org/rules/Release2003-006.pdf (Apr.
16, 2003).
3
What must be included in the annual internal control report?
A company’s annual report will have to include an internal control report by management that contains:
• A statement of management’s responsibility for establishing and maintaining adequate internal control
over financial reporting for the company;
• A statement identifying the framework used by management to conduct the required evaluation of the
effectiveness of the company’s internal control over financial reporting;
• Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year, including a statement as to whether or not
the company’s internal control over financial reporting is effective;5 and
• A statement that the accounting firm that audited the financial statements included in the annual report
has issued an attestation report on management’s assessment of the registrant’s internal control over
financial reporting.6
Are there any formal standards applicable to management’s assessment of effectiveness?
Yes. Management will not be permitted to conclude that the company’s internal control over financial
reporting is effective if there are one or more “material weaknesses”7 in the company’s internal control over
financial reporting. Management’s assessment will have to include disclosure of any material weaknesses
identified by management.
Do the final rules mandate use of particular evaluation criteria for management’s report on internal
controls?
No, but the new rules do set forth standards for the evaluation criteria selected by management. Management must base its evaluation of the effectiveness of the company’s internal control over financial reporting on
a suitable, recognized control framework that is established by a body or group that has followed due-process
5
The SEC acknowledged that some of the evaluation frameworks used to assess a foreign company’s internal controls in its home
country do not require a statement regarding whether the company’s system of internal control has been effective, but emphasized
that its new rules nevertheless require management of every issuer to state affirmatively whether or not the company’s internal
control over financial reporting is effective. A negative assurance statement indicating that nothing has come to management’s
attention to suggest that the company’s internal control over financial reporting is not effective will not be acceptable.
6
See new Item 308 of Regulations S-B and S-K, Item 15 of Form 20-F and General Instruction B(6) of Form 40-F.
7
A “material weakness” is defined in Statement on Auditing Standards No. 60 (codified in Codification of Statements on Auditing
Standards AU §325) as a reportable condition in which the design or operation of one or more of the internal control components
does not reduce to a relatively low level the risk that misstatements caused by errors or fraud in amounts that would be material in
relation to the financial statements being audited may occur and not be detected within a timely period by employees in the normal
course of performing their assigned functions. The SEC indicated that, in its view, a “material weakness” constitutes a greater
deficiency than a “significant deficiency” (which it indicated had the same meaning as the term “reportable condition” as used in
the applicable accounting literature), but that an aggregation of significant deficiencies could constitute a material weakness.
4
procedures, including the broad distribution of the framework for public comment.8 The SEC noted that the
COSO framework satisfies these criteria, but also noted that other suitable evaluation criteria exist outside
the U.S., including the “Guidance on Assessing Control” published by the Canadian Institute of Chartered
Accountants and the “Turnbull Report” published by the Institute of Chartered Accountants in England &
Wales. In any event, the rules require that the management report identify “the framework used by management to conduct the required evaluation.”
Do the final rules mandate use of particular evaluation methodology for management’s assessment?
No. The SEC declined to specify particular procedures or methodologies that should be used in performing
management’s assessment, stating only that the assessment of internal control must “be based on procedures
sufficient both to evaluate its design and to test its operating effectiveness.” The SEC did emphasize, however,
that the assessment “must be supported by evidential matter, including documentation, regarding both the
design of internal controls and the testing processes” and that “developing and maintaining such evidential
matter is an inherent element of effective internal controls.” In addition, without such evidential matter, the
auditors would be unable to perform the work required in order to provide their required attestation.
Do the final rules address where management’s internal control report must appear in the annual report?
Yes, but the SEC did not require that the report appear in any particular location in the annual report. The
SEC noted the importance of placing the management report in close proximity to the corresponding attestation report issued by the company’s accounting firm and stated that it expects that the internal control report
and the attestation report will appear near the MD&A disclosure or in a portion of the document immediately
preceding the company’s financial statements.
Does the quarterly evaluation requirement of the company’s internal control report differ from the
annual evaluation report?
Yes. The proposed rules would have required companies’ certifying officers to evaluate the effectiveness
of the company’s internal controls as of the end of the period covered by each annual and quarterly report
required to be filed under the Exchange Act. The SEC acknowledged comments that the expense and disruption of a requirement to perform a complete evaluation of internal controls four times each year outweighed
any incremental benefit to investors. Accordingly, the final rules require a company’s management (with the
participation of its principal executive and financial officers) to evaluate only any change in the company’s
internal control over financial reporting that occurred during a fiscal quarter that has “materially affected,” or
is reasonably likely to “materially affect,” the company’s internal control over financial reporting.
Does the quarterly evaluation requirement in the final rules apply to foreign private issuers?
Yes. The management of foreign private issuers must report any material changes to the issuer’s internal
control over financial reporting. However, because foreign private issuers are not required to file quarterly
8
See amended Exchange Act Rule 13a-15(c) or 15d-15(c), amended Item 15 of Form 20-F and amended General Instruction (B)
to Form 40-F.
5
reports under Section 13(a) or 15(d) of the Exchange Act, the final rules clarify that a foreign private issuer’s
management need only disclose in the issuer’s annual report any change to its internal control over financial
reporting that occurred in the period covered by the annual report that materially affected, or is reasonably
likely to affect, the internal control.9
What obligations do the final rules impose on accounting firms?
Amended Rule 2-02 of Regulations S-X requires every accounting firm that issues an audit report that is
included in an annual report required by Section 13(a) or 15(d) of the Exchange Act and containing an assessment by management of the effectiveness of the registrant’s internal control over financial reporting to attest
to, and report on, management’s assessment. In its attestation report, the accounting firm must express an
opinion, or state that an opinion cannot be expressed, concerning management’s assessment of the effectiveness of the company’s internal control over financial reporting in accordance with standards on attestation
engagements. When an overall opinion cannot be expressed, the accounting firm is required to state why it
is unable to express such an opinion.
Do the final rules impose any standards by which accounting firms will prepare and issue attestation
reports?
No. But, on April 16, 2003, the Public Company Accounting Oversight Board (PCAOB) designated Statements on Standards for Attestation Engagements (SSAE) in existence on April 16 as the standard for attestations of management’s assessment of the effectiveness of internal control over financial reporting, pending
further PCAOB standard-setting in the area (and subject to SEC approval of the PCAOB’s actions).10 SSAE
No. 10 therefore remains the standard applicable on a transition basis for attestations required under the new
Section 404 rules, pending further PCAOB standard-setting.
Do the final rules amend the SEC’s rules on auditor independence?
No. The SEC acknowledged that its auditor independence rules permit auditors to assist management in
documenting internal controls. When the auditor is engaged to assist management in documenting internal
controls, management must be actively involved in the process11 and cannot delegate its responsibility to
assess its internal controls over financial reporting to the auditor.
9
See Exchange Act Rules 13a-15(d) and 15d-15(d); Item 15(d) of Form 20-F; and General Instruction B(6)(e) of Form 40-F.
10
See Establishment of Interim Professional Auditing Standards, PCAOB Rel. No. 2003-006, http://www.pcaobus.org/rules/
Release2003-006.pdf (Apr. 16, 2003). On April 25, 2003, the SEC approved the PCAOB’s action. See Order Regarding Section 103(a)(3)(B) of the Sarbanes-Oxley Act of 2002, Securities Act Rel. No. 33-8222, Exchange Act Rel. No. 34-47745, http:
//www.sec.gov/rules/other/33-8222.htm (Apr. 25, 2003)..
11
In the SEC’s view, management’s mere acceptance of responsibility for the documentation and testing performed by the auditor
is insufficient.
6
Are registered investment companies subject to the new rules?
Yes, but they are not subject to the SEC’s rules adopted under Section 404 of the Act.12 The SEC did,
however, apply to most registered investment companies many of the changes to its rules and forms implementing Section 302, as revised to conform to changes made for other issuers.
The new rules provide that registered investment companies must maintain internal control over financial
reporting and must report on changes to their internal control over financial reporting that occurred during the
last fiscal half-year (the registrant’s second fiscal half-year in the case of an annual report) that has materially
affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting.
These requirements not apply to small business investment companies or unit investment trusts. However,
no registered investment company is required to perform, or disclose the results of, any annual evaluation of
its internal control over financial reporting.13
Are issuers of asset-backed securities subject to the Section 404 rules?
No.
Do the final rules afford flexibility to companies that are already subject to the FDIC’s internal control
reporting requirements?
Yes. Insured depository institutions have long been subject to FDIC rules requiring an annual management
report on internal controls. The SEC stated that companies subject to internal control requirements of both
Section 404 and the FDIC’s rules may choose either of the following two options:
• They can prepare two separate management reports to satisfy the FDIC’s and the SEC’s new requirements; or
• They can prepare a single management report that satisfies both the FDIC’s requirements and the
SEC’s new requirements.
If an insured depository institution (or its holding company) chooses to prepare a single report to satisfy
both sets of requirements, the report of management on the institution’s or holding company’s internal control
over financial reporting will have to contain the following:14
• A statement of management’s responsibility for preparing the institution’s annual financial statements, for establishing and maintaining adequate internal control over financial reporting, and for the
12
Section 405 of the Act exempts registered investment companies from the requirements of Section 404.
13
See Exchange Act Rule 15d-15(a) and (d), Investment Company Act Rule 30a-3 and revised Item 9 of Form N-CSR.
14
An insured depository institution subject to both the FDIC’s requirements and the SEC’s new requirements choosing to file a
single report to satisfy both sets of requirements will file the report with its primary federal regulator under the Exchange Act, the
FDIC, its primary federal regulator (if other than the FDIC), and any appropriate state depository institution supervisor under Part
363 of the FDIC’s regulations. A holding company choosing to prepare a single report to satisfy both sets of requirements will
file the report with the SEC under the Exchange Act, the FDIC, the primary federal regulator of the insured depository institution
subsidiary subject to the FDIC’s requirements, and any appropriate state depository institution supervisor under Part 363.
7
institution’s compliance with laws and regulations relating to safety and soundness designated by the
FDIC and the appropriate federal banking agencies;
• A statement identifying the framework used by management to evaluate the effectiveness of internal
control over financial reporting as required by Exchange Act Rule 13a-15 or 15d-15;
• Management’s assessment of the effectiveness of internal control structure and procedures for financial reporting as of the end of the most recent fiscal year, including a statement as to whether or not
management has concluded that internal control over financial reporting is effective,15 and of the
institution’s compliance with the designated safety and soundness laws and regulations during the
fiscal year; and
• A statement that the accounting firm that audited the financial statements included in the annual report
has issued an attestation report on management’s assessment of internal control over financial reporting.
Additionally, the institution or holding company will have to provide the accounting firm’s attestation
report on management’s assessment in its annual report filed under the Exchange Act.
Section 302 and 906 Certifications
The SEC adopted the new rules relating to the filing of Section 302 and 906 certifications substantially as
proposed.16 As adopted, each of the 302 and 906 certifications will be required to be filed as exhibits to the
Exchange Act reports to which they relate. The SEC also adopted a number of changes to the language of
the Section 302 certifications to conform to the newly adopted Section 404 rules.
What changes to filing practices are required by the new rules?
As adopted, the new rules amend each of Exchange Act Rules 13a-14 and 15d-14, Investment Company
Act Rule 30a-2, and Item 601 of Regulations S-B and S-K to require that each of the Section 302 and 906
certifications be filed as exhibits to the Exchange Act reports to which they relate. The new rules also make
various conforming changes to Forms 10-Q, 10-QSB, 10-K, 10-KSB, 20-F, 40-F and N-CSR. Accordingly,
the Section 302 certification will no longer be embedded in the body of the Exchange Act report, but instead
15
Management will not be permitted to conclude that the registrant’s internal control over financial reporting is effective if there are
one or more material weaknesses in the registrant’s internal control over financial reporting. Management’s discussion of its assessment must include disclosure of any material weakness in internal control over financial reporting identified by management.
16
See Proposed Rule: Certification of Disclosure in Certain Exchange Act Reports, Securities Act Rel. No. 33-8212, Exchange
Act Rel. No. 34-47551, Investment Co. Act Rel. No. IC-25967, http://www.sec.gov/rules/proposed/33-8212.htm (Mar. 21, 2003);
Alston & Bird LLP Securities Law Advisory, “SEC Proposes New Filing Requirements for Section 302 and 906 Certifications,”
http://www.alston.com/articles/Section%20302%20and%20906%20Certifications.pdf (Apr. 1, 2003). For background regarding
SEC implementation of Sections 302 and 906 of the Sarbanes-Oxley Act, see Alston & Bird LLP Securities Law Advisory, “Certification Requirements under Section 906 of Sarbanes-Oxley Act of 2002 Raise Difficult Issues; SEC to adopt Rules under Section 302,” http://www.alston.com/articles/ACF43.pdf (Aug. 6, 2002); Alston & Bird LLP Securities Law Advisory, “SEC Adopts
Certification Regulations under Section 302 of Sarbanes-Oxley Act and Accelerates Deadlines for 10-K and 10-Q Filings by Large
Issuers,” http://www.alston.com/articles/SEC%20Adopts%20Certification%20Regulations.pdf (Aug. 30, 2002).
8
will be filed as an exhibit. The increasingly common practice of filing the Section 906 certifications as exhibits
to periodic reports will now be mandatory.17
Do the final rules change the form of the Section 302 certification?
Yes. The SEC’s final rules amend the form of the Section 302 certifications in the following ways:
• To replace the term “internal controls” in the certification with the term “internal control over financial
reporting”;
• To add a statement that the principal executive and financial officers are responsible for designing
the company’s internal control over financial reporting or having such controls designed under their
supervision;
• To clarify that disclosure controls and procedures may be designed under the supervision of the principal executive and financial officers;
• To require that management’s evaluation of the effectiveness of disclosure controls and procedures
be made as of the end of the period (rather than as of a date within 90 days prior to the filing of the
report);
• To amend the provision of the certification relating to changes in internal control over financial reporting, consistent with the final rules discussed above regarding evaluation and disclosure, so that it refers
to changes that have materially affected or are reasonably likely to materially affect internal control
over financial reporting; and
• To incorporate minor changes in the organization of the certification.
Do the final rules require separate filings of Section 302 and 906 certifications by the CEO and CFO?
Yes. Nothing in the new rules permits filing of any “combined” Section 302 and 906 certification. Section 906 certifications may be consolidated into a single statement signed by both the chief executive officer
and chief financial officers18, but the Section 302 certifications will continue to require separate statements
of each officer.
Are Section 302 and 906 certifications subject to the signature requirements of the Exchange Act?
Yes. Although filed as exhibits under the proposed rules, both the Section 302 and 906 certifications would
be subject to the signature requirements of Exchange Act Rule 12b-11(d), and issuers should retain the manually signed certifications for a period of five years.19
17
In the release, the SEC notes that amendments to periodic reports that do not contain financial statements would require new
certifications under Section 302, but not under Section 906 (since Section 906 applies, by its terms, only to periodic reports that
contain financial statements).
18
See Exchange Act Rules 13a-14(b) and 15d-14(b) and Investment Company Act Rule 30a-2(b).
19
See Rule 302 of Regulation S-T.
9
How does the requirement to file Section 906 certifications as exhibits affect companies’ potential
liability for the certifications?
Although the Section 302 certifications will continue to be “filed” as a part of the periodic report to which
they relate, the Section 906 certifications will be “furnished” rather than “filed” with the report, since Section 906 only requires those certifications “accompany” the filings to which they relate. Accordingly, the
Section 906 certifications will not be subject to liability under Section 18 of the Exchange Act and will not
be automatically incorporated by reference into the issuer’s Securities Act registration statements, which are
subject to liability under Section 11 of the Securities Act.
Will failure to file Section 906 certifications affect companies’ ability to use Form S-3 or the ability to
effect sales in reliance on Rule 144?
Since the Section 906 certifications will be furnished rather than filed with the SEC, a failure to include the
Section 906 certifications with a report will not affect an issuer’s eligibility to use Form S-3, which requires an
issuer to have “filed all the material required to be filed pursuant to Section 13, 14, of 15(d)” of the Exchange
Act20 or the ability of a stockholder to use Rule 144, which requires that the issuer have “filed all the reports
required to be filed [under Section 13 or 15(d) of the Exchange Act] during the 12 months preceding” the
stockholder’s sale in reliance upon Rule 144.21
Are Section 906 certifications applicable to annual reports filed on Form 11-K?
Not at the present time, but stay tuned. The SEC received many comments on whether Section 906 should
apply to Form 11-K. On April 11, 2003, U.S. Senator Joseph Biden introduced into the Congressional Record
a statement discussing Section 906 that asserts, among other things, that Section 906 “is intended to apply
to any financial statement filed by a publicly-traded company, upon which the investing public will rely to
gauge the financial health of the company,” which includes financial statements included in current reports on
Forms 6-K and 8-K and annual reports on Form 11-K. 22 In light of the comments received, the SEC stated
that it is considering, in consultation with the Department of Justice, the application of Section 906 to current
reports on Forms 6-K and 8-K and annual reports on Form 11-K.
Transition Provisions
What is the transition period for compliance with the new rules?
A company that is an “accelerated filer”23 as of the end of its first fiscal year ending or after June 15, 2004,
must begin to comply with the requirement to publish a management report (and related auditor attestation)
20
Instruction I.A.3 to Form S-3.
21
Securities Act Rule 144(c)(1).
22
See 149 Cong. Rec. S5325, S533 (daily ed. Apr. 11, 2003).
23
Generally defined to include domestic issuers with a common equity public float of $75 million or more that have been subject
to Exchange Act reporting requirements for at least 12 months. See Exchange Act Rule 12b-2.
10
on internal control over financial reporting in its annual report for that fiscal year.24 Foreign private issuers
and domestic issuers that are not accelerated filers must begin to comply with these requirements for their
first fiscal year ending on or after April 15, 2005. Companies must comply with the requirements to disclose
certain changes to its internal control over financial reporting beginning 60 days after publication of the new
rules in the Federal Register.25 Voluntary early compliance is permitted.
The final rules changing the language of the Section 302 and 906 certifications and requiring that those
certifications be filed as exhibits to periodic reports will be effective 60 days after publication of the final
rules in the Federal Register. To account for differences between the compliance date of the Section 404 rules
and the effective date of changes to the language of the Section 302 certifications, a company’s certifying
officers may temporarily modify the content of the Section 302 certifications to eliminate some, but not all,
references to internal control over financial reporting until that company is first required to comply with the
Section 404 rules.
Do the final rules affect the SEC’s interim guidance regarding filing procedures?
No. The SEC previously issued interim guidance on the filing of Section 906 certifications.26 The SEC
acknowledged that issuers have used a variety of methods to submit the Section 906 certifications. Accordingly, the SEC encouraged issuers to file all Section 906 certifications as exhibits to the reports to which they
relate, and indicated that issuers filing the exhibit electronically should include the following statement after
the text of the Section 906 certification: “A signed original of this written statement required by Section 906,
or other document authenticating, acknowledging, or otherwise adopting the signature that appears in typed
form within the electronic version of this written statement required by Section 906, has been provided to
[name of issuer] and will be retained by [name of issuer] and furnished to the Securities and Exchange Commission or its staff upon request.” In the event that the EDGAR system is not updated by the effective date,
companies should submit the required certifications as Exhibit 99.27 The SEC’s interim guidance will remain
in effect until the rules become effective.
24
Specifically, the extended compliance periods apply to the following new rules: (i) the provisions of Items 308(a) and (b) of
Regulations S-K and S-B and the comparable provisions of Forms 20-F and 40-F requiring management’s internal control report
and the related attestation; (ii) the amendments to Exchange Act Rules 13a-15(a) and 15d-15(a) relating to maintenance of internal
control over financial reporting; and (iii) the provisions of Exchange Act Rules 13a-15(c) and (d) and 15d-15(c) and (d) requiring
evaluations of internal control over financial reporting and changes thereto. The SEC emphasized that the extended compliance
periods do not “in any way affect the provisions of our other rules and regulations regarding internal controls that are in effect,
including, without limitation, Rule 13b-2 under the Exchange Act.”
25
The SEC explained that these requirements “modify existing requirements regarding disclosure of changes in internal control over
financial reporting, are related to statements made in the Section 302 certifications” and “provide clarifications that are beneficial
and whose implementation need not be delayed.”
26
See Proposed Rule: Certification of Disclosure in Certain Exchange Act Reports, Securities Act Rel. No. 33-8212, Exchange Act
Rel. No. 34-47551, Investment Co. Act Rel. No. IC-25967, http://www.sec.gov/rules/proposed/33-8212.htm (Mar. 21, 2003).
27
Use of Exhibit 99 for this purpose will remain in effect until the SEC announces that its EDGAR system permits registrants to
file or furnish exhibits 31 and 32 for Section 302 and 906 certifications.
11
This Securities Law Advisory is published by Alston & Bird LLP (www.alston.com) to provide a summary of significant developments to our clients and friends. It is intended to be informational and does not constitute legal advice regarding any specific situation.
This material may also be considered advertising under applicable court rules. This advisory may be reprinted without the express
permission of Alston & Bird so long as it is reprinted in its entirety including the Alston & Bird name and logo. If you have any
questions or would like additional information, and/or if you would like to receive this information via e-mail, please contact your
Alston & Bird attorney or the following:
Peter Q. Bassett
404-881-7343
pbassett@alston.com
Todd R. David
404-881-7357
tdavid@alston.com
Brad S. Markoff
919-862-2210
bmarkoff@alston.com
Robert H. Bergdolt
919-862-2216
rbergdolt@alston.com
Bryan E. Davis
404-881-7591
bdavis@alston.com
Mark F. McElreath
212-210-9595
mmcelreath@alston.com
David E. Brown, Jr.
202-756-3345
dbrown@alston.com
Dennis O. Garris
202-756-3452
dgarris@alston.com
William R. Mitchelson, Jr.
404-881-7661
mmitchelson@alston.com
Mark T. Calloway
704-444-1089
mcalloway@alston.com
Gary C. Ivey
704-444-1090
givey@alston.com
Nils H. Okeson
404-881-7889
nokeson@alston.com
Frank M. Conner III
202-756-3303
fconner@alston.com
M. Hill Jeffries
404-881-7823
hjeffries@alston.com
Kisha L. Parker
212-210-9598
klparker@alston.com
J. Vaughan Curtis
404-881-7397
vcurtis@alston.com
John L. Latham
404-881-7915
jlatham@alston.com
Jonathan H. Talcott
202-756-3304
jtalcott@alston.com
If you would like to receive future Securities Law Advisories electronically, please forward your contact
information including your e-mail address to securities.advisory@alston.com. Be sure to put “subscribe”
in the subject line.
www.alston.com
Atlanta: One Atlantic Center l 1201 West Peachtree Street l Atlanta, Georgia, USA, 30309-3424 l 404-881-7000 l Fax: 404-881-7777
Charlotte: Bank of America Plaza l 101 South Tryon Street, Suite 4000 l Charlotte, North Carolina, USA, 28280-4000 l 704-444-1000 l Fax: 704-444-1111
New York: 90 Park Avenue l New York, New York, USA, 10016-1387 l 212-210-9400 l Fax: 212-210-9444
Research Triangle: 3201 Beechleaf Court, Suite 600 l Raleigh, North Carolina, USA, 27604-1062 l 919-862-2200 l Fax: 919-862-2260
Washington, D.C.: 601 Pennsylvania Avenue, N.W. l North Building, 10th Floor l Washington, D.C., USA, 20004-2601 l 202-756-3300 l Fax: 202-756-3333
© Alston & Bird LLP 2003