Saturday, 31 July 2010
     
 

Hebrew site Hebrew    
 
 
Sarbanes-Oxley Act
Section 302 Section 404 and COSO´s Internal Control Framework

 

CONTENT
CORPORATE GOVERNANCE
Definition
"The group of rules and practices that govern the relationship between managers, board of directors (BoD) and shareholders of corporations, as well as stakeholders like employees and creditors."

 

Actors in a Corporate Governance framework:
BoD and its committees
Senior Management
Internal Audit
External Audit
Other Stakeholders

Good Corporate Governance Practices Main objectives:

  • Encourage confidence in the financial markets
    Attract capitals
    Promote competitiveness
    Implementation of an effective Internal Control System (ICS)
    Creation of value for the shareholders
    Defend rights and interests of investors
    Balance between interests of shareholders, directors and managers
    Equal treatment of shareholders
    Defense of the company's interests including all stakeholders

Corporate Governance & Internal Control
Internal Control System (ICS) is an essential part of Corporate Governance
Importance of IC increased with the development of the concept of Corporate Governance
Every Guide, code or regulation on Corporate Governance introduces the concept of internal control as a basic component for the company's success

Fraudulent collapses
Lack of appropriate Corporate Governance Framework that could guarantee:

 

  1. shareholders protection
    safeguarding of their interests
    balanced treatment of shareholders
    an efficient internal control system
    ethics and positive values from members of the board of directors and high ranking executives

 

COSO's Internal Control Integrated Framework
The Committee of Sponsoring Organizations of the Treadway Commission - COSO - established a definition of Internal Control that is adopted by:
listed and non-listed companies
independent public accountants and firms
legislators and regulatory entities (AICPA, PCAOB, SEC)
It provides a broad framework of criteria against which companies could evaluate the effectiveness of their ICSs.

 

COSO's IC Framework Definition of Internal Control:
"a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of the company's objectives in these three categories:
1-Effectiveness and efficiency of operations
2-Reliability of financial reporting
3-Compliance with applicable laws and regulations"

 

 

COSO's 5 Interrelated components of IC
Control environment - discipline, structure, integrity, ethical values, employee competence, management's philosophy and operating style, and leadership provided by senior management and BoD
Risk assessment - establishment of objectives, identification & analysis of risks to achievement, determining how the risks should be managed
Control activities - policies and procedures that ensure how management directives are executed: approvals, authorizations, verifications, reconciliations, reviews of operating performance, the safeguarding of assets, and the segregation of duties
Information and communication - Information that is adequately identified, captured, and communicated. Personnel clear understanding of their role in IC, as well as how individual activities relate to others
Monitoring - IC process must be monitored to react to changing conditions of the company

 

SECTION 404 & COSO's Internal Control Framework
SEC Rules required management to base its evaluation of the ICOFR effectiveness on a recognized control framework
SEC Rules determined that COSO's IC framework satisfied its demands
SEC Rule links governance controls with control activities of COSO
COSO's Internal Control Framework - widely-accepted and used by management and auditors to fulfill SOX's Section 404 requirements

 

 

SECTION 404 COSO IC FRAMEWORK
COSO framework main objectives:
improve efficiency and profitability
prevent fraud
and develop accurate financial reporting
Companies that follow the COSO framework will build an efficient IC structure and comply with SEC Rule for Section 404 as well as PCAOB Auditing Standard 2.

Sarbanes-Oxley Act - July 2002
SOX deals with Corporate Governance aspects throughout all its sections

 

 

  • SOX Section 302 - Corporate responsibility for financial reports

 

SOX - SECTION 302
Exhibit 12.2
Certification of Chief Financial Officer

Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002

 

I, XXX, certify that:

Dated: ___________

 

1. I have reviewed this annual report on Form 20-F of XX company;

 

2. Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;

 

3. Based on my knowledge, the F/S, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this report;

 

 

 

 

 

4. The Company's other certifying officer and I are responsible for establishing and maintaining DCP (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) for the Company and have:

 

  • (a) designed such DCP, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the Company, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;

 

(b) evaluated the effectiveness of the Company's DCP and presented in this report our conclusions about the effectiveness of the DCP, as of the end of the period covered by this report based on such evaluation; and

 

(c) disclosed in this report any change in the Company's ICOFR that occurred during the period covered by the annual report that has materially affected, or is reasonably likely to materially affect, the Company's ICOFR; and

 

5. The Company's other certifying officer and I have disclosed, based on our most recent evaluation of ICOFR, to the Company's auditors and the audit committee of the Company's BoD (or persons performing the equivalent functions):

 

(a) all significant deficiencies and material weaknesses in the design or operation of ICOFR which are reasonably likely to adversely affect the Company's ability to record, process, summarize and report financial information; and

 

(b) any fraud, whether or not material, that involves management or other employees who have a significant role in the Company's ICOFR

 

Signature___________________________

Executive Vice President and CFO

 

 

SOX Section 404 - Management assessment of ICs
The SEC shall adopt rules requiring each annual report of a registrant, required by Section 13 (a) or 15 (d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)), to contain an internal control report, which shall contain:

 

(1) a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and

 

(2) management's assessment, as of the end of the registrant's most recent fiscal year, of the effectiveness of the registrant's internal control structure and procedures for financial reporting (ICOFR).

 

SEC - Rules

 

Management's Internal Control Report must include:

 

  • a statement of management's responsibility for establishing and maintaining adequate ICOFR for the registrant,
  • management's assessment of the effectiveness of the registrant's ICOFR as of the end of the registrant's most recent fiscal year,
  • framework used by management to evaluate the effectiveness of the registrant's ICOFR, anda statement that the auditor of the F/S included in the annual report has issued an attestation report on management's assessment of the registrant's ICOFR and.
  • a statement that the auditor of the F/S included in the annual report has issued an attestation report on management's assessment of the registrant's ICOFR.

 

SECTION 404 & COSO's Internal Control Framework
COSO created a model of IC
COSO broke down IC into 5 interrelated components in order to simplify a company's organizational plan of all activities that go into an efficient IC structure

 

  • These 5 layers, and the controls within each, must be included in management's assessment

 

  • COSO - IC "a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of the objectives" in the following categories:

 

 

  •  1-Effectiveness and efficiencies of operations;
  •  2-Reliability of financial reporting; and
  •  3-Compliance with applicable laws and regulations

 

 

SECTION 404 SEC Rules on ICOFR

 

 

   "Internal Control over Financial Reporting": 
     A process designed by CEO and CFO and effected by the BOD, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of F/S for external purposes in accordance with GAAP including policies and procedures that:

 

(1) Relate to maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant;

(2) Provide reasonable assurance that transactions are correctly recorded in order to prepare F/S in accordance with GAAP

 

(3) Prevent or timely detect unauthorized acquisitions, use or disposition of the company's assets with material effect on the F/S

 

SECTION 404 IMPLEMENTATION

 

Phase 1 - Establish an implementation team and a written assessment plan
Phase 2 - Risk assessment
Phase 3 - Documentation of financial cycles
Phase 4 - Identification and assessment of IC at an entity-level  
Phase 5 - Identification assessment and testing of key controls at the process, transaction or  application level
Phase 6 - Evaluating the adequacy of controls
Phase 7 - Management's Report

 

SECTION 404 & COSO's IC FRAMEWORK

 

4 - Entity-level controls

  • Control environment
  • Risk Assessment
  • Information & Communication
  • Monitoring

 

 

5 - Process Transaction or Application Level

 

  • Activities of Control

 

 

 

  • Approvals
  • Authorizations
  • Verifications
  • Reconciliations
  • Reviews of operating performance
  • Security of assets
  • Segregation of duties

 

SOX 404

Entity-level controls

Although the majority of controls to be assessed are in Control Activities, Entity-level controls should be carefully assessed because:

 

 

  • 1-These controls have a pervasive effect on the activities of the entire company
    2-Most control deficiencies identified in last years' fraudulent collapses were in these areas

 

 

Management's assessment

Determine if the system of IC of the company as of the date of the assessment provides reasonable assurance that material errors, in either interim or annual financial statements, will be prevented or detected

 

 

Two highlights in the assessment process

 

1- Identify, assess and test the design and operating effectiveness of key controls over transactions that constitute the balances in significant accounts in the F/S

 

2- Assess if any control deficiencies identified in the above process represent, individually or in aggregate, a more than remote likelihood of a material error (a "material weakness")

 

Management's Assessment

 

Management's 
* Identification  of key controls
* Assessment 
* Testing                                    

Sufficient to address all major risks & no material weaknesses are identified

 

 

ICOFR effective

 

 

Material errors (interim or annual F/S) will be prevented or detected

 

 

Management's Report on ICOFR

 

     The Company's management is responsible for establishing and maintaining adequate ICOFR as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Under the supervision and with the participation of the Company's management, including its CEO and CFO, the Company conducted an evaluation of the effectiveness of its ICOFR based on criteria established in the framework in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, the Company's management concluded that its ICOFR was effective as of December 31, 2005.

 

     Because of its inherent limitations, ICOFR may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risks that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. The Company's independent registered public accounting firm has audited management's assessment of the effectiveness of the Company's ICOFR as of December 31, 2005 as stated in their report which appears on page XX.

 

    Changes in Internal Control Over Financial Reporting

 

      There have not been any changes in the Company's ICOFR (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, the Company's ICOFR.

 

 

SECTION 302 & 404

 

Content

302

404

302 & 404

Management (CEO & CFO) responsible for adequacy of IC

 

 

yes 

Included in quarterly and annual F/R

yes

 

 

Quarterly and annual assessment of "disclosure controls and procedures"

 

yes

 

 

Required in annual reports only

 

yes

 

Assess adequacy of ICOFR at Interim periods

yes 

 

 

Assess adequacy of ICOFR annually

 

yes

 

Follow recognized IC framework

 

yes 

 

Interim assessment not audited by the external auditor

yes

 

 

 

 

COSO's Guidance for Smaller Public Companies
Main considerations:

 

  • Focusing on risk

 

 

  • Right sizing Documentation

 

 

  • Viewing Internal Control as an Integrated Process

 

Section 404 Advantages of the assessment process

 

 

a) Better trained personnel,  more aware of their responsibilities and eventually an increased efficiency in their work.

 

b) Revision of IC allows the identification of possible redundancies in activities or processes in a timely manner as well as to focus on the processes or activities that most affect the financial statements. As a result, the efficiency of the company will increase.

 

c) Improved quality of the BOD and audit committee members as well as a better functioning as supervisors of management.

 

SECTION 404 Compliance Dates

 

(A) Management´s Internal Control Report

  • Accelerated filers - Foreign Private Issuer - in annual reports for fiscal years ending on or after  July 15th 2006
  • Non-accelerated filers - FPI or U.S. Issuers - in annual reports for fiscal years ending on or after December 15, 2007

 

SECTION 404 Compliance Dates

(B) Auditor's Report

Accelerated filers - Foreign Private Issuers - to present it with their annual reports for fiscal years ending on or after July 15th 2007

Non-accelerated filer - FPI or U.S. Issuers - to include it in their annual reports for fiscal years ending on or after Dec 15th 2008

 

 
 
   
BKR Yarel + Partners - 1 Nirim Street Tel Aviv 67060 Tel: 03-6883380 Fax: 03-6883808

© 2010 Yarel + Partners