|
Section 302 Section 404 and COSO´s Internal Control Framework
CONTENT
CORPORATE GOVERNANCE
Definition
"The group of rules and practices that govern the relationship between managers, board of directors (BoD) and shareholders of corporations, as well as stakeholders like employees and creditors."
Actors in a Corporate Governance framework:
BoD and its committees
Senior Management
Internal Audit
External Audit
Other Stakeholders
Good Corporate Governance Practices Main objectives:
Encourage confidence in the financial markets
Attract capitals
Promote competitiveness
Implementation of an effective Internal Control System (ICS)
Creation of value for the shareholders
Defend rights and interests of investors
Balance between interests of shareholders, directors and managers
Equal treatment of shareholders
Defense of the company's interests including all stakeholders
Corporate Governance & Internal Control
Internal Control System (ICS) is an essential part of Corporate Governance
Importance of IC increased with the development of the concept of Corporate Governance
Every Guide, code or regulation on Corporate Governance introduces the concept of internal control as a basic component for the company's success
Fraudulent collapses
Lack of appropriate Corporate Governance Framework that could guarantee:
shareholders protection
safeguarding of their interests
balanced treatment of shareholders
an efficient internal control system
ethics and positive values from members of the board of directors and high ranking executives
COSO's Internal Control Integrated Framework
The Committee of Sponsoring Organizations of the Treadway Commission - COSO - established a definition of Internal Control that is adopted by:
listed and non-listed companies
independent public accountants and firms
legislators and regulatory entities (AICPA, PCAOB, SEC)
It provides a broad framework of criteria against which companies could evaluate the effectiveness of their ICSs.
COSO's IC Framework Definition of Internal Control:
"a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of the company's objectives in these three categories:
1-Effectiveness and efficiency of operations
2-Reliability of financial reporting
3-Compliance with applicable laws and regulations"
COSO's 5 Interrelated components of IC
Control environment - discipline, structure, integrity, ethical values, employee competence, management's philosophy and operating style, and leadership provided by senior management and BoD
Risk assessment - establishment of objectives, identification & analysis of risks to achievement, determining how the risks should be managed
Control activities - policies and procedures that ensure how management directives are executed: approvals, authorizations, verifications, reconciliations, reviews of operating performance, the safeguarding of assets, and the segregation of duties
Information and communication - Information that is adequately identified, captured, and communicated. Personnel clear understanding of their role in IC, as well as how individual activities relate to others
Monitoring - IC process must be monitored to react to changing conditions of the company
SECTION 404 & COSO's Internal Control Framework
SEC Rules required management to base its evaluation of the ICOFR effectiveness on a recognized control framework
SEC Rules determined that COSO's IC framework satisfied its demands
SEC Rule links governance controls with control activities of COSO
COSO's Internal Control Framework - widely-accepted and used by management and auditors to fulfill SOX's Section 404 requirements
SECTION 404 COSO IC FRAMEWORK
COSO framework main objectives:
improve efficiency and profitability
prevent fraud
and develop accurate financial reporting
Companies that follow the COSO framework will build an efficient IC structure and comply with SEC Rule for Section 404 as well as PCAOB Auditing Standard 2.
Sarbanes-Oxley Act - July 2002
SOX deals with Corporate Governance aspects throughout all its sections
- SOX Section 302 - Corporate responsibility for financial reports
SOX - SECTION 302
Exhibit 12.2
Certification of Chief Financial Officer
Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002
I, XXX, certify that:
Dated: ___________
1. I have reviewed this annual report on Form 20-F of XX company;
2. Based on my knowledge, this report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading with respect to the period covered by this report;
3. Based on my knowledge, the F/S, and other financial information included in this report, fairly present in all material respects the financial condition, results of operations and cash flows of the Company as of, and for, the periods presented in this report;
4. The Company's other certifying officer and I are responsible for establishing and maintaining DCP (as defined in Exchange Act Rules 13a-15(e) and 15d-15(e)) for the Company and have:
- (a) designed such DCP, or caused such disclosure controls and procedures to be designed under our supervision, to ensure that material information relating to the Company, including its consolidated subsidiaries, is made known to us by others within those entities, particularly during the period in which this report is being prepared;
(b) evaluated the effectiveness of the Company's DCP and presented in this report our conclusions about the effectiveness of the DCP, as of the end of the period covered by this report based on such evaluation; and
(c) disclosed in this report any change in the Company's ICOFR that occurred during the period covered by the annual report that has materially affected, or is reasonably likely to materially affect, the Company's ICOFR; and
5. The Company's other certifying officer and I have disclosed, based on our most recent evaluation of ICOFR, to the Company's auditors and the audit committee of the Company's BoD (or persons performing the equivalent functions):
(a) all significant deficiencies and material weaknesses in the design or operation of ICOFR which are reasonably likely to adversely affect the Company's ability to record, process, summarize and report financial information; and
(b) any fraud, whether or not material, that involves management or other employees who have a significant role in the Company's ICOFR
Signature___________________________
Executive Vice President and CFO
SOX Section 404 - Management assessment of ICs
The SEC shall adopt rules requiring each annual report of a registrant, required by Section 13 (a) or 15 (d) of the Securities Exchange Act of 1934 (15 U.S.C. 78m or 78o(d)), to contain an internal control report, which shall contain:
(1) a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and
(2) management's assessment, as of the end of the registrant's most recent fiscal year, of the effectiveness of the registrant's internal control structure and procedures for financial reporting (ICOFR).
SEC - Rules
Management's Internal Control Report must include:
- a statement of management's responsibility for establishing and maintaining adequate ICOFR for the registrant,
- management's assessment of the effectiveness of the registrant's ICOFR as of the end of the registrant's most recent fiscal year,
- framework used by management to evaluate the effectiveness of the registrant's ICOFR, anda statement that the auditor of the F/S included in the annual report has issued an attestation report on management's assessment of the registrant's ICOFR and.
- a statement that the auditor of the F/S included in the annual report has issued an attestation report on management's assessment of the registrant's ICOFR.
SECTION 404 & COSO's Internal Control Framework
COSO created a model of IC
COSO broke down IC into 5 interrelated components in order to simplify a company's organizational plan of all activities that go into an efficient IC structure
- These 5 layers, and the controls within each, must be included in management's assessment
- COSO - IC "a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of the objectives" in the following categories:
- 1-Effectiveness and efficiencies of operations;
- 2-Reliability of financial reporting; and
- 3-Compliance with applicable laws and regulations
SECTION 404 SEC Rules on ICOFR
"Internal Control over Financial Reporting":
A process designed by CEO and CFO and effected by the BOD, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of F/S for external purposes in accordance with GAAP including policies and procedures that:
(1) Relate to maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant;
(2) Provide reasonable assurance that transactions are correctly recorded in order to prepare F/S in accordance with GAAP
(3) Prevent or timely detect unauthorized acquisitions, use or disposition of the company's assets with material effect on the F/S
SECTION 404 IMPLEMENTATION
Phase 1 - Establish an implementation team and a written assessment plan
Phase 2 - Risk assessment
Phase 3 - Documentation of financial cycles
Phase 4 - Identification and assessment of IC at an entity-level
Phase 5 - Identification assessment and testing of key controls at the process, transaction or application level
Phase 6 - Evaluating the adequacy of controls
Phase 7 - Management's Report
SECTION 404 & COSO's IC FRAMEWORK
4 - Entity-level controls
|
|
|
|
- Information & Communication
|
|
|
5 - Process Transaction or Application Level
- Approvals
- Authorizations
- Verifications
- Reconciliations
- Reviews of operating performance
- Security of assets
- Segregation of duties
SOX 404
Entity-level controls
Although the majority of controls to be assessed are in Control Activities, Entity-level controls should be carefully assessed because:
- 1-These controls have a pervasive effect on the activities of the entire company
2-Most control deficiencies identified in last years' fraudulent collapses were in these areas
Management's assessment
Determine if the system of IC of the company as of the date of the assessment provides reasonable assurance that material errors, in either interim or annual financial statements, will be prevented or detected
Two highlights in the assessment process
1- Identify, assess and test the design and operating effectiveness of key controls over transactions that constitute the balances in significant accounts in the F/S
2- Assess if any control deficiencies identified in the above process represent, individually or in aggregate, a more than remote likelihood of a material error (a "material weakness")
Management's Assessment
Management's
* Identification of key controls
* Assessment
* Testing
Sufficient to address all major risks & no material weaknesses are identified
ICOFR effective
Material errors (interim or annual F/S) will be prevented or detected
Management's Report on ICOFR
The Company's management is responsible for establishing and maintaining adequate ICOFR as defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act. Under the supervision and with the participation of the Company's management, including its CEO and CFO, the Company conducted an evaluation of the effectiveness of its ICOFR based on criteria established in the framework in Internal Control-Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission. Based on this evaluation, the Company's management concluded that its ICOFR was effective as of December 31, 2005.
Because of its inherent limitations, ICOFR may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risks that controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate. The Company's independent registered public accounting firm has audited management's assessment of the effectiveness of the Company's ICOFR as of December 31, 2005 as stated in their report which appears on page XX.
Changes in Internal Control Over Financial Reporting
There have not been any changes in the Company's ICOFR (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, the Company's ICOFR.
SECTION 302 & 404
|
Content
|
302
|
404
|
302 & 404
|
|
Management (CEO & CFO) responsible for adequacy of IC
|
|
|
yes
|
|
Included in quarterly and annual F/R
|
yes
|
|
|
|
Quarterly and annual assessment of "disclosure controls and procedures"
|
yes
|
|
|
|
Required in annual reports only
|
|
yes
|
|
|
Assess adequacy of ICOFR at Interim periods
|
yes
|
|
|
|
Assess adequacy of ICOFR annually
|
|
yes
|
|
|
Follow recognized IC framework
|
|
yes
|
|
|
Interim assessment not audited by the external auditor
|
yes |
|
|
COSO's Guidance for Smaller Public Companies
Main considerations:
- Right sizing Documentation
- Viewing Internal Control as an Integrated Process
Section 404 Advantages of the assessment process
a) Better trained personnel, more aware of their responsibilities and eventually an increased efficiency in their work.
b) Revision of IC allows the identification of possible redundancies in activities or processes in a timely manner as well as to focus on the processes or activities that most affect the financial statements. As a result, the efficiency of the company will increase.
c) Improved quality of the BOD and audit committee members as well as a better functioning as supervisors of management.
SECTION 404 Compliance Dates
(A) Management´s Internal Control Report
- Accelerated filers - Foreign Private Issuer - in annual reports for fiscal years ending on or after July 15th 2006
- Non-accelerated filers - FPI or U.S. Issuers - in annual reports for fiscal years ending on or after December 15, 2007
SECTION 404 Compliance Dates
(B) Auditor's Report
Accelerated filers - Foreign Private Issuers - to present it with their annual reports for fiscal years ending on or after July 15th 2007
Non-accelerated filer - FPI or U.S. Issuers - to include it in their annual reports for fiscal years ending on or after Dec 15th 2008
|