3.5 Disclosure Controls and Procedures
In discussions of DC&P,15 registrants must use language that conforms to the requirements of Rule 13a-15(e) or
Rule 15d-15(e) of the Exchange Act.16 The SEC staff often comments when registrants do not use the proper definition of
DC&P or omit certain language in reaching conclusions about the effectiveness of their
DC&P. In these situations, the staff frequently requires registrants to amend prior
filings or revise their disclosures in future filings.
3.5.1 Inappropriate Conclusion About DC&P
Examples of SEC Comments
- We note your statement that your disclosure controls and procedures are not effective for a company your size. Please revise to remove the qualifier “for a company our size.” Refer to Item 307 of Regulation S-K, which requires a clear and unqualified statement as to whether your disclosure controls and procedures are effective or ineffective.
- Please amend your disclosure to clarify whether management concluded that disclosure controls and procedures were effective or ineffective as of [the fiscal year-end]. Your current disclosure indicates that they were both not effective and determined to be effective upon “re-evaluation.”
The SEC staff has noted that management must clearly state, without using any qualifying or alternative language, its conclusion about whether DC&P are “effective” or “ineffective” as of the end of the respective quarter. Examples of unacceptable language include phrases such as “adequate,” “effective except for,” “effective except as disclosed below,” or “reasonably effective.”
The SEC staff has also commented when registrants refer to the level of assurance of the design of their DC&P. Although registrants are not required to discuss such assurance, the staff has asked registrants that choose to do so to also state clearly whether the DC&P are, in fact, effective at the “reasonable assurance” level.
In addition, when registrants have concluded that their DC&P are ineffective, the staff has asked them to discuss how they intend to remedy the deficiencies identified.
3.5.2 Incomplete, Inconsistent, or Inaccurate Information in Disclosure About DC&P
Examples of SEC Comments
-
We note you do not disclose management’s conclusion regarding the effectiveness of disclosure controls and procedures as of [your fiscal year-end]. Please be advised that all annual and quarterly filings are required to include a conclusion as to whether disclosure controls and procedures are effective or not effective as of the end of the period covered by the report.
- Please note that pursuant to Item 307 of Regulation S-K disclosure controls and procedures is defined as controls and procedures that are designed “to ensure information required to be disclosed by the issuer in the reports that it files or submits under the Act . . . is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms” and controls and procedures that are designed “to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Act is accumulated and communicated to the issuer’s management including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decision regarding required disclosure.” We note that the Company’s conclusions regarding the effectiveness of your disclosure controls and procedures refer to only half of the definition. If you choose to refer to the definition of disclosure controls and procedures when concluding as to the effectiveness of your disclosure controls and procedures then you should provide the entire definition. Alternatively, you may conclude that your disclosures controls and procedures were “effective” or “not effective” without providing any part of the definition. Please revise your filings accordingly.
Registrants are not required to define DC&P in their conclusion (they may refer to the definition in the Exchange Act Rules instead). However, if they choose to define the term, they must use the entire definition in Rule 13a-15(e) or Rule 15d-15(e). The SEC staff has commented when registrants (1) define DC&P but do not use the entire definition or (2) neither fully define DC&P nor refer to the definition in the Exchange Act Rules. In addition, the staff has commented when a registrant’s DC&P disclosure (1) is inconsistent with other disclosures in the filing or previous filings or (2) does not contain all of the required information.
3.5.3 Conclusion That DC&P Were Effective if a Restatement Is Required, a Material Weakness Exists, or Reports Were Not Filed in a Timely Manner
Examples of SEC Comments
- Please tell us how you were able to conclude that your disclosure controls and procedures were effective in light of the material weaknesses that existed as of [the fiscal year-end] and considering your conclusion in subsequently filed Form 10-Qs that your disclosure controls and procedures were not effective due to these same material weaknesses. Refer to Item 307 of Regulation S-K.
- [P]lease consider whether management’s failure to perform or complete its report on internal control over financial reporting impacts its conclusions regarding the effectiveness of your disclosure controls and procedures . . . and revise your disclosure as appropriate.
-
You state that management conducted an evaluation of your disclosure controls and procedures (DCP) as of the end of this annual report and concluded that your DCPs were effective. However, under “Management’s Report on Internal Controls over Financial Reporting” you disclose that in connection with the audit of your financial statements for the [fiscal year], your independent auditor identified material weaknesses in your internal controls over financial reporting (ICFR). Please explain to us how management determined that your DCPs were effective at [the end of the fiscal year] in light of the existing material weaknesses.
-
You indicate that as of [the end of fiscal year 2], your disclosure controls and procedures (DCP) were effective. Please explain how you reached this conclusion. In this regard, we note the Item 4 disclosures in your Form 10-Q for the [third quarter of fiscal year 2] indicate that the two material weaknesses identified in your assessment of internal controls over financial reporting (ICFR) as of [the end of fiscal year 1] were still not remediated. In light of this disclosure, as well as your current disclosure that during the [fourth quarter of fiscal year 2], there were no changes in your ICFR that have materially affected, or are reasonably likely to materially affect, your ICFR, it is unclear how the two material weaknesses were sufficiently remediated in order for you to conclude that your DCP was effective as of [the end of fiscal year 2]. Please revise your disclosures accordingly.
-
Please explain how you reached the conclusion that your ICFR was effective despite . . . the fact that you determined that your disclosure controls and procedures were not effective.
Paragraph 4310.9 of
the FRM states, in part, “Because of the substantial overlap between ICFR and [DC&P],
if management concludes that ICFR is ineffective, it must also consider the impact of [a]
material weakness on its conclusions related to [DC&P].” If a registrant concludes
that its DC&P are effective when a material weakness exists, the SEC staff often asks
for information on the factors the registrant considered in reaching such a conclusion.
Registrants are rarely able to provide sufficient explanation and often are required to
amend their filings to conclude that DC&P were ineffective. Similarly, the SEC staff
has also asked registrants to provide explanations when management concludes that DC&P
are ineffective, but ICFR is effective. Although there is substantial overlap between
DC&P and ICFR, management’s conclusion on the effectiveness of DC&P may differ
from its conclusion on the effectiveness of ICFR in rare circumstances.17 In addition, when a registrant is required to file amended periodic reports
containing restated financial statements, the SEC staff generally asks the registrant to
reconsider its conclusions about the effectiveness of its DC&P.
The SEC staff has also asked about management’s conclusion that DC&P were effective when a registrant did not file periodic reports in a timely manner. A registrant should design DC&P to ensure that information disclosed in its reports filed or submitted under the Exchange Act is recorded, processed, summarized, and reported within the periods specified in the SEC’s rules. If the registrant does not report such information within these periods, the staff may request that the registrant supply additional information to support management’s conclusion.
3.5.4 A Change in the Conclusion That DC&P Were Effective if No Changes to ICFR Were Disclosed
Example of an SEC Comment
You state that your disclosure controls and procedures were effective as of [the end of the second quarter of fiscal year 2]. Given that your disclosure controls and procedures appear to have been ineffective as of [the end of fiscal year 1], please tell us what changed from [the end of fiscal year 1] to [the end of the second quarter of fiscal year 2] that allowed you to reach a different conclusion about the effectiveness of your disclosure controls and procedures as of [the end of the second quarter of fiscal year 2].
If a registrant concludes that its DC&P were effective after a period in which the DC&P had been deemed ineffective, the SEC staff may ask the registrant to explain the basis for its conclusion. The staff is especially likely to do so if the registrant has disclosed in the same period that there have been no changes to its ICFR.