3.6 Internal Control Over Financial Reporting

In addition to disclosing material changes in ICFR on a quarterly basis,15 a registrant must annually provide management’s report on ICFR and, if applicable, the attestation report of the registrant’s registered public accounting firm.16 These reports are not required in registration statements or Form 11-K.17 Further, newly public companies generally do not need to provide management’s report on ICFR in the first Form 10-K that they file after their initial public registration statement is declared effective;18 however, they are required to include a statement regarding the transition period established for them19 if management’s report is not included. In addition, the Jumpstart Our Business Startups (JOBS) Act amended Section 404(b) of the Sarbanes-Oxley Act by exempting EGCs from the requirement to obtain an attestation report on ICFR for as long as such entities retain their EGC status. See Section 3.8 for considerations related to EGCs.

Entities should be mindful of the SEC’s June 20, 2007, interpretive release regarding management’s assessment of ICFR, particularly the guidance on the evaluation of control deficiencies. The SEC staff has stated that internal control reporting is a focus in its reviews and enforcement actions, and this focus is demonstrated by past SEC cases.

3.6.1 Evaluation of Severity of Control Deficiencies

Examples of SEC Comments

Please describe in detail your evaluation of the severity of the key control deficiency. Refer to the guidance for evaluation of control deficiencies beginning on p. 34 of SEC Release No. 33-8810 “Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934.” Include in your analysis a description of the maximum potential amount or total of transactions exposed to the deficiency and how that determination was made.
[W]e note that you identified a misstatement in the accounting for certain partnership interests . . . , which resulted in a reduction to Retained Deficit of $[X] million, an increase in Additional Paid-In Capital of $[Y] million and a decrease in Redeemable Non-Controlling Interests of $[Z] million. We also note that you concluded the misstatement to be immaterial to the prior periods and revised the historical consolidated financial information within this Form 10-Q. Please [d]escribe the nature of the error, how it was identified and how the error impacted your conclusion on the effectiveness of the Company’s disclosure controls and procedures (“DC&P”) and internal control over financial reporting (“ICFR”). In this regard, please note that a material weakness as defined in Rule 1-02(a) of Regulation S-X is not limited to the existence of a material financial statement misstatement but rather considers whether there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

Registrants whose responses to SEC staff comments disclosed the identification of numerous control deficiencies without reporting a material weakness have received follow-up comments asking them to explain how they evaluated the severity of the deficiencies in the aggregate. The SEC staff has reiterated that the existence of a material weakness does not depend on the actual magnitude of an error (or whether an error existed) but instead depends on whether there was a reasonable possibility that a material misstatement could have occurred without being detected or prevented by the registrant’s ICFR. In the interpretive release discussed above, the SEC stated that (1) management needs to consider “whether each deficiency, individually or in combination, is a material weakness as of the end of the fiscal year . . . even though such deficiencies may be individually less severe than a material weakness” and (2) “[m]ultiple control deficiencies that affect the same financial statement amount or disclosure increase the likelihood of misstatement.”

At the 2015 AICPA Conference, the SEC staff reiterated the importance of ICFR,20 noting that some of the recent PCAOB inspection findings related to ICFR may not solely rest on audit execution but may indicate underlying issues involving management controls and assessments. In addition, the staff reminded auditors and management that before the severity of a control deficiency is assessed, it is important to properly identify and describe the nature of the deficiency in the context of the complete population of transactions that the control addresses. The staff also noted that when the severity of the deficiency is evaluated, consideration of the likelihood and magnitude of the misstatement is important; this analysis often rests on the “could factor” aspect of evaluation, which frequently requires management to look at additional information that is not otherwise part of the control.

ICFR was also a key topic at the 2016 AICPA Conference. The SEC staff stated at the conference that although companies’ identification of material weaknesses is improving, improvement is still needed with respect to the timing of identifying deficiencies and the evaluation of their severity, noting that this continues to be a focus of the SEC.

At the 2018 AICPA Conference, the SEC staff noted that the OCA may object to management’s conclusions about material weakness if, for example, management’s analysis did not fully evaluate all potential misstatements that may arise from the related control deficiency.

3.6.2 Evaluation of Control Deficiencies Related to Immaterial Misstatements

Examples of SEC Comments

We note that you concluded that the errors related to deferred tax assets were immaterial to the previously reported amounts contained in your periodic reports. Please tell us the following concerning these errors:
- Explain to us in greater detail the nature of the errors and how they were determined and remediated;
- Tell us if there was any impact on the evaluation of your disclosure controls and procedures and your conclusion on Internal Control over Financial Reporting; and
- Provide us with your SAB 99 materiality analysis beginning with the initial time period in which the errors were detected, addressing how you concluded that these errors were immaterial to the previously reported amounts contained in your periodic reports.
We note your disclosures that you identified “accounting issues” pertaining to: (i) netting treatment in the presentation of a limited population of certain securities lending and borrowing activities; and (ii) reclassification and other changes to the consolidated statements of cash flows in [fiscal years 2 and 1]. Please provide us with a full and detailed description of the errors, including, but not limited to, who identified them, when, and how, and whether they were the result of control deficiencies. In addition, provide us with your assessment of materiality supporting your conclusion that they are immaterial both individually and in the aggregate. Ensure your response addresses qualitative and quantitative factors and provides an objective assessment of materiality from the perspective of a reasonable investor, including your consideration of guidance in ASC 250, SAB 99, and management’s assessment of the design and effectiveness of ICFR.

In his March 9, 2022, statement, Paul Munter, then acting chief accountant (and currently chief accountant) of the SEC, indicated that the SEC staff will continue to question how registrants have considered and evaluated the severity of deficiencies in ICFR related to immaterial misstatements that were corrected by immaterial restatements.21 Mr. Munter reminded registrants that the severity of a deficiency does not depend on whether a misstatement actually has occurred; rather, it depends on whether there is a reasonable possibility that the deficiency could have resulted in a misstatement. Accordingly, it is possible that an immaterial restatement represents a material weakness in ICFR even though the actual magnitude of an error was not material. As Mr. Munter noted, “while the existence of a material accounting error is an indicator of the existence of a material weakness, a material weakness may also exist without the existence of a material error. Management’s assessment of the effectiveness of ICFR should therefore be focused on a holistic, objective analysis of what could happen in the context of current and evolving financial reporting risks.”

The SEC’s June 20, 2007, interpretive release states, in part:

Management evaluates the severity of a deficiency in ICFR by considering whether there is a reasonable possibility that the company’s ICFR will fail to prevent or detect a misstatement of a financial statement amount or disclosure; and the magnitude of the potential misstatement resulting from the deficiency or deficiencies. The severity of a deficiency in ICFR does not depend on whether a misstatement actually has occurred but rather on whether there is a reasonable possibility that the company’s ICFR will fail to prevent or detect a misstatement on a timely basis.

3.6.3 Evaluation of Deficiencies Identified in the Other COSO Components

Example of an SEC Comment

We continue to question your evaluation of the deficiencies in ICFR and your determination that it was not reasonably possible that a material misstatement of your financial statements would not be prevented or detected on a timely basis as a result of certain control deficiencies. In this regard, please address the following:

Tell us how you considered the various errors identified at your corporate location and across multiple geographic regions, some of which were the result of control deficiencies, including significant deficiencies, in different components of the COSO Framework, in evaluating the effectiveness of the control environment component of COSO, especially as it relates to the factor regarding competence (i.e., knowledge, skills, training, and experience of the relevant employees).
For the significant deficiencies you identified in the risk assessment, monitoring, and information and communication components, tell us why the severity of each is limited to the specific, individual process-level errors you describe in your response and how you determined that the reasonably possible potential error for each is limited to the various errors identified. For example, how was it determined that the significant deficiency in the risk assessment component related to “not having the appropriate resources” is limited to only being manifested through an immaterial error in a specific type of revenue transaction?
Tell us how you concluded that the significant deficiency resulting in the embedded derivative error is appropriately classified within the information and communication component, as opposed to the failure to identify the relevant clauses in the contracts resulting from, for example, a lack of appropriate employee technical skill (control environment), an improper risk assessment of the types of activities that could lead to embedded derivatives, or the ineffective monitoring of the regional accounting team by the corporate accounting team.

The SEC staff has questioned whether deficiencies in control activities may be related to deficiencies in one or more of the following components of ICFR:

Control environment.
Information and communication.
Risk assessment.
Monitoring.

Specifically, the SEC staff may ask a registrant to provide a detailed analysis on how it concluded that the controls related to each of the other four COSO components were effective. At the 2014 AICPA Conference, the staff cited an example in which a growing company had “not employed sufficient resources in the finance department to keep up,” noting that such a situation “raises questions about what other amounts or disclosures could be impacted by the lack of resources and how the Control Environment and Risk Assessment components of COSO had been evaluated.”22 The staff explained that if management does not understand the nature of all deficiencies, it “is more likely to overlook the possibility that there is a deficiency in another COSO component that may already represent, or could otherwise be developing into, a material weakness.”

3.6.4 Disclosure of Material Changes in ICFR

Examples of SEC Comments

You disclose that you substantially completed the implementation of your new Enterprise Resource Planning System (“ERP”) by the end of [the fiscal year] and the implementation of this System has affected and will continue to affect your internal controls over financial reporting. We remind you that if your ERP implementation results in any material changes to internal controls over financial reporting, you should provide disclosures required by Item 308(c) of Regulation S-K.
We note your disclosure . . . concerning the changes that are continually being made to your controls in light of the restatement announced in [fiscal year 1]. Given the nature of the items outlined in the remediation plan, including the uniform internal control policy implementation, new team members, internal audit, and enhanced compliance practices, please tell us how you concluded that there have been no changes in your internal control over financial reporting that have materially affected, or are reasonably likely to materially affect, your internal control over financial reporting as of [the end of fiscal year 1], [the end of the first quarter of fiscal year 2], and [the end of the second quarter of fiscal year 2]. As part of your response, please tell us whether you expect to report any changes in your future periodic reports.
We note your disclosure that there were no changes in your internal controls over financial reporting (“ICFR”) that have materially affected, or are reasonably likely to materially affect, your ICFR. In light of your accounting issues and resulting revisions, as well as the various changes that have taken place during [the fiscal year] with regards to processes, procedures, organizational and business structure, and senior management, please provide us with your analysis supporting your conclusion that there were no material changes to ICFR.
We note that you concluded that your disclosure controls and procedures were effective as of [the end of fiscal year 2]. In forming this conclusion, please tell us how you considered the material weaknesses you had as of [the end of fiscal year 1]. In this regard, we note that (i) [one of your disclosures in your Form 10-K for fiscal year 2] indicates that during [fiscal year 2] there had been no change in internal control over financial reporting and (ii) you disclosed in each of your Form 10-Qs filed during [fiscal year 2] that no material changes in your internal control over reporting had occurred.

The SEC staff has commented when a registrant has not explicitly and clearly asserted whether there has been a change in ICFR in the last fiscal quarter that had or could have a material effect on its ICFR, as required by Regulation S-K, Item 308(c). Registrants should state clearly whether there were changes in ICFR for the quarter and, if so, should disclose the nature of the changes. The staff has stressed that registrants should avoid “boilerplate” disclosure that there have been no material changes affecting ICFR in a period, particularly when there have been identifiable events such as layoffs, changes in outsourcing arrangements, or changes in accounting policies.

In reviewing registrants’ filings, the SEC staff looks for indicators of potential ICFR deficiencies. Common indicators include disclosures about changes in ICFR and corrections of errors. If indicators are observed, the staff routinely asks registrants about management’s consideration of such indicators in relation to its conclusions about the effectiveness of ICFR (i.e., whether a deficiency in internal control represents a material weakness that should have been identified and disclosed). For the quarter in which any material changes in ICFR occur, registrants should provide disclosures about such material changes, including (1) the identification of any material weaknesses and (2) changes made to remediate material weaknesses.

3.6.5 Disclosures About the Impact and Remediation of Material Weaknesses

Examples of SEC Comments

We note your disclosure that your independent registered public accounting firm identified material weaknesses in the internal control over financial reporting during the . . . audits. Please revise to address the following:
- Please provide information surrounding each of the material weaknesses identified. Quantify the effects of each one on your financial statements.
- Please provide an expanded discussion of the specific steps you have taken and put into place to resolve each material weakness. Identify which material weaknesses have been resolved and which have not been resolved.
- Please revise MD&A to provide a discussion of the material weaknesses that includes the information requested in the first two [bullet] points of this comment and that includes a discussion of how the material weaknesses affected your financial condition, results of operations and cash flows.
[Please amend your 10-K to clearly] describe the actual material weakness in [DC&P] rather than just state that it relates to your analysis of the accounting for goodwill and other intangibles and accounting for the impairment of long lived assets. For example, describe the actual controls that failed such as whether it related to impairment testing, valuation matters, etc. This way, when you describe how the material weaknesses were remediated in subsequent filings, investors can better understand how the changes in ICFR remediated the material weaknesses.
We note you originally identified your material weakness in internal control over financial reporting [in your prior annual report] where you indicated that management intended to test your updated controls design during the fourth quarter [of your most recently completed fiscal year]. Accordingly, please revise to address what steps have been completed in your remediation plan to date, including any completed control design and testing procedures, what still remains to be completed, and revise to update your estimate of the expected timing of your remediation plan.
Noting the length of time your material weaknesses have existed, please tell us and revise future filings to discuss the status of and estimated time remaining to complete each remediation action disclosed.

The SEC staff has indicated that management’s disclosures about material weaknesses are expected to go beyond merely identifying the existence of one or more material weaknesses or providing a limited description. Rather, such disclosures should contain enough information to allow investors to understand the cause of a material weakness and determine the pervasiveness of its effect on ICFR. Such expectations apply when a company discloses a material weakness outside of management’s report of ICFR, including in Form S-1 and Form 10-Q filings.

Similarly, the staff has called for more transparent disclosures about the pervasiveness of a material weakness’s impact on the registrant’s financial reporting and its ICFR. The staff has stressed that registrants need to avoid narrowly focusing their disclosures on a particular financial statement line item affected by a material weakness and should consider other financial statement line items that may also be affected.23

At the 2018 AICPA Conference, the SEC staff reiterated that the goal of management’s material weakness disclosure is not only to highlight the existence of a material weakness, but also “to allow for investors to understand the cause of the control deficiency and assess its potential impact on the company’s financial reporting.”24 The staff noted that although the OCA has observed improvements in registrants’ disclosures of material weaknesses, “more could be done to make these disclosures more informative to investors.” To help registrants determine whether a disclosure about a material weakness would provide an investor with the most meaningful information, the staff suggested that they consider the following questions:

“Does the disclosure allow an investor to understand what went wrong in the control that resulted in a material weakness?”
“Is it sufficiently clear from the disclosure what the impact of each material weakness is on the company’s financial statements? For example, is the material weakness pervasive or isolated to specific accounts or disclosures?”
“Are management’s plans to remediate the material weakness sufficiently clear? For example, does [the] disclosure of the remediation plans provide sufficient detail [to allow] an investor [to] understand what management’s plans are and how the remediation plans would address the identified material weakness?”

In certain instances, the SEC staff has observed that questions about the validity and completeness of management’s disclosures regarding material weaknesses have arisen as a result of management’s discussion of its remediation plans. Sometimes the remediation plans are broader than the material weakness identified, potentially indicating that the actual material weakness is more pervasive than the material weakness disclosed or that there may be another material weakness that was not identified and disclosed. In providing disclosures about remediation plans, registrants should therefore consider the root cause of a material weakness and whether it highlights a more pervasive material weakness in their ICFR or deficiencies in other controls. The SEC staff may also inquire about the progress of remediation when the same material weakness is reported in multiple annual reports.

Further, the SEC staff has commented when registrants identified one or more material weaknesses in ICFR but either refrained from concluding on the effectiveness of ICFR or concluded that their ICFR is effective. In such instances, the staff has reminded registrants that Regulation S-K, Item 308(a)(3), prohibits a conclusion that ICFR is effective when one or more material weaknesses exist and has asked registrants to amend their filings to state that their ICFR is not effective as a result of the material weaknesses that were identified.

3.6.6 Conclusion That ICFR Remains Effective After a Restatement

Examples of SEC Comments

As the restatement impacted periods prior to the most recent fiscal year, it is unclear whether your prior conclusions on the effectiveness of [ICFR] and [DC&P] for those restated fiscal years are still appropriate. If management has determined that a material weakness existed in those prior fiscal years in relation to the errors identified and therefore, both ICFR and [DC&P] are ineffective for those years, please amend your filing to disclose this information.
[P]lease tell us your consideration of management’s assessment of the effectiveness of ICFR in light of the restatement. If no consideration will be given, please explain why. That is, please explain to us why you believe internal controls over financial reporting continue to be effective in light of the error and why no modifications to the disclosures contained [in] management’s report, including any material changes made to ICFR, are required.

Because a restatement is typically indicative of a material weakness in ICFR, the SEC staff may challenge registrants when they conclude that their ICFR and DC&P are effective after restating their financial statements. In addition, because it is typically difficult for a registrant to conclude that its DC&P are effective when its ICFR is ineffective (since most elements of ICFR are subsumed in the definition of DC&P), the SEC staff may ask registrants after a restatement has occurred to explain why they concluded that their DC&P are effective.

Registrants should consider paragraphs 4310.16 and 4310.17 of the FRM regarding the restatement of financial statements, which state, in part:

There is no requirement for a company to reevaluate the effectiveness of its internal controls and/or reissue a revised management’s report on ICFR when a company restates its financial statements to correct errors . . . . However, a company may need to consider whether or not its original disclosures in management’s report continue to be appropriate in light of these errors, and should modify or supplement its original disclosure to include any other material information that is necessary for such disclosures not to be misleading in light of the restatement. . . . If a company’s management concludes that its original assessment of ICFR was incorrect, it should consider whether or not to revise its original report on ICFR.

3.6.7 Disclosure of the Framework Used to Evaluate ICFR

Examples of SEC Comments

We note that management has conducted an evaluation of the effectiveness of your internal control over financial reporting as of [the fiscal year-end] based on the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Please tell us and revise future filings to disclose whether you applied the 1992 or 2013 COSO framework in your assessment. Reference is made to Item 308(a)(2) of Regulation S-K.
Management’s report on internal control over financial reporting still does not identify the relevant framework that was used to evaluate your internal controls over financial reporting. Please revise to indicate the relevant framework that was used to evaluate your internal controls over financial reporting.
Revise Management’s Annual Report on Internal Control over Financial Reporting in future filings to identify the Committee of Sponsoring Organizations of the Treadway Commission, or COSO, Internal Control-Integrated Framework used to evaluate the effectiveness of your internal control over financial reporting (e.g., COSO 2013). Please refer to Item 308(a)(2) of Regulation S-K.
Please clarify your statement that in performing an evaluation of the effectiveness of your internal control over financial reporting as of [your fiscal year-end,] management used the criteria “established in Internal Control-Integrated Framework issued by the board members,” since we do not [recognize] the framework you listed. It appears that your management should have used the criteria established in the Committee of Sponsoring Organization[s] of the Treadway Commission (COSO) Internal Control — Integrated Framework (2013). Please refer to Item 308(a)(2) of Regulation S-K.

The COSO framework is one of the most widely applied frameworks that registrants use to evaluate the effectiveness of their ICFR. On May 14, 2013, COSO released an updated version of its Internal Control — Integrated Framework to reflect the significant changes in business and operational environments that have occurred since the original framework was introduced in 1992. Although the components of internal control under the framework remain unchanged, the update introduced 17 new principles that explicitly articulate and describe the components of internal control.25 Registrants must disclose the internal control framework they applied in assessing the effectiveness of their ICFR in accordance with paragraph 4310.7 of the FRM. COSO’s transition guidance stated that the 1992 framework would be available until December 15, 2014, after which COSO would consider the 1992 framework to be superseded by the 2013 framework. However, because COSO is not a standard setter or a regulator, registrants may view the adoption of the 2013 framework as optional. Accordingly, when issuers have disclosed their use of the 1992 framework after the December 15, 2014, transition date, the SEC staff has questioned why they continue to use the 1992 framework.

The SEC staff often comments when registrants do not disclose the framework used to evaluate the effectiveness of ICFR. The staff has cited specific examples in which management did not identify the framework used, as well as instances in which management inappropriately referred to SEC guidance or COSO’s small-company guidance as the framework used for the evaluation. As a result, when a registrant has not disclosed the framework it used, it may be asked to advise the SEC staff of the framework it used in the current year and to revise its disclosures in current and future filings.

3.6.8 Incomplete or Missing ICFR Evaluation

Examples of SEC Comments

[Y]ou did not include your conclusion regarding the effectiveness of your internal control over financial reporting. Please confirm to us that you intended to state . . . that your internal control over financial [reporting] is not effective, if correct, and confirm that you will include your conclusions for your assessments of the effectiveness of your disclosure controls and procedures and internal control over financial reporting in all future Forms 10-K.
Please revise this report in future [Forms 10-K] to include all the statements required by Item 308(a)(1) of Regulation S-K, including a statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting.
We note that your management report does not include a statement that your registered public accounting firm issued an attestation report. Refer to Item 308(a)(4) of Regulation S-K and revise future filings as necessary.
We note your disclosure that this report does not include a report of management’s assessment regarding internal control over financial reporting or an attestation report of the company’s registered public accounting firm due to a transition period established by rules of the SEC for newly public companies or emerging growth companies. Since this is your second 10-K these transition rules no longer apply. Please amend your filing to include management’s assessment of internal control and revise your [Sarbanes-Oxley Act Section 302] certifications, accordingly. Identify in your report which version, 1992 or 2013, of the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control — Integrated Framework you utilized when performing your assessment of internal control over financial reporting.

Regulation S-K, Item 308(a)(3), requires registrants to assess and conclude on the effectiveness of their ICFR as of the end of their most recent fiscal year. However, Instruction 1 to Item 308 provides that a newly public company does not need to provide management’s report on ICFR on the company’s first Form 10-K.26 That said, in several instances, registrants that issued a second annual report on Form 10-K omitted an ICFR conclusion or provided one that did not contain all of the required information. Registrants that are newly public companies should ensure that their second annual report on Form 10-K includes management’s report on ICFR unless other rules apply and the certifications of the principal executive officer (PEO) and principal financial officers include language referring to ICFR.

The SEC staff has issued comments to registrants that failed to indicate a date for their ICFR evaluation or included in their filing a date other than the end of their most recent fiscal year. Registrants should ensure that the appropriate date of their ICFR evaluation is prominently displayed in any filing with the SEC.

In addition, the SEC staff has issued comments to registrants that did not comply with Regulation S-K, Item 308(a)(4), which requires a registrant to include in management’s report a statement that the registered public accounting firm that audited the registrant’s financial statements issued an attestation report on the registrant’s ICFR.

Footnotes

See footnote 12.

The requirement to provide an attestation report applies only to large accelerated and accelerated filers because nonaccelerated filers are exempt from this requirement under Section 404(b) of the Sarbanes-Oxley Act.

Form 11-K is used to file the annual reports for employee stock purchase, savings, and similar plans.

However, paragraph 4310.6 of the FRM states, in part, “A company that historically reported under the Exchange Act as a voluntary filer or because of registered debt, and therefore filed annual reports up to and through the date of its [equity] IPO, in which it was required to comply with . . . Item 308(a) of Regulation S-K, is therefore required to provide management’s report on ICFR in its first annual report following the IPO.”

As required by Instruction 1 to Regulation S-K, Item 308.

See the December 9, 2015, speech delivered by Brian Croteau, then deputy chief accountant in the SEC’s Office of the Chief Accountant (OCA), at the 2015 AICPA Conference.

An immaterial restatement is a restatement of previously issued financial statements for the correction of a misstatement that is either (1) not material to the prior period being changed but would be material to the current period if corrected in the current period or (2) not material to any periods being presented.

See the December 8, 2014, speech delivered by then OCA Senior Associate Chief Accountant Kevin Stout at the 2014 AICPA Conference.

This issue was discussed at the Forums on Auditing in the Small Business Environment hosted by the PCAOB in December 2012.

See the December 10, 2018, speech delivered by Emily Fitts, then a professional accounting fellow in the OCA, at the 2018 AICPA Conference.

For additional information, see Deloitte’s June 10, 2013, Heads Up on the revised COSO framework.

Instruction 1 to Item 308 notwithstanding, registrants should note that paragraph 4310.6 of the FRM states, in part, “A company that historically reported under the Exchange Act as a voluntary filer or because of registered debt, and therefore filed annual reports up to and through the date of its [equity] IPO, in which it was required to comply with . . . Item 308(a) of Regulation S-K, is therefore required to provide management’s report on ICFR in its first annual report following the IPO.”