Chairman Cox and members of the Commission:
As Chairman Cox has explained, we are here today to recommend that you approve and publish interpretive guidance regarding the planning and conduct of management's evaluation of internal control over financial reporting in final form. I must say that it has been an exciting and important journey to arrive at today's recommendations to the Commission — a journey that started soon after I arrived on the staff last spring and began with the SOX 404 roundtable and the "next steps" press release last May. I was told when I arrived that addressing the implementation of SOX 404 was perhaps the most pressing issue facing the Commission at that time and it should be given our highest priority. The decision announced in its press last May to have the Commission provide so-called "management guidance" — something the Commission had chosen not to do when SOX 404 was first being implemented three years earlier — was a critical element in this plan to improve the implementation of SOX 404. In a very intense year on this front, I believe the Commission has moved forward in its best traditions — working extraordinarily hard, collecting extensive public comment, first on a concept release, and then on a proposing release. Then, holding an open meeting to discuss alignment of its proposed management's guidance with the concurrent efforts of the PCAOB to provide a new auditing standard AS-5. In the process, the Commission and the staff have created something that simply did not exist before in one place — guidance for management in implementing SOX 404. So, today is the culmination of that effort and we on the staff are very pleased and very proud to make our recommendation to you. In a moment, Conrad Hewitt and Zoe-Vonna Palmrose are going to set out the core principles that have guided us, and lay out the details of our recommendations to you — I will just take a couple of minutes to lay out the structure of our recommendations and how we got there.
An important initial structural decision was whether the management guidance should be issued as an interpretation or instead codified as a Commission rule — over 2/3rds of the commenters preferred that the guidance be issued as an interpretation. We agree and are following that advice and recommending that you issue the final version of the guidance in the form of an interpretive release. This will permit the guidance to be more easily updated or modified than if it were incorporated into the Section 404 rules.
In addition to this Interpretive Guidance, we are recommending that you approve a separate release adopting amendments to the Section 404 rules. At the proposing stage, the Interpretive Guidance and the proposed rule amendments were combined in a single release, but we believe at this stage it is more practical and user friendly if you adopt two separate releases — one setting forth the guidance and the other the final rule amendments. When codified, the rule amendments will appear in their appropriate places within our other 404-related rules and, for ease of use by all issuers, including smaller issuers who are complying with Section 404 for the first time this year, the interpretive guidance will be free-standing in its own release. The two releases will appear together in the Federal Register.
Zoe-Vonna will be describing the guidance — let me outline the rule amendments. First, one of the amendments states that, while there are many different ways to conduct an evaluation of the effectiveness of internal control over financial reporting, an evaluation conducted in accordance with the interpretive guidance will satisfy the rules. An important point here is that we understand that many of the larger public companies already complying with the Section 404 requirements have established a compliant evaluation process that may differ from the approach described in the interpretive guidance. That's okay. There is no requirement for these companies to alter their procedures from the last 3 years to align them with the new interpretive guidance, unless they choose to do so.
Second, we also are recommending that you revise two Regulation S-X provisions pertaining to the auditor's attestation report on internal control over financial reporting to clarify that, going forward, the auditor will be required to express only one opinion directly on the effectiveness of internal control over financial reporting in its audit report. Under existing requirements, the auditor must express two separate opinions — one on effectiveness and another on management's assessment.
Finally, we also are recommending that you codify the definition of the term "material weakness" substantially as it was proposed in the interpretive guidance. The final rules would define a material weakness as a deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis. We anticipate that the PCAOB's revised auditing standard also will include the same definition.
We think it makes sense to also include a definition of the term "significant deficiency" in Commission rules and recommend that you issue a release to seek additional public comment on this term. Although the Commission's July 2006 concept release sought comment on definitions of both "material weakness" and "significant deficiency," the proposed interpretive guidance defined only the term "material weakness." Several commenters on the guidance indicated that the Commission also should define the term "significant deficiency." We agree.
Chairman Cox has already thanked the many staff members who have worked on these releases as well as the PCAOB and staff, who have worked with us — and I echo those thanks. But, before I turn things over to Conrad, I want to extend special thanks to a key member of the Section 404 team — Carol Stacey, Corp. Fin's chief accountant for the past 5 years, who will be leaving the Commission this week to return to the private sector. Carol has been a major force in shaping Section 404 policies ever since 2002 when the Sarbanes-Oxley Act first became law. She has helped both companies and audit firms to deal with many of the daunting challenges presented by the internal control requirements. It is therefore very fitting that she is here at the table today as we reach this important milestone in our work to improve Section 404 implementation. Although the Section 404 work may have seemed all-consuming at times, Carol's contributions have extended far, far beyond this area. Aside from her notable talents as an accountant, as a manager and as the face of the Division on accounting matters for many years, Carol has demonstrated a truly remarkable ability to maintain grace under pressure throughout her tenure as our Chief Accountant. She will be sorely missed all of us in Corp Fin and at the Commission. I want to publicly express our deep appreciation for Carol's 11 years of service at the Commission and extend our best wishes to her for the future.
Now I would like to turn it over to Conrad Hewitt, the Commission's Chief Accountant, for what I believe is a first — he is joining us today via teleconference from Zurich.
http://www.sec.gov/news/speech/2007/spch050207jww.htm