«SECURITIES AND EXCHANGE COMMISSION 17 CFR PARTS 210 and 240 [RELEASE NOS. 33-8829; 34-56203; File No. S7-24-06] RIN 3235-AJ58 Definition of the Term ...»
SECURITIES AND EXCHANGE COMMISSION
17 CFR PARTS 210 and 240
[RELEASE NOS. 33-8829; 34-56203; File No. S7-24-06]
Definition of the Term Significant Deficiency
AGENCY: Securities and Exchange Commission.
ACTION: Final rule.
SUMMARY: We are defining the term “significant deficiency” for purposes of the
Commission’s rules implementing Section 302 and Section 404 of the Sarbanes-Oxley
Act of 2002.
EFFECTIVE DATE: September 10, 2007.
FOR FURTHER INFORMATION CONTACT: N. Sean Harrison, Special Counsel, Division of Corporation Finance, at (202) 551-3430, or Josh K. Jones, Professional Accounting Fellow, Office of the Chief Accountant, at (202) 551-5300, U.S. Securities and Exchange Commission, 100 F Street, NE, Washington, DC 20549.
SUPPLEMENTARY INFORMATION: We are adopting amendments to Rule 12b-21 under the Securities Exchange Act of 1934 (the “Exchange Act”)2 and Rule 1-023 of Regulation S-X.4 1 17 CFR 240.12b-2.
2 15 U.S.C. 78a et seq.
3 17 CFR 210.1-02.
4 17 CFR 210.1-01 et seq.
6 15 U.S.C. 7262.
7 17 CFR 240.13a-15(c) and 15d-15(c).
8 See Rule 1-02(p) of Regulation S-X [17 CFR 210.1-02(p)] and Exchange Act Rule 12b-2 [17 CFR 240.12b-2]. In this release, we are moving the definitions to new paragraph (a)(4) of Rule 1-02.
2 deficiency” and “material weakness” in a concept release on ICFR requirements,9 and then proposed and adopted a definition of the term “material weakness.”10 Several commenters pointed out that while the proposing release for the interpretive guidance11 referenced the term “significant deficiency,” the Commission did not include a definition of the term in the proposal.12 Certain commenters indicated that the Commission should include a definition of significant deficiency in the Interpretive Release.13 In light of the comments received in response to the proposed interpretive guidance, and because Commission rules implementing Section 302(a) of the SarbanesOxley Act require senior management to certify they have communicated significant deficiencies to the audit committee and the external auditors, the Commission solicited additional comment on a definition for “significant deficiency.” In a release issued on June 27, 2007, the Commission requested additional comment on the following definition of the term “significant deficiency:”14 A deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of a registrant’s financial
9 Release No. 34-54122 (Jul. 11, 2006) [71 FR 40866, Jul. 18, 2006] available at http://www.sec.gov/rules/concept/2006/34-54122.pdf.
10 See Release No. 33-8809 (Jun. 20, 2007) [72 FR 35310, Jun. 27, 2007] 11 Release No. 33-8762 (Dec. 20, 2006) [71 FR 77635, Dec. 27, 2006].
12 See, for example, letters from Cardinal Health, Inc. (“Cardinal”), Edison Electric Institute, and Protiviti to Release No. 33-8762, File No. S7-24-06.
13 See, for example, letters from Cardinal and Protiviti to Release No. 33-8762, File No. S7-24Release No. 33-8811 (Jun. 20, 2007) [72 FR 35346, Jun. 27, 2007].
3 We received 22 comment letters in response to the request for additional comment.15 These letters came from accounting firms, professional associations, corporations and other interested parties. We have reviewed and considered all of the comments that we received on the proposed definition. We discuss our conclusions with respect to the comments in more detail in this release.
II. DISCUSSION A company’s principal executive officer and principal financial officer must certify that they have disclosed significant deficiencies in the design or operation of ICFR that are reasonably likely to adversely affect the company’s ability to record, process, summarize and report financial information, to the external auditor and the audit committee, with the intended result that these parties can more effectively carry out their respective responsibilities with regard to the company’s financial reporting.16 Including a definition of “significant deficiency” in Commission rules, in addition to the definition of “material weakness,” will enable management to refer to Commission rules and guidance for information on the meaning of these terms rather than referring to the auditing standards.
In developing the definition of “significant deficiency,” we considered comments received in response to the Public Company Accounting Oversight Board’s proposed auditing standard for audits of internal control over financial reporting. In its proposed 15 The comment letters are available for inspection in the Commission’s Public Reference Room at 100 F Street, NE, Washington, DC 20549 in File No. S7-24-06, or may be viewed at http://www.sec.gov/comments/s7-24-06/s72406.shtml.
16 See Section 302(a)(4) of the Sarbanes-Oxley Act (requiring signing officers to certify that they are responsible for establishing and maintaining internal controls and have designed the internal controls to ensure that material information relating to the issuer is made known to the signing officers, and have disclosed any significant deficiencies in internal control to the independent auditors and audit committee) [15 U.S.C 7241].
4 auditing standard, the PCAOB proposed to define significant deficiency as “a control deficiency, or combination of control deficiencies such that there is a reasonable possibility that a significant misstatement of the company’s annual or interim financial statements will not be prevented or detected.”17 Further, the PCAOB proposed to define a significant misstatement as “a misstatement that is less than material yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.” In response to the comments received on its proposal, the PCAOB, working with the Commission staff, decided to modify its proposed definition to focus the auditor on the communication requirement surrounding the term “significant deficiency” and to clarify that auditors should not scope their audit procedures to search for deficiencies that are less severe than a material weakness.
In proposing the definition, we believed that the focus of the term “significant deficiency” should be on the communications required to take place among management, audit committees and independent auditors. Therefore, we believed that the framework for the definition of “significant deficiency” should vary from that recently adopted for “material weakness.” Unlike the definition of the term “material weakness,” we did not believe it was necessary for the proposed definition of “significant deficiency” to include a likelihood component (that is, reasonable possibility). Rather, we believed that a definition focused on matters that are important enough to merit attention would allow for, and indeed encourage, sufficient and appropriate judgment by management to 17 See PCAOB Proposed Auditing Standard, An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of Financial Statements and Related Other Proposals (PCAOB Release No. 2006-007, Dec. 19, 2006).
5 determine the deficiencies that need to be reported to the independent auditor and the audit committee.
Comments on the Proposal A majority of commenters expressed their support for the proposed definition,18 noting that it would further the Commission’s objective of improving implementation of the provisions of the Sarbanes-Oxley Act of 2002. These commenters also noted that the definition would permit the exercise of appropriate judgment by management and independent auditors to determine those deficiencies in ICFR that are important enough to merit attention by those responsible for oversight of financial reporting. In addition, they noted that a consistent definition of significant deficiency in the Commission’s rules and in the PCAOB’s standards was imperative to promoting effective and efficient compliance by management and auditors with respect to their responsibilities to communicate and respond to significant deficiencies in internal control. Some of these commenters also supported the Commission’s inclusion of the term within its rules so that management could look to the Commission’s rules for the definition.19 A number of commenters agreed that the proposed definition of “significant deficiency” should not include a likelihood component.20 However, a few commenters 18 See, for example, letters from BDO Seidman, LLP; Center for Audit Quality; Committees on Federal Regulation of Securities and Law and Accounting of the Section of Business Law of the American Bar Association; Deloitte & Touche LLP; Ernst & Young LLP; Financial Executives International – Small Public Company Task Force; Grant Thornton LLP; KPMG LLP; PepsiCo;
PricewaterhouseCoopers LLP; The Internal Auditors Division of the Securities Industry and Financial Markets Association; Sprint Nextel Corporation; and The Institute of Internal Auditors.
19 See, for example, letters from BDO Seidman LLP; Center for Audit Quality; Committees on Federal Regulation of Securities and Law and Accounting of the Section of Business Law of the American Bar Association; Deloitte & Touche LLP; Ernst & Young LLP; Grant Thornton LLP;
KPMG LLP; and PricewaterhouseCoopers LLP.
20 See, for example, letters from BDO Seidman, LLP; Committees on Federal Regulation of Securities and Law and Accounting of the Section of Business Law of the American Bar 6 stated the definition should include a likelihood component because they believed that the addition of such a component would enhance management’s ability to evaluate deficiencies that need to be communicated to the audit committee.21 We agree with the commenters who stated that it was not necessary for the definition to include a likelihood component, as it could have the unintended effect of diminishing the use of appropriate judgment by management and independent auditors in performing the evaluation. We believe that excluding a likelihood component from the definition reduces the chance that management or independent auditors will design and implement evaluations or audits for the purpose of identifying deficiencies that are less severe than material weaknesses.
Further, we believe the guidance provided in our Interpretive Release and in the PCAOB’s Auditing Standard No. 5, An Audit of Internal Control Over Financial Reporting that is Integrated with an Audit of the Financial Statements (“Auditing Standard No. 5”), appropriately outlines that the scope of each evaluation is to detect material weaknesses, which is also consistent with comments the Commission received related to Auditing Standard No. 5.22 Therefore, we decided not to add a likelihood component to the definition as adopted.
Many commenters believed the definition allowed for the appropriate exercise of management and auditor judgment regarding what is important enough to merit attention based on each company’s particular facts and circumstances, and that some variability in Association; Deloitte & Touche LLP; Ernst & Young LLP; Grant Thornton LLP; PepsiCo;
Society of Corporate Secretaries and Governance Professionals; U.S Chamber Center for Capital Market Competitiveness; and The Institute of Internal Auditors.
21 See, for example, letters from Financial Executives International – Small Public Company Task Force; PricewaterhouseCoopers LLP; and Simone Heidema and Erick Noorloos.
22 See comments received for Releases 34-55912 and 34-55876.
these commenters believed that this would be acceptable based on the specific facts and circumstances of the individual registrants, and the fact that significant deficiencies are not required to be disclosed publicly.