The Commission voted to adopt rule and form amendments to implement requirements of Section 404 of the Sarbanes-Oxley Act of 2002.

Management's Report on Internal Control over Financial Reporting

Section 404 of the Act directs the Commission to adopt rules requiring each annual report of a company, other than a registered investment company, to contain (1) a statement of management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) management's assessment, as of the end of the company's most recent fiscal year, of the effectiveness of the company's internal control structure and procedures for financial reporting. Section 404 also requires the company's auditor to attest to, and report on management's assessment of the effectiveness of the company's internal controls and procedures for financial reporting in accordance with standards established by the Public Company Accounting Oversight Board. The Commission received over 60 comments on the Section 404 proposals that expressed general overall support for the Commission's approach to implementing Section 404 of the Act. The adopting release will incorporate a number of changes recommended by commenters.

Under the final rules, management's annual internal control report will have to contain:

• a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the company;
   
• a statement identifying the framework used by management to evaluate the effectiveness of this internal control;
   
• management's assessment of the effectiveness of this internal control as of the end of the company's most recent fiscal year; and
   
• a statement that its auditor has issued an attestation report on management's assessment.

Under the new rules, management must disclose any material weakness and will be unable to conclude that the company's internal control over financial reporting is effective if there are one or more material weaknesses in such control. Furthermore, the framework on which management's evaluation is based will have to be a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment.

The new rules implementing Section 404 of the Act will define the term "internal control over financial reporting" to mean

a process designed by, or under the supervision of, the registrant's principal executive and principal financial officers, or persons performing similar functions, and effected by the registrant's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that

• pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the registrant;
   
• provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and receipts and expenditures of the registrant are being made only in accordance with authorizations of management and directors of the registrant; and
   
• provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the registrant's assets that could have a material effect on the financial statements.

The Commission also voted to adopt amendments requiring companies to perform quarterly evaluations of changes that have materially affected or are reasonably likely to materially affect the company's internal control over financial reporting.

Compliance with the rules regarding management's report on internal controls will be required as follows: companies, other than foreign private issuers, meeting the definition of an "accelerated filer" in Exchange Act Rule 12b-2 (generally, U.S. companies that have equity market capitalization over $75 million and have filed an annual report with the Commission) will be required to comply with the management report on internal control over financial reporting requirements for fiscal years ending on or after June 15, 2004, and all other issuers, including small business issuers and foreign private issuers, will be required to comply for their fiscal years ending on or after April 15, 2005.

Certifications

The final rules will amend the exhibit requirements for periodic reports to add the certifications required by Sections 302 and 906 of the Sarbanes-Oxley Act to the list of required exhibits to be included in reports filed with the Commission. Under the final rules, the specific form and content of the Section 302 certification will be set forth in the applicable exhibit filing requirements for a company's periodic reports.

The amendments will permit companies to "furnish" rather than "file" the Section 906 certifications with the Commission. Thus, the certifications will not be subject to liability under Section 18 of the Exchange Act. Moreover, the certifications will not be subject to automatic incorporation by reference into a company's Securities Act registration statements, which are subject to liability under Section 11 of the Securities Act, unless the issuer takes steps to include the certifications in a registration statement.

The rules and form amendments concerning Section 302 and Section 906 certifications generally will become effective sixty days after their publication in the Federal Register.