SOX_SECTION_404_001

rules/regulations/us/sox_section_404.yaml

Citation

15 U.S.C. §7262(a) Rules required: The Commission shall prescribe rules requiring each annual report required by section 78m(a) or 78o(d) of this title to contain an internal control report, which shall- (1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting. §7262(b) Internal control evaluation and reporting: With respect to the internal control assessment required by subsection (a), each registered public accounting firm that prepares or issues the audit report for the issuer, other than an issuer that is an emerging growth company (as defined in section 78c of this title), shall attest to, and report on, the assessment made by the management of the issuer. An attestation made under this subsection shall be made in accordance with standards for attestation engagements issued or adopted by the Board. Any such attestation shall not be the subject of a separate engagement.

Condition

Requires each annual report to contain an internal control report stating management's responsibility for establishing and maintaining adequate internal control structure for financial reporting, plus an assessment of effectiveness. Sarbanes-Oxley Act Section 404, codified at 15 U.S.C. §7262.

Layer 1 detects

no, without, skip, skipping, bypass, or omit (and words that begin with it), then internal control, ICFR, SOX 404 or 404, then report, assessment, testing, attestation or evaluation; material weakness or significant deficiency or deficiencies, then not disclosed, hidden, or a word beginning with conceal, undisclos or omit; misrepresent, or a word beginning with falsif or overstate, then internal control, ICFR or control effectiveness; circumvent, bypass or override, then internal control, ICFR, SOX or control procedure; internal control, ICFR or SOX 404 assessment or testing not performed, skipped, incomplete or inadequate; management assertion or certification without or lacking basis, testing, documentation or evidence; and annual report or 10-K, then without, lacking or missing, then internal control report, ICFR report or 404 report. The words follow each other with nothing in between. It matches wording, not meaning: it misses the practice told in other words ("File the 10-K without the internal control report this year; nobody reads it." has the word "the" before "internal control report"), it does not read the smaller issuer exemption, and it fires on text that only names the practice, such as a refusal. Whether a report or assessment is missing or misstated is judged in Layer 2.

Condition type

regex; semantic condition in the file, not run by the engine

Status in the file

approved