Introduction
Who is Subject to Sarbanes-Oxley?
When Does Sarbanes-Oxley Take Effect?
Key Provisions of Sarbanes-Oxley, and Related SEC Rulemaking
Certification Requirements
- Section 302
- Section 906
- Differences Between Section 906 and Section 302 Certifications
Section 404—Internal Control Over Financial Reporting
Non-GAAP Financial Measures
- Regulation G
- Regulation S-K Item 10(e)
Off-Balance Sheet and Other MD&A Disclosure
- Off-Balance Sheet Arrangements
- Table of Contractual Obligations
- Contingent Liabilities and Commitments
Standards Relating to Listed Company Audit Committees
Audit Committee Financial Expert
Auditor Independence
Improper Influence on the Conduct of Audits
Auditor Record Retention
Material Correcting Adjustments
Attorney Conduct Rules
Code of Ethics
Blackout Trading Restrictions
Loans to Executives
Forfeiture of Bonuses
Reseach Analysts
Liability Issues Relating to Sarbanes-Oxley
Annex A -Effective Dates for Certain Sarbanes-Oxley Sections and Related SEC Rulemaking
Introduction
This update summarizes the key provisions of the U.S. Sarbanes-Oxley Act of 2002 (the "Sarbanes-Oxley Act," "Sarbanes-Oxley," or the "Act"), and the U.S. Securities and Exchange Commission’s (the "SEC") rules under the Act relevant to foreign private issuers (a term that covers most non-U.S. issuers, other than foreign governments). It is current through September 1, 2004.
Who is Subject to Sarbanes-Oxley?
- have registered securities under the U.S. Securities Exchange Act of 1934, as amended (the "Exchange Act" or the "1934 Act");
- are required to file reports under Section 15(d) of the Exchange Act; or
- have filed a registration statement under the U.S. Securities Act of 1933, as amended (the "Securities Act" or the "1933 Act") that has not yet become effective.1
This means, for example, that any foreign private issuer that has listed its securities in the United States, or issued securities to the public in the United States whether or not listed (such as in a registered exchange offer for high-yield bonds) is subject to the Sarbanes-Oxley Act. A foreign private issuer that has not sold securities to the public in the United States, or that is exempt from Exchange Act registration by virtue of Exchange Act Rule 12g3-2(b) is not subject to the requirements of the Sarbanes-Oxley Act. Accordingly, when we refer below to "issuers" and "foreign private issuers" we mean those companies that are subject to Sarbanes-Oxley.
Although the Sarbanes-Oxley Act does not generally distinguish between U.S. domestic and foreign private issuers, the SEC has, in its implementing rules, made various exceptions for the benefit of foreign private issuers.
When Does Sarbanes-Oxley Take Effect?
Key Provisions of Sarbanes-Oxley, and Related SEC Rulemaking
Certification Requirements
Section 302
However, these Rules, Item 15 and the certification text have been further modified by the SEC’s "internal control" rules adopted under Section 404 of the Sarbanes-Oxley Act.5 As a result, we have summarized below the revised versions of the Rules, Item 15 and the certification text. The revised versions generally took effect August 14, 2003 (with certain exceptions that we note below).6
Section 302 Certification Text—1934 Act Rules 13a-14, 15d-14; Form 20-F
- the officer has reviewed the annual report;
- based on the officer's knowledge, the annual report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made, in light of the circumstances under which such statements were made, not misleading;
- based on the officer's knowledge, the financial statements, and other financial information included in the annual report, fairly present in all material respects the financial condition, results of operations and cash flows of the issuer;
- the CEO and CFO are responsible for establishing and maintaining disclosure controls and procedures [and "internal control over financial reporting"10]11 for the issuer and have:
- designed such disclosure controls and procedures, or caused such disclosure controls and procedures to be designed under their supervision, to ensure that material information relating to the issuer, including its consolidated subsidiaries, is made known to them by others within those entities;
- [designed such internal control over financial reporting, or caused such internal control over financial reporting to be designed under their supervision, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles;]12
- evaluated the effectiveness of the issuer's disclosure controls and presented in the annual report their conclusions about the effectiveness of the disclosure controls and procedures, as of the end of the period covered by the report based on such evaluation;13 and
- disclosed in the report any change in the issuer's internal control over financial reporting that occurred during the period covered by the report that has materially affected, or is reasonably likely to materially affect, the issuer's internal control over financial reporting; and
- the CEO and CFO have disclosed, based on their most recent evaluation of internal control over financial reporting, to the issuer's auditors and the audit committee:
- all significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting which are reasonably likely to adversely affect the issuer's ability to record, process, summarize and report financial information; and
- any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's internal control over financial reporting.
These certifications must be included as an exhibit to the issuer’s annual report on Form 20-F.14 Except for the portions of the certifications appearing above in square brackets (which do not come into effect until July 15, 2005), the wording of the certifications may not be changed in any respect, even if the changes would appear to be inconsequential.15
Disclosure Controls and Procedures— 1934 Act Rules 13a-15 and 15d-15; Item 15(a) of Form 20-F
Under Rules 13a-15 and 15d-15, a foreign private issuer must maintain disclosure controls and procedures.16 In addition, as of the end of each fiscal year, the issuer’s management, with the participation of the CEO and CFO, must make an evaluation of the effectiveness of the issuer’s disclosure controls and procedures.17 Finally, under Item 15a of Form 20-F, the issuer must disclose the conclusions of its CEO and CFO regarding the effectiveness of the disclosure controls and procedures based on their review as of the end of the period to which the report relates.18
For the purposes of Rules 13a-15 and 15d-15, and Item 15(a) of Form 20-F (as well as the required certifications of Rules 13a-14 and 15d-14), "disclosure controls and procedures" means controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Exchange Act is (1) timely recorded, processed, summarized and reported and (2) accumulated and communicated to the issuer’s management, to allow for timely decisions about disclosure.19
Violations of Section 302
Section 906
- the periodic report fully complies with the requirements of Section 13(a) or Section 15(d) of the Exchange Act; and
- the information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the issuer.
Although Section 906 is selfimplementing, the SEC has adopted 1934 Act Rules 13a-14(b) and 15d- 14(b) to require that the Section 906 certification (which may be a joint certification of the CEO and CFO) must be provided, and must be furnished as an exhibit to the relevant periodic report. Because the Section 906 certification is not considered "filed" as a technical matter, it would not attract liability under Section 18 of the Exchange Act or be incorporated by reference into the issuer’s subsequent Securities Act registration statements (unless specifically incorporated by the issuer).20 As with the Section 302 certification, the Section 906 certification is not required for current reports on Form 6-K.21
Violations of Section 906
Although the text of the two required certifications overlap, there are some important differences between them. In contrast to the Section 302 certification, the text of the Section 906 certification does not explicitly provide for the officer to certify as to his or her knowledge. The U.S. Department of Justice has, however, confirmed that an officer may qualify a Section 906 certification to his or her knowledge because knowledge would, in any event, be a necessary element of criminal prosecution.23 Furthermore, whereas the Section 302 certification is required for any amendment to an annual report on Form 20-F, the SEC has stated that Form 20-F amendments do not require a new Section 906 certification.24
Section 404—Internal Control Over Financial Reporting
The SEC has accordingly adopted new Rules 13a-15 and 15d-15 under the Exchange Act, and new Item 15 of Form 20-F, and the PCAOB has adopted Auditing Standard No. 2.25
Rules 13a-15 and 15d-15 require a foreign private issuer:
- to maintain internal control over financial reporting;
- to evaluate (with the participation of the CEO and CFO) the effectiveness of internal control as of the end of each fiscal year; and
- to evaluate (with the participation of the CEO and CFO) any change in its internal control that occurred during the fiscal year that has materially affected, or is reasonably likely to materially affect, the issuer’s internal control over financial reporting.
A foreign private issuer must comply with Rules 13a-15 and 15d-15, as they pertain to internal control over financial reporting, for the first fiscal year ending on or after July 15, 2005.26
In addition to the requirements relating to disclosure controls and procedures, new Item 15 of Form 20-F (discussed in more detail below) also requires an annual report from management on internal control, an attestation report of the issuer’s independent auditor and the disclosure of any changes in internal control. A foreign private issuer must comply with these requirements of new Item 15 in connection with its annual report on Form 20-F for the first fiscal year ending on or after July 15, 2005, except with respect to the disclosure of changes in internal control which took effect as of August 14, 2003.
Definition of Internal Control Over Financial Reporting
- pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer;
- provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and
- provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer’s assets that could have a material effect on the financial statements.27
Management’s Annual Assessment of, and Report on, Internal Control—Item 15 of Form 20-F
In an issuer’s annual report on Form 20-F, management must provide a report on the issuer’s internal control over financial reporting that contains, among other things:28
- a statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting;
- a statement identifying the framework used by management to evaluate the effectiveness of the issuer’s internal control over financial reporting;
- management’s assessment of the effectiveness of the issuer’s internal control over financial reporting as of the end of the most recent fiscal year, including a statement as to whether or not the issuer’s internal control over financial reporting is effective. The statement must also include disclosure of any material weakness in the issuer’s internal control over financial reporting identified by management. Management is not permitted to conclude that the issuer’s internal control over financial reporting is effective if there are one or more material weaknesses in internal control;29 and
- a statement that the independent auditor that audited the financial statements included in the annual report has issued an attestation report on management’s assessment of the issuer’s internal control over financial reporting.
In addition, a foreign private issuer must also include:
- an attestation report of the independent auditor on management’s assessment of the issuer’s internal control over financial reporting; and
- disclosure of any change in its internal control over financial reporting that occurred during the fiscal year that has materially affected, or is reasonably likely to materially affect, the issuer’s internal control over financial reporting.30
With the exception of the disclosure of changes in internal control over financial reporting, which took effect as of August 14, 2003, a foreign private issuer need not comply with the above requirements of Item 15 until its annual report on Form 20-F for its first fiscal year ending on or after July 15, 2005.31
Framework for Evaluation
The framework must:34
- be free from bias;
- permit reasonably consistent qualitative and quantitative measures of an issuer’s internal control;
- be sufficiently complete so that those relevant factors that would alter a conclusion about the effectiveness of an issuer’s internal controls are not omitted; and
- be relevant to an evaluation of internal control over financial reporting.
Auditor Independence
Material Weaknesses
Method of Evaluation
- controls over initiating, recording, processing and reconciling account balances, classes of transactions and disclosure and related assertions included in the financial statements;
- controls related to the initiation and processing of non-routine and non-systematic transactions;
- controls related to the selection and application of appropriate accounting policies; and
- controls related to the prevention, identification and detection of fraud.
The SEC has cautioned that inquiry alone generally will not provide an adequate basis for management’s assessment.
Changes in Internal Control
Certain Internal Control Issues
- Equity investees:
Internal Control Audits—Auditing Standard No. 2
46Auditing Standard No. 2 sets out the PCAOB’s rules for the independent auditor’s attestation report on management’s assessment of internal control over financial reporting as required by Section 404, Rules 13a-15 and 15d-15 and Item 15 of Form 20-F. Under Auditing Standard No. 2, the independent auditor’s audit (the PCAOB chose to refer to an "audit" rather than an "attestation")47 takes the form of an auditor’s report which includes two opinions: one on management’s assessment of internal control and another on the effectiveness of internal control over financial reporting. The PCAOB stated that the objective of the audit of internal control over financial reporting is to form an opinion as to whether management’s assessment of the effectiveness of the issuer’s internal control over financial reporting is fairly stated in all material respects.48 The auditor’s conclusion will therefore relate directly to whether the auditor can agree with management that internal control is effective.49 In this connection, the auditor needs to evaluate management’s assessment process (to ensure that management has an appropriate basis for its conclusion) and to test the effectiveness of internal control.50
Significant Deficiencies and Material Weaknesses
Auditing Standard No. 2 provides that a control deficiency should be classified as a "significant deficiency" if, "by itself or in combination with other control deficiencies, it results in more than a remote likelihood of a misstatement of the company’s annual or interim financial statements that is more than inconsequential will not be prevented or detected."53 In addition, a "significant deficiency should be classified as a material weakness if, by itself or in combination with other control deficiencies, it results in more than a remote likelihood that a material misstatement in the company’s annual or interim financial statements will not be prevented or detected."54
Auditing Standard No. 2 mandates that an auditor must communicate in writing to the audit committee all significant deficiencies and material weaknesses of which the auditor is aware.55 In addition, the auditor must communicate to management, in writing, all control deficiencies of which the auditor is aware that have not previously been communicated in writing to management and to notify the audit committee of such a communication.56
Identifying Significant Deficiencies
- ineffective oversight by the audit committee of the issuer’s external financial reporting and internal control. As part of evaluating the control environment, an auditor must assess the effectiveness of the audit committee’s oversight and must communicate to the board of directors if it concludes that oversight is ineffective;
- material misstatement in the financial statements not initially identified by the issuer’s internal control. Failure to detect the misstatement is "a strong indicator that the company’s internal control" is ineffective; and
- significant deficiencies that have been communicated to management and the audit committee, but that remain uncorrected after reasonable periods of time.
Auditor’s Report
An auditor may express an unqualified opinion if it has identified no material weaknesses.60 If the auditor cannot perform all of the necessary procedures, the auditor may either qualify or disclaim an opinion.61 If an overall opinion cannot be expressed, Auditing Standard No. 2 requires the auditor to explain why.62
The auditor’s report may disclose only material weaknesses, although if an aggregation of significant deficiencies constituted a material weakness, then disclosure would be required.63 Auditing Standard No. 2 does not permit a qualified opinion on the effectiveness of internal control in the event of a material weakness; instead, the auditor must express an "adverse opinion."64 The auditor may express an unqualified opinion on management’s assessment (but not on the effectiveness of internal control) so long as management properly identifies the material weakness and concludes that internal control was not effective.65 If, however, the auditor and management disagree about the existence of the material weakness, then the auditor would render an adverse opinion on management’s assessment.66
Non-GAAP Financial Measures
Regulation G
The term non-GAAP financial measure does not include:72
- operating or other financial measures and ratios or statistical measures calculated using exclusively one or both of (1) financial measures calculated in accordance with GAAP and (2) operating measures or other measures that are not non-GAAP financial measures; or
- financial measures required to be disclosed by GAAP, SEC rules or other regulations applicable to the issuer.
Regulation G requires that disclosure of this sort be accompanied by the most directly comparable financial measure calculated in accordance with GAAP, and a reconciliation of the differences between the two.73 In addition, Regulation G prohibits an issuer from making any non-GAAP financial measure public if it contains a material misstatement or omits to include information needed to make the included measure not misleading.74 Regulation G took effect on March 28, 2003.75
A foreign private issuer is exempt from Regulation G if:76
- its securities are listed or quoted outside the United States;
- the non-GAAP financial measure being used is not derived from or based on a measure calculated and presented in accordance with U.S. GAAP; and
- the disclosure is made outside the United States.
Regulation S-K Item 10(e)
Item 10(e) requires that whenever an issuer includes a non-GAAP financial measure in an SEC filing it must also include:78
- a presentation, with equal or greater prominence, of the most directly comparable GAAP financial measure;
- a reconciliation of the differences between the non-GAAP financial measure and the most directly comparable GAAP financial measure;
- a statement why management believes the non-GAAP financial measure provides useful information for investors; and
- to the extent material, a statement of the additional purposes for which management uses the non-GAAP financial measure.
Furthermore, Item 10(e) prohibits in SEC filings, among other things:79
- non-GAAP measures of liquidity that exclude items requiring cash settlement, other than EBIT and EBITDA;
- the adjustment of non-GAAP measures of performance to eliminate or smooth items characterized as non-recurring, unusual or infrequent when the nature of the charge or gain is such that it is reasonably likely to recur within two years or there was a similar charge or gain within the prior two years; and
- the use of titles or descriptions for non-GAAP financial measures that are the same as, or confusingly similar to, titles or descriptions used for GAAP financial measures.
Item 10(e) contains an exemption from these prohibitions for a foreign private issuer if the non-GAAP financial measure relates to the local GAAP used in the issuer’s primary financial statements, is required or expressly permitted by the standard-setter that establishes the local GAAP, and is included in the issuer’s annual report for its home jurisdiction.80
The SEC has cautioned that inclusion of a non-GAAP financial measure may be misleading unless accompanied by disclosure as to:81
- the manner in which management uses the non-GAAP measure to conduct or evaluate its business;
- the economic substance behind management’s decision to use such a measure;
- the material limitations associated with the use of the non-GAAP financial measure as compared to the use of the most directly comparable GAAP financial measure;
- the manner in which management compensates for these limitations when using the non-GAAP financial measure; and
- the substantive reasons why management believes the non-GAAP financial measure provides useful information to investors.
The SEC has also stated that "earnings" as used in EBIT and EBITDA is intended to mean net income as presented in the statement of operations under GAAP, and that measures that are calculated differently should not be characterized as EBIT or EBITDA.82 To the extent EBIT or EBITDA are presented as a performance measure, the term should be reconciled to net income and not operating income.83
Off-Balance Sheet and Other MD&A Disclosure
Off-Balance Sheet Arrangements
- the nature and business purpose of the off-balance sheet arrangements;
- the importance to the issuer of the off-balance sheet arrangements in respect of liquidity, capital resources, market risk support, credit support or other benefits;
- the amount of revenues, expenses and cash flows arising from these arrangements;
- the nature and amounts of any interests retained, securities issued or amounts incurred by the issuer under these arrangements;
- the nature and amounts of any other obligations or liabilities (contingent or otherwise) arising from these arrangements that are reasonably likely to become material and the triggering events that could cause them to arise; and
- any known events or trends that will, or are reasonably likely to, result in the termination or reduction in availability to the issuer of these arrangements and the course of action the issuer proposes to take in response.
An "off-balance sheet arrangement" is defined to include any transaction, agreement or contractual arrangement to which an entity unconsolidated with the issuer is a party under which the issuer has certain obligations or interests.88 Because the definition of "off-balance sheet arrangement" incorporates concepts from U.S. GAAP, foreign private issuers will need to refer to U.S. GAAP for some of the disclosure items.89 However, the MD&A disclosure should focus on the primary financial statements in the document (while taking reconciliation to U.S. GAAP into account).90
Table of Contractual Obligations
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
