: The Sarbanes-Oxley Act : Internal Control Related Requirements

Section 404 of the Sarbanes-Oxley Act of 2002 requires public companies to include in their annual reports, "an internal control report which shall (1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting."

Section 404 also requires "each registered public accounting firm that prepares or issues the audit report for the issuer to attest to and report on the assessment made by the management of the issuer".

This page is dedicated to the implementation of Section 404 of the Act, including the related rules and standards issued by the U.S. Securities Exchange Commission (SEC) and the Public Companies Accounting Oversight Board (PCAOB).

SEC and PCAOB Guidance and Rules on Section 404

Summaries of Section 404 Related Laws and Rules

Surveys, Perspectives, Resources for Implementing the Requirements

COSO Resources on Internal Controls

Related “FEI Committee Comment Letters”