On this page:

• Key Components of an ICFR Auditor Attestation
• ICFR Auditor Attestations in 10-K and 10-Q Filings
  • ICFR Disclosures in Form 10-K Filings
  • ICFR Disclosures in Form 10-Q Filings
• Content of the ICFR Attestation Report
• Exemptions for Smaller Companies
• Relevant Regulations
  • Key Sections and Regulations Involving ICFR
• References

An ICFR auditor attestation is an external auditor's independent evaluation of the effectiveness of a company's Internal Control over Financial Reporting (ICFR) as required by SOX Section 404(b). The auditor provides an opinion on whether the company's internal controls are effective, which provides assurance to investors and stakeholders about the reliability of financial reporting. A qualified or adverse opinion on ICFR indicates potential weaknesses that could impact the integrity of financial statements, while an unqualified opinion confirms that controls are effectively implemented.

This process is aimed at enhancing the reliability and transparency of financial reporting and ensuring that adequate controls are in place to prevent and detect material misstatements and fraud.

1. Audit of Management's Assessment

   • The auditor's attestation involves reviewing management's assessment of ICFR, which includes testing whether management has appropriately designed and operated internal controls to ensure the reliability of financial reporting. These controls cover processes for recording transactions, preventing and detecting fraud, making accounting estimates, and disclosing information.
   • The auditor evaluates documentation, interviews management, and assesses whether management's conclusions are reasonable and supported by evidence.

2. Evaluation of Control Design and Operating Effectiveness

   • The auditor assesses both the design and the operating effectiveness of the internal controls:
     • Design Effectiveness: The auditor evaluates whether the internal controls, as designed, are capable of effectively preventing or detecting material misstatements in the financial statements.
     • Operating Effectiveness: The auditor tests the controls in operation to determine whether they have been functioning effectively over the reporting period.

3. Material Weaknesses and Significant Deficiencies

   • During the evaluation, if the auditor identifies any material weaknesses or significant deficiencies in internal controls, they must document these findings:
     • A material weakness is a deficiency (or combination of deficiencies) in ICFR such that there is a reasonable possibility that a material misstatement of the company's financial statements will not be prevented or detected on a timely basis.
     • A significant deficiency is a control deficiency that is less severe than a material weakness but important enough to merit attention by those responsible for oversight.
   • If a material weakness is found, the auditor must issue an adverse opinion, stating that ICFR is not effective.

4. Scope of Testing

   • The auditor's attestation includes specifying the scope of testing:
     • Which internal controls were selected for testing.
     • How much reliance was placed on the work performed by management or internal auditors.
     • The time period over which the internal controls were tested.

5. Types of Auditor Opinions

   • The opinions issued on ICFR are different from the opinions issued on financial statements.
   • Based on the results of the audit, the external auditor issues an opinion on the effectiveness of ICFR:
     • Unqualified (Clean) Opinion: Issued when the auditor concludes that ICFR is effective and provides assurance to stakeholders that the company's financial reporting process is reliable.
     • Adverse Opinion: Issued if a material weakness is identified and not remediated, indicating that ICFR is not effective. It could indicate serious control problems, negatively impacting investor confidence and potentially resulting in regulatory scrutiny or a decline in stock value.
     • Disclaimer of Opinion: If the auditor cannot obtain sufficient audit evidence to provide a conclusion, a disclaimer of opinion is issued.

6. Communication with the Audit Committee

   • The auditor is required to communicate any material weaknesses or significant deficiencies identified during the audit to the company's audit committee and, in some cases, to the board of directors.

7. Reference to Management’s Report

   • The auditor's attestation report typically includes a reference to management’s report on ICFR. Management's report is part of the company's annual report (Form 10-K) and includes their assessment of whether ICFR is effective.
   • The attestation may also comment on the appropriateness and completeness of management's report.

Form 10-K and Form 10-Q filings represent annual and quarterly reports filed by public companies with the Securities and Exchange Commission (SEC). These filings provide detailed information about a company's financial performance, position, and internal controls. In the context of ICFR, these filings include specific disclosures and assessments related to the effectiveness of internal controls.

Form 10-K is the annual report and includes more extensive disclosures related to ICFR than Form 10-Q. Key ICFR-related disclosures included in Form 10-K are:

1. Management’s Report on ICFR:

   • Section 404(a) of SOX requires that management provide an assessment of the effectiveness of the company’s ICFR.
   • Management’s Report must include:
     • A statement of responsibility for establishing and maintaining adequate ICFR.
     • The framework used to evaluate the effectiveness of ICFR (typically the COSO Internal Control - Integrated Framework).
     • Management’s conclusion on whether ICFR is effective as of the end of the fiscal year.

2. Auditor’s Attestation on ICFR (if applicable):

   • Section 404(b) of SOX requires an independent auditor attestation of ICFR for accelerated filers and large accelerated filers.
   • The external auditor’s report provides an opinion on whether the company’s internal controls are effective.
   • The auditor’s attestation is generally included in the same filing as the financial statement audit report.

3. Disclosure of Material Weaknesses:

   • If any material weaknesses in ICFR are identified, management must disclose them in the Form 10-K.
   • A material weakness is a deficiency or combination of deficiencies in internal controls that creates a reasonable possibility of a material misstatement of the company’s financial statements.

4. Changes in ICFR:

   • The company must disclose any changes to its internal controls that occurred during the fiscal year and that have materially affected or are reasonably likely to materially affect ICFR.
   • This disclosure helps provide transparency regarding modifications or improvements made to the internal control framework.

Form 10-Q is a quarterly report that provides updates on the company’s financial performance. ICFR disclosures in Form 10-Q are less extensive than those in Form 10-K, but they serve to keep investors informed of any changes in internal control.

1. Quarterly Evaluation of ICFR:

   • Under Exchange Act Rules 13a-15 and 15d-15, management is required to evaluate the effectiveness of ICFR as of the end of each fiscal quarter.
   • This evaluation is typically conducted by the CEO and CFO and is included in the Form 10-Q.
   • Unlike Form 10-K, there is no requirement for an auditor attestation for ICFR in Form 10-Q.

2. Changes in ICFR:

   • Management must disclose any material changes to ICFR during the most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, ICFR.
   • The purpose of this disclosure is to provide ongoing transparency about any modifications to internal controls during the interim periods.

3. Disclosure Controls and Procedures:

   • In Form 10-Q, the company must also discuss the effectiveness of disclosure controls and procedures.
   • Disclosure controls and procedures ensure that all material information is disclosed in a timely and accurate manner.
   • Management evaluates and provides a conclusion on whether disclosure controls and procedures are effective as of the end of each quarter.

An ICFR auditor attestation report generally includes the following:

1. Title: The report is titled to indicate it is an independent auditor's report.
2. Addressee: The report is addressed to the board of directors or shareholders.
3. Scope Paragraph: Describes the scope of the auditor's work, which includes evaluating the effectiveness of ICFR.
4. Criteria Used: Specifies the criteria used to evaluate ICFR effectiveness, typically COSO (Committee of Sponsoring Organizations of the Treadway Commission) Internal Control - Integrated Framework.
5. Opinion Paragraph: States the auditor’s conclusion regarding whether ICFR is effective:
   • Unqualified Opinion: ICFR is effective.
   • Adverse Opinion: ICFR has material weaknesses and is not effective.
   • Disclaimer: Inability to provide an opinion.
6. Basis for Adverse Opinion (if applicable): If a material weakness is identified, the auditor must include a paragraph explaining the nature of the weakness.
7. Signature: The audit firm signs the report.
8. Date: The date when the audit procedures were completed.

• Smaller Reporting Companies and non-accelerated filers are generally exempt from the auditor attestation requirement under Section 404(b). However, management must still provide their own assessment of ICFR.
• Larger public companies, such as accelerated filers and large accelerated filers, are required to obtain an ICFR attestation from an external auditor.

The requirements for ICFR auditor attestation are mainly contained within the Sarbanes-Oxley Act of 2002 (SOX), specifically Section 404. This section, in conjunction with related SEC rules and provisions in Regulation S-K, outlines the information and requirements surrounding internal controls and the role of both management and auditors. Below are the key sections and regulations that pertain to ICFR and related disclosures:

1. Sarbanes-Oxley Act of 2002 (SOX)

   • Section 404:
     • Section 404(a): Requires management to assess the effectiveness of internal control over financial reporting and include this assessment in the company's annual report.
     • Section 404(b): Requires an independent external auditor to evaluate and attest to the effectiveness of ICFR. This is mandatory for accelerated filers and large accelerated filers.
   • Section 302:
     • This section requires CEO and CFO certifications regarding the accuracy of financial statements and the effectiveness of disclosure controls, which also encompasses internal control procedures.

2. Exchange Act Rules (Securities Exchange Act of 1934)

   • Rule 13a-15 and Rule 15d-15:
     • These rules, adopted by the SEC under the Exchange Act, require companies to establish, maintain, and assess internal controls over financial reporting. These rules outline the obligations of management to evaluate the effectiveness of ICFR as part of their quarterly and annual reports on Form 10-Q and 10-K.
   • Section 13(b)(2)(B) of the Exchange Act:
     • This section requires public companies to maintain internal accounting controls sufficient to provide reasonable assurances regarding the reliability of financial reporting.

3. Regulation S-K (17 CFR Part 229)

   • Item 308 - Internal Control over Financial Reporting:
     • Item 308(a): Requires management to provide an assessment of the effectiveness of ICFR.
     • Item 308(b): Requires disclosure of the attestation report provided by the independent external auditor regarding the effectiveness of ICFR (for accelerated and large accelerated filers).
     • Item 308(c): Requires companies to disclose changes in ICFR that occurred during the most recent fiscal quarter that have materially affected, or are reasonably likely to materially affect, the company's ICFR.

4. Form Requirements for Disclosure

   • Form 10-K (Annual Report):
     • Form 10-K is the primary document where companies disclose information related to ICFR. Under Section 404 of SOX and Item 308 of Regulation S-K, companies must provide:
       • Management's report on the effectiveness of ICFR.
       • Auditor's attestation on ICFR (for companies that are subject to Section 404(b)).
   • Form 10-Q (Quarterly Report):
     • For quarterly reports, companies must disclose material changes to ICFR as required by Rule 13a-15 and Item 308(c) of Regulation S-K.

• SARBANES-OXLEY ACT OF 2002
• 15 U.S.C. 7262 - Management assessment of internal controls
• ICFR FAQ
• Study of SOX, Section 404, ICFR
• SOX for small businesses
• SEC Proposes Additional Disclosures, Prohibitions to Implement Sarbanes-Oxley Act