IPO Center › Public Company Readiness
United States · Public Company
Public Company Readiness
Before a company lists, it must stand up the operating machine that public-company reporting assumes already exists: disclosure controls and procedures and internal control over financial reporting under Exchange Act Rule 13a-15, the officer certifications that Sarbanes-Oxley Sections 302 and 906 and the rules implementing them require, management's annual internal-control assessment under Section 404(a), a quarterly close and disclosure function able to produce certified reports, and an audit committee that meets Rule 10A-3. The SEC's rules phase several of these in — the first annual report after an IPO carries an express transition, and the auditor's Section 404(b) attestation turns on an accelerated-filer status a company cannot hold at its first annual report — which fixes the order in which the rules require each piece to be in place.
Each section answers one question, with every fact mapped to a named primary authority and linked for verification.
What does a company have to stand up before it lists, and which parts of it are legally required?
Exchange Act Rule 13a-15(a) requires every issuer with a class of securities registered under Section 12 of the Exchange Act — other than an asset-backed issuer, a small business investment company registered on Form N-5, and a unit investment trust as defined in Section 4(2) of the Investment Company Act of 1940 — to maintain disclosure controls and procedures, and, if the issuer either had been required to file an annual report under Section 13(a) or 15(d) for the prior fiscal year or had filed an annual report with the Commission for the prior fiscal year, internal control over financial reporting. Sarbanes-Oxley Section 302 directs the Commission to require the principal executive and principal financial officers to certify each annual and quarterly report, and Section 404(a) directs the Commission to require each annual report to contain an internal control report by management.
Rule 13a-14(a) carries the certification requirement into the reports themselves: each report filed on Form 10-Q, Form 10-K, Form 20-F or Form 40-F under Section 13(a), other than a report filed by an asset-backed issuer, must include certifications in the form specified in the applicable exhibit filing requirements, filed as an exhibit, and each principal executive and principal financial officer at the time of filing must sign one. Rule 15d-15(a) imposes the same controls obligations on an issuer that files reports under Section 15(d). The obligations are not all simultaneous: disclosure controls and procedures attach with reporting status, while the internal-control-over-financial-reporting obligation in Rule 13a-15(a) is conditioned on a prior fiscal year of annual reporting. The reporting obligations themselves — which reports are triggered, by what, and when they are due — are covered on the Becoming a Reporting Company page; the board-independence and audit-committee composition rules are covered on the Governance and Controls page; the readiness domains addressed before the registration statement is filed are covered on the IPO Preparedness page. This page addresses the control, certification, close and disclosure machinery a company builds to be capable of meeting those obligations.
What are "disclosure controls and procedures," and when does the obligation to have them attach?
Rule 13a-15(e) defines disclosure controls and procedures as controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports it files or submits under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Commission's rules and forms. The obligation to maintain them attaches under Rule 13a-15(a) to every issuer with a class of securities registered under Section 12 — other than the asset-backed issuers, Form N-5 small business investment companies and unit investment trusts the rule excepts — with no prior-fiscal-year condition and no transition period, unlike the internal-control-over-financial-reporting obligation in the same paragraph.
The definition adds that disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports it files or submits under the Act is accumulated and communicated to the issuer's management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Rule 13a-15(b) requires each issuer's management to evaluate, with the participation of the principal executive and principal financial officers or persons performing similar functions, the effectiveness of the issuer's disclosure controls and procedures as of the end of each fiscal quarter, except that the evaluation is performed as of the end of each fiscal year in the case of a foreign private issuer and, in the case of an investment company registered under Section 8 of the Investment Company Act of 1940, within the 90-day period prior to the filing date of each report requiring certification under Rule 30a-2. Rule 15d-15(a) and (e) apply the same requirement and the same definition to every issuer that files reports under Section 15(d). Rule 13a-15(a) excludes an Asset-Backed Issuer as defined in Item 1101 of Regulation AB, a small business investment company registered on Form N-5, and a unit investment trust as defined in Section 4(2) of the Investment Company Act of 1940.
Source: 17 CFR 240.13a-15(a), (b), and (e); 17 CFR 240.15d-15 (eCFR) ↗
How do the SEC's rules define internal control over financial reporting (ICFR)?
Rule 13a-15(f) defines internal control over financial reporting as a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.
The rule specifies that ICFR includes those policies and procedures that: (1) pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer's assets that could have a material effect on the financial statements. Rule 15d-15(f) carries the identical definition for Section 15(d) filers. The definition is the standard against which management's annual assessment under Item 308(a) of Regulation S-K is made.
Source: 17 CFR 240.13a-15(f) (eCFR) ↗
When does the ICFR obligation first attach to a newly public company, and what goes in the first annual report?
Rule 13a-15(a) conditions the ICFR obligation on the issuer having either been required to file an annual report under Section 13(a) or 15(d) for the prior fiscal year or having filed an annual report with the Commission for the prior fiscal year. Instruction 1 to Item 308 of Regulation S-K states that a registrant need not comply with paragraphs (a) and (b) of that Item — management's annual ICFR report and the auditor's attestation report — until that same condition is met, and requires a registrant that does not comply to include a statement to that effect in its first annual report.
Instruction 1 to Item 308 prescribes the statement in substantially the following form: "This annual report does not include a report of management's assessment regarding internal control over financial reporting or an attestation report of the company's registered public accounting firm due to a transition period established by rules of the Securities and Exchange Commission for newly public companies." The same prior-fiscal-year condition appears in Rule 13a-15(c), which requires management's annual evaluation of ICFR effectiveness, and in Rule 13a-15(d), which requires the quarterly evaluation of changes in ICFR. Rule 13a-15(a)'s disclosure-controls-and-procedures obligation carries no such condition. The practical consequence set by the rule text is a sequence: disclosure controls and procedures and the Section 302 certification apply from the first periodic report filed after the offering, while management's first ICFR assessment falls in the annual report for the first fiscal year at whose end the issuer had already filed, or had been required to file, an annual report for the prior fiscal year — in the ordinary case, the second annual report it files.
Source: 17 CFR 229.308 (Item 308), Instruction 1; 17 CFR 240.13a-15(a) and (c) (eCFR) ↗
What does the Sarbanes-Oxley Section 302 certification require the CEO and CFO to say?
Section 302(a) of the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7241) directs the Commission to require, for each company filing periodic reports under Section 13(a) or 15(d) of the Exchange Act, that the principal executive officer or officers and the principal financial officer or officers, or persons performing similar functions, certify in each annual or quarterly report that the signing officer has reviewed the report; that based on the officer's knowledge the report does not contain any untrue statement of a material fact or omit to state a material fact necessary to make the statements made not misleading; and that based on the officer's knowledge the financial statements and other financial information included in the report fairly present in all material respects the financial condition and results of operations of the issuer.
Section 302(a)(4) further requires certification that the signing officers are responsible for establishing and maintaining internal controls, have designed them to ensure that material information relating to the issuer and its consolidated subsidiaries is made known to the officers by others within those entities, have evaluated their effectiveness, and have presented in the report their conclusions about that effectiveness. Section 302(a)(5) requires the signing officers to certify that they have disclosed to the issuer's auditors and the audit committee of the board of directors, or persons fulfilling the equivalent function, all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer's ability to record, process, summarize and report financial data; that they have identified for the issuer's auditors any material weaknesses in internal controls; and that they have disclosed any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's internal controls. Section 302(b) provides that nothing in the section shall be interpreted or applied in any way to allow any issuer to lessen the legal force of the statement required under the section by having reincorporated, or having engaged in any other transaction that resulted in the transfer of the issuer's corporate domicile or offices from inside the United States to outside of the United States. Rule 13a-14(a) implements the section: each report filed on Form 10-Q, Form 10-K, Form 20-F or Form 40-F under Section 13(a), other than a report filed by an asset-backed issuer, must include certifications in the form specified in the applicable exhibit filing requirements, filed as an exhibit, and each principal executive and principal financial officer at the time of filing must sign one. Rule 13a-14(c) provides that a person required to certify may not have the certification signed on his or her behalf under a power of attorney or other form of confirming authority. Rule 13a-14(a) also carves out the internal-control language for a newly public company: the principal executive and principal financial officers may omit the portion of the introductory language in paragraph 4, as well as the language in paragraph 4(b), of the certification that refers to the certifying officers' responsibility for designing, establishing and maintaining internal control over financial reporting for the issuer, until the issuer becomes subject to the ICFR requirements in Rule 13a-15 or Rule 15d-15 — tracking the same prior-fiscal-year condition. The remainder of the certification, including the disclosure-controls-and-procedures representations, applies from the first periodic report filed after the offering.
What is the separate Section 906 certification, and how does it differ from the Section 302 certification?
18 U.S.C. 1350, added by Section 906(a) of the Sarbanes-Oxley Act of 2002, requires that each periodic report containing financial statements filed by an issuer with the SEC under Section 13(a) or 15(d) of the Exchange Act be accompanied by a written statement by the chief executive officer and chief financial officer (or equivalent) certifying that the periodic report fully complies with the requirements of Section 13(a) or 15(d) and that information contained in the periodic report fairly presents, in all material respects, the financial condition and results of operations of the issuer.
18 U.S.C. 1350(c) sets criminal penalties: a person who certifies a statement as set forth in subsections (a) and (b) knowing that the periodic report accompanying the statement does not comport with all the requirements set forth in the section shall be fined not more than $1,000,000 or imprisoned not more than 10 years, or both; a person who willfully certifies such a statement with that knowledge shall be fined not more than $5,000,000 or imprisoned not more than 20 years, or both. The provision was added by Public Law 107-204, title IX, Section 906(a), July 30, 2002, 116 Stat. 806. Rule 13a-14(b) requires the Section 1350 certifications to be furnished as an exhibit to each periodic report containing financial statements, and permits the requirement to be satisfied by a single certification signed by the issuer's principal executive and principal financial officers. Two differences from the Section 302 certification are set by the rule text: the Section 302 certification is filed as an exhibit and is required in each annual and quarterly report, while the Section 1350 statement is furnished and accompanies each periodic report containing financial statements; and the Section 302 certification has no prior-year carve-out other than the paragraph 4 ICFR language addressed in Rule 13a-14(a).
What must management's annual internal control report contain under Section 404(a)?
Section 404(a) of the Sarbanes-Oxley Act (15 U.S.C. 7262) directs the Commission to prescribe rules requiring each annual report required by Section 13(a) or 15(d) of the Exchange Act to contain an internal control report stating the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting, and containing an assessment, as of the end of the issuer's most recent fiscal year, of the effectiveness of that internal control structure and procedures. Item 308(a) of Regulation S-K implements it and specifies four contents.
Item 308(a) requires a report of management on the registrant's ICFR containing: (1) a statement of management's responsibility for establishing and maintaining adequate ICFR for the registrant; (2) a statement identifying the framework used by management to evaluate the effectiveness of ICFR as required by Rule 13a-15(c) or 15d-15(c); (3) management's assessment of the effectiveness of ICFR as of the end of the registrant's most recent fiscal year, including a statement as to whether or not ICFR is effective, and including disclosure of any material weakness identified by management; and (4) if the registrant is an accelerated filer or a large accelerated filer, or otherwise includes an attestation report in its annual report, a statement that the registered public accounting firm that audited the financial statements has issued an attestation report on the registrant's ICFR. Item 308(a)(3) states that management is not permitted to conclude that ICFR is effective if there are one or more material weaknesses. Instruction 2 to Item 308 requires the registrant to maintain evidential matter, including documentation, to provide reasonable support for management's assessment. Form 10-K Item 9A, Controls and Procedures, requires the information required by Items 307 and 308 of Regulation S-K.
When does the auditor's Section 404(b) attestation on internal control apply — and when does it not?
Item 308(b) of Regulation S-K requires the registered public accounting firm's attestation report on ICFR only if the registrant is an accelerated filer or a large accelerated filer as defined in Rule 12b-2, and is not an emerging growth company as defined in Securities Act Rule 405 or Exchange Act Rule 12b-2. Sarbanes-Oxley Section 404(b) itself excludes an issuer that is an emerging growth company, and Section 404(c) provides that subsection (b) shall not apply with respect to any audit report prepared for an issuer that is neither a "large accelerated filer" nor an "accelerated filer" as those terms are defined in Rule 12b-2.
Rule 12b-2 defines an accelerated filer as an issuer after it first meets four conditions as of the end of its fiscal year: an aggregate worldwide market value of voting and non-voting common equity held by its non-affiliates of $75 million or more but less than $700 million as of the last business day of its most recently completed second fiscal quarter; having been subject to the requirements of Section 13(a) or 15(d) for a period of at least twelve calendar months; having filed at least one annual report under Section 13(a) or 15(d); and not being eligible to use the requirements for smaller reporting companies under the applicable revenue test. A large accelerated filer meets the same conditions with a float of $700 million or more. The twelve-calendar-month and one-annual-report conditions are what place the attestation outside a newly public company's first annual report. Rule 12b-2 separately defines an emerging growth company as an issuer that had total annual gross revenues of less than $1,235,000,000 during its most recently completed fiscal year, and provides that an issuer that is an emerging growth company as of the first day of a fiscal year continues to be deemed one until the earliest of four events; the full filer-category and emerging-growth-company definitions, and the reporting deadlines that turn on them, are covered on the Becoming a Reporting Company page. Section 404(b) also provides that an attestation must be made in accordance with standards for attestation engagements issued or adopted by the Public Company Accounting Oversight Board, and shall not be the subject of a separate engagement; the PCAOB publishes its integrated-audit standard as AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements — a third-party standard, cited here and not reproduced. Separately, Instruction 1 to Item 308 relieves a registrant from paragraphs (a) and (b) of the Item for its first annual report, on the same prior-fiscal-year condition described above.
What control framework must management use, and does the SEC prescribe how the evaluation is run?
Rule 13a-15(c) requires that the framework on which management's evaluation of ICFR is based be a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment. The rule adds that although there are many different ways to conduct an evaluation, an evaluation conducted in accordance with the interpretive guidance issued by the Commission in Release No. 34-55929 will satisfy the evaluation required by the paragraph.
Release Nos. 33-8810; 34-55929; FR-77, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934, is an interpretive release effective June 27, 2007 and published at 17 CFR Part 241. It states that the guidance sets forth an approach by which management can conduct a top-down, risk-based evaluation of ICFR, and that it is organized around two broad principles, the first being that management should evaluate whether it has implemented controls that adequately address the risk that a material misstatement of the financial statements would not be prevented or detected in a timely manner. The release states that the guidance does not require management to identify every control in a process or document the business processes impacting ICFR. On frameworks, the release states that in the Adopting Release the Commission specified characteristics of a suitable control framework and identified the Internal Control—Integrated Framework (1992) created by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) as an example of a suitable framework, and cited the Canadian Institute of Chartered Accountants' Guidance on Assessing Control and the Turnbull Report as examples of other suitable frameworks issuers could choose. Framework documents published by COSO and the other bodies named are third-party works and are cited here rather than reproduced. Item 308(a)(2) requires management's report to identify the framework used.
What quarterly rhythm do the control rules impose on the financial close?
Rule 13a-15(b) requires management to evaluate the effectiveness of the issuer's disclosure controls and procedures, with the participation of the principal executive and principal financial officers, as of the end of each fiscal quarter — as of the end of each fiscal year in the case of a foreign private issuer. For an issuer that has passed the prior-fiscal-year threshold in Rule 13a-15(a), Rule 13a-15(d) requires management to evaluate, with the same participation, any change in the issuer's internal control over financial reporting that occurred during each of the issuer's fiscal quarters that has materially affected, or is reasonably likely to materially affect, ICFR, and Rule 13a-15(c) requires the evaluation of ICFR effectiveness as of the end of each fiscal year.
The reports carry the output of those evaluations. Item 307 of Regulation S-K requires disclosure of the conclusions of the registrant's principal executive and principal financial officers regarding the effectiveness of disclosure controls and procedures as of the end of the period covered by the report, based on the evaluation required by Rule 13a-15(b) or 15d-15(b). Item 308(c) requires disclosure of any change in ICFR identified in connection with the Rule 13a-15(d) or 15d-15(d) evaluation that occurred during the registrant's last fiscal quarter — the fourth fiscal quarter in the case of an annual report — that has materially affected, or is reasonably likely to materially affect, ICFR. Form 10-Q Item 4, Controls and Procedures, requires the information required by Item 307 and Item 308(c); Form 10-K Item 9A requires the information required by Items 307 and 308. Because the certifications under Rule 13a-14 must be signed by the principal executive and principal financial officers at the time of filing, the evaluation, the disclosure and the certification all sit inside the same close cycle. The filing deadlines those cycles must meet are set by filer category in the general instructions to Forms 10-K and 10-Q and are covered on the Becoming a Reporting Company page.
What is a disclosure committee, and does the SEC require one?
In Release Nos. 33-8124; 34-46427; IC-25722, Certification of Disclosure in Companies' Quarterly and Annual Reports, effective August 29, 2002, the Commission stated that it was not requiring any particular procedures for conducting the required review and evaluation, and that it expects each issuer to develop a process that is consistent with its business and internal management and supervisory practices. In the same discussion the Commission stated: "We do recommend, however, that, if it has not already done so, an issuer create a committee with responsibility for considering the materiality of information and determining disclosure obligations on a timely basis." The committee is recommended, not required.
The release adds that, as is implicit in Section 302(a)(4) of the Sarbanes-Oxley Act, such a committee would report to senior management, including the principal executive and financial officers, who bear express responsibility for designing, establishing, maintaining, reviewing and evaluating the issuer's disclosure controls and procedures. The release is the adopting release for the Section 302 certification rules and for the rules requiring issuers to maintain, and regularly evaluate the effectiveness of, disclosure controls and procedures designed to ensure that the information required in reports filed under the Exchange Act is recorded, processed, summarized and reported on a timely basis. SEC releases are U.S. Government works.
How quickly must a newly listed company's audit committee become fully independent?
Rule 10A-3(b)(1)(iv)(A) sets a transition for an issuer listing securities pursuant to a registration statement under Section 12, or an issuer with a Securities Act registration statement covering an initial public offering of securities to be listed, where in each case the listed issuer was not, immediately prior to the effective date of that registration statement, required to file reports under Section 13(a) or 15(d): all but one of the members of the audit committee may be exempt from the Rule 10A-3(b)(1)(ii) independence requirements for 90 days from the date of effectiveness of the registration statement, and a minority of the members may be exempt from those requirements for one year from the date of effectiveness.
The two exemption windows run from the effective date of the registration statement, and the rule's own structure fixes the readiness timetable: because all but one of the members may be exempt for 90 days, at least one member must meet the Rule 10A-3(b)(1)(ii) independence requirements from the date of effectiveness; because only a minority may be exempt for one year, all but a minority must meet them once the 90 days run; and every member must meet them once the year runs. Rule 10A-3(b)(1)(ii) provides that, to be considered independent, a member of the audit committee of a listed issuer that is not an investment company may not, other than in his or her capacity as a member of the audit committee, the board of directors, or any other board committee, accept directly or indirectly any consulting, advisory or other compensatory fee from the issuer or any subsidiary, or be an affiliated person of the issuer or any subsidiary. The substance of the audit-committee composition and responsibility rules is covered on the Governance and Controls page. Rule 10A-3 operates through the listing standards of the national securities exchanges; exchange rulebook text is not reproduced here.
What must the disclosure and investor-relations function be ready for on the first day of reporting status?
Regulation FD applies from the moment the company has a class of securities registered under Section 12 of the Exchange Act or is required to file reports under Section 15(d). Rule 100(a) provides that whenever an issuer, or any person acting on its behalf, discloses any material nonpublic information regarding that issuer or its securities to a person described in Rule 100(b)(1) — brokers or dealers and their associated persons; investment advisers, institutional investment managers that filed a Form 13F for the most recent quarter ended prior to the disclosure, and their associated persons; investment companies and their affiliated persons; and holders of the issuer's securities under circumstances in which it is reasonably foreseeable that the holder will purchase or sell the issuer's securities on the basis of the information — the issuer shall make public disclosure of that information simultaneously in the case of an intentional disclosure, and promptly in the case of a non-intentional disclosure.
Rule 101(b) defines the issuers subject to the regulation as those with a class of securities registered under Section 12 or required to file reports under Section 15(d), including closed-end investment companies but not other investment companies, foreign governments or foreign private issuers as defined in Securities Act Rule 405. Rule 101(c) defines "person acting on behalf of an issuer" as any senior official of the issuer, or any other officer, employee or agent who regularly communicates with the securities market professionals described in Rule 100(b)(1)(i), (ii) or (iii), or with holders of the issuer's securities; Rule 101(f) defines "senior official" as any director, executive officer as defined in Rule 3b-7, investor relations or public relations officer, or other person with similar functions. Rule 101(d) defines "promptly" as as soon as reasonably practicable, but in no event after the later of 24 hours or the commencement of the next day's trading on the New York Stock Exchange, after a senior official learns of a non-intentional disclosure of information the official knows, or is reckless in not knowing, is both material and nonpublic. Rule 101(e) provides that public disclosure is made by furnishing to or filing with the Commission a Form 8-K disclosing the information, unless the issuer instead disseminates it through another method or combination of methods reasonably designed to provide broad, non-exclusionary distribution of the information to the public. Rule 100(b)(2)(iii) sets out an exclusion for disclosures made in connection with certain registered securities offerings by specified means; communications during the offering itself are covered on the Waiting-Period Communications and Research Quiet Periods pages.
What has to be standing before the first report, and when does each piece attach?
The elements of the public-company operating machine, what each is, and the point at which the SEC's rules require it. Each row is sourced to the governing statute, eCFR rule or SEC release; U.S. statutes, SEC rules and SEC releases are U.S. Government works in the public domain (17 U.S.C. 105).
| Element | What it is | When the rules require it | Authority |
|---|---|---|---|
| Disclosure controls and procedures | Controls designed to ensure Exchange Act report information is recorded, processed, summarized and reported within the time periods specified in the Commission's rules and forms, and is accumulated and communicated to management to allow timely decisions regarding required disclosure | On registration of the class under Section 12, or on becoming a Section 15(d) filer — no prior-fiscal-year condition and no transition; the rule excepts asset-backed issuers, Form N-5 small business investment companies and unit investment trusts | 17 CFR 240.13a-15(a), (e); 240.15d-15(a), (e) · source |
| Internal control over financial reporting | A process to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP | Only if the issuer had been required to file an annual report under Section 13(a) or 15(d) for the prior fiscal year, or had filed an annual report with the Commission for the prior fiscal year | 17 CFR 240.13a-15(a), (c), (f) · source |
| Section 302 certification | Certification by each principal executive and principal financial officer, signed personally and filed as an exhibit to each Form 10-K and Form 10-Q | With each annual and quarterly report; the paragraph 4 introductory language and paragraph 4(b) referring to ICFR responsibility may be omitted until the issuer becomes subject to Rule 13a-15 or 15d-15 ICFR requirements | SOX §302 (15 U.S.C. 7241); 17 CFR 240.13a-14(a), (c) · source |
| Section 906 certification | Written statement by the CEO and CFO that the report fully complies with Section 13(a) or 15(d) and that the information fairly presents, in all material respects, the financial condition and results of operations — furnished as an exhibit | With each periodic report containing financial statements; may be satisfied by a single certification signed by both officers | 18 U.S.C. 1350; 17 CFR 240.13a-14(b) · source |
| Management's annual ICFR report | Management's statement of responsibility, identification of the framework used, and assessment of ICFR effectiveness as of fiscal year-end, including disclosure of any material weakness | Not required until the registrant had been required to file, or had filed, an annual report for the prior fiscal year; the first annual report instead carries the Instruction 1 transition statement | SOX §404(a) (15 U.S.C. 7262); 17 CFR 229.308(a) and Instruction 1 · source |
| Auditor attestation on ICFR | The registered public accounting firm's attestation report on the registrant's ICFR, made in accordance with PCAOB attestation standards and not the subject of a separate engagement | Only if the registrant is an accelerated filer or large accelerated filer under Rule 12b-2 and is not an emerging growth company; those filer definitions require at least twelve calendar months subject to Section 13(a) or 15(d) and at least one annual report already filed | SOX §404(b), (c); 17 CFR 229.308(b); 240.12b-2 · source |
| Control framework | A suitable, recognized control framework established by a body or group that has followed due-process procedures, including broad distribution for public comment; the framework used must be identified in management's report | By the first fiscal year-end for which management must evaluate ICFR effectiveness; an evaluation conducted per Release No. 34-55929 satisfies the rule | 17 CFR 240.13a-15(c); 229.308(a)(2); Release Nos. 33-8810; 34-55929 · source |
| Disclosure committee | A committee with responsibility for considering the materiality of information and determining disclosure obligations on a timely basis, reporting to senior management including the principal executive and financial officers | Recommended by the Commission, not required; the Commission requires no particular procedures and expects each issuer to develop a process consistent with its business and internal management and supervisory practices | SEC Release Nos. 33-8124; 34-46427; IC-25722 · source |
| Independent audit committee | The audit committee of a listed issuer, subject to the independence requirements of Rule 10A-3(b)(1)(ii) | All but one member may be exempt from the independence requirements for 90 days from the registration statement's effective date; a minority of members may be exempt for one year from that date | 17 CFR 240.10A-3(b)(1)(iv)(A) · source |
| Regulation FD disclosure process | The process by which material nonpublic information disclosed to covered market professionals or holders is made public — by Form 8-K or another method reasonably designed to provide broad, non-exclusionary distribution | Once the issuer has a class registered under Section 12 or is required to file reports under Section 15(d); simultaneous public disclosure for intentional selective disclosure, prompt disclosure for non-intentional | 17 CFR 243.100; 243.101(b), (d), (e) · source |
Key terms, defined
- Disclosure controls and procedures
- Controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports it files or submits under the Exchange Act is recorded, processed, summarized and reported within the time periods specified in the Commission's rules and forms, including, without limitation, controls and procedures designed to ensure that such information is accumulated and communicated to the issuer's management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. ↗
- Internal control over financial reporting (ICFR)
- A process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles, including the record-keeping, transaction-recording and asset-safeguarding policies and procedures specified in the rule. ↗
- Material weakness
- A deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the registrant's annual or interim financial statements will not be prevented or detected on a timely basis. Under Item 308(a)(3) of Regulation S-K, management is not permitted to conclude that internal control over financial reporting is effective if there are one or more material weaknesses. ↗
- Significant deficiency
- A deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant's financial reporting. Section 302(a)(5)(A) of the Sarbanes-Oxley Act requires the signing officers to certify that they have disclosed to the issuer's auditors and the audit committee all significant deficiencies in the design or operation of internal controls which could adversely affect the issuer's ability to record, process, summarize and report financial data. ↗
- Section 302 certification
- The certification the principal executive and principal financial officers, or persons performing similar functions, must sign and file as an exhibit to each annual and quarterly report, covering their review of the report, the absence of material misstatements or omissions, fair presentation of the financial information, their responsibility for and evaluation of controls, and their disclosures to the auditors and audit committee. It may not be signed on an officer's behalf under a power of attorney or other form of confirming authority. ↗
- Section 906 certification
- The written statement by the chief executive officer and chief financial officer, or equivalent, that must accompany each periodic report containing financial statements filed with the SEC under Section 13(a) or 15(d), certifying that the report fully complies with those sections and that the information contained in it fairly presents, in all material respects, the financial condition and results of operations of the issuer. Knowing certification of a non-complying report carries a fine of not more than $1,000,000 or imprisonment of not more than 10 years, or both; willful certification carries not more than $5,000,000 or 20 years, or both. ↗
- Management's annual report on internal control over financial reporting
- The report required in an annual report by Item 308(a) of Regulation S-K, containing a statement of management's responsibility for establishing and maintaining adequate ICFR, a statement identifying the framework used to evaluate ICFR effectiveness, management's assessment of ICFR effectiveness as of the end of the most recent fiscal year including disclosure of any material weakness, and, where applicable, a statement that the registrant's registered public accounting firm has issued an attestation report on ICFR. ↗
- Attestation report on internal control over financial reporting
- The registered public accounting firm's report attesting to and reporting on management's ICFR assessment, required by Item 308(b) of Regulation S-K only where the registrant is an accelerated filer or large accelerated filer under Rule 12b-2 and is not an emerging growth company. Sarbanes-Oxley Section 404(b) requires such an attestation to be made in accordance with standards for attestation engagements issued or adopted by the Public Company Accounting Oversight Board, and provides that it shall not be the subject of a separate engagement. ↗
- Suitable, recognized control framework
- The basis Rule 13a-15(c) requires for management's evaluation of ICFR: a framework established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment. The rule provides that an evaluation conducted in accordance with the Commission's interpretive guidance in Release No. 34-55929 will satisfy the evaluation requirement, and Item 308(a)(2) requires management's report to identify the framework used. ↗
- Disclosure committee
- A committee with responsibility for considering the materiality of information and determining disclosure obligations on a timely basis, which the Commission recommended — but did not require — that issuers create in the release adopting the Section 302 certification and disclosure-controls rules. The Commission stated that such a committee would report to senior management, including the principal executive and financial officers, who bear express responsibility for designing, establishing, maintaining, reviewing and evaluating the issuer's disclosure controls and procedures. ↗
Cite this page
1BusinessWorld IPO Center, "Public Company Readiness." Compiled from U.S. Government primary sources — the Sarbanes-Oxley Act of 2002 (Sections 302, 404, and 906), 18 U.S.C. 1350, SEC Rules 10A-3, 12b-2, 13a-14, 13a-15, and 15d-15, Items 307 and 308 of Regulation S-K, Regulation FD (17 CFR 243.100 and 243.101), SEC Forms 10-K and 10-Q, and SEC Release Nos. 33-8124 and 33-8810 — each linked inline. Retrieved 2026-07-16.
The IPO Center is informational only. It is provided by 1BusinessWorld strictly for general informational and educational purposes. Nothing in the IPO Center constitutes, or should be construed as, legal, accounting, auditing, underwriting, tax, investment, financial, valuation, listing, or other professional advice, or a recommendation, endorsement, solicitation, or offer to buy or sell any security or to engage in any transaction. 1BusinessWorld is not a law firm, accounting firm, auditor, broker-dealer, underwriter, investment adviser, or securities exchange, and nothing in the IPO Center creates any advisory, fiduciary, attorney-client, or other professional relationship with 1BusinessWorld. Although the IPO Center references official materials published by regulators, exchanges, and other authorities, 1BusinessWorld makes no representation or warranty, express or implied, as to the accuracy, completeness, timeliness, or fitness for any purpose of any content, and, to the fullest extent permitted by law, disclaims all liability for any loss or damage of any kind arising directly or indirectly from the use of, or reliance on, any information presented. Securities laws, regulations, listing standards, and market practices change frequently and differ by jurisdiction; readers must verify all information against the current official text and consult qualified legal, accounting, underwriting, tax, investor-relations, and other professional advisors before acting. Any decision relating to an initial public offering or any securities transaction is made solely at the reader's own risk. Last reviewed: July 16, 2026.
