As directed by section 404 of Sarbanes-Oxley, the SEC adopted a rule requiring registered companies to include in their annual reports a report of management on the company’s internal control over financial reporting. The internal control report must include
- a statement of management’s responsibility for establishing and maintaining adequate internal controls;
- a management assessment of the effectiveness of the company’s internal controls including disclosure of any material weaknesses;
- a statement identifying the framework used by management to evaluate the effectiveness of internal controls;
- a statement that the independent auditors have issued an attestation report on management’s assessment of the company’s internal controls over financial reporting. In addition, companies must provide disclosure about off-balance-sheet transactions in registration statements, annual reports, and proxy statements.