International Journal of Disclosure and Governance Volume 2 Number 1 The US Sarbanes–Oxley Act of 2002: Summary and update for non-US issuers Alexander F. Cohen* and D. Jamal Qaimmaqami Received: 26th October, 2004 *Latham & Watkins, 99 Bishopsgate, London EC2M 3XF, UK; Tel: +44(0) 7710 1014; E-mail: [email protected] Alexander F. Cohen is a partner in the London time, the US Securities and Exchange office of Latham & Watkins. Latham & Watkins Commission (SEC) has issued a host of rules operates as a limited liability partnership world- under the Act. wide with affiliates in the UK and Italy, where the Many companies have found it difficult practice is conducted through an affiliated multi- enough coping with the mass of new national partnership. regulations and requirements that the Act has spawned. But the largest challenge lies D. Jamal Qaimmaqami is an associate in the London office of Latham & Watkins. ahead — namely, the implementation of the internal control provisions of Sarbanes– ABSTRACT Oxley. For foreign private issuers (a term KEYWORDS: US Sarbanes–Oxley Act of that covers most non-US issuers, other than 2002, audit committees, foreign private governments), those provisions take full issuers, internal control effect for fiscal years ending on or after 15th July, 2005. This paper summarises the key aspects of the US This paper will summarise the internal Sarbanes–Oxley Act of 2002 (‘the Act’), as it control rules that will take effect in 2005. It applies to foreign private issuers. The authors focus will also outline the other key portions of first on internal control and lay out the requirements Sarbanes–Oxley relevant to foreign private of Section 404 of the Act as well as the Public issuers, as they apply today. Company Accounting Oversight Board’s Auditing Standard No. 2 (governing internal control audits). BACKGROUND The paper also highlights the provisions of the Act covering central topics such as chief executive and chief Who is subject to Sarbanes–Oxley? financial officer certification, non-GAAP financial The Sarbanes–Oxley Act applies to all measures, off-balance sheet and other MD&A dis- issuers — including foreign private issuers closure, standards relating to listed company audit — that: committees, auditor independence rules, attorney conduct and liability. + have registered securities under the 1934 Act; INTRODUCTION + are required to file reports under Section On 30th July, 2002, President Bush signed 15(d) of the 1934 Act; or the US Sarbanes–Oxley Act of 2002 (here- + have filed a registration statement under International Journal of Disclosure and Governance, inafter ‘the Act’, ‘Sarbanes–Oxley’ or ‘the the 1933 Act that has not yet become Vol. 2, No. 1, 2005, pp. 81–106 1 Henry Stewart Publications, Sarbanes–Oxley Act’) into law. Since that effective. 1741–3591 Page 81 The US Sarbanes–Oxley Act of 2002: Summary and update for non-US issuers This means, for example, that any foreign the independence requirements appli- private issuer that has listed its securities in cable to audit committee members. In the United States, or issued securities to the addition, foreign private issuers may have public in the United States whether or not a statutory board of auditors or statutory it is listed (such as in a registered exchange auditors established pursuant to home offer for high-yield bonds) is subject to the country law or listing requirements. Sarbanes–Oxley Act. A foreign private issuer that has not sold securities to the KEY PROVISIONS OF SARBANES– public in the United States, or that is OXLEY AND RELATED SEC exempt from Exchange Act registration by RULEMAKING virtue of Exchange Act Rule 12g3-2(b) is not subject to the requirements of the Section 404: Internal control over Sarbanes–Oxley Act. Accordingly, when the financial reporting authors refer below to ‘issuers’ and ‘foreign Section 404 of Sarbanes–Oxley directs the private issuers’ they mean those companies SEC to issue rules requiring an issuer’s that are subject to Sarbanes–Oxley. annual report to contain an internal control report (1) stating management’s responsi- Exceptions for the benefit of foreign bility for establishing and maintaining an private issuers adequate internal control structure and The Sarbanes–Oxley Act does not generally procedures for financial reporting and (2) distinguish between domestic US and for- containing an assessment, as of the end of eign private issuers. In its implementing the issuer’s most recent fiscal year, of the rules, however, the SEC has made a effectiveness of the issuer’s internal control number of exceptions for the benefit of structure and procedures for financial foreign private issuers. These include: reporting. In addition, Section 404 requires an issuer’s independent auditor to attest to, + Internal control implementation date. As and report on, management’s assessment, in noted above, the internal control provi- accordance with standards adopted by the sions of the Act do not take full effect US Public Company Accounting Oversight for foreign private issuers until fiscal Board (PCAOB). (Section 404 provides, years ending on or after 15th July, 2005. however, that the attestation cannot be a By contrast, domestic US issuers that are separate engagement of the auditor.) ‘accelerated filers’ must comply for fiscal The SEC has accordingly adopted new years ending on or after 15th November, Rules 13a-15 and 15d-15 under the 2004. Exchange Act, and new Item 15 of Form + Quarterly certifications. Unlike domestic 20-F, and the PCAOB has adopted Audit- US issuers, foreign private issuers are not ing Standard No. 2.2 required to provide Section 302 or 906 Rules 13a-15 and 15d-15 require a for- certification on a quarterly basis. eign private issuer: + Non-GAAP financial measures. Foreign private issuers that are listed outside the + to maintain internal control over finan- United States are exempt in certain cases cial reporting;3 from the restrictions on the use of + to evaluate (with the participation of the non-GAAP financial measures provided chief executive officer (CEO) and chief by Regulation G. financial officer (CFO)) the effectiveness + Audit committee independence. Foreign pri- of internal control as of the end of each vate issuers have certain exemptions from fiscal year;4 and Page 82 Cohen and Qaimmaqami + to evaluate (with the participation of authorised acquisition, use or disposition the CEO and CFO) any change in its of the issuer’s assets that could have a internal control that occurred during the material effect on the financial state- fiscal year that has materially affected, or ments.7 is reasonably likely to materially affect, the issuer’s internal control over financial Management’s annual assessment of, reporting.5 and report on, internal control: Item 15 of Form 20-F A foreign private issuer must comply with In an issuer’s annual report on Form 20-F, the above rules in connection with its management must provide a report on the annual report on Form 20-F for the first issuer’s internal control over financial report- fiscal year ending on or after 15th July, ing that contains, among other things:8 2005.6 + a statement of management’s responsi- Definition of internal control over bility for establishing and maintaining financial reporting adequate internal control over financial For the purposes of Rules 13a-15 and 15d- reporting; 15, and Item 15 of Form 20-F (as well as + a statement identifying the framework the Section 302 certification discussed used by management to evaluate the below), ‘internal control over financial effectiveness of the issuer’s internal con- reporting’ is defined as a process designed trol over financial reporting; by, or under the supervision of, the issuer’s + management’s assessment of the effec- CEO and CFO, and effected by the issuer’s tiveness of the issuer’s internal control board of directors, management and other over financial reporting as of the end of personnel, to provide reasonable assurance the most recent fiscal year, including a regarding the reliability of financial report- statement as to whether or not the ing and the preparation of financial state- issuer’s internal control over financial ments for external purposes in accordance reporting is effective. The statement with generally accepted accounting princi- must also include disclosure of any ples. The term includes those policies and material weakness in the issuer’s internal procedures that: control over financial reporting identified by management. Management is not + pertain to the maintenance of records permitted to conclude that the issuer’s that in reasonable detail accurately and internal control over financial reporting is fairly reflect the transactions and dispo- effective if there are one or more material sitions of the assets of the issuer; weaknesses in internal control;9 and + provide reasonable assurance that trans- + a statement that the independent auditor actions are recorded as necessary to per- that audited the financial statements mit preparation of financial statements included in the annual report has issued in accordance with generally accepted an attestation report on management’s accounting principles, and that receipts assessment of the issuer’s internal control and expenditures of the issuer are being over financial reporting (the independent made only in accordance with authori- auditor’s attestation report must also be sations of management and directors of provided in the annual report). the issuer; and + provide reasonable assurance regarding In addition, a foreign private issuer must prevention or timely detection of un- also include: Page 83 The US Sarbanes–Oxley Act of 2002: Summary and update for non-US issuers + an attestation report of the independent + be relevant to an evaluation of internal auditor on management’s assessment of control over financial reporting. the issuer’s internal control over financial reporting; and Auditor independence15 + disclosure of any change in its internal Although management may coordinate its control that occurred during the fiscal evaluation of internal controls with that ff year that has materially a ected, or is of its auditors, it cannot compromise the ff reasonably likely to materially a ect, the auditors’ independence.