The Sarbanes-Oxley Act of 2002 addresses perceived weaknesses in internal controls, the systems a public company employs to collect, process, and disclose financial information to satisfy its statutory reporting requirements. Recent corporate and accounting frauds have demonstrated the inadequacy of internal controls with regard to revenue recognition. The act also contains requirements aimed at ensuring proper revenue recognition.
The new auditing requirements for internal controls states that auditors must test the scope of a company’s internal control procedures and present its findings in its annual audit report. This audit report must include an evaluation of whether the internal controls provide both a system of maintaining records that fairly and accurately reflect the company’s transactions, and a reasonable assurance that transactions are recorded in accordance with the preparation of GAAP financial statements. The audit report must also contain a description of any material weaknesses in the internal controls and any material noncompliance.
The Act requires the CEO and CFO to certify, in each annual and quarterly report issued by the company, as to a number of subjects, including internal controls. They must certify that they are responsible for establishing and maintaining internal controls; have designed the internal controls to enable them to obtain all financial material; have evaluated the effectiveness of the internal controls; and have presented their conclusions about the effectiveness of the internal controls in the report. The CEO and CFO must also certify that they have disclosed to the company’s auditors and the audit committee of the board of directors all significant deficiencies in the internal controls that could adversely affect the company’s ability to maintain and report financial data, and have identified for the auditors any