Internal Control over Financial Reporting
Internal control over financial reporting (ICFR) is a process designed by, or under the supervision of, a company's principal executive and principal financial officers, and effected by the board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with U.S. GAAP.
The concept of internal control over financial reporting was codified for U.S. public companies primarily through Section 404 of the Sarbanes-Oxley Act of 2002 and the SEC's implementing rules (Rules 13a-15 and 15d-15 under the Securities Exchange Act of 1934). The SEC adopted management's assessment requirements based on the framework developed by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), which provides a widely used conceptual model for evaluating internal control effectiveness.
ICFR encompasses the policies, procedures, and controls that a company uses to ensure that transactions are properly authorized and recorded, that financial statements are prepared in conformity with GAAP, that assets are safeguarded against unauthorized use or disposition, and that errors and irregularities are detected and corrected in a timely manner. Controls are typically organized into entity-level controls (tone at the top, risk assessment, control environment) and process-level controls (specific transaction controls in areas such as revenue, procurement, payroll, and financial reporting).
The COSO Internal Control — Integrated Framework organizes internal control into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. For a company to conclude that its ICFR is effective, all five components must be present and functioning, and no material weaknesses can exist as of the assessment date.
For U.S. accelerated filers and large accelerated filers, Section 404(b) of Sarbanes-Oxley requires not only management's assessment of ICFR effectiveness but also an independent attestation by the registered public accounting firm that audits the company's financial statements. Smaller reporting companies are required to include management's assessment but are exempt from the auditor attestation requirement, a significant difference in the level of external scrutiny applied.
For investors, the effectiveness of a company's ICFR is a leading indicator of financial reporting quality. Companies with ineffective ICFR — evidenced by disclosed material weaknesses — are statistically more likely to restate financial statements, more likely to experience CFO or auditor turnover, and more likely to be subject to SEC enforcement actions. Monitoring ICFR disclosures in annual reports is a fundamental component of assessing reporting risk in a company's financial statements.