Rule 13a-15 requires the effectiveness of disclosure controls and procedures to be evaluated, and separately requires the effectiveness of internal control over financial reporting to be evaluated. How often must each of those two evaluations be made?

Disclosure controls and procedures at the end of each fiscal quarter and each fiscal year; internal control over financial reporting once in each fiscal year

Disclosure controls and procedures at the end of each fiscal quarter and each fiscal year; internal control over financial reporting at the end of each fiscal quarter as well

Before the Sarbanes-Oxley Act, what did a public company already owe in respect of its internal controls, and what did Rule 13a-15 add to that?

Control duties applied and management already assessed effectiveness each year, but that assessment went to the board and the auditor rather than being disclosed to investors

No control obligation of a general kind applied to public companies, so the rule created both the duty to operate control systems and the duty to evaluate how well they worked

Books-and-records and internal accounting control duties already applied; what the rule added was a specific annual management assessment of control effectiveness, disclosed publicly

Control duties applied and an annual assessment was already required, but only of a company whose auditor had reported a control breakdown in the preceding fiscal year

A registrant must describe a material legal proceeding in its Exchange Act reports, but the information never reaches the officers who prepare them, and its financial statements are accurate in every respect. Which of the two frameworks Rule 13a-15 requires has broken down?

Disclosure controls and procedures, which reach the whole process of gathering and reporting information that has to appear in Exchange Act filings, financial or otherwise

Internal control over financial reporting, since a proceeding material enough to require description would have had to be provided for in the statements once it was identified

Neither of them, both frameworks addressing the reliability of financial reporting and leaving non-financial disclosure to the judgement of the officers who sign the report

Both of them equally, each framework covering every item of information that a registrant is required to disclose in the reports it files under the Exchange Act

A company registers a class of equity securities under Section 12 part way through a fiscal year and has not yet had to file an annual report for any earlier year. What does Rule 13a-15(a) require of it?

Both frameworks must be maintained from the date of registration, the rule drawing no distinction between them and treating a registrant's first year of reporting in exactly the same way as it treats any later one

Disclosure controls and procedures must be maintained from the outset, while the duty to maintain internal control over financial reporting waits until an annual report has been due for the preceding fiscal year

Neither framework need be maintained until the company has actually filed its first annual report, both of the maintenance duties running from the date of that filing rather than from the registration itself

Internal control over financial reporting must be maintained at once because financial statements are prepared from the first day, while the duty to maintain disclosure controls waits for the first annual report

Management replaces the system that produces the company's revenue figures. No misstatement has occurred and no effect on internal control over financial reporting can yet be observed. How does Rule 13a-15(d)'s standard for changes apply to it?

The change is caught only where it was made to remedy a control deficiency that management had already identified and recorded as a material weakness in its own evaluation

The change falls outside the standard until an effect on internal control over financial reporting can be identified, the assessment resting on what the change has in fact done

The change is caught, because the standard reaches one that is reasonably likely to affect internal control over financial reporting materially as well as one that already has

The change falls outside the standard unless the financial statements of the period are themselves materially affected, a change being measured by its effect on those statements

A company's data centre access and change-management controls govern the infrastructure on which its accounting systems run, but they are not financial controls in themselves. How does Rule 13a-15(f)'s definition of internal control over financial reporting treat them?

They fall inside that definition for a period in which the infrastructure was changed, and outside it in any period in which the infrastructure operated without change

They fall inside that definition, which reaches every control over a system whose output is used in preparing the financial statements for external purposes under GAAP

They fall outside that definition but inside the definition of disclosure controls and procedures, which takes in every control bearing on the systems that generate the information a registrant reports

They fall outside that definition, which excludes technology general controls at the infrastructure level even where the systems concerned are used in financial reporting

A smaller reporting company files annual reports under the Exchange Act and has never engaged its auditor to report on its internal control over financial reporting. Its finance director asks whether the company owes any internal-controls reporting obligation at all. What is the position?

Management must still evaluate internal control over financial reporting and disclose its conclusion; what the company is permanently relieved of is the independent auditor's attestation on that assessment

Nothing is owed, because the relief given to companies of that size covers the internal-controls reporting framework as a whole, including the assessment management would otherwise make

The auditor's attestation is owed after all, the relief for companies of that size having been a temporary measure that was extended repeatedly and was then allowed to lapse

The controls must be maintained but nothing need be evaluated or disclosed, the reporting obligation attaching only to a company that must also obtain an auditor's attestation

The presence or absence of an independent auditor's attestation on management's internal control assessment is treated as one of the most commercially significant distinctions drawn between filer categories. What makes that distinction so significant?

It settles whether the issuer's own financial statements have to be audited at all, and an audit of those statements is the largest single component of the cost of reporting for an issuer of any size whatever

It moves the cost of Exchange Act reporting materially, so it bears on whether an issuer stays public, lists on an exchange, or keeps the filer status that carries the requirement

It settles whether identified control weaknesses go to the Commission or only to the issuer's own audit committee, and the difference between those two routes is what drives the practical burden of the requirement

It reflects the different litigation exposure of the two groups of issuers, an attestation moving responsibility for the assessment away from the issuer's own officers and onto the accounting firm that gives it

An officer's certification attests to the design, maintenance and evaluation of the company's disclosure controls and of its internal control over financial reporting. Where do those two terms take their content from, and what follows for a certification that turns out to be false?

From the auditing standard that governs the attestation on management's assessment, so a false certification is measured against what the auditor's own testing procedures established

From the certifying officers' own description of the systems in the report, so a false certification is tested against the account of those systems that the company itself gave

From Rule 13a-15's own definitions, so a false certification necessarily misstates the condition of the very frameworks that rule defines and requires the issuer to maintain

From the accounting framework used to prepare the financial statements, so a false certification is measured by whether those statements in fact complied with that framework

Management completes its evaluation of internal control over financial reporting and the annual report states only its conclusion that the controls were effective, with nothing further. Why does that fall short of the annual internal-control reporting obligation?

Because a conclusion on effectiveness has to be accompanied by a remediation plan for every control deficiency identified during the evaluation, whatever the severity of the deficiency

Because a conclusion on effectiveness may be given only in a statement signed personally by the principal executive and financial officers, an unsigned statement of it carrying no effect

Because the conclusion has to be expressed as of the date the annual report is filed rather than any earlier date, so a bare conclusion is read as covering the wrong period entirely

Because that obligation is set by Rule 13a-15 together with Regulation S-K Item 308, which calls for the scope of the evaluation and the criteria used as well as the conclusion reached

In May 2013 the Commission issued a statement about the COSO 2013 Internal Control — Integrated Framework and the evaluation required by Rule 13a-15(c). What did that statement do for an issuer conducting the evaluation?

It confirmed the framework as a suitable basis for the evaluation, leaving an issuer free to evaluate its controls against other suitable criteria instead

It made the framework the required basis for the evaluation, so an issuer evaluating its controls against any other criteria no longer satisfies the rule

It withdrew the earlier version of the framework from use, requiring each issuer to perform its most recent evaluation again on the updated framework

It confirmed the framework as suitable for the auditor's attestation work, leaving management's own evaluation to be made on criteria the rule prescribes

The COSO 2013 Internal Control — Integrated Framework is the structure within which the Rule 13a-15(c) evaluation is commonly carried out, its seventeen principles being grouped under five components. What are those components?

Control environment, fraud risk assessment, segregation of duties, management review, and internal audit

Governance, risk appetite, control design, control testing, and remediation of identified deficiencies

Tone at the top, entity-level controls, process-level controls, technology controls, and external reporting

In Commission enforcement, how does an issuer's failure to maintain adequate disclosure controls and procedures typically come to light?

Through the auditor's report on the issuer's controls, which the staff compares each year with management's own conclusion in order to identify disagreements between them

Through the issuer's own description of the failure in its periodic reports, which the staff then reviews before deciding whether to open an investigation into the issuer

During a wider fraud or financial misstatement investigation, where the breakdown in those controls had allowed the underlying misconduct to go undetected and unreported

Through a routine inspection programme under which the staff tests a sample of registrants' disclosure controls and publishes the deficiencies that the testing identifies

A company's management reports that its internal control over financial reporting was effective for the year, although it knew of a material weakness when the report was published. Who is exposed to Commission action over that published conclusion?

Neither of them, provided the weakness had been reported to the audit committee and to the auditor, the published conclusion then resting on an informed exercise of judgement

The issuer but not the officers, whose own exposure arises where they also sold securities of the company before the weakness concerned had been disclosed to investors

The officers but not the issuer, whose exposure is confined to the restatement of the affected reports and to the remedial undertakings that the Commission requires of it

Both the issuer and the certifying officers, the Commission having brought reporting and antifraud actions against each of them over false conclusions of this kind

SEC Rule 13a-15 | Disclosure Controls & ICFR | Financial Regulation Courses

SEC Rule 13a-15: Disclosure Controls and Internal Control Over Financial Reporting

SEC Rule 13a-15, codified at 17 C.F.R. § 240.13a-15 under the Securities Exchange Act of 1934, requires every Section 12 registrant to establish and maintain disclosure controls and procedures and internal control over financial reporting, to evaluate the effectiveness of disclosure controls and procedures as of the end of each fiscal quarter and fiscal year, to evaluate annually the effectiveness of internal control over financial reporting, and to assess and disclose any changes in internal control over financial reporting that occurred during each quarterly period that have materially affected or are reasonably likely to materially affect the company's financial reporting integrity.

The rule is the operational foundation of the Sarbanes-Oxley Act's Section 404 internal controls framework — giving regulatory form to the congressional mandate that public company management take direct and documented responsibility for the systems through which material financial and non-financial information is gathered, assessed, and disclosed. Rule 13a-15 operates alongside Rule 13a-14's certification requirements as the two-part architecture of Sarbanes-Oxley's corporate governance accountability mechanism: Rule 13a-14 requires personal officer certification of disclosure quality, and Rule 13a-15 requires the systemic controls infrastructure that makes those certifications meaningful rather than merely symbolic.

Overview and Regulatory Purpose

Before Sarbanes-Oxley, no Exchange Act rule required public companies to establish and evaluate specific systems of disclosure controls, nor to report annually on the effectiveness of their internal controls over financial reporting. Companies were required to maintain books and records under Section 13(b) and to implement internal accounting controls under the Foreign Corrupt Practices Act, but these requirements were not linked to a specific, publicly disclosed annual management assessment.

The consequence — as the wave of financial fraud at Enron, WorldCom, and others demonstrated — was that management could certify the accuracy of financial statements while operating in an environment where fundamental control breakdowns had allowed those statements to be prepared on a fraudulent basis, and where no formal process existed to identify and disclose those breakdowns to investors or the board.

Rule 13a-15 addresses this gap by requiring two distinct but related governance structures. Disclosure controls and procedures are the policies and processes through which information required to be disclosed in Exchange Act filings is identified, captured, processed, and reported accurately and on a timely basis — encompassing the information flows that feed into every component of the annual and quarterly reports.

Internal control over financial reporting is the more narrowly defined but more intensively evaluated framework of policies and procedures designed to provide reasonable assurance that transactions are properly authorised and recorded, assets are safeguarded, and financial statements are prepared in accordance with GAAP.

Together these two frameworks constitute the systemic governance infrastructure for which management accepts formal documented responsibility under Rule 13a-15 and certifies personal responsibility under Rule 13a-14.

Statutory Authority and Rulemaking History

Rule 13a-15 derives its statutory authority from Sections 13(a) and 23(a) of the Securities Exchange Act of 1934, as amplified by Sections 302 and 404 of the Sarbanes-Oxley Act of 2002. Section 302 directed the Commission to adopt rules requiring certifying officers to take responsibility for disclosure controls and procedures — the direct statutory mandate for Rule 13a-15(b)'s quarterly evaluation requirement. Section 404(a) required the Commission to adopt rules requiring each annual report to contain a management report on the effectiveness of internal control over financial reporting — the direct mandate for Rule 13a-15(c)'s annual ICFR assessment. Section 404(b) required the Commission to adopt rules requiring that the auditor attest to and report on management's ICFR assessment — the statutory basis for the auditor attestation requirement that applies to large accelerated and accelerated filers.

The Commission adopted Rule 13a-15 on June 5, 2003 — Securities Exchange Act Release No. 34-47986, published at 68 FR 36636, June 18, 2003 — implementing the Section 302 and 404 mandates simultaneously. The rule was subsequently amended on January 7, 2005 — 70 FR 1621 — to make technical corrections, on December 21, 2006 — 71 FR 76596 — to align the ICFR evaluation standard with the Commission's June 2007 interpretive guidance on management's evaluation process, and for the last time on June 27, 2007 — 72 FR 35321 — in connection with the adoption of the interpretive guidance itself. The Commission has not amended Rule 13a-15 since June 2007, and no pending rulemaking proposes changes to the rule's substantive framework through June 2026.

Key Provisions and Operative Requirements

Rule 13a-15(a) establishes the maintenance obligation. Every Section 12 registrant — other than asset-backed issuers, small business investment companies registered on Form N-5, and unit investment trusts — must maintain disclosure controls and procedures and, if the issuer has been required to file an annual report for the prior fiscal year, internal control over financial reporting. The maintenance obligation is continuous — not limited to evaluation periods — and reflects the Commission's determination that the controls frameworks must be operational throughout the year rather than assembled for evaluation purposes at period-end.

Rule 13a-15(e) defines disclosure controls and procedures as controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Exchange Act is recorded, processed, summarised, and reported, within the time periods specified in the Commission's rules and forms.

The definition specifically includes, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports it files or submits under the Exchange Act is accumulated and communicated to the issuer's management, including its principal executive and financial officers, as appropriate to allow timely decisions regarding required disclosure. Disclosure controls and procedures therefore encompass a broader category of information management than ICFR alone — they address the complete information gathering and reporting process for all Exchange Act disclosures, including non-financial information such as legal proceedings, risk factors, executive compensation, and cybersecurity disclosures, as well as financial information.

Rule 13a-15(b) requires quarterly evaluation of disclosure controls and procedures. The principal executive and financial officers must evaluate the effectiveness of the disclosure controls and procedures within 90 days prior to the filing date of each annual and quarterly report, and must present their conclusions about the effectiveness of those controls in the report. The 90-day evaluation window — rather than a specific evaluation date — was designed to give management meaningful time to gather and assess the evidence needed to reach a responsible conclusion about the effectiveness of controls across the company's operations without requiring an artificial single-date snapshot.

Rule 13a-15(c) requires annual evaluation of internal control over financial reporting. Management must evaluate, using suitable control criteria, the effectiveness of the issuer's internal control over financial reporting as of the end of each fiscal year.

The evaluation must be documented and must result in a written management report — the Section 404(a) report — included in the annual Form 10-K and covering the scope of the evaluation, the framework used to evaluate ICFR, management's conclusions about ICFR effectiveness as of fiscal year-end, and, where applicable, any identified material weaknesses in ICFR that prevented management from concluding that ICFR was effective. The Commission has confirmed through its June 2007 interpretive guidance that a top-down, risk-based approach is one compliant methodology for satisfying Rule 13a-15(c)'s evaluation requirement, without mandating that approach to the exclusion of other reasonable evaluation frameworks.

Rule 13a-15(f) defines internal control over financial reporting as a process designed by, or under the supervision of, the issuer's principal executive and financial officers, and effected by the issuer's board of directors, management, and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP.

The definition specifies that ICFR includes policies and procedures that: pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer; provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with GAAP, and that receipts and expenditures are being made only in accordance with authorisations of management and directors; and provide reasonable assurance regarding prevention or timely detection of unauthorised acquisition, use, or disposition of the issuer's assets that could have a material effect on the financial statements.

The definition specifically excludes information and communications technology general controls at the data centre or infrastructure level that relate to systems used in financial reporting but are not themselves financial controls.

Rule 13a-15(d) requires evaluation of changes in ICFR. Management must evaluate whether any change in the issuer's ICFR occurred during each fiscal quarter — including the fourth fiscal quarter in the case of an annual report — that has materially affected, or is reasonably likely to materially affect, the issuer's ICFR. This quarterly change assessment — disclosed in both Form 10-Q Part II and the Form 10-K — ensures that significant control modifications, remediations, or deteriorations are communicated to investors as they occur rather than only in the context of the annual ICFR effectiveness assessment.

Scope of Application

Rule 13a-15 applies to all Section 12 registrants with the three specific exclusions noted in Rule 13a-15(a). The Section 404(b) auditor attestation requirement — which requires large accelerated and accelerated filers to include in their Form 10-K an attestation report from their independent registered public accounting firm on management's ICFR assessment — applies only to those two filer categories. Non-accelerated filers and smaller reporting companies are permanently exempt from the auditor attestation requirement following the permanent exemption enacted by Section 989G of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, which eliminated the prior temporary exemptions that had been repeatedly extended since Sarbanes-Oxley's adoption.

The Section 404(b) exemption for non-accelerated filers and smaller reporting companies represents one of the most commercially significant filer category distinctions in the Exchange Act reporting framework — the presence or absence of the auditor attestation requirement materially affects the cost of Exchange Act reporting and is a central consideration in issuers' decisions about whether to remain public, list on a national securities exchange, or maintain accelerated filer status. The Dodd-Frank permanent exemption has been sustained without subsequent legislative modification, reflecting Congress's determination that the Section 404(b) cost burden on smaller reporting companies exceeded the investor protection benefit for that population of issuers.

Rule 13a-15's definitions of disclosure controls and procedures and ICFR are the operative terms referenced in the Section 302 certifications required by Rule 13a-14(a). The fourth paragraph of the Section 302 certification — attestation to the design, maintenance, and evaluation of both disclosure controls and ICFR — draws directly on Rule 13a-15(e)'s and (f)'s definitions, making the two rules operationally inseparable. An officer who certifies the adequacy of disclosure controls and ICFR under Rule 13a-14(a) is certifying to the frameworks defined in Rule 13a-15, and a false certification necessarily involves a false representation about the state of those frameworks.

Rule 13a-15's ICFR evaluation requirement interacts with Regulation S-K Item 308, which specifies the content of management's annual ICFR report included in the Form 10-K. Item 308(a) requires management's assessment of ICFR effectiveness, disclosure of the control evaluation framework used, and identification of any material weaknesses. Item 308(b) requires inclusion of the auditor's attestation report for large accelerated and accelerated filers. Together Rule 13a-15 and Regulation S-K Item 308 define the complete ICFR reporting obligation for annual reports.

The PCAOB's Auditing Standard 2201 — the standard governing the auditor's attestation on management's ICFR assessment required by Section 404(b) — directly governs the independent assessment that large accelerated and accelerated filers must obtain and include in their Form 10-K alongside management's own assessment. The auditor's Section 404(b) attestation is not a repetition of management's assessment but an independent evaluation conducted using the auditor's own testing procedures, capable of reaching independent conclusions about ICFR effectiveness — including identifying material weaknesses that management's evaluation failed to identify.

Amendment History and Regulatory Evolution

Rule 13a-15's substantive framework has been stable since its June 2007 amendment, which aligned the rule with the Commission's interpretive guidance on the top-down, risk-based evaluation methodology. The most significant post-adoption development was the Dodd-Frank Act's 2010 permanent exemption of non-accelerated filers and smaller reporting companies from the Section 404(b) auditor attestation requirement, which restructured the practical landscape of ICFR compliance without amending Rule 13a-15's operative text.

The evolution of the ICFR evaluation landscape since 2007 has been driven primarily by the PCAOB's audit standard development and the adoption of the COSO 2013 Internal Control — Integrated Framework — the updated version of the original 1992 COSO framework that was the predominant ICFR evaluation tool at the time of Sarbanes-Oxley's adoption.

The Commission issued a statement in May 2013 confirming that the COSO 2013 framework is a suitable framework for evaluating ICFR under Rule 13a-15(c), and the transition from the 1992 to the 2013 framework was substantially complete across reporting companies by the fiscal years ending December 31, 2014. The COSO 2013 framework's seventeen principles — organised across the five components of control environment, risk assessment, control activities, information and communication, and monitoring — provide the practical structure within which most companies conduct their Rule 13a-15(c) evaluation.

Enforcement Context and SEC Action Patterns

Rule 13a-15 enforcement arises in two primary categories. The first involves the failure to maintain adequate disclosure controls and procedures — typically identified in connection with a broader fraud or financial misstatement investigation where the breakdown in disclosure controls enabled the underlying misconduct to go undetected and unreported.

The Commission has brought actions against issuers for failing to design and maintain disclosure controls capable of capturing material information — including cybersecurity incidents, related party transactions, and executive compensation arrangements — that was required to be disclosed in Exchange Act filings but was not identified through the disclosure controls process.

The second enforcement category involves material weaknesses in ICFR that were not disclosed in the annual management report, or that were disclosed in a manner that understated their severity or scope. The Commission's enforcement programme has identified cases where management's ICFR assessment concluded that controls were effective despite known material weaknesses, and has brought Section 13(a) and Section 10(b) actions against issuers and certifying officers for false ICFR effectiveness conclusions disclosed in Form 10-K.

The PCAOB's inspection programme has identified systemic deficiencies in auditors' Section 404(b) attestation work, with recurring inspection findings addressing inadequate testing of management review controls, insufficient attention to information technology general controls, and overreliance on management's own assessment without independent auditor verification. These inspection findings have driven progressive improvements in auditors' ICFR attestation methodology and have contributed to a gradual tightening of the substantive standards applied to both management and auditor ICFR assessments.

Examination Relevance and Key Takeaways

Rule 13a-15 is examined at the Series 7 and Series 65 levels in the context of the Sarbanes-Oxley governance framework and the distinction between the two controls frameworks — disclosure controls and procedures and internal control over financial reporting. The practical distinction between the two — disclosure controls covering all information required to be disclosed in Exchange Act filings, ICFR covering specifically the financial reporting process — is a consistently examined concept.

The Section 404(a) management assessment applicable to all registrants and the Section 404(b) auditor attestation applicable only to large accelerated and accelerated filers is among the most significant filer category distinctions examined in the context of reporting company governance obligations.

The transition obligation — requiring a QII or Passive Investor to convert from Schedule 13G to Schedule 13D within five business days of determining that it holds or has acquired securities with the purpose or effect of changing or influencing control — is a practically significant examination concept that reflects the boundary between passive institutional investment and active corporate governance engagement.

The key points to retain are these. Rule 13a-15 requires all Section 12 registrants to maintain disclosure controls and procedures — covering the complete information gathering and reporting process for Exchange Act disclosures — and internal control over financial reporting — covering specifically the reliability of financial statement preparation.

Management must evaluate disclosure controls and procedures quarterly within 90 days of each filing, and must annually evaluate ICFR effectiveness and disclose its conclusions in the Form 10-K. Management must assess and disclose any material changes in ICFR each quarter.

Large accelerated and accelerated filers must include an independent auditor attestation on management's ICFR assessment under Section 404(b); non-accelerated filers and smaller reporting companies are permanently exempt from the auditor attestation requirement.

The COSO 2013 Internal Control — Integrated Framework is the predominant evaluation framework used to satisfy the Rule 13a-15(c) annual assessment. The definitions of disclosure controls and procedures in Rule 13a-15(e) and ICFR in Rule 13a-15(f) are the operative terms referenced in the Section 302 certification required by Rule 13a-14(a), making the two rules operationally interdependent.