As security is such a major theme on the Act, many organizations are using the international ISO standards. The ISO 27001 Portal outlines these. A copy of the standards, and security policies, can be obtained via the ISO 17799 Toolkit.
Our server logs indicate some interesting mis-spellings: Sarbannes Oxley, Sorbane Oxley, Sarbanne Oxley, Sarbaines Oxley, Sarbanesoxley, Sorbanes Oxley, Sabanes Oxley, Sarbane Oxley, and Sarbanes Oaxley, to name but a few!
Sarbanes-Oxley Act Forum: Forums
The Sarbanes Oxley Act :: View topic - Excluding an Acquisition from Management's Evaluation
Posted: Thu Nov 03, 2005 11:07 am Post subject: Excluding an Acquisition from Management's Evaluation
I understand that there is an option to exclude a newly acquired business from the control evaluation under 404. Can anyone provide an example of a company that has exercised this option? I am interested in what the management report would look like.
Posted: Thu Nov 10, 2005 4:15 pm Post subject: Acquistions
I've heard the same thing, and I am looking for more information about acquisitions under SOX. I work for a healthcare company that regularly acquires hospitals. It takes some time to get the hospitals under our controls and following our procedures, so I didn't know if anyone had any advice they could share regarding a grace period between the time a company/hospital is acquired and the time it is considered in scope. Any info on acquisitions would be helpful. Thanks!
Joined: Sep 21, 2004 Posts: 149 Location: Northern Europe
Posted: Fri Nov 11, 2005 2:59 am Post subject:
I am not 110% sure, but I think they can give you a postponed deadline for newly acquired businesses before they have to be compliant, but I think they're talking about 1 year, maybe 2 tops. _________________ Sarbanes Oxley Advisor
How should current-year acquisitions
and divestments be treated?
As for current-year acquisitions, the SEC staffís frequently asked questions indicated they would typically expect managementís report on ICOFR to include controls at all consolidated entities. The SEC staff acknowledged that it might not be possible to conduct an assessment of an acquired businessís ICOFR in the period between the transaction consummation date and the date of managementís assessment. In these instances, the SEC staff indicated they would not object to management excluding from its evaluation of ICOFR business acquisitions for a period
not to exceed one year from the date of acquisition. In these instances, the SEC staff indicated that management should refer to (1) a discussion in the registrantís Form 10-K or Form 10-KSB regarding the scope of the
assessment and (2) such disclosure, noting that management excluded the acquired business from managementís report on ICOFR. If such a reference is made, however, management must identify the acquired
business that was excluded and indicate the significance of the acquired business to the companyís consolidated financial statements.
The SEC staff indicated that notwithstanding managementís exclusion of an acquired businessís internal controls from its annual assessment, a company must disclose any material change to its internal control over
financial reporting that is due to the acquisition pursuant to either Exchange Act Rule 13a-15(d) or Exchange Act Rule 15d-15(d). In addition, the period in which management may omit an assessment of an acquired businessís internal control over financial reporting from its assessment of the companyís internal control may not extend beyond one
year from the date of acquisition. Such assessments also may not be omitted from more than one annual management report on internal control over financial reporting. There is currently no guidance from the SEC or PCAOB that specifically addresses how management should treat divestments for the purposes of section 404. However, managementís
assessment of the effectiveness of the companyís ICOFR is ďas of Ē the end of the companyís most recent fiscal year. Therefore, to the extent a company divests part of its operations prior to the end of the most recent
fiscal year, internal controls over financial reporting at the divested peration would be excluded from managementís assessment for purposes of section 404 of Sarbanes-Oxley. If management chooses to exclude a business unit from documentation and testing due to the business unitís planned divestiture, management should be certain that the divestiture will take place prior to the companyís fiscal year-end. Otherwise, the processes and controls for that business unit should be documented, tested, and included in managementís assessment as of the the companyís fiscal year-end.
The FAQs on the SEC website link provided above seem to refer specifically to changes in internal control over financial reporting. The 302 certification also refers to evaulation of disclosure controls and procedures. Do you interpret the SEC quidance to refer to both the evaulation of disclosure controls and procedures and changes in internal control over financial reporting?
Posted: Thu Jul 16, 2009 8:34 am Post subject: What about disclosures in interim (10-Q) statements?
What are the consequences of closing on an acquisition just prior to a quarter end? What disclosure would be required in the 10-Q if there were not enough time to evaluate controls at the new acquisition?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
Trademarks referenced on the SOX Act Forum are property of their respective owners. Comments are property of their respective posters. Sarbanes-Oxley Act Implementation Portal: Sarbanes Oxley compliance, information, software, & internal audit committee resources. Sarbox. Site source is copyright nuke (c)2003, and is Free Software under the GNU / GPL licence agreement. All Rights Are Reserved.