302 Certification 2419



  • I am struggling with trying to determine the amount of interim testing we should do to support our 302 certification. Historically we’ve been focused on testing for 404 only and now that we’ve got a couple of years behind us, I’d like to minimize the testing as much as possible. Our current test plan basically calls for quarterly testing of all key controls regardless of frequency, so we’re going to basically be testing all controls for the entire year, which, assuming there are no deficiencies, is overkill for 404, but I don’t want to not have proper support for management’s 302 certifications.
    Can others give me some ideas as to what they’re doing for interim testing and to support the 302?



  • Disclosure controls and procedures’ are defined as controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports filed or submitted by it under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in its Exchange Act reports is accumulated and communicated to the issuer’s management, including its principal executive and financial officers, as appropriate to allow timely decisions regarding required disclosure.’
    So the scope of disclosure controls, encompasses all disclosures, not just financial reporting information, in the periodic reports (10-K, 10-Q, etc.) or other reports (8-K, 6-K, etc.) filed or furnished to the SEC.
    A lot of issuers do do quartely tests of the effectiveness of internal control over financial reporting with the same intensity as for the annual 404 assessment. Just having upward cascading self-assessments by mangagement with self-sub-certifications by management is also an establshed practice. But I do recommend to test the controls aground the non-financial information sometimes (not necessarily every quarter). You will be amazed how many foreign private issuers do not even fully know the SEC’s rules and regulations and provide incomplete disclosure. The results of a review of the disclosure of your issuer by SEC staff can be seen in EDGAR on the SEC’s website. If you already have instances in the past, where stuff was missing, it is an indicator that your DCP are not effective.



  • We do not perform quarterly tests of controls. We primarily rely on our annual testing and representations from process owners as to the ongoing effectiveness of controls and identification of process changes and changed/new controls.



  • Thanks for the replies.
    We have a very active Disclosure Committee which primarily consists of upper management across the company, so the non-financial as well as the financial disclosures are getting looked at closely. So, I’m thinking we can add self-assessments/sub-certifications to the mix and be fine for 302. That’s great news.
    We will definitely continue to do quarterly testing, but I do want to scale back from doing every process, every quarter. kymike, by not doing quarterly testing, how do you remediate when you find an deficiency?



  • kymike, by not doing quarterly testing, how do you remediate when you find an deficiency?
    We test after Q2 and then again at year end. We hope that deficiencies noted at Q2 will be remediated by the end of the year. If not, then they carry over. We will always have some deficiencies, but lately, they have all been pretty minor.


Log in to reply