First time SOX Compliance: When? 2651
My company is reviewing the possibility to issue shares on the New York Stock Exchange. Once of the requirements is to be SOX Compliant.
But is this the case? Is there an ‘implementation’ period to take into consideration? Do I have time to implement the internal controls as required for SOX?
The different sections of the Sarbanes-Oxley Act have different compliance dates by which your company needs to comply and relate to disclosure in different reports that are filed with the SEC.
Are you a US company or a foreign private issuer (FPI)? US companies also have to file quarterly reports with the SEC (on form 10-Q or form 10-QSB), FPIs do not have to. The assessment of the effectiveness of disclosure controls and procedures (i.e. section 302) will apply with your first quarterly or annual report filed with the SEC. You will only have to include management’s assessment of the effectiveness of internal control over financial reporting and the auditor’s audit of it (section 404) starting with the second annual report that you file with the SEC. In addition non-accelerated filers (i.e. market capitalization below 75 million USD) do not have to have an audit of the effectiveness of internal control over financial reporting yet (only management’s assessment). Keep in mind that your company is required to maintain internal control over financial reporting (a system of internal accounting controls under the old terminology in the Securities Exchange Act) from day one. You need to work out your materiality amount thresholds, make a risk assessment what could go wrong in your financial reporting (due to fraud or errors) and then figure out key controls for the material amount items with reasonably possible risks that something could go wrong. Start with this part early and coordinate it with your registered public accounting firm. The actual assessment of the effectiveness of internal control over reporting should be close to the financial year end of your second annual report since the assessment is as of that date. Otherwise you would need to do roll-forward testing from the time of the assessment until the end of the fiscal year.
Have a look at sec.gov/rules/final/2006/33-8760.pdf
I do not have much time now because I will go out now, but I can provide more advice if you have more questions.
It is a European based Company, which is already listed on the Euronext.
The fact that the company is a European company and that it is already listed on a foreign stock exchange does not make much of a difference.
If your company is listing securities (equity or debt) on a national securities exchange in the US (e.g. the New York Stock exchange). You have to comply with SOX as I described.
The only difference between US companies and foreign (e.g. European companies) is that a foreign company is only required to file annual reports with the SEC (on form 20-F, Canadians on form 40-F) and is not required to formally file quarterly reports. However, if the Euroxnet’s listing rules or local European laws or regulations also require semi-annual, quarterly or ad-hoc reports or if you voluntarily make such reports/news releases to investors, then you also need to furnish this information to the SEC on form 6-K. However the content of those reports or news releases is whatever you do in European and is not defined by US securities law. In addition, financial statements included in reports on form 6-K do not need to have a formal certification by the CEO and CFO (section 302 Sarbanes-Oxley Act). For the annual report on form 20-F, everything that I said in my first posting applies.
If your financial reporting standard is IFRS, you do not need to include a reconciliation from IFRS to US GAAP anymore. However if you use other standards than IFRS or US GAAP, you need to provide a reconciliation to US GAAP.
Also do not forget to check the New York stock exchange’s listig rules. Your corporate governance can follow the laws of your local country and Euronext listing rules with the exception of mandatory rules concerning the need for an audit committee, the independence of the audit committee members and certain minimum responsibilities of the audit committee (no need for a nomination or compensation committee). However, you are required to disclose the difference between your corporate governance rules and the ones that the New York stock exchange and US law would apply to US companies.
Also do not forget which information you need to provide in the registration statement (similar to a securities prospectus) that you need to file with the SEC before you list the securities on the New York stock exchange.
I advise to go to sec.gov/edgar/searchedgar/companysearch.html and to enter the name of a European company from your country that you know in the field company name (e.g. Eurand). If you get multiple results, select the one with SIC (industry code) below it. Then enter 20-F in the filter results box to only get the annual reports on form 20-F. If you want the registration statements instead, enter F-. Look at the registration statements which are not F-6 (e.g. F-1 or F-3). The information in the registration statement is quite similar to the one that you will have to provide in the annual reports on form 20-F later. Eurand is an example of a European company that listed on the NASDAQ not too long ago.
thanks for the detailed explanation. Can you tell me what annual report (let’s say we are listed as of September 1, 2009) will have to include the certification of the external auditor on management’s assessement on the internal controls over the financial reporting. Is the company already supposed to be 100% SOX compliant for his Annual Report of December 31, 2009, or can it wait till December 31, 2010?
As I mentioned in my first posting ‘You will only have to include management’s assessment of the effectiveness of internal control over financial reporting and the auditor’s audit of it (section 404) starting with the second annual report that you file with the SEC.’
If the registration statement for the security that you want to list on the New York stock exchange is declared effective on September 1, 2009 and if the financial year end of your company is December 31 (or some other date after September 1 if it is a non-calendar year financial year), then the annual report for the financial year ending on December 31, 2009 will be the first annual report that you file after your registration with the SEC. Only starting with the SECOND annual report (i.e. the annual report for the financial year ending December 31, 2010) you need to include management’s assessment of the effectiveness of internal control over financial reporting and the auditor’s opinion on the effectiveness of internal control over financial reporting.
However, you need to comply with all other aspects of the Sarbanes-Oxley Act and the other US securities laws and regulations starting with the registration of the securities with the SEC. Examples are having an auditor that is registered with the PCAOB, having an independent audit committee, having internal control over financial reporting, having disclosure controls and procedures, having the CEO and the CFO certify the accuracy of already the first annual report, etc.