Section 404 of the Sarbanes-Oxley Act (SOX) required the SEC to adopt rules for companies to file an annual internal control report. That report must contain statements from management regarding the effectiveness of the company's internal control over financial reporting. Additionally, the company's auditor must attest to management's assertions in the internal control report.

The SEC gave many companies a reprieve by allowing them more time to comply with Section 404. No longer is there too much work to be done in an unrealistic timeframe. The SEC released its final rules in June 2003 regarding Section 404, making time an asset rather than a liability. This issue of The Bulletin addresses these final rules and what they mean.