It's time to revisit the basics of the most important section of the Sarbanes Oxley Act. This is my attempt to explain the main requirements of Section 404 from the point of view of a layman. For those who came in late Section 404 of the Sarbanes Oxley Act has laid down two main requirements for issuers / companies required to comply with the provisions of the SOX Act:

- To include a report that contains management's assertions regarding the effectiveness of the company's internal control structure and procedures over financial reporting. In simple terms, the management of a company has to include a seperate report on internal controls alongwith the financial statements that are filed with the SEC. This report should express management's opinion on the effectiveness of internal control in the company.

- The second requirement of Section 404 puts the onus on the Company Auditor to attest and report on management's assessment of internal control over financial reporting. After the management has made out its report on internal control, the company auditor has to attest it and comment / report whether he is satisfied with management's assessment of internal control.

A question naturally arises in one's mind as to how management can be sure that internal control over financial reporting is effective. SOX states that management can reach such a conclusion only when there are no material weaknesses in internal controls. Internal controls in a company thus, need to be effective in Design as well in Operation throughout the period of audit.

I will also discuss the detailed contents of the internal control report to be submitted by the management in my next posts. So keep reading !!