What Section 404 Says

According to the SEC, companies must:

“Include in their annual reports a report of management on the company’s internal control over financial reporting.”

The control report must include:

• “A statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting.”
• “Management’s assessment of the effectiveness of the company’s internal control over financial reporting.”
• “A statement identifying the framework used by management to evaluate the effectiveness of the company’s internal control over financial reporting.”
• “A statement that the registered public accounting firm that audited the company’s financial statements…has issued an attestation report on management’s assessment of the company’s internal control over financial reporting.”