Item 9A Internal Control Memo
Filer status and what it obliges, management's report checked element by element, and a conclusion the rule actually permits — because Item 308(a)(3) does not allow 'effective except for'.
Filer status decides the attestation. It is computed from Rule 12b-2, not from Item 308 — including the condition (iv) that removes accelerated status where the smaller-reporting-company revenue test is available.
Rule 1-02(a)(4) of Regulation S-X supplies both definitions. A material weakness that existed at the assessment date bars an effective conclusion — remediation counts only where the new control was placed in operation AND tested effective before that date.
Informational only — not audit, attest, legal, tax, or investment advice. We are the preparer, never the filer of record. Unfolding Values is not an audit firm.
Item 9A: the conclusion the rule permits, not the one the draft would prefer
Item 9A is short and it is graded on one sentence. Everything else in it — the framework, the fourth-quarter changes, the disclosure-controls conclusion, the attestation — is machinery around the question of whether management may say internal control over financial reporting was effective. Item 308(a)(3) answers that question and leaves no room for negotiation: one or more material weaknesses and the answer is no.
The failure mode is not ignorance of the rule. It is the drafting instinct that reaches for a middle position — effective except for the matter described below, effective in all material respects, generally effective — because the negative conclusion feels disproportionate to a weakness that has already been fixed on paper. There is no middle position. The only question that moves the answer is whether the material weakness existed at the assessment date, which is the end of the most recent fiscal year, and remediation counts only where the new control was placed in operation and tested effective before that date. A remediation plan approved in December does not make a December 31 assessment come out differently.
The second thing this memo settles before it settles anything else is filer status, because the attestation obligation turns on it and Item 308 does not contain the answer. Both the accelerated and large accelerated definitions in Rule 12b-2 carry a fourth condition, that the issuer is not eligible for the smaller-reporting-company revenue test, and that condition removes accelerated status from companies whose float alone would confer it. Reading Item 308(b) without Rule 12b-2 produces an attestation requirement that does not exist, or misses one that does.
This tool determines filer status from the Rule 12b-2 conditions, lists what Item 9A obliges for that status, checks management’s report against the four elements of Item 308(a) one by one, supplies the wording for the conclusion and for the Item 308(c) sentence, and refuses to produce a conclusion where the facts do not support one — naming the unanswered question instead of filling it in. It does not classify a deficiency as a material weakness, judge whether a change was material, or make the Item 307 conclusion for you; those are management judgments and the memo says where each one belongs.
Frequently asked questions
Can internal control over financial reporting be effective if there is a material weakness?
No, and the rule says so in terms. Item 308(a)(3) of Regulation S-K: “Management is not permitted to conclude that the registrant's internal control over financial reporting is effective if there are one or more material weaknesses in the registrant's internal control over financial reporting.” There are two available conclusions, effective and not effective. “Effective except for” and “effective in all material respects” are not among them, and a memo that reaches for either has substituted an audit-opinion vocabulary for the one the item uses.
A company has a $400 million public float. Does it need the auditor's attestation?
Not necessarily, and Item 308 alone will not tell you. Item 308(b) requires the attestation of an accelerated or large accelerated filer that is not an emerging growth company. Whether the company is an accelerated filer is settled by Rule 12b-2, and condition (iv) of that definition excludes an issuer that “is not eligible to use the requirements for smaller reporting companies under the revenue test.” That revenue test is annual revenues under $100 million together with either no public float or a float under $700 million. So a $400 million float with $60 million of revenue is a non-accelerated filer and owes no attestation.
Does a newly public company have to include management's report in its first annual report?
No. Instruction 1 to Item 308 defers paragraphs (a) and (b) until the registrant either had been required to file, or had filed, an annual report for the prior fiscal year. But silence is not an option: the instruction prescribes a statement, in substantially its own words, that the annual report omits the report and the attestation because of the transition period for newly public companies. Item 307 is not deferred with it — the disclosure-controls conclusion is still owed in the first annual report.
Which quarter does the Item 308(c) changes disclosure cover in a 10-K?
The fourth. Item 308(c) reaches a change “that occurred during the registrant's last fiscal quarter (the registrant's fourth fiscal quarter in the case of an annual report)” that has materially affected, or is reasonably likely to materially affect, internal control over financial reporting. Two conditions have to hold together: the change must be in Q4, and it must be material or reasonably likely to be. Where changes happened but were judged immaterial, the negative sentence has to be written about disclosure, not about fact.
If ICFR is not effective, must disclosure controls also be not effective?
Not as a matter of rule. Rule 13a-15(e) defines disclosure controls by a different test — whether required information is recorded, processed, summarized and reported within the required time periods, and accumulated and communicated to management to allow timely decisions about disclosure. The overlap is large and the combination of not-effective ICFR with effective disclosure controls is the most challenged pairing in Item 9A, but it is a judgment for management to make and explain, not one that can be computed.
Which control framework does the SEC require?
None by name. Rule 13a-15(c) sets a standard instead: the framework “must be a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment.” Item 308(a)(2) then requires management's report to identify whichever framework was used. A report that describes an evaluation without naming its framework is missing a required element.