Section 404: Ensuring a healthy immune system .............................
The rules set out in Section 404 can be compared to the guidelines for a
healthy lifestyle: Having a healthy immune system, for example, is not just a
case of luck. We have to make good choices: eat lots of fruit and vegetables
rather than junk food, drink lots of water, and take vitamins. Buying fresh pro-
duce and vitamins can be expensive, but we decide that being healthy is
worth the extra expense. Lots of healthy individuals make a more healthy
society. Section 404 is fresh food and vitamins for a company: It may cost you
to implement the internal controls, but they ensure that your business runs
wholesomely and that bugs like fraud are flushed out before they make the
company sick. Lots of clean, healthy companies make for a clean and healthy
investment culture.
The content of Section 404 is succinct, weighing in as it does at 168 words:
“(a) Rules Required. The Commission shall prescribe rules requiring each
annual report required by section 13(a) or 15(d) of the Securities
Exchange Act of 1934 to contain an internal control report, which shall
(1) state the responsibility of management for establishing and maintain-
ing an adequate internal control structure and procedures for financial
reporting; and
(2) contain an assessment, as of the end of the most recent fiscal year of
the issuer, of the effectiveness of the internal control structure and proce-
dures of the issuer for financial reporting.
Figure 4-3:
The
enforcement
of SOX led
to a raft of
convictions
in the
regulation’s
very first
year.
96 Part II: Diving into GRC
