(a) Every issuer that files reports under section 15(d) of the Act (15 U.S.C. 78o(d)), other than an Asset Backed Issuer (as defined in § 229.1101 of this chapter), a small business investment company registered on Form N-5 (§§ 239.24 and 274.5 of this chapter), or a unit investment trust as defined in section 4(2) of the Investment Company Act of 1940 (15 U.S.C. 80a-4(2)), must maintain disclosure controls and procedures (as defined in paragraph (e) of this section) and, if the issuer either had been required to file an annual report pursuant to section 13(a) or 15(d) of the Act (15 U.S.C. 78m(a) or 78o(d)) for the prior fiscal year or had filed an annual report with the Commission for the prior fiscal year, internal control over financial reporting (as defined in paragraph (f) of this section).
(b) Each such issuer's management must evaluate, with the participation of the issuer's principal executive and principal financial officers, or persons performing similar functions, the effectiveness of the issuer's disclosure controls and procedures, as of the end of each fiscal quarter, except that management must perform this evaluation:
(1) In the case of a foreign private issuer (as defined in § 240.3b-4) as of the end of each fiscal year; and
(2) In the case of an investment company registered under section 8 of the Investment Company Act of 1940 (15 U.S.C. 80a-8), within the 90-day period prior to the filing date of each report requiring certification under § 270.30a-2 of this chapter.
(c) The management of each such issuer, that either had been required to file an annual report pursuant to section 13(a) or 15(d) of the Act (15 U.S.C. 78m(a) or 78o(d)) for the prior fiscal year or previously had filed an annual report with the Commission for the prior fiscal year, other than an investment company registered under section 8 of the Investment Company Act of 1940, must evaluate, with the participation of the issuer's principal executive and principal financial officers, or persons performing similar functions, the effectiveness, as of the end of each fiscal year, of the issuer's internal control over financial reporting. The framework on which management's evaluation of the issuer's internal control over financial reporting is based must be a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment. Although there are many different ways to conduct an evaluation of the effectiveness of internal control over financial reporting to meet the requirements of this paragraph, an evaluation that is conducted in accordance with the interpretive guidance issued by the Commission in Release No. 34-55929 will satisfy the evaluation required by this paragraph.
(d) The management of each such issuer that previously either had been required to file an annual report pursuant to section 13(a) or 15(d) of the Act (15 U.S.C. 78m(a) or 78o(d)) for the prior fiscal year or previously had filed an annual report with the Commission for the prior fiscal year, other than an investment company registered under section 8 of the Investment Company Act of 1940 (15 U.S.C. 80a-8), must evaluate, with the participation of the issuer's principal executive and principal financial officers, or persons performing similar functions, any change in the issuer's internal control over financial reporting, that occurred during each of the issuer's fiscal quarters, or fiscal year in the case of a foreign private issuer, that has materially affected, or is reasonably likely to materially affect, the issuer's internal control over financial reporting.
(e) For purposes of this section, the term disclosure controls and procedures means controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Act (15 U.S.C. 78a et seq.) is recorded, processed, summarized and reported, within the time periods specified in the Commission's rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Act is accumulated and communicated to the issuer's management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.
(f) The term internal control over financial reporting is defined as a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:
(1) Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer;
(2) Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and
(3) Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer's assets that could have a material effect on the financial statements.
[68 FR 36667, June 18, 2003, as amended at 70 FR 1622, Jan. 7, 2005; 71 FR 76596, Dec. 21, 2006; 72 FR 35322, June 27, 2007]