The new guidance will enhance compliance under Section 404 of the Sarbanes-Oxley Act of 2002 by focusing company management on the internal controls that best protect against the risk of a material financial misstatement. The guidance is based on two broad principles:

• Management should evaluate whether it has implemented controls that adequately address the risk that a material misstatement in the financial statements would not be prevented or detected in a timely manner.
• Management's evaluation of evidence about the operation of its controls should be based on its assessment of risk.

Under the guidance, management can align the nature and extent of its evaluation procedures with those areas of financial reporting that pose the highest risks to reliable financial reporting (that is, whether the financial statements are materially accurate). As a result, management may be able to use more efficient approaches to gathering evidence, such as self-assessments, in low-risk areas and perform more extensive testing in high-risk areas. The SEC believes that by following these two principles, companies of all sizes and complexities will be able to implement our rules effectively and efficiently. Click for Press Release (PDF 36k).