Among the most important regulations that are placed on banking institutions is the requirement for disclosure of the bank's finances. Particularly for banks that trade on the public market, the Securities and Exchange Commission (SEC) requires management to prepare annual financial statements according to a financial reporting standard, have them audited, and to register or publish them. Often, these banks are even required to prepare more frequent financial disclosures, such as Quarterly Disclosure Statements. The Sarbanes-Oxley Act of 2002 outlines in detail the exact structure of the reports that the SEC requires.
In addition to preparing these statements, the SEC also stipulates that directors of the bank must attest to the accuracy of such financial disclosures. Thus, included in their annual reports must be a report of management on the company's internal control over financial reporting. The internal control report must include: a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the company; management's assessment of the effectiveness of the company's internal control over financial reporting as of the end of the company's most recent fiscal year; a statement identifying the framework used by management to evaluate the effectiveness of the company's internal control over financial reporting; and a statement that the registered public accounting firm that audited the company's financial statements included in the annual report has issued an attestation report on management's assessment of the company's internal control over financial reporting. Under the new rules, a company is required to file the registered public accounting firm's attestation report as part of the annual report. Furthermore, the SEC added a requirement that management evaluate any change in the company's internal control over financial reporting that occurred during a fiscal quarter that has materially affected, or is reasonably likely to materially affect, the company's internal control over financial reporting 1.