(a) Rules required
The Commission shall prescribe rules requiring each annual report required by section 78m(a) or 78o(d) of this title to contain an internal control report, which shall—
(1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and
(2) contain an assessment, as of the end of the most recent fiscal year of the issuer, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting.
(b) Internal control evaluation and reporting
With respect to the internal control assessment required by subsection (a), each registered public accounting firm that prepares or issues the audit report for the issuer, other than an issuer that is an emerging growth company (as defined in section 78c of this title), shall attest to, and report on, the assessment made by the management of the issuer. An attestation made under this subsection shall be made in accordance with standards for attestation engagements issued or adopted by the Board. Any such attestation shall not be the subject of a separate engagement.
(c) Exemption for smaller issuers
Subsection (b) shall not apply with respect to any audit report prepared for an issuer that is neither a "large accelerated filer" nor an "accelerated filer" as those terms are defined in Rule 12b–2 of the Commission (17 C.F.R. 240.12b–2).
AMENDMENTS 2012—Subsec. (b). Pub. L. 112–106 inserted ", other than an issuer that is an emerging growth company (as defined in section 78c of this title)," before "shall attest to". 2010—Subsec. (c). Pub. L. 111–203 added subsec. (c).EFFECTIVE DATE OF 2010 AMENDMENT Amendment by Pub. L. 111–203 effective 1 day after July 21, 2010, except as otherwise provided, see section 4 of Pub. L. 111–203, set out as an Effective Date note under section 5301 of Title 12, Banks and Banking.
15 U.S.C. § 7262 (2018)