What does the Sarbanes-Oxley Act require regarding internal controls in annual reporting?

• A. A statement regarding management's responsibility for establishing and maintaining internal controls
• B. A statement regarding the efficiency of the company's internal controls and procedures
• C. A statement regarding the internal auditors' report on management's assessment of internal control
• D. A statement regarding all key controls related to financial reporting

Answer: (A)

The main idea is that Sarbanes-Oxley requires management to take responsibility for the company’s internal controls and to state that they are establishing and maintaining an adequate internal control system over financial reporting in the annual report. This certification creates accountability for the reliability of financial statements.

Why this is the best fit: the requirement focuses on management’s responsibility for the design and operation of internal controls, which is exactly what the statement in the annual report must convey. It’s not about claiming that controls are efficient, nor about an internal auditors’ report on management’s assessment, nor about listing all key controls. The act does require an assessment of internal control effectiveness and external attestation, but the core annual-report statement centers on management’s responsibility for internal controls.