Which statement reflects the Sarbanes-Oxley requirement regarding internal control reporting?

• A. Management is responsible for establishing and maintaining internal controls
• B. External auditors are responsible for establishing internal controls
• C. The board must personally certify the internal controls
• D. Internal controls are optional if the company is small

Answer: (A)

Internal control reporting under Sarbanes-Oxley centers on management taking responsibility for the design, implementation, and ongoing maintenance of internal controls over financial reporting, and for annually assessing and reporting on their effectiveness. This means the company’s leadership must ensure controls are in place and functioning, and they must certify the results in the annual report. External auditors play a separate role by evaluating the effectiveness of those controls and providing an opinion, but they do not establish or maintain the controls themselves. The board governs and oversees the process, but certification duties are borne by management (not the board) and, in practice, the CEO and CFO sign specific attestations about the control structure and the financial statements. The idea that internal controls are optional for small companies is incorrect; publicly traded companies are expected to have robust internal controls, with certain scaled requirements only applying in specific, limited cases.