17 CFR 229.308
§ 229.308 (Item 308) Internal control over financial reporting.
United States · 17 CFR — Commodity and Securities Exchanges · Status: effective
Cite this
- Citation
- 17 CFR 229.308, § 229.308 (Item 308) Internal control over financial reporting, United States, version 1 as recorded 2026-07-09, yourstate.us, https://yourstate.us/provision/68423
- Permanent ID
ys:prov:68423@1- SHA-256
b231bfb98af16b6044a005bf17b262495cbfcf1e52521287dc2829392cd199ef
The hash is SHA-256 of this version's text, with every run of whitespace collapsed to a single space and the ends trimmed. The ID always leads back here, and checking it says whether the text you cited is still the current version.
Full text
(a) Management's annual report on internal control over financial reporting. Provide a report of management on the registrant's internal control over financial reporting (as defined in § 240.13a-15(f) or § 240.15d-15(f) of this chapter) that contains:
(1) A statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting for the registrant;
(2) A statement identifying the framework used by management to evaluate the effectiveness of the registrant's internal control over financial reporting as required by paragraph (c) of § 240.13a-15 or § 240.15d-15 of this chapter;
(3) Management's assessment of the effectiveness of the registrant's internal control over financial reporting as of the end of the registrant's most recent fiscal year, including a statement as to whether or not internal control over financial reporting is effective. This discussion must include disclosure of any material weakness in the registrant's internal control over financial reporting identified by management. Management is not permitted to conclude that the registrant's internal control over financial reporting is effective if there are one or more material weaknesses in the registrant's internal control over financial reporting; and
(4) If the registrant is an accelerated filer or a large accelerated filer (as defined in § 240.12b-2 of this chapter), or otherwise includes in its annual report a registered public accounting firm's attestation report on internal control over financial reporting, a statement that the registered public accounting firm that audited the financial statements included in the annual report containing the disclosure required by this Item has issued an attestation report on the registrant's internal control over financial reporting.
(b) Attestation report of the registered public accounting firm. If the registrant, other than a registrant that is an emerging growth company, as defined in Rule 405 of the Securities Act of 1933 (§ 230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§ 240.12b-2 of this chapter), is an accelerated filer or a large accelerated filer (as defined in § 240.12b-2 of this chapter), provide the registered public accounting firm's attestation report on the registrant's internal control over financial reporting in the registrant's annual report containing the disclosure required by this Item.
(c) Changes in internal control over financial reporting. Disclose any change in the registrant's internal control over financial reporting identified in connection with the evaluation required by paragraph (d) of § 240.13a-15 or 240.15d-15 of this chapter that occurred during the registrant's last fiscal quarter (the registrant's fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant's internal control over financial reporting.
Instructions to Item 308: 1. A registrant need not comply with paragraphs (a) and (b) of this Item until it either had been required to file an annual report pursuant to section 13(a) or 15(d) of the Exchange Act (15 U.S.C. 78m or 78o(d)) for the prior fiscal year or had filed an annual report with the Commission for the prior fiscal year. A registrant that does not comply shall include a statement in the first annual report that it files in substantially the following form: “This annual report does not include a report of management's assessment regarding internal control over financial reporting or an attestation report of the company's registered public accounting firm due to a transition period established by rules of the Securities and Exchange Commission for newly public companies.”
2. The registrant must maintain evidential matter, including documentation, to provide reasonable support for management's assessment of the effectiveness of the registrant's internal control over financial reporting.
Legislative history
This is a federal regulation, adopted through agency rulemaking under the Administrative Procedure Act — not enacted by a recorded vote of Congress.