ICFR (Internal Control over Financial Reporting)

Internal control over financial reporting (ICFR) is the set of processes a public company uses to provide reasonable assurance that its financial reporting is reliable and that its external financial statements are prepared in accordance with GAAP. The SEC defines it in Exchange Act Rule 13a-15(f) as a process designed under the supervision of the principal executive and principal financial officers and carried out by the board, management, and other personnel.

Full guide: Which SEC Filings Are Audited, and Which Aren't

Rule 13a-15(f) says ICFR includes the policies and procedures that keep records accurately reflecting the company's transactions and asset dispositions, that ensure transactions are recorded so GAAP statements can be prepared and that spending happens only with proper authorization, and that prevent or promptly detect unauthorized use of assets that could materially affect the financial statements.

Under Rule 13a-15(c), management must evaluate the effectiveness of ICFR as of each fiscal year end, using a suitable, recognized control framework. Under Rule 13a-15(d), it must also evaluate any change during each quarter that has materially affected, or is reasonably likely to materially affect, ICFR. These obligations begin once a company has been required to file, or has filed, an annual report for the prior fiscal year, so a newly public company's first annual report does not carry the ICFR assessment. The results appear in Item 9A of Form 10-K (Controls and Procedures) and, for quarterly changes, Item 4 of Form 10-Q. The 10-K cover page also includes a check box showing whether the company's auditor has attested to management's ICFR assessment under Section 404(b) of the Sarbanes-Oxley Act.

ICFR is distinct from disclosure controls and procedures, defined in Rule 13a-15(e), which cover all information a company must report on time, not only financial statements. Both are the subject of the officers' Exhibit 31 certifications.