J-SOX

April 12, 2008

Japan recently enacted the Financial Instruments Exchange Law  which includes a regulation entitled Management Assessment and Audit of Internal Control over Financial Reporting (”ICFR”).  ICFR requires management to provide an assessment of its internal control over its financial reporting. The regulation also requires that the registrant obtain an auditor’s opinion on management’s assessment. The regulation, commonly referred to as “J-SOX” named after Sarbanes-Oxley, is applicable to companies that are publicly registered on Japanese stock exchanges and is effective for registrants’ fiscal years beginning on or after April 1, 2008.

The new law is complex and confusing. ICFR will impact the 3,800 companies listed on Japanese stock exchanges and will also affect the subsidiaries of the listed companies, even if they operate in other parts of the world.

The implementation guidance (published by the FSA) recommending a risk-based, top-down approach to J-SOX implementation twhcih means that  that the parent company will begin by evaluating entity level controls (e.g., overall control environment, oversight by the board of directors, etc.) and will work down to specific processes and financial statement accounts.

The Section 1 guidance, which covers the basic framework for internal control, requires a control framework that includes the common COSO elements of:

  • Control Environment
  • Risk Assessment
  • Control Activities
  • Information and Communication
  • Monitoring

 In addition to those five COSO elements, J-SOX also incorporates “Response to IT” as it relates to ICFR as a new component. The Section 2 guidance covers management assessment and reporting of ICFR and includes the following five areas:

  • Definition of Financial Reporting
  • Scoping of Management Assessment
  • Structure for Internal Control Assessment Method and Use of Specialists
  • Evaluation of Company Level Controls
  • Process Level Controls – Assessment of Operating Effectiveness

The Section 3 guidance covers the audit of ICFR and includes the following four areas:

  • The meaning of auditor’s “Indirect Reporting”
  • Sample size for testing operating effectiveness
  • Use of the work of internal audit and/or others
  • Reporting on material weaknesses and other reportable conditions.

Japan’s electronic data regulations and their potential interplay with J-SOX will be the subject of a later post.

Posted by Sarbox | Filed Under Uncategorized, blog 

Comments

Got something to say?