Sarbanes-Oxley Law - Internal Control Structure:

Each annual report of an issuer must contain the internal control structure report. The CEO and CFO are responsible for establishing and maintaining internal controls.

Management Assessment of Internal Controls - Section 404 and Section 302:

The internal control structure must state the responsibility of the management for establishing and maintaining adequate internal control structure and procedures for financial reporting.
The internal control structure must contain an assessment at the end of the issuer’s fiscal year of its effectiveness and procedures for financial reporting.
The issuer’s auditor shall attest and report on the assessment made by the management of the issuer.
Internal control structure must include records that accurately reflect transactions and disposition of assets.
The receipts and expenditures must be made only with authorization of senior management and directors.
The CEO and CFO must evaluate the internal controls of the issuer for effectiveness within 90 days prior to the report.
The CEO and CFO must present in the report the conclusions about the effectiveness of the internal controls.
The CEO and CFO must report all significant deficiencies in the design or operation of internal controls and any fraud involving employees and management, which has significant effects on the internal controls, must also be reported to the issuer’s auditors and audit committee.
Any significant changes that may significantly affect the internal controls have to be indicated in the report.

Next:Sarbanes Oxley Penalty