Requires the attestation and report by a registered public accounting firm on an issuer's management assessment of its internal control structure and procedures to focus upon the process and system used by management to identify and manage risks, identify and implement key controls, and come to a conclusion on the effectiveness of the internal controls over financial reporting.

Prohibits an auditor's attestation and report from including a separate (pass/fail) opinion on the effectiveness of such internal controls.

Requires such attestation and report to be performed at three-year intervals.

Prescribes standards for such attestations and reports, including a risk-based evaluation.

Permits attestations and reports to rely on examinations and inspections by federal and state regulatory agencies.

Instructs the Securities and Exchange Commission to develop a standard of materiality for such assessments and reports based upon whether the internal control has a material effect on the company's financial statements and is significant to the issuer's overall financial status.

Exempts a smaller public company from the requirements for management assessment of internal controls, unless it voluntarily elects to comply with them.