Sarbanes-Oxley Act of 2002
The Sarbanes-Oxley Act of 2002 (SOX) is a US federal law designed to protect investors by improving the accuracy and reliability of corporate financial disclosures. It was enacted in response to major accounting scandals to prevent corporate fraud and ensure transparency through strict auditing and internal control requirements.
Who it applies to
- Publicly traded companies listed on any US stock exchange.
- Wholly owned subsidiaries of US public companies.
- Foreign private issuers that have securities listed on US exchanges.
- Companies currently preparing for an Initial Public Offering (IPO) in the United States.
How it works
SOX focuses heavily on corporate governance and financial oversight. Section 302 requires CEOs and CFOs to personally certify that their company's financial reports are accurate and not misleading. Section 404 is the most operationally intensive part of the law, requiring management to establish internal controls over financial reporting (ICFR) and assess their effectiveness annually.
Compliance involves identifying every process that impacts financial statements—such as payroll, revenue recognition, and procurement—and implementing "controls" to prevent errors or fraud. These controls may include mandatory approvals, segregation of duties, and automated system checks.
To certify compliance, companies undergo an annual audit. An independent external auditor tests the identified controls to ensure they are designed correctly and operating consistently. If significant weaknesses are found, the company must disclose these "material weaknesses" in its public filings.
Getting started
- Define the scope by identifying all financial systems and business processes that feed into the final financial statements.
- Document existing internal controls for each process in a risk-control matrix (RCM).
- Perform a gap analysis to identify where current controls are missing or insufficient based on an established framework, such as COSO.
- Implement remediation plans to fix identified gaps and update documentation.
- Establish a continuous monitoring program to test control effectiveness throughout the fiscal year.
Controls & requirements
- s.302 Section 302: officer certifications
- s.404 Section 404: internal control over financial reporting
- s.906 Section 906: criminal certifications
- IT general controls (ITGCs) in a SOX audit
- Access management controls
- Change management controls
- Segregation of duties
- Deficiencies: from control gap to material weakness
- AS 2201 The auditor's ICFR audit under PCAOB AS 2201
- Scoping a SOX programme: materiality and key controls
Common misconceptions
- SOX is often mistaken for an IT standard; while it requires General IT Controls (GITCs), it is fundamentally a financial governance requirement owned by business leadership, not the IT department.
- Many believe compliance is a one-time certification project, but it is actually a permanent operational cycle of testing and reporting that must be repeated every year.