In 2002, Congress changed what executives have to put their names to. CEOs and CFOs now certify the numbers, auditors test the controls behind them and anyone who falsifies a record to block an investigation risks prison. Here is what the law asks of companies and of the people who run them.

What is SOX compliance?

SOX compliance is a regulation that requires firms to provide accurate financial statements and have internal controls in place to protect financial information, with the overall aim of reducing malpractice that would harm investors and the public.

What is Sarbanes-Oxley?

The Sarbanes Oxley Act came into effect in 2002 when it was passed by the United States Congress. It is named after Paul Sarbanes and Michael Oxley, who created it. For that reason, SOX compliance is sometimes referred to as Sarbanes Oxley compliance.

The regulation is all about improving transparency within US public companies by making corporate disclosures more accurate and reliable, while also improving governance and accountability across firms. Security is another focus, with the regulation placing onus on firms to have sufficient internal controls. Combined, these measures intend to protect the public, as well as investors or shareholders, from fraud and other misconduct.

Corporate scandals at Enron, Tyco and WorldCom pushed Congress to act

The Sarbanes Oxley Act was passed in Congress following multiple high-profile scandals such as those involving Enron, Tyco and WorldCom. These scandals resulted in heavy losses for both firms and investors, and they had a significant detrimental impact on the financial market. Unsurprisingly, investors lost trust in companies.

It became clear that new compliance standards were necessary to ensure such scandals never happened again. The SOX compliance measures were introduced to fulfill this need by preventing fraudulent practices and restoring confidence in the industry.

Public companies, their subsidiaries and foreign issuers must comply

The Sarbanes Oxley requirements affect the following:

  • Public companies
  • Their wholly owned subsidiaries
  • Publicly traded foreign companies who do business in the United States

For these companies, the Sarbanes Oxley requirements are mandatory. This has wide-reaching implications for many within these companies, including finance and IT departments. IT, for example, can play a part in protecting electronic financial data against breaches. Executives such as CEOs and CFOs also have additional responsibilities under the SOX requirements.

Sections 302 and 404 take up most of the compliance effort

The SOX requirements are divided into eleven titles with multiple sections under each title. The sections that you should be most aware of are 302, 404, 409, 802 and 906. In particular, the focus of most companies will be on sections 302 and 404 as these will make up the majority of your compliance efforts.

Section 302: corporate responsibility for financial reports

This section states that CEOs and CFOs are personally responsible for:

  • Certifying all periodic financial reports
  • Making sure that these reports and financial statements provide an accurate picture of their company's business operations and financial status
  • Submitting these statements to the Securities and Exchange Commission (SEC), which is the body that oversees compliance

When it comes to internal controls, company executives must also:

  • Ensure that they are implemented and adequate, having been regularly assessed and evaluated within 90 days prior to the report
  • Disclose any weaknesses that could negatively impact financial reporting and any significant changes
  • Report any fraud involving management or staff working with internal controls

What is SOX 404?

Section 404 of the Sarbanes-Oxley Act requires the annual report of a company that reports under the Securities Exchange Act of 1934, other than a registered investment company, to include a report of management on the company's internal control over financial reporting, covering management's responsibility for those controls and its assessment of how effective they are.

404 states that companies need to publish an annual report which must:

  • State that management, such as the CEO and CFO, is responsible for both having sufficient internal controls over financial reporting and assessing these
  • Disclose any material weaknesses within their internal control over financial reporting

For accelerated filers and large accelerated filers, this section also requires the external auditor to attest to and report on management's assessment each year. Other companies are exempt from the auditor attestation under Section 404(c), effective September 21, 2010.

Sections 409, 802 and 906 cover real-time disclosure and criminal penalties

Section 409: real time issuer disclosures

Companies are required to promptly disclose any material changes in their financial condition or operations. These disclosures, which aim to protect investors and the public, must be written in plain English that is easy to understand.

Section 802: criminal penalties for altering documents

If you alter, destroy, mutilate, conceal or falsify any records or documents with the intention of disrupting or influencing a federal investigation, you can face severe penalties. Section 802 defines this as up to 20 years imprisonment for anyone who knowingly does so.

Section 906: certification of financial reports

Finally, section 906 states that CEOs and CFOs must personally sign and certify the report that contains financial statements. They must confirm that this document:

  • Complies with SEC reporting requirements
  • Accurately represents the company's finances and operations

Certifying a misleading or fraudulent report could also lead to significant consequences. Certifying a report knowing it does not comply carries a fine of up to $1 million and up to 10 years in prison, rising to a fine of up to $5 million and up to 20 years in prison for willful certification. For a more in-depth look at each of these requirements, you can read the full Sarbanes Oxley Compliance Act.

SOX controls are the safeguards behind every requirement

Throughout this blog, internal controls have come up often. But what exactly are these?

Put simply, they are the safeguards or countermeasures you implement in order to achieve compliance with SOX regulation. There is not one single approach you are required to follow with your SOX controls; this is down to the individual company.

Nonetheless, the measures you can take include standards, policies, processes, procedures or other activities such as risk assessment, monitoring or security measures to protect financial data. By having adequate controls in place, you will be better able to spot and prevent problems, and thereby avoid the risks that accompany non-compliance or an insecure environment. The internal controls blog covers how they work in more detail.

Reliable numbers and tested controls are what every section of the Act asks for

Whether the section is the executive certification in 302 and 906, the annual internal control report in 404, the prompt disclosure in 409 or the criminal penalties in 802, the Act asks the same thing of every covered company: financial results that can be trusted, backed by controls that someone can show are working. Failing to meet the requirements could result in hefty fines and even imprisonment, as well as reputational damage. For finance teams the practical step is to know which controls support the financial statements, who owns each one and what evidence shows it ran.