SOX — Sarbanes-Oxley Act

Why does it matter?

SOX is the law that turned internal control over financial reporting into a management and audit obligation with personal liability attached. Section 302 makes the signing officers responsible for designing, evaluating and reporting on internal controls each quarter; section 906 makes a knowingly false certification a crime punishable by up to $1 million and ten years, or $5 million and twenty years if willful; section 304 claws back a year of incentive pay and trading profits after a restatement caused by misconduct; and section 404 puts an annual, framework-based assessment of ICFR in every 10-K, with an independent attestation for accelerated and large accelerated filers. The PCAOB inspects the auditors, the SEC enforces the disclosure rules, and 18 U.S.C. 1514A protects the employees who report fraud.

Key benefits include:

• Personal certification

Section 302 requires the principal executive and financial officers to certify each annual and quarterly report, including that they evaluated the effectiveness of internal controls within 90 days of the report.

• A documented control assessment

Section 404(a) requires management's annual report on the adequacy of the internal control structure and an assessment of its effectiveness as of fiscal year-end.

• Independent attestation

Section 404(b) requires the registered public accounting firm to attest to and report on management's assessment, under PCAOB standards, unless section 404(c) or the emerging growth company exclusion applies.

• Auditor independence

Section 201 bans nine non-audit services for audit clients, section 202 requires audit committee preapproval of the rest, and section 203 rotates the lead and reviewing partners after five years.

• Criminal backstops

Section 802 punishes destroying or falsifying records in a federal matter with up to 20 years, section 806 protects whistleblowers, and section 906 criminalizes false certifications.

How does it work?

Section 302(a) directs the SEC to require, for each company filing reports under section 13(a) or 15(d) of the Exchange Act, that the signing officers certify that they reviewed the report; that it contains no untrue statement or omission of a material fact; that the financial statements fairly present the issuer's condition and results; that they are responsible for establishing and maintaining internal controls, have designed them so that material information reaches them, have evaluated their effectiveness within 90 days of the report and have presented their conclusions; that they disclosed all significant deficiencies and material weaknesses and any fraud involving management to the auditors and the audit committee; and that they indicated any significant changes in internal controls since the evaluation. Section 302(b) stops an issuer escaping the duty by reincorporating abroad.

Section 404(a) requires each annual report to contain an internal control report stating management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting, and an assessment, as of the end of the most recent fiscal year, of their effectiveness. Section 404(b) requires the issuer's registered public accounting firm to attest to and report on that assessment in accordance with PCAOB attestation standards, not as a separate engagement. The SEC implemented this in Regulation S-K Item 308, which requires management's report to name the framework used to evaluate ICFR, to state whether ICFR is effective, and to disclose any material weakness, since management may not conclude that ICFR is effective if one exists; the SEC's 2007 interpretive guidance (Release 33-8810, effective June 27, 2007) describes a top-down, risk-based evaluation and cites the COSO framework as an example of a suitable control framework. The PCAOB's AS 2201 governs the integrated audit of ICFR and the financial statements.

Section 404(c), added by section 989G of the Dodd-Frank Act in 2010, provides that the attestation does not apply to an issuer that is neither a large accelerated filer nor an accelerated filer under Exchange Act Rule 12b-2, and section 103 of the JOBS Act (2012) excludes emerging growth companies from section 404(b). The SEC's amendments of March 12, 2020 (Release 34-88365, effective April 27, 2020) exclude from the accelerated and large accelerated filer definitions an issuer eligible to be a smaller reporting company with annual revenues under $100 million, so such issuers keep the management assessment but not the auditor attestation, and the Form 10-K cover now carries a checkbox stating whether an ICFR attestation is included. Section 802 added 18 U.S.C. 1520, which requires auditors to keep audit workpapers for five years, and the SEC's Rule 2-06 of Regulation S-X extends the retention of audit records to seven years.

Key Elements

• Public Company Accounting Oversight Board (sections 101 to 109)

A nonprofit board under SEC oversight that registers public accounting firms, sets auditing, quality control and independence standards, inspects firms and disciplines them.

• Audit committee standards (section 301)

Exchange Act section 10A(m): the audit committee, composed of independent directors, appoints, pays and oversees the auditor, sets procedures for confidential employee complaints about accounting matters and may engage its own advisers.

• Section 302 and section 906 certifications

The civil certification in each periodic report, enforced by the SEC, and the criminal certification of 18 U.S.C. 1350 that the report fully complies with the Exchange Act and fairly presents the issuer's condition.

• Section 404 internal control report

Management's framework-based assessment of ICFR as of year-end in every annual report, with the auditor's attestation for accelerated and large accelerated filers that are not emerging growth companies.

• Disclosure controls (sections 401, 406, 407, 409)

Material off-balance-sheet arrangements and pro forma rules, disclosure of whether the issuer has a code of ethics for senior financial officers and a financial expert on its audit committee, and rapid disclosure of material changes.

• Records, whistleblowers and penalties (sections 802, 806, 906)

18 U.S.C. 1519 (up to 20 years for destroying or falsifying records), 18 U.S.C. 1520 (audit workpaper retention, up to 10 years), 18 U.S.C. 1514A (civil action against retaliation) and 18 U.S.C. 1350 (false certification).

What does it cover?

SOX applies to issuers, defined in section 2 as companies with securities registered under section 12 of the Exchange Act, required to file reports under section 15(d), or with a filed registration statement pending, which takes in domestic public companies and foreign private issuers listed in the United States, together with their officers, directors, audit committees and registered public accounting firms, including foreign firms that audit issuers (section 106). Section 405 exempts registered investment companies from sections 401, 402 and 404. Section 404(b) does not apply to non-accelerated filers or emerging growth companies, but every issuer remains subject to the section 302 certification, the management assessment of section 404(a) and the criminal provisions of Titles VIII and IX.

What are its objectives?

The Act's long title states its purpose: to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to the securities laws, and for other purposes. Its titles pursue that through five mechanisms.

Independent oversight of public company auditors through the PCAOB and the independence rules of Title II.

Personal accountability of the chief executive and chief financial officers for each report under sections 302, 304 and 906.

A documented, framework-based assessment of internal control over financial reporting each year under section 404, attested by the auditor where section 404(b) applies.

Fuller and faster disclosure of off-balance-sheet arrangements, insider transactions, codes of ethics and material changes under Title IV.

Criminal penalties for destroying records and defrauding shareholders, and protection for the employees who report it, under Titles VIII, IX and XI.

Framework in Context

SOX is implemented by the SEC's rules, including Regulation S-K Item 308, Exchange Act Rules 13a-15 and 15d-15 and Regulation S-X Rule 2-06, and audited under the PCAOB's standards, of which AS 2201 governs the integrated audit of ICFR. Management's assessment is made against a suitable control framework, and the SEC's 2007 guidance names the COSO Internal Control framework as its example. COBIT 2019 provides a reference for the IT general controls that support financial applications, and the controls at outsourced service organizations reach the issuer's auditors through SOC 1 reports under SSAE 18. The Dodd-Frank Act of 2010 and the JOBS Act of 2012 narrowed the attestation requirement, and the SEC's 2020 accelerated filer amendments narrowed it again by revenue.

Common Framework Mappings

Issuers map SOX's control, certification and audit requirements to the frameworks below so that one control library serves management's assessment, the external auditor and other regulators.

Mapped frameworks include:

Basel III

COBIT 2019

COSO IC 2013

IFRS

ISO 27001:2022

NIST CSF 2.0

PCAOB AS 2201

SOC 1

US GAAP