What is SOX compliance?
SOX compliance means meeting the requirements of the Sarbanes-Oxley Act of 2002, the US law on financial reporting by public companies. Its best-known parts require the CEO and CFO to certify each periodic report, management to assess internal control over financial reporting every year, and, for larger companies, the external auditor to attest to that control.
Also calledSarbanes-Oxley complianceSOX 404ICFR
Compare the softwareBest audit software →All 8 audit vendors →
- Law
- Sarbanes-Oxley Act of 2002
- Applies to
- US-listed companies
- Auditor attestation
- Accelerated filers and larger
How SOX compliance works
The Act was passed in 2002 after the Enron and WorldCom failures. Section 302 requires the chief executive and chief financial officer to certify that each annual and quarterly report is accurate and that disclosure controls work. Section 404(a) requires management to assess and report on the effectiveness of internal control over financial reporting each year. Section 404(b) requires the external auditor to attest to that assessment; under the Dodd-Frank Act it does not apply to issuers that are neither accelerated nor large accelerated filers. The Act also created the PCAOB to oversee auditors of public companies. In practice, SOX work means documenting processes and risks, defining key controls, often against the COSO framework, testing them through the year, tracking deficiencies and fixing them before year end. Companies preparing for a US listing usually build the programme a year or more in advance.
Common questions
What is the difference between SOX 302 and SOX 404?+
Section 302 is the CEO and CFO certification of each quarterly and annual report. Section 404 covers the annual assessment of internal control over financial reporting by management and, for larger companies, the auditor.
Do private companies need SOX compliance?+
No, SOX applies to companies with securities registered with the SEC. Private companies often adopt similar controls when preparing for an IPO, for lenders or because acquirers expect them.
What is a material weakness?+
A deficiency, or combination of deficiencies, in internal control serious enough that a material misstatement of the financial statements might not be prevented or found in time. It must be disclosed.
Software used for SOX compliance
Part of Accountio’s accounting technology coverage · Glossary
