Sarbanes-Oxley
SOXAlso called sarbanes-Oxley Act of 2002, SOX 404
The Sarbanes-Oxley Act of 2002 is a US federal law that sets rules on financial reporting, internal controls and auditor independence for companies listed in the US. Chief executives and finance chiefs must certify their accounts. Management must assess internal control over financial reporting each year, and larger companies need an auditor's opinion on it.
How it works
Companies document the processes that feed their financial statements, identify key controls and test them during the year. Section 302 requires the CEO and CFO to certify each quarterly and annual report. Section 404(a) requires management's annual assessment of internal control over financial reporting. Section 404(b) requires the external auditor to attest to it for accelerated and large accelerated filers.
SOX created the Public Company Accounting Oversight Board to set auditing standards and inspect audit firms. It makes officers personally accountable for false certifications, with criminal penalties under section 906. For banks and listed financial firms, SOX controls testing sits alongside prudential and compliance testing, often run by the same internal control teams.
The rules
Sets officer certifications, internal control reporting, auditor independence rules and created the PCAOB.
Companies with securities registered with the SEC and their auditorsSets how external auditors perform the section 404(b) audit of internal control over financial reporting.
Auditors of accelerated and large accelerated filersCommon questions
Who must comply with SOX?
Companies with securities registered with the SEC, including foreign private issuers, must comply. The auditor attestation in section 404(b) applies to accelerated and large accelerated filers. Smaller non-accelerated filers are exempt from 404(b) but still need management's assessment.
What is SOX 404?
Section 404 covers internal control over financial reporting. Section 404(a) requires management to assess and report on those controls each year. Section 404(b) requires the external auditor to attest to management's assessment for larger filers.
What is a material weakness?
It is a deficiency, or combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility that a material misstatement will not be prevented or detected on time. Companies must disclose material weaknesses publicly.
Does SOX apply outside the US?
It applies to non-US companies whose securities are registered with the SEC, such as those with US listings. Other countries have similar regimes. The UK Corporate Governance Code 2024 adds a board declaration on material controls from 2026.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostSarbanes Oxley Workflows Shift as Regtech Adoption JumpsRead the article →RegTech PostPetual Raises $20M to Automate SOX Compliance With Agentic AI PlatformRead the article →
