SOX Compliance

SOX compliance means meeting the requirements of the Sarbanes-Oxley Act of 2002, the US law passed after the Enron and WorldCom failures to make public company financial reporting reliable. It applies to companies that file with the SEC, and private companies preparing for an IPO or an acquisition by a public buyer often build SOX-style controls early so the first audit does not become a rebuild.

Four sections do most of the work for a finance team. Section 302 requires the CEO and CFO to certify each quarterly and annual report, including that they have evaluated the company's disclosure controls and disclosed any significant deficiencies and fraud involving management. Section 404(a) requires management to assess internal control over financial reporting each year and report the conclusion. Section 404(b) requires the external auditor to attest to that assessment for larger filers, and smaller companies are exempt from the auditor attestation. Section 802 sets retention requirements for audit workpapers and related records, with criminal penalties for destroying them.

In practice, SOX compliance is a testing cycle. Management documents the processes that feed the financial statements, such as the close, revenue, payables, payroll and treasury. It identifies the key controls inside them, using the COSO 2013 framework, and tests whether each control is designed well and operated as designed during the period. Typical key controls include bank reconciliation review, journal entry approval, segregation of duties between the person who prepares and the person who approves, and access restrictions on the general ledger.

Every control needs evidence. A reviewer who signed off a reconciliation in March must be able to show the preparer, the reviewer, the date, the support, and the resolution of each reconciling item, months later, to an auditor who was not in the room. Controls that run on email approvals and spreadsheets without version history are the ones that fail testing.

Test results feed the severity ladder. A control deficiency that could allow a material misstatement to go undetected becomes a material weakness, which management must disclose and remediate.

Related terms: Material Weakness and Significant Deficiency, Audit Trail, Journal Entry, General Ledger

Go deeper: The Month-End Close: The Complete Guide

SOX testing asks one question of every number: who prepared it, who approved it, and where is the proof. Adopt's agents prepare reconciliations and entries with source-linked support, and a named person approves each item before it counts, so the evidence exists when the auditor asks. Sign up free.