What Is SOX?
The Sarbanes-Oxley Act (SOX) is a US federal law enacted in 2002 in response to major corporate accounting scandals at Enron, WorldCom, and Tyco. It established requirements for financial reporting, internal controls, and corporate governance at publicly traded companies. SOX applies to all companies listed on US stock exchanges, including foreign companies with US listings.
Why SOX Was Created
The early 2000s saw massive corporate frauds where executives manipulated financial statements, destroying billions in shareholder value and undermining public trust in capital markets. SOX was Congress's response — establishing mandatory internal controls over financial reporting, requiring executive certification of financial statements, and creating criminal penalties for fraud.
Key Sections
Section 302 requires CEO and CFO certification of quarterly and annual financial reports. Executives personally attest that financial statements are accurate and that they have evaluated internal controls.
Section 404 requires management assessment and external auditor attestation of the effectiveness of internal controls over financial reporting (ICFR). This is the most resource-intensive SOX requirement.
Section 906 establishes criminal penalties for executives who certify financial reports knowing they do not comply with SOX requirements.
Section 802 addresses document retention, making it a crime to alter, destroy, or conceal documents to obstruct investigations.
Who Must Comply
SOX applies to all US public companies (companies listed on US stock exchanges), their management, and their external audit firms. Private companies are generally not subject to SOX, though many adopt SOX-like controls voluntarily, especially when preparing for an IPO.
Consequences of Non-Compliance
SOX violations carry severe penalties. Willful certification of non-compliant reports can result in fines up to $5 million and imprisonment up to 20 years. Companies face potential delisting, SEC enforcement actions, and shareholder lawsuits. SOX compliance is not optional for public companies.
In the next lesson, we will cover Sections 302 and 906 certifications.