SOX compliance
Meeting the requirements of the US Sarbanes-Oxley Act, which makes public companies' executives responsible for accurate financial reporting and effective internal controls.
In short
- It applies to companies with securities registered with the SEC, including foreign companies listed in the US.
- Section 404 requires management to assess internal control over financial reporting each year.
- Canada's equivalent for listed companies is National Instrument 52-109.
The Sarbanes-Oxley Act, or SOX, was passed in the United States in 2002 after major accounting scandals. It aims to make corporate financial reporting more reliable by holding executives personally accountable and requiring strong internal controls.
Key sections
- Section 302: the CEO and CFO must certify in each quarterly and annual report that the financial statements are accurate and that they are responsible for disclosure controls.
- Section 404: management must assess and report on the effectiveness of internal control over financial reporting (ICFR) each year. For larger companies, the external auditor must also attest to that assessment.
- Section 802: criminal penalties for destroying or falsifying records.
What compliance involves
Companies document their key financial processes, identify the risks of material misstatement, design controls to address them and test those controls regularly. Typical controls include approval workflows, segregation of duties, account reconciliations, review of manual journal entries and system access controls. Deficiencies are classified by severity, and a material weakness must be disclosed publicly.
For private companies
SOX does not apply to private companies, but its practices are widely adopted by companies preparing for an IPO, backed by investors, or simply wanting stronger controls. In Canada, listed companies follow National Instrument 52-109, which requires similar CEO and CFO certifications.
Worked example
A control and its test
A listed company's control states that every manual journal entry over $50,000 is reviewed and approved by someone other than the preparer before posting. Internal audit selects 25 such entries from the year and finds evidence of independent approval for 24. The one exception is documented, its cause is fixed, and the deficiency is assessed as not significant.