Sarbanes-Oxley Act of 2002
Kyle Ashcraft, CPA · 2019 CPA Exam Scores · 95 FAR · 98 BEC · 91 REG · 90 AUD
Corporate fraud was rampant in the early 2000s, and Congress responded with a law that changed how public companies report, who signs off on those reports, and what happens when someone lies. That's the Sarbanes-Oxley Act of 2002 (SOX).
SOX applies mainly to public companies (issuers), with a lighter touch on private companies. Rather than memorizing section numbers, it's more useful to know the law by topic — internal controls, executive accountability, audit process changes, the PCAOB, and penalties.
What does Section 404 require?
Section 404 requires public companies to have their internal controls audited every year, alongside the financial statement audit. When an auditor examines a public company, they're now looking at two things: the financial statements and disclosures themselves, and the effectiveness of the company's internal controls.
Without effective internal controls, no one can trust the numbers. If nobody is reviewing an accountant's work, there's nothing stopping manipulated figures from reaching investors. Section 404 exists to close that gap.
What do CEOs and CFOs have to certify?
SOX requires the CEO and CFO to sign a statement taking personal responsibility for the financial statements — so neither one can later claim ignorance if something goes wrong. That statement affirms that they:
- Are responsible for establishing and maintaining internal controls
- Have designed effective internal controls
- Have reasonable assurance that the financial statement figures are accurate
- Have communicated any control issues to the auditors and audit committee
- Believe, to their knowledge, that the financial statements contain no false statements
- Believe the financial statements fairly represent the company's financial condition in all material respects
How does SOX affect executive pay and loans?
If executives receive a bonus based on financial statements that later get restated due to inaccurate reporting, they have to return that bonus — a direct disincentive against misstating results to inflate pay. Separately, executives and board members are barred from taking out personal loans from the company.
What new disclosures does SOX require?
SOX added footnote disclosure requirements that didn't exist before: operating leases, contingent obligations, and relationships with unconsolidated subsidiaries. A contingent obligation, for example, is a liability the company might owe in the future but isn't certain about yet — SOX requires a footnote explaining it rather than letting it stay hidden off the balance sheet.
How did SOX change the audit process?
Beyond the Section 404 internal control audit, three changes stand out:
- Seven-year workpaper retention. Auditors must keep their workpapers for public company audits for seven years, so the work can be revisited if questions come up later.
- Five-year partner rotation. The lead audit partner has to rotate off an engagement every five years, preventing that partner from growing too close to the company's management over time.
- A stronger audit committee. The audit committee selects the external auditor and sets its compensation. Every member must already sit on the company's board of directors, at least one member must qualify as a financial expert, and all members must be independent — meaning they can't accept consulting fees from the company.
A financial expert doesn't need one specific credential — experience with internal controls, GAAP, other audit committees, or auditing financial statements can all qualify.
What is the PCAOB?
The Public Company Accounting Oversight Board (PCAOB) is a nonprofit created by SOX to oversee the audits of public companies. It sets auditing standards and inspects completed audits to check they were done correctly. Every firm that wants to audit public companies must register with the PCAOB.
The PCAOB doesn't operate independently, though: the SEC has authority over it and must approve any new PCAOB rules or standards. And when it comes to prosecuting criminal violations, that authority sits with the SEC, not the PCAOB — the PCAOB has no power to bring criminal charges.
What else does SOX cover?
- Whistleblower protection. Employees who report wrongdoing can't be fired or otherwise retaliated against for doing so — the safer reporting feels, the more likely fraud gets reported instead of hidden.
- A written code of conduct. Companies must adopt one for their senior officers to reinforce ethical behavior.
- Ownership disclosure. Anyone holding at least 10% ownership in a company must file disclosures, giving investors visibility into who actually owns it.
What are the penalties for violating SOX?
SOX significantly increased the criminal consequences for corporate misconduct, layering fines on top of prison time:
| Violation | Maximum penalty |
|---|---|
| Knowingly/willfully false CEO or CFO certification | $5 million fine and/or 20 years in prison |
| Tampering with evidence in an investigation (e.g., destroying documents) | 20 years in prison |
| Securities fraud | 25 years in prison |
Want the full AUD and BEC framework?
My free CPA 101 course covers the study approach I used to score 90+ on every CPA exam section.
More on internal controls
Kyle Ashcraft, CPA scored 90 or above on every section of the CPA exam in 2019, including a 90 on AUD. He is the founder and sole instructor of Maxwell CPA Review, a complete CPA review course covering all six sections, where he creates every lecture, textbook and study outline himself.
Double-click to edit...