The Sarbanes-oxley Act
Learning outcome statements
The learning outcome statement relevant for this section is:
- describe the major internal control provisions of the Sarbanes-Oxley Act
The Sarbanes-Oxley Act
The Sarbanes-Oxley Act of 2002 (SOX) is a U.S. federal law enacted in response to corporate accounting scandals of the early 2000s, such as Enron and WorldCom, which eroded public trust in financial reporting. Its primary goal is to protect investors by improving the accuracy and reliability of corporate disclosures and strengthening internal controls over financial reporting.
SOX applies to all publicly traded companies in the United States, as well as wholly owned subsidiaries and foreign companies listed on U.S. stock exchanges. It also impacts accounting firms that audit these companies.
The Act is administered and enforced by several regulatory bodies, primarily the Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB). The SEC oversees compliance and rulemaking, while the PCAOB establishes auditing standards and inspects the work of public accounting firms.
Below is an outline of the key titles of SOX. The provisions most tested on the CMA exam are Sections 201, 203, 204, 302, 404, and 407.
Title I – Public Company Accounting Oversight Board (PCAOB)
Title I of the Sarbanes-Oxley Act established the Public Company Accounting Oversight Board (PCAOB) to oversee the audits of public companies and protect investors by promoting informative, accurate, and independent audit reports. Key provisions include:
- Creation of the PCAOB as a nonprofit corporation under the oversight of the Securities and Exchange Commission (SEC)
- Registration requirement for all public accounting firms that prepare audit reports for publicly traded companies
- Regular inspections of registered accounting firms to assess their compliance with auditing standards
- Establishment of auditing, quality control, ethics, independence, and other professional standards
- Authority to conduct investigations and disciplinary proceedings against audit firms and associated persons
This title fundamentally reshaped the regulation of the auditing profession and placed oversight in the hands of an independent authority rather than self-regulation through the profession itself.
Title II – Auditor independence
Title II of the Sarbanes-Oxley Act contains provisions designed to preserve the independence of external auditors and reduce conflicts of interest. These rules aim to ensure that auditors maintain objectivity when evaluating a company’s financial statements. Key provisions include:
- Prohibition on auditors providing certain non-audit services to audit clients (e.g., bookkeeping, financial information systems design, valuation services, and internal audit outsourcing) (Section 201)
- Mandatory rotation of the lead audit partner every five years (Section 203)
- Requirement for the audit committee to pre-approve all audit and non-audit services provided by the external auditor
- Requirement that auditors report directly to the company’s audit committee rather than management
- A one-year cooling-off period: the audit firm may not audit a company whose CEO, CFO, controller, chief accounting officer or equivalent was employed by the firm and took part in that company’s audit during the prior year (Section 206)
- GAO study of the potential effects of requiring mandatory rotation of audit firms (Section 207); note that SOX itself requires rotation of the lead audit partner, not the audit firm
These measures help safeguard the integrity and impartiality of the audit process and promote confidence in the financial statements issued by public companies.
Title III – Corporate responsibility
Title III of the Sarbanes-Oxley Act reinforces the accountability of senior executives for the accuracy and completeness of corporate financial reports. It introduces significant obligations for corporate officers to personally certify and assume responsibility for their company’s financial disclosures. Key provisions include:
- Requirement for the Chief Executive Officer (CEO) and Chief Financial Officer (CFO) to personally certify the accuracy and completeness of financial reports submitted to the SEC (Section 302)
- Section 302 certification also covers the effectiveness of disclosure controls and procedures, and requires reporting any deficiencies or fraud to the auditors and audit committee
- Establishment of internal control responsibilities for management, including the design, maintenance, and assessment of internal control over financial reporting
- Prohibition on officers and directors improperly influencing, coercing, manipulating, or misleading the company’s auditors (Section 303)
- Criminal penalties for knowingly or willfully false certifications are imposed separately, under Section 906 (Title IX)
- Assigns responsibility to the audit committee for the appointment, compensation, and oversight of the external auditor, reinforcing the committee’s independence from management and strengthening corporate accountability.
This title aims to ensure that corporate leadership is directly accountable for the integrity of financial statements and internal control systems.
Title IV – Enhanced financial disclosures
Title IV focuses on increasing transparency and the reliability of financial disclosures made by public companies. It includes provisions that aim to strengthen investor confidence through improved financial reporting. Key provisions include:
- Requirement for more timely and accurate disclosure of material changes in financial condition or operations (Section 409, real-time issuer disclosures)
- Mandatory disclosure of off-balance sheet transactions and obligations, such as operating leases and contingent liabilities
- Prohibition of personal loans to executive officers and directors (Section 402)
- Enhanced disclosure of internal control effectiveness: Section 404(a) requires management to issue an annual report assessing the effectiveness of internal control over financial reporting, and Section 404(b) requires the external auditor to attest to that assessment (the attestation requirement applies only to accelerated filers; smaller non-accelerated filers are exempt)
- Requirement for public companies to disclose whether the audit committee includes at least one financial expert, and if not, why (Section 407)
- Accelerated reporting deadlines for financial statements and insider trading disclosures
- Greater accountability for financial disclosures, including more rigorous certification requirements for senior executives, and the requirement for public companies to disclose whether they have adopted a code of ethics for senior financial officers, including provisions to promote honest and ethical conduct, full disclosure, and compliance with applicable laws
These measures aim to provide investors and regulators with a clearer, more complete picture of a company’s financial position and risk exposures.
Certifications compared: Sections 302, 404, and 906
The exam often tests the difference between these certification and assessment requirements:
| Section | Who certifies | What’s certified | Consequence of a false certification |
|---|---|---|---|
| 302 | CEO and CFO | Each periodic report is accurate and complete, and disclosure controls are effective | Civil liability |
| 404 | Management (404(a)) and the external auditor (404(b)) | Effectiveness of internal control over financial reporting | Material weaknesses must be disclosed; the 404(b) auditor attestation applies only to accelerated filers |
| 906 | CEO and CFO | The periodic report complies with SEC requirements and fairly presents the company’s financial condition and results | Criminal liability - a fine of up to $1 million and imprisonment of up to 10 years for a knowing violation; up to $5 million and 20 years for a willful violation |
Title VII – Studies and reports
Title VII directs the GAO and SEC to study related topics, such as the consolidation of public accounting firms and the role of credit rating agencies. It contains no internal control provisions and isn’t a focus of the CMA exam.
Title VIII – Corporate and criminal fraud accountability
Title VIII of the Sarbanes-Oxley Act focuses on deterring and punishing corporate fraud and document tampering. It strengthens criminal penalties for fraudulent financial activity and reinforces protections for whistleblowers. Key provisions include:
- Creation of new federal offenses for altering, destroying, or falsifying records with the intent to obstruct a federal investigation (including audit records), with penalties including fines and imprisonment of up to 20 years
- Requirement for accountants and auditors to retain workpapers and audit documentation for a minimum of five years
- Protection for whistleblowers who report fraudulent activities, including prohibitions on retaliation by employers
This title emphasizes the importance of ethical conduct, transparency, and accountability in corporate reporting and audit practices.
Title IX – White-collar crime penalty enhancements
Title IX increases criminal penalties for corporate fraud. Key provisions include:
- Enhanced penalties for mail and wire fraud related to corporate misconduct (Section 903)
- A criminal certification requirement under which the CEO and CFO must certify that each periodic report containing financial statements complies with SEC requirements and fairly presents the company’s financial condition and results, with a knowing violation punishable by a fine of up to $1 million and imprisonment of up to 10 years, and a willful violation by up to $5 million and 20 years (Section 906)
This title adds criminal consequences on top of the civil certification and disclosure requirements found elsewhere in the Act.
Title X – Corporate tax returns
Title X contains a brief but symbolic provision intended to reinforce executive accountability. Key provision includes:
- A “sense of the Senate” provision (Section 1001) that the Chief Executive Officer (CEO) of each publicly traded company should sign the company’s federal income tax return. It states an expectation rather than a binding legal requirement, and it highlights the personal responsibility of top executives in ensuring the accuracy and completeness of tax filings, aligning with the broader accountability principles of the Sarbanes-Oxley Act.