SOX Section 302: Certifications, Clawbacks, and False Filings

A SOX Section 302 certification is the signed statement that a public company’s CEO and CFO must personally attach to every quarterly and annual report, confirming that they have reviewed the filing, that it is not materially false or misleading, and that they are responsible for the controls behind the numbers. The requirement comes from Section 302 of the Sarbanes-Oxley Act of 2002, codified at 15 U.S.C. § 7241, and the wording is prescribed by the SEC in Item 601(b)(31) of Regulation S-K.¹² Each officer signs a separate copy, and the certifications are filed as Exhibit 31 to the report.

What the CEO and CFO Are Certifying

The statute requires each signing officer to make six assertions about the report:

The officer has personally reviewed the report.
Based on the officer’s knowledge, the report contains no untrue statement of a material fact and does not omit anything that would make it misleading.
The financial statements and other financial information fairly present the company’s financial condition and results of operations.
The signing officers are responsible for establishing and maintaining the company’s disclosure controls and internal control over financial reporting.
The officers have evaluated the effectiveness of those controls and presented their conclusions in the report.
The officers have disclosed to the auditors and audit committee any significant deficiencies in the control systems and any fraud (of any size) involving management or employees with a significant role in those controls.¹

The language is not negotiable. Companies cannot paraphrase or shorten it, and each officer must sign a standalone certification rather than a joint one.²

The Two Control Systems Being Certified

Section 302 covers two separate systems, and the difference matters when something goes wrong. Disclosure controls and procedures are the broader set. They exist to make sure everything the company is required to report, financial or not, is captured, processed, and moved up to management in time to meet filing deadlines. Internal control over financial reporting is narrower, aimed specifically at the reliability of the financial statements and their compliance with generally accepted accounting principles.² A material legal risk buried in a subsidiary that never surfaces in the filing is a disclosure controls failure even if the accounting itself is clean.

The signing officers have to evaluate these controls regularly. Under the SEC’s implementing rule, domestic companies evaluate disclosure controls as of the end of each fiscal quarter, not just within a 90-day window as the original statute suggested.³ Foreign private issuers evaluate as of the end of each fiscal year. Officers must also disclose any changes to internal controls during the most recent quarter that materially affected, or are reasonably likely to affect, financial reporting.¹ A company cannot quietly rebuild a broken system between quarters and skip telling investors.

Section 302 Is Not Section 906

Every periodic filing carries two separate certifications from the CEO and CFO, and confusing them is one of the most common mistakes made about Sarbanes-Oxley.

The Section 302 certification is filed as Exhibit 31 under Exchange Act Rule 13a-14(a). It contains the detailed assertions about review, accuracy, controls, and disclosure of problems described above.⁴ Because it is “filed” with the report, it carries liability under Section 18 of the Exchange Act and the general anti-fraud provisions.

The Section 906 certification is a shorter statement required by 18 U.S.C. § 1350, furnished as Exhibit 32. It certifies that the report complies with Exchange Act requirements and that the financial information fairly presents the company’s condition and results.⁴ It is “furnished” rather than “filed,” so it sits outside Section 18 liability. What it carries instead is a dedicated criminal penalty: a knowing false Section 906 certification can bring fines up to $1 million and up to 10 years in prison, and a willful false certification can reach $5 million and 20 years.⁵ Those criminal numbers belong to Section 906, not Section 302, even though many summaries pin them on the wrong section. Section 906 falls to the Department of Justice; Section 302 enforcement is primarily an SEC matter.

What Happens if the Certification Is False

Section 302 does not have its own dedicated criminal penalty statute, but signing a false Exhibit 31 is not a low-consequence event. The SEC can bring civil enforcement actions under the Exchange Act’s anti-fraud provisions, seek financial penalties, and ask a federal court to bar the individual from serving as an officer or director of any public company. An officer-and-director bar effectively ends a career in public-company leadership, which is why securities lawyers treat these certifications with the same weight as criminal exposure.

A false certification can also feed private securities fraud litigation by shareholders and can be used as evidence of scienter in broader fraud cases. And because the same underlying misstatement almost always taints the Section 906 certification signed alongside it, the criminal penalties under 18 U.S.C. § 1350 typically come into play on top of whatever the SEC pursues.⁵

Compensation Clawback After a Restatement

Section 304 of Sarbanes-Oxley adds a personal financial consequence that runs alongside the certification regime. If a company has to restate its financials because of misconduct, the CEO and CFO must reimburse the company for any bonus, incentive compensation, or equity-based pay received during the 12 months after the original flawed report was filed or first made public, plus any profits from selling company stock during that same window.⁶

Section 304 requires misconduct to trigger recovery. The SEC’s newer Rule 10D-1, adopted under the Dodd-Frank Act, requires recovery of excess incentive compensation after any accounting restatement regardless of fault and reaches back three years rather than one. The two regimes now operate side by side, with Section 304 remaining the tool tied to SEC enforcement actions built on misconduct.

Where Section 302 Ends

A few boundaries are worth knowing, because Section 302 does not do everything people assume it does.

It is not the same rule as Section 404. Section 404 requires a separate annual management report assessing the overall effectiveness of internal control over financial reporting, and Section 404(b) requires the outside auditor to independently attest to that assessment. Companies below the accelerated-filer thresholds (generally a public float under $75 million) are exempt from the auditor attestation, but they still owe the Section 404(a) management assessment and the quarterly Section 302 certifications.⁷

The certification travels with amendments. When a company files a 10-K/A or 10-Q/A, the CEO and CFO in office at the time of the amendment must sign fresh Section 302 and Section 906 certifications for the amended filing; the originals do not carry over.⁸

The rule reaches foreign issuers. Any foreign private issuer filing under Section 13(a) or 15(d) of the Exchange Act must include the prescribed certifications in its annual report on Form 20-F, and Canadian filers using Form 40-F under the Multi-Jurisdictional Disclosure System face the same requirement.⁹¹⁰ The obligation does not extend to current reports on Form 6-K.

1
Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
2
eCFR. 17 CFR 229.601 – Exhibits
3
eCFR. 17 CFR 240.13a-15 – Controls and Procedures
4
eCFR. 17 CFR 240.13a-14 – Certification of Disclosure in Annual and Quarterly Reports
5
Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
6
Office of the Law Revision Counsel. 15 USC 7243 – Forfeiture of Certain Bonuses and Profits
7
eCFR. 17 CFR 240.12b-2 – Definitions
8
eCFR. 17 CFR 240.12b-15 – Amendments
9
U.S. Securities and Exchange Commission. Certification of Disclosure in Companies Quarterly and Annual Reports
10
U.S. Securities and Exchange Commission. Financial Reporting Manual – Topic 16