What Is SOX? The Sarbanes-Oxley Act Explained

The Sarbanes-Oxley Act is a 2002 federal law that overhauled how public companies report their finances and how their auditors are regulated. It requires CEOs and CFOs to personally certify the accuracy of financial reports, forces companies to test and disclose the strength of their internal controls, created an independent board to police accounting firms, and protects employees who report fraud. Executives who sign off on knowingly false financials face up to 20 years in federal prison and $5 million in fines.¹

Why the Law Exists

Congress passed SOX after Enron, WorldCom, Tyco, and Adelphia collapsed under massive accounting fraud in the early 2000s. Enron hid billions in debt through off-balance-sheet entities. WorldCom inflated its assets by roughly $11 billion. In each case, outside auditors either missed or enabled the fraud, and Enron’s auditor, Arthur Andersen, was convicted of obstruction for shredding audit documents after learning of an SEC investigation. Senator Paul Sarbanes and Representative Michael Oxley co-sponsored the response, whose stated purpose is “to protect investors by improving the accuracy and reliability of corporate disclosures.”²

Who Has to Comply

SOX applies primarily to companies with securities registered with the Securities and Exchange Commission or that are required to file periodic reports. A company triggers SEC reporting when it lists securities on a U.S. exchange, has more than $10 million in total assets and a class of equity securities held by 2,000 or more people, or has completed a public offering.³ Wholly owned subsidiaries whose numbers flow into a public parent’s consolidated statements are covered, as are foreign private issuers listed on U.S. exchanges.

Public accounting firms that audit any covered company must register with the Public Company Accounting Oversight Board and follow its standards. Without registration, a firm cannot issue an audit report for a public company.⁴

Private companies are mostly exempt, but two provisions reach everyone: the criminal ban on destroying documents to obstruct a federal investigation, and the prohibition on retaliating against whistleblowers. A private company that shreds records during a federal probe faces the same 20-year maximum sentence as a Fortune 500 firm.⁵

Smaller public companies get a narrower carve-out. Non-accelerated filers, generally those with a public float below $75 million, are permanently exempt from the external auditor attestation on internal controls under Section 404(b); management still assesses the controls, but no outside auditor signs off.⁶ The 2012 JOBS Act added a similar exemption for emerging growth companies during their first five years after an IPO, subject to revenue and debt-issuance caps.⁷

What Executives Must Personally Certify

SOX built two separate certification requirements, one civil and one criminal, and they operate independently.

Section 302: Civil Certification

Under Section 302, the CEO and CFO must personally certify every quarterly and annual report filed with the SEC. They confirm that they have reviewed the report, that it contains no material misstatements or omissions, and that the financial statements fairly present the company’s financial condition and results of operations. They also acknowledge responsibility for the company’s internal controls and confirm that they have evaluated those controls within 90 days before the filing date.⁸ If they find significant deficiencies, material weaknesses, or any fraud involving people with a role in the internal controls, they must disclose it to the auditors and audit committee.

Section 906: Criminal Certification

Section 906 adds a criminal layer. Every periodic report must include a separate written statement from the CEO and CFO certifying that the report fully complies with SEC requirements and fairly presents the company’s finances. An officer who signs this certification knowing the report does not comply faces up to $1 million in fines and 10 years in prison. If the false certification is willful, the ceiling rises to $5 million and 20 years.¹ A knowing violation means the officer was aware the report was non-compliant but signed anyway. A willful violation requires deliberate intent to deceive.

Section 304: Compensation Clawbacks

When a company restates its financials because of misconduct, Section 304 requires the CEO and CFO to reimburse the company for incentive-based compensation and stock sale profits they received during the 12 months after the faulty statements were filed. The clawback applies even if the individual executive was not personally responsible for the misconduct.

Internal Control Reporting

Section 404 requires every annual report to include a formal assessment of the company’s internal controls over financial reporting.⁶ Internal controls here means the systems and checks a company uses to make sure transactions are properly authorized, recorded, and reported. Management picks a recognized evaluation framework (most companies use COSO) and tests whether the controls actually work.

For companies that are not exempt, Section 404(b) adds an outside layer. The company’s registered public accounting firm must independently examine management’s assessment and issue its own opinion on whether the controls are effective.⁹ The auditor samples controls, walks through transaction flows, and evaluates whether gaps could produce a material misstatement.

Two categories of problems can surface. A significant deficiency is a gap serious enough to deserve the audit committee’s attention. A material weakness is worse: it means there is a reasonable possibility that a material error in the financial statements would not be caught in time. A disclosed material weakness typically triggers negative market reactions, which is why companies invest heavily in software, specialized staff, and year-round monitoring.

Auditor Oversight and Independence

Before SOX, the accounting profession largely regulated itself. The law ended that by creating the Public Company Accounting Oversight Board, a nonprofit corporation established by Congress and operating under SEC oversight.¹⁰ The PCAOB sets auditing standards, inspects registered firms, and disciplines firms and individual auditors. Sanctions run from fines through suspension to permanent revocation of a firm’s registration or a permanent bar for an individual.

SOX also requires the lead audit partner and the reviewing partner on an engagement to rotate off after five consecutive years, and a partner who rotates off generally must wait five years before returning to the same engagement. The goal is to prevent the long-term auditor-client relationships that contributed to the pre-SOX scandals.

A registered accounting firm cannot sell certain non-audit services to its audit clients. The banned list covers bookkeeping, financial information systems design, appraisal or valuation, actuarial services, internal audit outsourcing, management functions, human resources, and broker-dealer or investment banking services.¹¹ Any non-audit service not on the prohibited list must be pre-approved by the audit committee.

Audit Committee and Executive Loan Ban

Every public company must maintain an audit committee composed entirely of independent board members. A director qualifies as independent only if they accept no consulting, advisory, or other compensation from the company beyond board fees and are not an affiliated person of the company or its subsidiaries.¹² The committee hires and oversees the outside auditor, establishes procedures for handling complaints about accounting or auditing matters (including a confidential channel for employees), and can engage independent legal counsel and other advisors at the company’s expense.

Section 402 makes it unlawful for a public company to extend personal loans to any director or executive officer. This targets the pre-SOX pattern of executives borrowing hundreds of millions from their own companies on favorable terms. Loans outstanding when the law took effect in July 2002 were grandfathered but cannot be materially modified or renewed.¹³ Narrow exceptions cover home improvement loans, consumer credit, and margin loans made in the ordinary course of business on terms available to the public.

Document Destruction Crimes

Section 802 created two criminal statutes aimed at preserving financial records. The first, 18 U.S.C. § 1519, makes it a federal crime to alter, destroy, conceal, or falsify any record with the intent to obstruct a federal investigation, with a maximum penalty of 20 years in prison.⁵ It applies to anyone, not just public companies, and it covers fabricated records as well as destroyed ones.

The second requires accounting firms to retain all audit workpapers for at least five years from the end of the fiscal period audited. An accountant who knowingly and willfully violates this retention rule faces up to 10 years in prison.¹⁴ The rule was a direct response to Arthur Andersen’s shredding of Enron audit documents; before SOX, no federal statute required auditors to preserve their working papers for a defined period.

Whistleblower Protections

SOX gives employees who report suspected fraud both a civil claim and a criminal shield, and the two tracks operate independently.

Civil Protection Under Section 806

Section 806, codified at 18 U.S.C. § 1514A, prohibits any public company, subsidiary, or agent from retaliating against an employee who reports conduct the employee reasonably believes violates federal securities laws, SEC rules, or any federal law relating to fraud against shareholders. Protected reporting includes giving information to a federal agency, a member of Congress, or a supervisor with authority to investigate.¹⁵

An employee who experiences retaliation must file a complaint with OSHA within 180 days of the adverse action, or within 180 days of learning of it.¹⁶ That deadline is strict. If OSHA does not issue a final decision within 180 days, the employee can move the case to federal district court. Remedies include reinstatement with the same seniority, back pay with interest, and compensation for special damages such as litigation costs and attorney fees.

Criminal Penalty Under Section 1107

Section 1107 makes it a federal offense to knowingly retaliate against any person for providing truthful information to law enforcement about a possible federal crime. This provision is not limited to employees of public companies. Anyone who takes harmful action against an informant, including interfering with their employment, faces up to 10 years in federal prison.¹⁷ Because the two tracks are independent, a single act of retaliation can trigger both an OSHA complaint and a federal prosecution.

1
Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
2
U.S. Department of Labor. Sarbanes-Oxley Act of 2002
3
Securities and Exchange Commission. Exchange Act Reporting and Registration
4
Public Company Accounting Oversight Board. Section 2 – Registration and Reporting
5
Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations
6
Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
7
Securities and Exchange Commission. Emerging Growth Companies
8
Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
9
United States Securities and Exchange Commission. Study of the Sarbanes-Oxley Act of 2002 Section 404 Internal Control over Financial Reporting Requirements
10
Public Company Accounting Oversight Board. About the PCAOB
11
Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence
12
Office of the Law Revision Counsel. 15 USC 78j-1 – Audit Requirements
13
Office of the Law Revision Counsel. 15 USC 78m – Periodical and Other Reports
14
Office of the Law Revision Counsel. 18 USC 1520 – Destruction of Corporate Audit Records
15
Office of the Law Revision Counsel. 18 USC 1514A – Civil Action to Protect Against Retaliation in Fraud Cases
16
Occupational Safety and Health Administration. Filing Whistleblower Complaints Under the Sarbanes-Oxley Act
17
Office of the Law Revision Counsel. 18 USC 1513 – Retaliating Against a Witness, Victim, or an Informant