The Sarbanes-Oxley Act of 2002 (SOX) is public accounting reform and investor legislation. The 107th Congress wrote the bill under HR 3763. With the passing of SOX, Congress sought to improve both the accuracy and reliability of financial disclosures after the high-profile business collapses of both Enron and WorldCom.
SOX Reporting Requirements
President George W. Bush signed SOX into law July 2002. The new rules ushered in multiple changes in the manner public companies issue financial statements with the Securities and Exchange Commission (SEC). In addition to the requirement for SEC registrants to engage external auditors to audit and opine on financial statements, the CEO and CFO of all publicly traded companies under SOX must certify to the competency of their company's internal control structure.
The Section 302 Certification filed with quarterly and annual reports issued with the SEC, focuses on disclosure controls and procedures, which are considered separate from the company's internal controls over financial reporting. The SOX Section 404 Certification process independently addresses such controls.
Section 302 Certification Requirements
When signing the Certification of the financial reports filed with the SEC, the CEO and CFO attest to the following requirements of Section 302:
- They have read the report filed with the SEC,
- The report does not contain untrue statements or omit statements of a material nature,
- Statements made in the reports are not misleading,
- Financial conditions and operations of the company are fairly represented by the report,
- Internal controls of the company are their responsibility and the internal controls are designed in such a way that material information is communicated to them in a timely manner,
- Internal controls within the company are assessed for operating effectiveness within 90 days of the certification and the conclusions on effectiveness have been included in the report,
- Significant deficiencies in design or operation of internal controls that could impact the ability to record, process, summarize, and report financial information have been communicated to the company's independent auditors and the audit committee of the Board of Directors,
- Material weaknesses in internal controls have been communicated to the company's independent auditors,
- They have disclosed any fraud by senior management or other employees who have a significant role in internal controls (materiality is not a consideration with fraud), and
- Whether there have been significant changes or corrective actions with regard to significant deficiencies and material weaknesses in internal controls or other factors subsequent to the date of the original evaluation of controls.
Stages of SOX Implementation
Congress enacted the key components of SOX in stages. On March 21, 2003, Congress implemented the requirements of the Section 302 Certification. The more robust component of SOX, Section 404, focuses on management's annual assessment of internal controls. In general, Section 404's implementation occurred for fiscal years ending after November 15, 2004 for large market capitalization corporations.
Degree of Testing Required to Support Section 302 Certification
When companies performed certification testing under Section 302, prior to Section 404's implementation, the testing and procedures that supported the certification tended to be less vigorous. The analysis necessary to meet Section 404's requirements includes testing the effectiveness of controls throughout the fiscal year and issuing an internal control annual assessment. As a result of the implementation of Section 404, the testing to support Section 302 quarterly certifications also intensified to coincide and support the assessments required for Section 404.
Kimberly Sernel - Education and Experience Kimberly Sernel is a CPA and a writer, graduating as class valedictorian from the University of Illinois at ...
