SOX compliance refers to the Sarbanes-Oxley Act that was enacted in 2002 in the US to protect the public from enterprises and their unethical practices. It followed many scandals such as the Enron and the Tyco with both corporations reporting fraudulent activities that reached over $100 million. The act was named after the congressmen who created it, Paul Sarbanes and Michael Oxley. As the main aim of the law is to increase transparency, it is not only necessary for corporations to comply because of legal obligations but because it is ethical and encourages good business practices. 

What SOX compliance involves

SOX compliance can be very expensive for companies. A survey showed that expenditures related to the SOX act could reach up to $1.4 million. This is because it requires US public enterprises and overseas entities that trade in the US to follow a list of requirements. Private companies do not need to comply if they make less than $100 million in revenue.

Each section has different requirements. The most important sections are:

  • Section 404
  • Section 302
  • Section 409
  • Section 802
  • Section 401

Section 404

Section 404 is the implementation of controls to ensure that financial reporting is accurate, without errors and reliable. The internal controls are documented. To decrease the costs associated with SOX compliance, a lot of companies use tools that automatically detect unlawful activities and problems. Organisations that wish to automate their compliance processes should identify which activities need to be manual and which ones do not. Section 404 also oversees the effectiveness of internal controls and determines whether additional measures need to be taken.

Section 302

Section 302 requires CEOs, CFOs or other executives to confirm that the information contained in the report is true and accurate. When signing the document they attest that they have reviewed all the data and to the best of their knowledge nothing is misleading. The officers are responsible for the financial reports and effectiveness of internal controls so they need to identify any deficiencies and if any fraudulent activities have been detected.

If the officers have discovered deficiencies and they have not disclosed them, then they are likely to face consequences. The severity of the consequences depends on whether it was intentional or unintentional.

Section 409

Section 409 refers to an organisation’s responsibility to disclose any issues related to its financial condition. Material changes need to be reported as quickly as possible to protect consumers and investors. The language used to convey these issues should be simple so it is easy for the readers to understand and can be supported by additional data or graphs if deemed necessary. Examples of problems could include cyberattacks and data breaches.

Section 802

Section 802 details the consequences for destroying, concealing, modifying or falsifying records. Whoever knowingly chooses to alter financial information could face severe legal repercussions. The section also includes the responsibility to store audit and review records for five years after their conclusion. Companies or individuals who fail to do so could face time in prison, fines or a combination of the two. The penalties for falsifying and modifying information differ from the penalties for not adequately storing records.

Section 401

Section 401 highlights the importance that companies must follow the Generally Accepted Accounting Principles (GAAP) when submitting reports. It stresses that the reports follow all relevant legal laws and regulations and have no untrue statements or off-balance sheets.

SOX Compliance

SOX Compliance audit

SOX compliance audits are generally conducted once per year and it is conducted by external audits. It is performed before the financial reports are given to the SEC and attempts to find any errors or inaccurate information.

Companies that usually use software for SOX compliance may think that they are ready for the audit while in reality, they are unprepared. Software is helpful but it needs to be updated regularly to adapt to changing fraudulent behaviour. SOX compliance should not be left solely up to tools to manage – it needs human input as well. Organisations have to prepare their workplace by discouraging illegal activities and by giving employees the training they need.

Automation can reduce the number of resources allocated to SOX compliance, and it can streamline internal audits. Internal audits can be conducted so the company detects any errors early before the official audit.

Fraudulent activities and prevention

Fraudulent activities can go undetected when a lot of responsibility and power is given to one person. Companies should aim to detect any staff with excessive control over business processes and share that control with other employees. Financial duties should be given to more than one employee. Employees should also be encouraged to backup information and store it in a safe place.

The SOX compliance controls should be monitored and reviewed regularly to increase their efficiency and effectiveness. Companies may need to implement further controls or make changes to the current ones based on audit results and complexity.

SOX compliance may be lacking in an organisation where employees are not aware of their duties and roles. This is why during an audit, auditors may conduct interviews with employees, to ensure that they understand what their position requirements are. This can also identify whether the staff is managed effectively or if a change in management is needed.

Benefits of SOX compliance

SOX compliance can lead to efficient financial reporting as it improves documentation. Even though it might be costly, reliable financial reporting can also improve the business environment as employees feel better for working for an ethical organisation.

SOX compliance also reduces the possibility of data breaches and establishes a response plan in the event that fraudulent activities are undertaken. This protects the business, its growth and its future as its reputation is not eroded.

The most obvious benefit is the avoidance of legal consequences as the organisation follows all relevant legal requirements related to the SOX act. By complying, the company avoids any unnecessary costs.

Conclusion

SOX Compliance can be slightly complicated and officers carry a lot of responsibility as they have to ensure all financial reporting is accurate and error-free. They need to ensure every employee within the business is aware of the SOX sections they need to comply with and what is the best way to meet these requirements.

Polonious can detect errors and help with audit transparency. Employees will be able to fill out audit reports online and ensure that all information is stored accurately. Polonious can cross reference information and everything can be managed through a central hierarchy. In cases there is a non-conformance or an opportunity for improvement, Polonious automatically creates a follow-up case to ensure that actions has been taken.