What Is the Sarbanes-Oxley Act?
Congress passed Sarbanes-Oxley, commonly shortened to SOX, in July 2002 after a wave of frauds destroyed billions in shareholder value and took down Arthur Andersen, one of the largest audit firms in the world. The law responded to a core failure: investors could not trust reported earnings because auditors were conflicted and executives faced little personal accountability.
SOX applies to all companies with securities registered in the US, including foreign issuers listed on American exchanges. It established the Public Company Accounting Oversight Board, ending the profession's era of self-regulation by giving the PCAOB power to set audit standards, inspect firms, and discipline auditors.
Key Provisions of SOX
Section 302 requires the CEO and CFO to personally certify each quarterly and annual report, attesting that the statements fairly present the company's condition. Section 404 requires management to assess internal control over financial reporting every year, and for larger companies known as accelerated filers, the external auditor must separately attest to those controls, which is the law's most expensive requirement.
Other provisions strengthened the system's plumbing. Auditors are barred from selling most consulting services to their audit clients and lead partners must rotate off engagements every five years, while audit committees composed of independent directors now hire and oversee the auditor. Section 906 adds criminal penalties of up to 20 years in prison for knowingly certifying false financials, and the law also protects whistleblowers who report fraud.
Why SOX Matters
SOX permanently raised the cost and rigor of being a public company. Annual compliance often runs into the millions of dollars for large filers, and the burden is one reason some companies stay private longer or choose a sale to private equity over an IPO. The JOBS Act of 2012 softened this by exempting emerging growth companies from the Section 404(b) auditor attestation for up to five years after going public.
For finance careers, SOX is unavoidable context. Auditors build much of their work around it, IPO teams must get a company SOX-ready before listing, and equity investors treat material weakness disclosures as red flags. Knowing what Sections 302 and 404 require, and why the law exists, is baseline literacy for anyone working with US public company financials.
