The Sarbanes-Oxley Act: A Framework for Corporate Governance and Integrity

The Sarbanes-Oxley Act was enacted in 2002 in response to a series of high-profile corporate accounting scandals.

The Act established the Public Company Accounting Oversight Board (PCAOB) to oversee the auditing of public companies. The PCAOB is responsible for registering public accounting firms and inspecting their audits.

The PCAOB also sets auditing standards and enforces compliance with those standards. This includes conducting inspections of audit firms and imposing penalties for non-compliance.

You might enjoy: Pakistan Standards & Quality Control Authority

The Sarbanes-Oxley Act was passed into law on July 30, 2002. Its primary goal is to protect investors by improving the accuracy and reliability of financial reporting and corporate disclosures.

The act was named after its sponsors: U.S. Sen. Paul Sarbanes (D-Md.), and U.S. Rep. Michael Oxley, (R-Ohio). Former U.S. President George W. Bush, who signed the act into law, called it "the most far-reaching reforms of American business practices since the time of Franklin Delano Roosevelt."

The act was created in response to several corporate and accounting scandals in the early 2000s, including Enron, Tyco International, WorldCom, Adelphia, and Peregrine Systems. These scandals eroded public trust in the financial markets, cost investors billions of dollars, and prompted lawmakers to take action.

Worth a look: U. S. Steel Košice, S.r.o.

The Sarbanes-Oxley Act delivered comprehensive reform to the public company corporate accounting practices and public accounting firms audit procedures. The initial impact of SOX was clearly evident by looking at the number of restatements in 2005 and 2006.

Here are the key statistics on restatements:

The Sarbanes-Oxley Act created a new quasi-government agency, the Public Company Accounting Oversight Board (PCAOB), to oversee and regulate public accounting firms auditing public companies.

The Sarbanes-Oxley Act is a complex piece of legislation with several key provisions. Section 302 mandates that senior corporate officers personally certify in writing that the company's financial statements comply with SEC disclosure requirements.

Officers who sign off on financial statements that they know to be inaccurate face criminal penalties, including prison terms. This is a serious consequence that highlights the importance of accurate financial reporting.

Section 404 requires that management and auditors establish internal controls and reporting methods to ensure the adequacy of those controls. This can be a costly and time-consuming process for publicly traded companies.

A unique perspective: Fidelity Investments Corporate Officers

Section 802 contains the rules that affect recordkeeping, including the destruction and falsification of records, retention periods, and specific business records that companies need to store. Companies must store electronic communications as part of their recordkeeping requirements.

The Sarbanes-Oxley Act also outlines requirements for information technology departments regarding electronic records. Companies must define which company records need to be kept on file and for how long.

The cost of Sarbanes-Oxley (SOX) compliance can vary widely depending on the size and complexity of the company, with smaller companies seeing costs as low as $200,000 annually and larger companies with over $10 billion in revenue seeing costs of over $2 million annually.

According to a 2007 FEI survey, the average compliance costs for decentralized companies were $1.9 million, while centralized company costs were $1.3 million, highlighting the benefits of automation and centralization in reducing compliance costs.

The costs of compliance have continued to decline since 2004, with a 2011 SEC study finding that Section 404(b) compliance costs have decreased, especially after 2007 accounting guidance.

Worth a look: Pensions Act 2007

A 2006 study by Foley & Lardner found that nearly 70% of survey respondents believed public companies with revenues under $251 million should be exempt from SOX Section 404, suggesting that smaller companies may face disproportionate compliance costs.

Here is a rough estimate of the costs of SOX compliance by company size:

The cost-benefit of compliance is a crucial aspect of Sarbanes-Oxley (SOX) regulations. Compliance costs can vary widely depending on the size and complexity of the company, with smaller companies paying as low as $200,000 annually and larger companies paying over $2 million annually.

A 2019 study in the Journal of Law and Economics found that SOX is effective in curbing the private benefits of control. The study also found that targeted firms improve the efficiency of investment, cash management, and chief executive officers' compensation relative to firms not targeted by SOX.

Compliance costs have continued to decline relative to revenues since 2004. In 2007, the average compliance costs for 168 companies with average revenues of $4.7 billion were $1.7 million (0.036% of revenue). However, cost for decentralized companies were considerably more than centralized companies.

For more insights, see: SOX 404 Top–down Risk Assessment

The FEI Survey (Annual) provides valuable insights into SOX Section 404 costs. Here are some key findings:

The survey also found that cost for decentralized companies were considerably more than centralized companies. For example, in 2007, the average compliance costs for decentralized companies were $1.9 million, while centralized company costs were $1.3 million.

The cost of compliance is not just a one-time expense, but an ongoing process. The SEC study found that Section 404(b) compliance costs have continued to decline, especially after 2007 accounting guidance.

If this caught your attention, see: When Are Product Costs Matched Directly with Sales Revenue

All publicly-traded companies, wholly-owned subsidiaries, and foreign companies that are publicly traded and do business in the United States must comply with SOX.

To ensure compliance, CEOs and CFOs must certify the company's financial report and the effectiveness of the company's internal controls. They must review the report, confirm that it does not contain any untrue statements of material fact, and fairly represent the company's financial condition.

The certification process requires CEOs and CFOs to conduct a reasonable level of due diligence, including performing a careful review of the financial report, interviewing company personnel, and consulting with the company's primary audit partner or external audit team.

The SEC requires year-end financial disclosure reports and internal controls reports. Financial disclosures must contain reporting of material changes in financial condition.

Here are the key players responsible for SOX compliance:

By understanding these key players and their responsibilities, companies can enhance their SOX compliance and reduce the risk of costly and time-consuming compliance issues.

The Sarbanes-Oxley Act has brought about numerous benefits for firms, investors, and the overall financial reporting system.

One notable benefit is the improvement in corporate transparency, as seen in research by Arping and Sautner (2010) which found that cross-listed firms became significantly more transparent following SOX.

The act has also led to a reduction in borrowing costs for companies that improved their internal control, by between 50 and 150 basis points, as indicated by Skaife, Collins, Kinney, and LaFond (2006).

A study by the Institute of Internal Auditors (2005) found that corporations have improved their internal controls and that financial statements are perceived to be more reliable.

Research by Donelson, Ege, and McInnis (2017) indicates that firms with reported material weaknesses have significantly higher fraud, highlighting the importance of maintaining strong internal controls.

Here are some key statistics on the benefits of SOX:

In addition to these benefits, SOX has also led to increased investor confidence, as stronger financial integrity and standardized financial reporting have become the norm.

Lord & Benoit Report (2006) found that companies with no material weaknesses in their internal controls or those that corrected them in a timely manner experienced much greater increases in share prices than companies that did not.

The act has also mandated more robust internal audit departments to perform year-round monitoring and testing of internal controls, helping executives evaluate the internal control environment.

Overall, the benefits of SOX far outweigh the costs, with many firms experiencing increased share prices, lower borrowing costs, and improved internal controls.

A different take: Increased Limit Factor

The Sarbanes-Oxley Act has several key provisions that aim to improve corporate governance and financial reporting. Section 302 requires public companies to adopt internal procedures for ensuring accuracy of financial statements and makes the CEO and CFO directly responsible for the accuracy, documentation, and submission of the financial reports and internal control structure.

Section 302 also mandates that senior corporate officers personally certify in writing that the company's financial statements comply with SEC disclosure requirements and "fairly present in all material respects the financial condition and results of operations of the issuer" at the time of the financial report.

Section 404 requires that management and auditors establish internal controls and reporting methods to ensure the adequacy of those controls. This section is often criticized for being expensive to implement, but it has led to improved audit standards and internal control frameworks.

The Sarbanes-Oxley Act also created the Public Company Accounting and Oversight Board (PCAOB) to oversee public audit companies and promulgate auditing standards to ensure quality reporting and independent auditing.

Additional reading: Standards Board for Alternative Investments

Here are the key sections of the Sarbanes-Oxley Act:

Section 404 also requires external auditors to assess the effectiveness of a company's internal control framework. A failure to do so can result in a qualified audit opinion and significant consequences for company executives.

The Sarbanes-Oxley Act has led to improved corporate governance and financial reporting. It has also increased regulatory oversight and expanded federal powers to prevent corporate fraud.

The Sarbanes-Oxley Act requires public companies to hire independent auditors to review their accounting practices.

The Act defines the rules of engagement for corporate audit committees and external auditors, ensuring a fair and unbiased review process.

The Public Company Accounting Oversight Board (PCAOB) was created to set standards and rules for audit reports.

All accounting firms that audit public companies are required to register with the PCAOB, which investigates and enforces compliance.

The PCAOB's primary goal is to protect investors by ensuring the accuracy and reliability of financial reports.

The Sarbanes-Oxley Act requires CEOs and CFOs to certify the company's financial report and the effectiveness of the company's internal controls.

The certification confirms that the report does not contain any untrue statements of material fact and fairly represents the company's financial condition.

CEOs and CFOs are also responsible for establishing and maintaining an effective internal controls environment.

They must evaluate the effectiveness of the issuer's internal controls within 90 days of the report and disclose any significant deficiencies in the design and operation of the company's internal controls.

Public companies are required to maintain an audit committee that is independent of management and not involved in day-to-day operations.

At least one member of the committee must be a financial expert, and the audit committee appoints the external auditors and approves their compensation.

Worth a look: Foreign Exchange Controls

Whistleblower protection is a crucial aspect of the Sarbanes-Oxley Act. Section 806 prohibits retaliation against employees who disclose reasonably perceived potential or actual violations of securities fraud, shareholder fraud, bank fraud, or other federal offenses.

Under Section 806, remedies for retaliation include reinstatement with the same seniority status, back pay with interest, and other forms of relief. The SEC can also take legal action against employers who retaliate against whistleblowers.

The Sarbanes-Oxley Act also has provisions for criminal penalties for retaliation against whistleblowers. Section 1107 states that knowingly retaliating against a whistleblower can result in fines and imprisonment for up to 10 years.

Here are some key facts about whistleblower protection under the Sarbanes-Oxley Act:

In addition, Section 806 prohibits companies from taking actions to impede employees from contacting the SEC directly to report a possible securities violation. Non-disclosure agreements and severance agreements may also be prohibited if they specifically prevent employees from reporting concerns directly to the SEC.

Intriguing read: International Prenuptial Agreements

Whistleblower retaliation penalties can be severe and far-reaching. If an employer retaliates against a whistleblower, they can face significant consequences. According to Section 806 of the Sarbanes-Oxley Act, employers can be held liable for retaliation, which can include reinstatement, back pay, and other remedies.

In some cases, employers may be subject to fines and imprisonment. Section 806 provides that "whoever knowingly, with the intent to retaliate, takes any action harmful to any person... shall be fined under this title, imprisoned not more than 10 years, or both." This means that employers who retaliate against whistleblowers can face serious penalties, including fines and imprisonment.

The Sarbanes-Oxley Act also provides for civil penalties for retaliation. In one notable case, a jury awarded a former senior manager at Progenics Pharmaceuticals, Inc. $5 million in damages for retaliation. This case highlights the severity of the penalties that can be imposed on employers who retaliate against whistleblowers.

Here are some key penalties for retaliation against whistleblowers:

It's worth noting that the Sarbanes-Oxley Act also provides for private agreements to extend the deadline to file a whistleblower complaint, as seen in the Turin v. Amtrust Financial Services case. This highlights the importance of understanding the specific provisions of the law that apply to your situation.

Penalties for SOX Noncompliance can be severe. Anyone who knowingly alters, destroys, or falsifies documents to impede an investigation can face a fine and up to 20 years in prison.

If you're a CEO or CFO, you're responsible for certifying financial reports. If you knowingly certify a report that doesn't comply with SOX requirements, you can face fines of up to $1 million and 10 years in prison.

Willful certification of a noncompliant report can lead to even harsher penalties. You could face fines of up to $5 million and up to 20 years in prison.

Record falsification, or destroying records to impede or influence an investigation, is also a serious offense. You can face fines or up to 20 years in prison.

Here are the specific penalties for SOX noncompliance:

Remember, SOX compliance is crucial for publicly-traded companies and their executives.

The Sarbanes-Oxley Act made significant changes to corporate governance, with a focus on increasing executive responsibility and accountability.

One of the key areas of reform was in the area of corporate responsibility, with new requirements placed on CEOs and CFOs to certify the accuracy of financial reports. Section 302 of the Act requires CEOs and CFOs to review all financial reports and ensure they are "fairly presented" and free from misrepresentations.

The Act also established the importance of internal accounting controls, requiring CEOs and CFOs to be responsible for ensuring their effectiveness. This includes the requirement for year-end financial disclosure reports and internal controls reports.

The Sarbanes-Oxley Act also created new requirements for corporate auditing practices, including the hiring of independent auditors and the segregation of duties to prevent conflicts of interest.

Here are some key requirements for corporate governance under the Sarbanes-Oxley Act:

These changes were designed to improve the reliability of public companies' financial reporting and restore investor confidence in the wake of high-profile corporate scandals.

The Sarbanes-Oxley Act has faced its fair share of criticism and challenges since its inception. Critics argued that the Act unfairly burdened executives with new regulations due to the dishonest and negligent acts of a few others.

Many executives felt that the Act's requirements were overly burdensome, taking up too much of their time and costing an exorbitant amount of money to comply with. Corporate leaders complained about Section 404, saying it was too much to handle.

In 2008, former Speaker of the House Newt Gingrich blamed the financial crisis on the Act, citing it as the reason for a low number of initial public offerings and asking Congress to repeal the Act. He claimed the Act hindered competition and business growth.

The Act has also faced legal challenges, with a lawsuit filed in 2006 questioning its constitutionality. The lawsuit argued that the PCAOB's officers should be appointed by the President, rather than the SEC.

Related reading: What Are the Main Challenges Initial Stage Start Ups Face

The Sarbanes-Oxley Act has been around since 2002, and despite its initial and ongoing criticism, it remains in place essentially unchanged.

Research has found that the law improves financial reporting, which is a significant outcome.

Many business leaders, however, believe that the resources required to meet the law's mandates are burdensome, especially for smaller companies, which are disproportionately affected.

It's worth noting that the law is seen as the most significant piece of security legislation since the Exchange Act.

The Sarbanes-Oxley Act has had a significant impact on non-American companies' listing choices. Some argue it's driven business from New York to London, where regulations are more lenient.

London's Alternative Investment Market claims its spectacular growth in listings almost entirely coincided with the Sarbanes-Oxley legislation. This suggests a clear shift in favor of less stringent regulations.

Companies from developed countries, like the UK, only incur costs from complying with Sarbanes-Oxley, as transparency is already adequate in their home countries. In contrast, companies from badly regulated countries see benefits from better credit ratings.

Piotroski and Srinivasan found that large foreign firms choosing between US and UK stock exchanges didn't change their listing preferences following SOX. However, they did find that small foreign firms were less likely to list on US exchanges after the Act was enacted.

Expand your knowledge: Piramal Pharma Share Listing Date

Countries around the world have implemented their own versions of corporate governance laws, similar to the Sarbanes-Oxley Act in the United States. These laws aim to protect investors and promote transparency in the financial markets.

In Canada, the C-SOX is the equivalent of the Sarbanes-Oxley Act, ensuring that companies maintain high standards of corporate governance. The German Corporate Governance Code, introduced in 2002, sets minimum requirements for risk management in trading companies.

The King Report on Corporate Governance in South Africa, released in 2002, provides a non-legislative framework for corporate governance, focusing on ethics and transparency. The Code Tabaksblat in the Netherlands, introduced in 2003, is a governance code that companies are expected to comply with or explain their reasons for not doing so.

Other countries with similar laws include Australia, France, and Japan. In Australia, the Corporate Law Economic Reform Program Act 2004 introduced new requirements for corporate reporting and disclosure. France's Financial Security Law, also known as the "Loi sur la Sécurité Financière", was enacted in 2003 to protect investors and promote financial stability.

Here's a list of some of these international corporate governance laws:

Despite early and ongoing criticism, the Sarbanes-Oxley Act remains in place, essentially unchanged from when it was first enacted in 2002.

Studies show that the law improves financial reporting. This is a significant finding, as it suggests that the Act's provisions have had a positive impact on the way companies present their financial information.

Many business leaders continue to believe that the resources required to meet the law's mandates are burdensome. This is particularly true for smaller companies, which are disproportionately burdened by the Act.

The law is seen as the most significant piece of security legislation since the Exchange Act.

The Sarbanes-Oxley Act of 2002 was a response to highly publicized corporate financial scandals earlier that decade that cost investors billions of dollars. The act created strict new rules for accountants, auditors, and corporate officers and imposed more stringent recordkeeping requirements.

The act also added new criminal penalties for violating securities laws. This was a major shift in corporate accountability.

Senior management, specifically the CEO and CFO, are held responsible for compliance with the act's requirements. They must certify financial reports and evaluate the performance of their company's internal controls framework.

The act is arranged into 11 sections, or titles. Two sections of particular note are Section 302 and Section 404. Section 302 pertains to corporate responsibility for financial reports and requires CEOs and CFOs to review all financial reports.

Section 302 also established that CEOs and CFOs are responsible for internal accounting controls. They must ensure that financial reports are "fairly presented" and don't contain misrepresentations.

To achieve this, CEOs and CFOs must conduct a reasonable level of due diligence. This includes performing a careful review of the financial report and interviewing company personnel who prepared the report.

Here's a breakdown of the key responsibilities:

The penalties for making false claims in these certifications can be severe, including fines of up to $1 million and up to 10 years in prison.

Overall, the Sarbanes-Oxley Act has improved corporate accountability and transparency. It has also led to more accurate and reliable financial reporting.