The Sarbanes-Oxley Act (SOX) is a US law passed in July 2002 after the Enron and WorldCom scandals. It makes CEOs and CFOs certify financial reports (section 302), requires an annual report on internal control over financial reporting (section 404), created the PCAOB to oversee auditors, and sets criminal penalties for fraud.
Key sections
| Section | What it requires |
|---|---|
| Title I | Creates the PCAOB to register, inspect and discipline audit firms |
| 201 | Bans auditors from providing many non-audit services to audit clients |
| 203 | Audit partner rotation every five years |
| 301 | Audit committee of independent directors, responsible for the auditor and whistleblowing procedures |
| 302 | CEO and CFO certify each report is accurate |
| 404 | Annual management report on internal control over financial reporting, with auditor attestation for larger companies |
| 802 | Criminal penalties for destroying or falsifying records |
| 806 | Protection for whistleblowers |
| 906 | Criminal penalties for false certification |
Signed into law on 30 July 2002. Source: US Congress, H.R. 3763.
SOX vs the UK approach
| US: Sarbanes-Oxley | UK: Corporate Governance Code | |
|---|---|---|
| Approach | Rules-based law | Principles-based, comply or explain |
| Internal control | Section 404 report and auditor attestation | Board monitors and reviews controls; from 2026, a declaration on material controls (Provision 29) |
| Penalties | Criminal and civil | Mainly market and shareholder pressure |
| Cost | High compliance cost | Lower, more flexible |
See rules-based vs principles-based governance.
Internal control responsibilities
Chapter 11 of the book stresses that the board is responsible for a sound system of internal control to protect shareholders, reviewed at least annually. Management runs the controls, internal audit tests them, and the audit committee oversees. See COSO, which most companies use as the framework for SOX 404.
Sarbanes-Oxley in ACCA SBL
SOX sits in governance (area B) and control and audit (area F). A typical task asks you to compare the US rules-based approach with the UK's, or advise a company planning a US listing. Weigh the benefits (investor confidence, stronger controls) against costs (compliance spending, management time, less flexibility).
Advantages
- Restored investor confidence after Enron
- Stronger internal controls and accountability
- Personal liability focuses directors' minds
Limitations
- High compliance costs, especially for smaller companies
- Box-ticking risk
- May discourage US listings
- Cannot prevent all fraud
FAQs
What is the Sarbanes-Oxley Act?
A US federal law passed in 2002 after the Enron and WorldCom scandals. It tightened rules on financial reporting, internal control, auditor independence and corporate responsibility for US-listed companies.
What is SOX section 404?
It requires management to assess and report on the effectiveness of internal control over financial reporting each year, and for larger companies the external auditor must attest to that assessment.
What is SOX section 302?
The chief executive and chief financial officer must personally certify that the financial reports are accurate and that they are responsible for internal controls.
What did SOX create?
The Public Company Accounting Oversight Board (PCAOB), which oversees the auditors of US public companies.
Does Sarbanes-Oxley apply to UK companies?
It applies to companies listed in the US, including UK companies with a US listing and their subsidiaries. UK companies listed only in the UK follow the UK Corporate Governance Code instead.
What are the penalties under SOX?
Under section 906, knowingly certifying false reports can lead to fines of up to $1 million and 10 years in prison, or $5 million and 20 years if wilful. Destroying documents to obstruct an investigation can carry up to 20 years (section 802).