SOX compliance means meeting the requirements of the US Sarbanes-Oxley Act of 2002 on the reliability of financial reporting. In practice, it means a company has documented, tested internal controls over financial reporting, its management has assessed them, and in some cases the external auditor reports on them as well. It applies to companies that report to the US Securities and Exchange Commission (SEC), which is why Indian teams meet it mainly through US-listed parents.
Last reviewed: 17 October 2026. Facts checked. We searched for how Section 404 applies by filer type and read search summaries of law-firm and compliance sources. The SEC pages we tried to open returned errors or unreadable PDF data, and the PCAOB page returned an access error, so we did not read primary SEC or PCAOB text. Filer-size thresholds changed in 2020 and one source gave a figure we could not reconcile, so we have not stated any threshold.
What SOX is
SOX was passed after major accounting failures in the US. It has many parts. Two matter most to finance and audit teams: Section 302 and Section 404. Our guide to SOX 302 vs SOX 404 covers the difference in detail.
- Section 302: senior management certify the accuracy of periodic reports and the state of disclosure controls.
- Section 404: management assesses internal control over financial reporting (ICFR), and in some cases the auditor attests to it.
Who needs it
Search summaries of law-firm sources say:
- Section 404(a), the management assessment, applies to almost all SEC-reporting issuers regardless of size.
- Section 404(b), the auditor attestation, applies to accelerated and large accelerated filers. Non-accelerated filers are exempt, following a Dodd-Frank amendment, and the SEC widened the exemption in 2020 by changing the filer definitions.
The exact filer thresholds sit in SEC rules, so check them for the company in question. Private companies and companies not reporting to the SEC are not covered by SOX itself, although lenders, investors or a parent may ask for similar controls.
What about India?
An Indian company is not subject to SOX only because it is Indian. It can be pulled in as a subsidiary or a significant component of a US-listed group. See SOX compliance for Indian subsidiaries of US-listed companies. India has its own internal financial controls requirement under the Companies Act, which is a different test. Our comparison, SOX controls vs IFC, explains how they differ.
What a SOX programme involves
| Step | What it means |
|---|---|
| Scope | Choose the significant accounts, processes, locations and systems |
| Risk assessment | Identify what could cause a material misstatement |
| Document | Map each process and write down the key controls, often in a risk and control matrix |
| Walkthroughs | Trace one transaction through to confirm the design |
| Test design | Ask whether the control, if it works, would stop the risk |
| Test operation | Sample and re-perform the control over the period |
| Evaluate deficiencies | Rate each failure by severity and look at what compensates |
| Report | Management concludes, and the auditor reports where required |
| Remediate and retest | Fix issues, then test again |
Our articles on walkthroughs and design vs operating effectiveness and key controls examples show how this looks in practice. Technology controls sit underneath nearly every key process, so see IT general controls testing. For the framework most programmes use, see COSO 2013 five components.
When a control fails, the next question is how serious it is. The SOX control deficiency severity evaluator helps structure that judgement.
Who does what
SOX work is shared. No single team can do it alone, because the controls sit in finance, IT and operations.
- Management and the audit committee: own the assessment and the conclusion.
- Process owners: operate the controls and keep evidence.
- Internal audit or a SOX team: often tests the controls.
- External auditor: audits the financial statements and, for covered companies, the controls. See management assessment vs auditor attestation.
Common problems
- Scope set once and not revisited after acquisitions or system changes.
- Controls documented as they should work, not as they do.
- Evidence kept in email and not retrievable at test time.
- Deficiencies closed without retesting.
- Reliance on spreadsheets that are not controlled.
- Testing done in the final weeks, leaving no time to fix and retest what fails.
Frequently Asked Questions
What is SOX compliance?
Meeting the Sarbanes-Oxley Act's requirements on reliable financial reporting, mainly through management certification and an assessment of internal control over financial reporting.
Who has to comply with SOX?
SEC-reporting companies. Management's assessment under Section 404(a) applies broadly. The auditor attestation under 404(b) applies to larger filers.
Does SOX apply to Indian companies?
Not by itself. It can apply to Indian subsidiaries of US-listed groups as part of the group's scope.
What is the difference between SOX 302 and 404?
Section 302 is a certification by senior management of reports and disclosure controls. Section 404 is about internal control over financial reporting.
Is SOX the same as internal financial controls under the Companies Act?
No. They are separate regimes with different rules, though the control work overlaps.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error