SOX does not apply to an Indian company just because it is in India. It applies to the SEC registrant, and an Indian subsidiary comes into scope when its numbers or processes matter to the parent's consolidated financial reporting. The parent decides the scope each year, and the subsidiary is then asked to document, test and certify controls to the parent's standard.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of SOX sections 302 and 404 and PCAOB AS 2201 as described in secondary summaries. These are primary documents that were not opened for this guide, so check current text. How a specific parent scopes its programme is the parent's decision and is not described here. No Indian filing deadlines are covered.
Who is actually covered
SOX applies to companies that are SEC registrants and to their auditors. Three common cases in India:
- An Indian company that is itself an SEC registrant, for example one that has securities registered in the US. It is covered directly, though the exact reports depend on its filer type.
- An Indian subsidiary of a US-listed parent. The subsidiary is not a registrant. But its results are consolidated, so its controls can fall inside the parent's ICFR scope.
- An Indian company with no SEC link. SOX does not apply. India's regime is the internal financial controls requirement; see SOX controls vs IFC.
A US-based customer or vendor relationship does not bring SOX in by itself. A customer may ask for assurance, but that is a contract term, not a legal duty under SOX.
How the parent decides scope
The parent's management scopes ICFR from the top down: which accounts are significant, which locations or business units carry them, and which processes feed them. A subsidiary in India may be:
- In full scope, if it is significant on its own;
- In scope for specific accounts or processes, such as revenue, payroll or a shared service centre; or
- Out of scope for ICFR testing, though it may still give a quarterly sub-certification.
Scope can change year to year with size, risk and acquisitions. Ask the parent for the scoping memo and the control list that applies to your entity.
Shared service centres and outsourcing
Many Indian entities run finance and IT processes for the group, such as accounts payable, general ledger and payroll. Controls here may feed the parent's financial reporting for several countries, so these processes often attract the most testing. Where a third party runs a process, the parent may rely on a service organisation report or test the controls directly. Read the scope and period of any such report carefully.
What the Indian team will usually be asked to do
| Task | What it involves |
|---|---|
| Process documentation | Narratives, flowcharts and a risk and control matrix in the parent's template |
| Control ownership | Named owners for each key control |
| Control performance and evidence | Perform controls on schedule, keep evidence in the format agreed |
| Self-testing or internal testing | Test operating effectiveness as required by the parent |
| Quarterly sub-certification | A signed statement to the parent about controls and deficiencies |
| Deficiency remediation | Fix gaps, track dates, retest |
| Support for the group auditor | Provide samples, walk through processes, answer queries |
The sub-certification supports the CEO and CFO's own certification at group level; see SOX 302 vs 404.
Local audit relationship
Two auditors can be involved. The group auditor, which is the parent's SEC registered auditor, directs the work for ICFR and may use component auditors, often the local audit firm or a member of the same network. The local statutory auditor in India reports separately under Indian law. The two reports are different and do not substitute for each other.
Overlap with Indian reporting
The Indian statutory regime asks for internal financial controls over financial reporting. Management's directors' responsibility statement and the auditor's report under section 143(3)(i) are covered in our SOX vs IFC guide. Much of the control documentation can serve both purposes, but check:
- The control wording and level of detail may differ.
- The exemptions available to Indian private companies do not remove SOX duties assigned by the parent.
- SOX testing is often to a higher standard and tied to US accounting, so differences between Indian and US reporting rules (Ind AS and US GAAP) may add controls over the conversion.
Practical tips for a subsidiary finance team
- Ask for the scoping memo and the control list on day one.
- Agree the evidence standard early. "Screenshot with date" and "reviewer name" requirements save rework.
- Keep a calendar of control frequencies, which could be daily, monthly or quarterly.
- Treat IT access and change controls as first priority. See SOX ITGC testing.
- Report deficiencies early. A deficiency found by you is easier to manage than one found by the group auditor.
- Use a risk and control matrix tool to keep documentation consistent. The RCM builder can help structure it.
Frequently Asked Questions
Is an Indian subsidiary of a US-listed company directly subject to SOX?
The statute applies to the registrant. The subsidiary is brought in indirectly because its financial information flows into the registrant's consolidated reporting.
Does the Indian subsidiary need its own SOX audit?
Not as a separate legal requirement. The group auditor decides what work is needed at the subsidiary for its ICFR audit, if one applies.
Can we use our Companies Act IFC work for SOX?
Often partly. The documentation can be reused, but the parent's scope, framework and testing standard will still apply.
Who signs the certifications?
The parent's CEO and CFO sign the statutory certifications. Subsidiary heads usually give internal sub-certifications supporting them.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error