The US parent's CEO and CFO sign a certification every quarter. They cannot know first-hand what happened in a subsidiary in Pune or Bengaluru, so they ask the people who do to sign a smaller version of the same statement. That internal sign-off is usually called a sub-certification, and for an Indian finance head it is the most personal part of SOX.
Last reviewed: 17 October 2026. Facts checked. We opened web search results on SEC Rules 13a-14 and 15d-14 and section 302 (law-firm and SEC-hosted summaries from the early 2000s). Those describe the officer certification; they do not describe sub-certification, which is an internal practice that companies design themselves and is not, to our knowledge, required by the rules in any prescribed form. We did not open current SEC rule text; check it before relying on any statement about the parent's certification. The timeline and checklist below are an invented, typical pattern.
Why sub-certifications exist
Section 302 asks the principal executive and financial officers to certify, among other things, that they have evaluated disclosure controls and disclosed to the auditors and audit committee significant deficiencies, material weaknesses and any fraud involving management or employees with a significant role in internal control. Our guide to SOX 302 versus 404 covers the structure.
A parent with operations in many countries cannot meet that standard on its own information. So it builds a chain: each subsidiary's finance head, sometimes with the managing director, certifies upwards on matters within their knowledge. The parent's officers use that chain as part of the basis for their own signature.
The sub-certificate does not shift legal responsibility. It supports the signers' inquiry and creates a record. The Indian signer's exposure under US law is a question for counsel; what is certain is that a false internal certificate is a serious employment and governance matter.
What a typical sub-certificate says
Each parent writes its own. Common elements, in plain language:
- The signer has reviewed the subsidiary's reporting package for the quarter.
- To their knowledge the package has no material misstatement and does not omit anything needed to make it not misleading.
- They have kept their areas' internal controls working and have told the parent about changes in those controls.
- They are not aware of fraud, whether or not material, involving management or anyone with a role in controls, other than what they have reported.
- They have disclosed any significant deficiencies or material weaknesses they know of.
- They have disclosed unusual transactions, side letters, disputes and litigation, related party dealings and changes in accounting estimates.
- They are not aware of whistleblower complaints or regulatory communications that have not been reported.
- Where relevant, they confirm compliance with the code of conduct and the policy on anti-bribery and sanctions.
The statement is only as good as the work behind it.
A quarterly timeline
A rough pattern that many subsidiaries follow, with dates depending on the parent's close calendar:
- Close week. The subsidiary closes the books and sends the reporting package.
- Control owner confirmations. Process owners (accounts payable, payroll, treasury, revenue, IT) each confirm that their key controls operated, that no changes occurred without notice and that no issues are open.
- Open items review. The internal control or SOX lead compiles exceptions from testing, open deficiencies and remediation status.
- Legal and HR inputs. The company secretary or legal lead confirms litigation, notices and regulatory correspondence; HR confirms whistleblower or ethics matters.
- Finance head review. The finance head reads the compiled evidence, asks questions and signs.
- Managing director sign-off where the parent requires it.
- Submission to the parent's SOX or controllership team, who consolidate and escalate anything unusual.
Work back from the parent's deadline and give owners a firm date. Late confirmations are the first sign the process is not working.
Evidence the finance head should want
Signing from memory is not a safe approach. A finance head can reasonably ask for:
- Control owner sign-offs, each dated and specific, not a blanket "no issues".
- A change log of processes, systems and key personnel in the quarter.
- An exceptions register with status.
- The latest ICFR test results, including any control deficiencies and their evaluation. See our guide to classifying control deficiencies.
- The reconciliation status for key balance sheet accounts.
- Intercompany reconciliations with the parent and sister entities.
- A list of unusual or non-routine transactions and approvals.
- Fraud and ethics reports in the period, even if closed.
Where the Indian entity must also satisfy local requirements, such as internal financial controls reporting under the Companies Act, one control set can often serve both. For how the two frameworks differ, see SOX controls versus IFC under section 143(3)(i).
Common problems
- Sign-off by habit. The certificate becomes a form completed in minutes. Make the supporting package a fixed part of the process.
- Vague wording. "No significant issues" is meaningless if nobody defined significant. Ask the parent for its definitions.
- Unreported changes. An ERP change, a new outsourced vendor or the departure of the controller can alter controls without anyone raising it. The change log catches these.
- Time-zone friction. Parent deadlines often fall at the start of the Indian workday after a US close. Build the buffer into the plan.
- Deficiencies held back. Teams are reluctant to report weaknesses before they are certain of the classification. The better habit is to report early with the facts, and let the parent evaluate.
- Unclear roles. If the finance head signs but the controller owns the controls, specify who confirms what.
A worked example (invented)
An Indian subsidiary's accounts payable lead discovers in November that vendor bank changes were approved by one person during a staff absence in August and September. No loss has been found. The lead tells the SOX coordinator, who logs it as an exception, tests the changes, and finds one change that cannot be traced to a request.
The finance head includes it in the quarterly sub-certificate as a control failure under evaluation, attaches the test result and asks the parent's SOX team to help evaluate severity. The parent's classification may differ from the local view, and that is acceptable; the point is that the item moved up the chain before the signature, not after. The facts and characters are invented.
What to do now
If you are a finance head newly exposed to this: ask the parent for the certificate wording and definitions, agree a calendar, appoint a coordinator, build an evidence pack, and read it before signing. Questions on personal liability belong with qualified counsel.
The takeaway
The sub-certificate is a promise that the signer looked. Make the looking visible, so the signature stands on a file and not on a feeling.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error