SOX Compliance Guide: Sections 302, 404, 906 and 802, Who Must Comply, a Checklist and What Drives Cost

The Sarbanes-Oxley Act of 2002 (SOX) was passed after accounting scandals at large public companies. It created the Public Company Accounting Oversight Board (PCAOB), restricted what auditors can do for the companies they audit, and placed personal responsibility on CEOs and CFOs for financial reports and internal control. It applies to companies that file reports with the SEC, called issuers.

This guide covers the sections that drive day-to-day compliance work, who is in and out of scope, a checklist for the compliance cycle and what makes it expensive. It is the hub for SOX topics; the SOX 404 guide covers management's assessment and the auditor's attestation in detail.

Who must comply?

SOX applies to issuers: companies with securities registered under the Securities Exchange Act of 1934 or that file reports under it. Some sections reach further:

• Section 802 (destruction of records) and the whistleblower and fraud provisions apply to anyone, including private companies. See whistleblower program.
• Private companies are not subject to the SOX internal control reporting rules unless they have public debt or equity or plan to go public. Many adopt SOX-style controls because lenders, acquirers or investors ask for them.
• Auditors of issuers must be registered with the PCAOB and follow PCAOB standards, not AICPA standards. See PCAOB vs AICPA standards.

The sections that matter most

The certifications in sections 302 and 906 are separate. Section 302 concerns controls and disclosure and is made under SEC rules. Section 906 is a criminal-law certification attached to the report.

Who is exempt from the auditor attestation?

Management's report under 404(a) applies to all issuers, with a transition for newly public companies: a first annual report need not include management's report on ICFR or the auditor's attestation. The attestation under 404(b) applies to accelerated filers and large accelerated filers.

• Non-accelerated filers are permanently exempt from 404(b), under Dodd-Frank section 989G. Non-accelerated status generally means a public float below $75 million.
• Smaller reporting companies with annual revenue under $100 million are excluded from the accelerated filer definitions by SEC amendments effective April 27, 2020, so they do not need the auditor attestation, though their management's assessment of ICFR is still required and the financial statement audit remains.
• Emerging growth companies are exempt from 404(b) for as long as they keep that status.

Confirm the filer category in the cover page of the Form 10-K and the current rule text in Rule 12b-2.

The compliance cycle: a checklist

1. Scope. Identify significant accounts, disclosures and locations from the financial statements. Document the rationale. See the SOX 404 scoping memo.
2. Choose the framework. Management must use a suitable, recognized framework. The 2013 COSO Internal Control—Integrated Framework is the one most issuers use. See COSO framework.
3. Assess risk. Identify where a material misstatement could arise, including fraud risks and IT risks. See fraud risk assessment.
4. Document processes and controls. Narratives, flowcharts and a risk and control matrix. See the risk and control matrix and control narrative template.
5. Cover the entity level and IT. Control environment, anti-fraud programs, period-end reporting, and general IT controls over access, change management and operations. See entity-level controls, IT general controls and the ITGC test plan.
6. Test design and operating effectiveness. Management tests, or internal audit tests for management, and the work is documented. See control testing and the control test workpaper.
7. Evaluate deficiencies. Classify each deficiency and evaluate in combination. See the deficiency evaluation worksheet.
8. Remediate and retest. Fix design gaps and retest enough operations to conclude.
9. Conclude and report. Management signs its ICFR report. A material weakness at year-end means management cannot conclude that ICFR is effective.
10. Support certifications. Run sub-certification and disclosure committee processes to support the CEO and CFO under 302.
11. Retain documentation under the SEC and PCAOB retention rules.

What drives cost?

There is no authoritative figure for the cost of SOX compliance; it varies with the factors below.

• Size and complexity: the number of locations, systems, significant accounts and processes.
• Maturity of controls: companies without documented controls spend more in year one.
• Automation: reliance on automated and IT-dependent controls shifts effort to ITGC testing.
• Use of internal audit or outside help for testing.
• Deficiencies: remediation and retesting add effort.
• External audit fees: the integrated audit adds audit procedures for companies subject to 404(b).
• Turnover: changes to systems or staff require updates to documentation and retesting.

A firm that supports SOX work should price by scope: the number of key controls, the count of processes in scope and the extent of rework.

SOX-style controls for private companies

A private company can adopt the framework without being an issuer. Lenders sometimes require management certifications or a control review, and companies preparing for an IPO or sale often assess readiness. AICPA attestation standards allow an examination of ICFR for a nonissuer under AT-C 205. This is a voluntary engagement, not a requirement. Smaller companies should scale the framework to their size and not copy the documentation volume of a large issuer.

Common mistakes

• Treating the certification as a formality. The signers are personally exposed.
• Scoping on last year's list without refreshing the risk assessment.
• Relying on a management review control without evidence of the precision of the review. See the management review control worksheet.
• Not testing the completeness and accuracy of reports used in controls. See information produced by the entity.
• Late evaluation of deficiencies, which leaves no time to remediate before year-end.

Frequently asked questions

What is SOX compliance?

Meeting the requirements of the Sarbanes-Oxley Act, mainly management certifications of reports, management's assessment of internal control over financial reporting and, for larger filers, the auditor's attestation.

What is the difference between SOX 302 and 404?

Section 302 requires the CEO and CFO to certify each report and to certify their responsibility for disclosure controls. Section 404 requires management's annual assessment of ICFR and, for non-exempt filers, an auditor attestation.

Does SOX apply to private companies?

Not directly. Some provisions, such as section 802 on destroying records, apply to everyone.

Which companies need the auditor attestation under 404(b)?

Accelerated and large accelerated filers, subject to the exemptions above.

What is a material weakness?

A deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis.

Sources

• Sarbanes-Oxley Act of 2002, Pub. L. 107-204, congress.gov
• SEC, Release 33-8238 (2003) and Release 33-8760 (2006) on management's report and the transition for newly public companies, sec.gov
• SEC, press release 2020-58, amendments to the accelerated filer and large accelerated filer definitions, sec.gov
• Dodd-Frank Act section 989G
• 18 U.S.C. 1350 and 1519
• PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, pcaobus.org
• AICPA, AT-C Section 205, Assertion-Based Examination Engagements

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error