SOX Compliance

Master SOX Compliance: A Comprehensive Guide for 2024

Prior to the Sarbanes-Oxley Act (SOX), the last time we saw major changes in how public companies operate and report financial results was during the Great Depression.

The Great Depression caused economic ruin for much of America’s society. 

The lack of stock market regulations allowed for easy market manipulation and fraudulent activities. Combined with other issues, including panic selling, bank failures, excessive risk-taking, and economic imbalances, it created the perfect storm that led to Black Tuesday. 

On that day in 1929, the stock market crashed, wiping away billions of dollars of wealth and marking the start of the Great Depression.

Fast forward 70 years. Many of the contributing factors to the Great Depression resurfaced and brought the US financial markets to a tipping point. Major fraud at large companies went undetected for years due to a lack of transparency and inadequate regulations. Once uncovered, these large companies went bankrupt and left investors with nearly nothing.  

Enter the Sarbanes-Oxley Act (SOX) of 2002. It’s the boldest attempt to regulate the conduct and financial reporting of public companies in the United States since the Great Depression.

In this comprehensive guide, we cover all you’ll need to know about SOX compliance. 

Table of Contents

• Definition of SOX Compliance
• Sarbanes-Oxley Act: Overview
• SOX Compliance Requirements
• The Importance of Internal Controls in SOX Compliance
• Achieving SOX Compliance
• Challenges and Solutions in SOX Compliance
• The Impact of Non-Compliance with Sarbanes-Oxley
• Conclusion: The Future of SOX Compliance

Definition of SOX Compliance

SOX compliance is the legal requirement for publicly traded companies to comply with the provisions of the Sarbanes-Oxley Act. 

As we’ll learn in the following section, the Sarbanes-Oxley Act became law in 2002 in response to a series of corporate financial scandals.

SOX compliance is structured to be two-pronged and encompasses guidelines regarding corporate responsibility for financial reports and adequate internal financial controls. 

Brief History and Purpose of the Sarbanes-Oxley Act

In 2001, energy company Enron’s spectacular collapse sent shockwaves throughout the financial world. 

Part of this surprise can be attributed to Enron’s prestigious  accolades, including “America’s Most Innovative Company” by Fortune Magazine, an award Enron bagged for an impressive six consecutive years preceding its sudden fall.

The following year, in 2002, telecommunications giant WorldCom and billion-dollar conglomerate Tyco also folded due to financial improprieties. 

These corporate failures could undermine public confidence in the financial markets. 

There was a fundamental need to investigate the root causes of these financial scandals to restore investor confidence and enhance corporate governance by holding senior executives accountable for accurate financial reporting.

Congress was jolted into action on February 1, 2022 when the then University of Texas law school dean and member of the Enron Board of Directors, William C. Powers Jr., led a Congressional subcommittee investigating the scandal and submitted his findings. 

He presented a 218-page report that read like a horror movie – financial transactions with no economic substance, designed to manipulate earnings and personally enrich Enron’s leaders. 

To protect investors by improving the accuracy and reliability of corporate financial reporting, Michael Oxley, Representative for Ohio’s 4th congressional district, quickly introduced a bill to the House less than two weeks later on February 14. 

It was known as the Corporate and Auditing Accountability, Responsibility, and Transparency Act.

On April 24, 2002, the House passed Oxley’s bill by a vote of 334 – 90 and forwarded the bill to the Senate.

However, the Senate Committee on Banking, Housing, and Urban Affairs was also drafting its own bill and needed help. The committee was chaired by the Maryland Senator, Paul Sarbanes.

Finally, on June 18, 2002, after Sarbanes secured the crucial support of Wyoming Senator Mike Enzi, the only accountant in the Senate, the Senate Banking Committee approved Sarbanes’s bill and forwarded it to the floor of the Senate.

Then Worldcom, on June 25, 2002, announced it had overstated its end-of-year earnings by more than $3.8 billion. Partly because of the ensuing public outrage, the Senate leadership slated Sarbanes’s bill for immediate debate.

The Senate approved the bill on July 15, 2022.

But now there were two bills – one by Rep. Oxley and one by Senator Sarbanes – and both approved by their respective House of Congress.

A conference committee was formed with members from both the Senate and the House of Representatives to reconcile the two bills.

On July 25, 2002, both houses nearly unanimously approved the combined bill, paving the way for President Bush’s signature on July 30, 2002. 

President Bush would describe the bill, now known as the Sarbanes-Oxley Act, to honor the effort of its two principal sponsors as “the most far-reaching reforms of American business practices since the time of Franklin Delano Roosevelt.”

Importance of SOX Compliance for Corporations

The Sarbanes-Oxley Act is crucial because it provides greater oversight for corporations by:

• Enhancing financial transparency
• Improving internal controls
• Increasing accountability and responsibility 

Enacted in the backdrop of high-profile corporate fraud cases, the Sarbanes-Oxley Act was designed to deter other corporations from engaging in bad behavior.

Yet the Sarbanes-Oxley Act is more than just a deterrent.

It also provides remedies for investors who suffer financial losses from false financial reporting. 

For example, when HealthSouth announced it inflated earnings and asset values for years, a 2009 class-action lawsuit brought by its investors garnered a $671 million settlement to compensate investors who incurred losses due to HealthSouth’s fraudulent accounting practices.

And Tyco’s investors reached a $3.2 billion settlement to compensate them for losses incurred by its fraud.

Also, recognizing the role whistleblowers can play in unraveling monumental scandals, the Act protects whistleblowers from retaliation when they report fraudulent activities.

The overarching goal of the SOX Act is to increase trust and confidence between corporations, the public, and investors.

Sarbanes-Oxley Act: Overview

The Sarbanes-Oxley Act is broad. It consists of 66 pages and touches on topics like:

• Public Company Accounting Oversight Board (PCAOB)
• Auditor independence
• Corporate responsibility
• Enhanced financial disclosures
• White-collar crime penalty enhancements
• Corporate tax returns

The Key Provisions of the Sarbanes-Oxley Act

While the Sarbanes-Oxley Act comprises 11 broad topics (called titles), the following seven provide an excellent overview.

• Title I: Creation of the Public Company Accounting Oversight Board (PCAOB)

The PCAOB was created to oversee the audits of public companies to protect the interests of investors and further the public interest in preparing informative, accurate, and independent audit reports. 

The duties of the PCAOB, subject to the oversight and enforcement authority of the Securities and Exchange Commission (SEC), include:

• Registering public accounting firms that prepare audit reports for public companies
• Establishing or adopting auditing, quality control, ethics, independence, and other standards related to the preparation of audit reports for public companies
• Conducting inspections of registered public accounting firms
• Conducting investigations and disciplinary proceedings concerning registered public accounting firms and associated persons and imposing appropriate sanctions where justified

The establishment of the PCAOB represents a significant change in the regulation of public company audits, intending to enhance the reliability and accountability of financial reporting.

• Title II: Increased Independence of External Auditors

Title II establishes standards and requirements to ensure the independence of external auditors, aiming to enhance the reliability and integrity of financial reporting.

It prohibits auditors from providing certain consulting services to their audit clients and requires a rotation of the lead audit partner every five years. 

It should be remembered that Arthur Andersen, the accounting firm contracted by Enron to handle its audits, used to provide Enron with substantial consulting services as well. The revenue generated by Andersen’s consulting services far outweighed its audit fee, putting its leaders in an awkward position to forgo millions in consulting revenue if they announced they discovered fraud at Enron.

This practice of providing consulting services to audit clients blurs the lines of independence since it involves a significant conflict of interest.

• Title III: Increased Corporate Responsibility

This provision requires senior executives to take individual responsibility for the accuracy and completeness of corporate financial reports. 

It states that the CEO and CFO must review all financial reports and that these officials can face criminal penalties for certifying false reports. 

Previously, corporate leaders had almost no accountability for their actions. 

Title III also requires all publicly listed companies to have an independent audit committee responsible for overseeing the work of the external auditors.

• Title IV: Enhanced Financial Disclosures

Title IV aims to improve the accuracy and transparency of corporate financial disclosures.

It requires companies to disclose more information, including off-balance sheet transactions and relationships.

It also mandates internal control assessments to ensure companies have the necessary checks and balances in place. 

These comprehensive disclosure requirements also stem from the Enron experience. For instance, whenever Enron needed cash, it would secretly create a temporary company technically known as a Special Purpose Entity (SPE). 

The purpose of the SPE was to secure financing from the bank and then transfer the cash to Enron for fictitious asset sales. This allowed Enron to keep the debt off its books while securing sizable cash inflows.

• Title V: Establishment of Conflict-of-Interest Rules for Security Analysts

In the wake of Enron’s collapse, investigators found that analysts at investment banks were making favorable recommendations to investors to buy Enron stock with the sole purpose of securing business for their employer and earning bonuses. 

Included as Title V of the Sarbanes Oxley Act, this provision attempts to prevent fraudulent analyst practices by establishing standards for securities analysts and protecting investors by ensuring that the investment advice they receive is unbiased and not influenced by the financial interests of the analyst or the investment bank. 

• Title VIII: Increased Criminal Penalties for Securities Fraud 

Title VIII aims to deter and punish corporate fraud and protect those who expose such misconduct.

This section contains the criminal penalties for destroying, altering, or falsifying documents to obstruct a federal investigation. 

This provision was partly motivated by the fact Arthur Andersen, Enron’s audit firm, destroyed documents related to the Enron audit to eliminate self-incriminating evidence.

This section also prevents debts incurred through violations of securities fraud laws from being discharged in bankruptcy.

Title VIII also establishes protections for whistleblowers and sets new rules for document retention. 

• Titles IX and XI: Corporate Fraud Accountability and White-Collar Crime 

These two Titles define the criminal penalties for corporate financial fraud and increase the penalties for white-collar crimes and conspiracies. 

For instance, the potential maximum term of imprisonment for various types of fraud is now 20 years. 

The following are the key provisions of the Sarbanes-Oxley Act at a glance:

The Role of the Public Company Accounting Oversight Board (PCAOB)

Created by the Sarbanes-Oxley Act of 2002, the Public Company Accounting Oversight Board (PCAOB) plays a significant role in SOX compliance, including setting standards for high-quality audits to reduce incidents of financial misrepresentations.

Before the establishment of the PCAOB, accounting firms were primarily self-regulated.

However, since investigators found that audit firms were complicit in the Enron scandal and other financial failures that exploded around the same time, self-regulation was considered inadequate. 

Consequently, Congress saw the need to establish the PCAOB, which would oversee the auditors of public companies. This was to protect the interests of investors, including ensuring the production of informative, accurate, and independent audit reports. 

Here are the key roles of PCAOB: 

• Registration of Public Accounting Firms: For accountability and order, one of the main tasks of the PCAOB is to oversee the registration of public accounting firms that prepare audit reports for public companies. Only accounting firms registered with the PCAOB can legally audit public companies.
• Inspection of Registered Public Accounting Firms: The PCAOB regularly inspects the registered firms to assess compliance with the SOX Act, PCAOB rules, professional standards, and federal securities laws. These inspections can be both regular or triggered by issues of concern. 

If an audit firm is found guilty of professional misconduct, the PCAOB can impose sanctions and penalties or limit its ability to conduct public company audits.

• Establish Auditing and Quality Control Standards: The PCAOB also sets auditing standards for public companies, known as PCAOB Auditing Standards. The goal of these standards is to ensure high-quality, independent audits. They cover various topics, from the ethical conduct of auditors to how an audit is completed and reported. 
• Enforcement Authority: To ensure it has teeth, the PCAOB can investigate and discipline an audit firm and its partners. This discipline can be for non-compliance with the SOX Act, PCAOB rules, SEC rules, and other professional standards governing the audits of public companies. 

SOX Compliance Requirements

For a more detailed look, we will cover the SOX compliance requirements in the following sections:

• Section 302: Corporate Responsibility for Financial Reports
• Section 404: Management Assessment of Internal Controls
• Section 409: Management Assessment of Internal Controls
• Section 802: Criminal Penalties for Altering Documents
• Section 906: Corporate Responsibility for Financial Reports

Section 302: Corporate Responsibility for Financial Reports

The essence of Section 302 is to assign individual responsibility for the accuracy of financial statements. This ensures senior executives don’t hide under the corporate veil to escape personal responsibility. 

For this purpose, the SOX rules require the CFO and CEO to sign and certify Form 10-Q (quarterly financial statements) and Form 10-K (annual financial statements). 

According to the provisions of Section 302, both the CEO and CFO personally attest to a range of statements that can be grouped into two broad categories as follows.

• Certifications regarding the accuracy and completeness of financial statements
• Certifications regarding the effectiveness and composition of internal controls

Regarding certifications that deal with the accuracy and completeness of financial statements, CEOs and CFOs confirm they reviewed the financial reports, and based on their knowledge, the financial reports do not contain any untrue statement of material fact or omit to state a material fact. 

The importance of this certification is that, to the best of their knowledge, the CFO and the CEO confirm that the financial reports are not misleading.

On the flip side, certifications regarding internal controls require the CFO and CEO to certify that they:

• Are responsible for establishing and maintaining the controls 
• Designed the controls to ensure all material information is made known to them
• Evaluated the effectiveness of the controls
• Presented their conclusions regarding the effectiveness of the controls 
• Informed the auditors of any material weaknesses or deficiencies in the design of the controls

Section 404: Management Assessment of Internal Controls

Section 404 introduces far-reaching reforms in the internal control structure of companies. 

Today, management must include a report in the annual financial statements that acknowledges their responsibility for maintaining internal controls and their assessment of said controls. 

Also, this Section increased the external auditor’s responsibility. The SOX rules require external auditors to confirm management’s assertions regarding the presence and effectiveness of internal controls.

That means audits today are heavily weighted on understanding financial processes and testing the controls in place to prevent errors from showing up in financial reports. 

Before Sarbanes-Oxley, external auditors did not have to test internal controls to determine their degree of effectiveness. 

In the same report, management should state that they are responsible for any shortcomings in the company’s internal control structure.  

Section 409: Real-Time Issuer Disclosures

The provision stipulates that companies must promptly report significant financial changes and events, such as asset sales, mergers, acquisitions, or other substantial financial undertakings. This disclosure should be comprehensive and easily understandable, enabling investors to make informed decisions. 

The Securities and Exchange Commission (SEC) enforces these requirements, and companies are encouraged to develop robust internal controls and processes to identify and report material events efficiently.

Section 409 plays a crucial role in the overall framework of the Sarbanes-Oxley Act by enhancing corporate transparency and protecting investor interests through the timely dissemination of critical financial information. This section underscores the importance of maintaining an open and transparent communication channel between publicly traded companies and their investors.

Section 802: Criminal Penalties for Altering Documents

On June 15, 2002, Arthur Andersen was found guilty of obstruction of justice for destroying important files and documents relating to its infamous audit client, Enron.

The disgraced audit firm was slapped with a $500,000 fine and five years’ probation.

In its spirited defense, Arthur Andersen argued that the destruction of Enron documents was in keeping with its document retention policy and was not motivated by obstruction of justice.

While the Supreme Court later overturned Arthur Andersen’s earlier conviction based on what the court termed “flawed” instruction to the jury, crucial lessons regarding the integrity of documents were learned.

The purpose of Section 802 of the Sarbanes-Oxley Act is simple: To ensure documents remain available and unaltered even after financial events. 

Section 802 of the SOX Act of 2002 contains the three rules that affect recordkeeping. 

1️⃣ The first deals with the destruction and falsification of records. 

According to the provisions of Section 802, if you’re convicted of knowingly altering, destroying, or falsifying any document to “impede, obstruct, or influence” any federal investigation, you’ll be liable for a fine and imprisonment of up to 20 years.

2️⃣ The second strictly defines the retention period for storing records as at least five years. 

3️⃣ The third rule outlines the specific business records that companies need to store, which includes electronic communications. 

This list of business records companies and external auditors should retain is broad and includes emails, memos, all accounting records, and any record that contains financial information.

Section 906: Corporate Responsibility for Financial Reports

CEOs and CFOs must personally certify that the report complies with the SEC’s requirements and that the information is accurate and complete. This certification must accompany each periodic report containing financial statements. Failure to comply with Section 906 can result in severe penalties, including fines and imprisonment. 

Section 906 aims to enhance the reliability and integrity of corporate financial reporting by holding top executives accountable. Thus, it protects investors and reinforces confidence in the financial markets.

Section 906 significantly strengthens the corporate governance framework by mandating executive accountability for financial disclosures, ensuring higher scrutiny and accuracy in financial reporting. This requirement aligns with the broader objectives of the Sarbanes-Oxley Act to prevent corporate fraud and protect investors.

The Importance of Internal Controls in SOX Compliance

Aside from ensuring operational efficiency so that control problems are identified well before external auditors discover them, internal controls play a massive role in ensuring financial statements are free of material misstatements. 

Weak internal controls, such as poor segregation of duties, are known to cause increased incidents of fraud.

Because of this, the Sarbanes-Oxley Act gives internal controls considerable prominence.

In this section, we’ll cover:

• The definition and role of internal controls
• The components of an effective internal control system
• How SOX compliance verifies the quality of these controls

The Definition and Role of Internal Controls

Typically, companies use internal controls to prevent or discover problems in organizational processes, ensuring the organization achieves its goals. And internal controls are in place throughout all departments of an organization, not just the accounting and finance departments.

SOX controls, also known as SOX 404 controls, are processes, policies, and procedures aimed to prevent and detect errors in a company’s financial reporting process. 

Public companies should have internal audit departments whose officers must complete regular compliance audits. The focus of these regular compliance audits is to verify that appropriate internal controls are in place and are functioning properly. 

But here’s what you should take note of. The SOX standards don’t provide a list of specific controls. And it doesn’t give detailed prescriptions on how to protect financial reporting. Instead, it requires organizations to define their own controls that meet the regulator’s goals. 

These goals could include access control, change management, segregation of duties, cybersecurity solutions, and backup systems.

The Components of an Effective Internal Control System

A Sarbanes-Oxley compliance audit has many facets. However, an enterprise’s internal audit and controls testing is generally the largest, most complex, and time-consuming part of an SOX compliance audit. 

But it’s a necessity for SOX compliance.

These include computers, hardware, software, and all other electronic devices that have access to financial data. 

As accountants, we understand that an effective internal control system over financial reporting includes:

1. The Control Environment

The control environment is the foundation of a company’s internal control system. It sets the tone for the company’s culture and influences employees’ behavior.

The control environment includes:

• Management’s philosophy and operating style (also known as “The Tone at the Top”)
• Organizational structure
• Board of Directors and Audit Committee
• Human resources policies
   

2. Risk Assessment

Risk assessment is the process of identifying and evaluating the risks that could impact achieving a company’s objectives. 

In the context of internal controls, risk assessment identifies and evaluates the risks that could prevent the company’s internal controls from operating effectively.

A risk assessment typically involves:

• Identifying risks
• Assessing the likelihood and impact of the risks 
• Prioritizing the risks
• Developing risk mitigation strategies

3. Control Activities

Control activities are designed to prevent or detect errors and fraud in financial reporting. They are implemented at all levels of the organization and are often embedded in business processes.

Examples of control activities include:

• Approvals
• Authorizations
• Verifications
• Reconciliations
• Asset security
• Segregation of duties

4. Monitoring Activities

Monitoring activities are the evaluations or observations of the performance of control activities that are necessary to provide reasonable assurance that internal controls are operating effectively. 

Monitoring activities are designed to detect control deficiencies.

Monitoring activities can be performed by the company’s internal audit function, management, or other personnel. They can be conducted on an ongoing basis.

5. Documentation and Assessment

Documentation provides a record of the company’s internal control system and helps to ensure that the system is understood and followed by employees. 

Examples of documentation include:

• Written descriptions of internal controls
• Diagrams or flowcharts of the company’s business processes
• Evidence of testing and monitoring of internal controls

Assessments are used to evaluate the effectiveness of the company’s internal control system.

How SOX Compliance Verifies the Quality of These Controls

To be ahead of the game, you’ll need to know how SOX compliance audits verify the quality of internal controls.

Here’s what often takes place.

After understanding the company’s control environment and creating their own risk assessment, external auditors will review its control activities to identify the SOX controls in place to prevent transactions from being incorrectly recorded. 

Alternatively, auditors will look for internal controls designed to promptly detect incorrect records.

Next, the auditors will test the controls’ effectiveness. They will be looking to see that the control is operating as designed and mitigates the identified financial reporting risk.

Tests can include auditing a sample of transactions, testing accessibility to sensitive information, and observing employees’ completing their work.

Achieving SOX Compliance

You may want to achieve SOX compliance because it’s the law, but that’s the wrong way to look at it. 

SOX-compliant companies often have better control of their risks and tend to operate more efficiently.

In this section, we’re going to cover:

• Steps toward establishing a SOX-compliant environment
• The role of internal and external audits in compliance
• Use of SOX compliance software and tools

Steps Towards Establishing a SOX-compliant Environment

If you want to establish a SOX-compliant environment, you may want to follow the following five steps listed below. While they may not be exhaustive, they’ll point you in the right direction.

1. Understand the SOX requirements.
   • The first step is to understand the specific requirements of SOX. This includes reading the SOX law, the PCAOB standards, and the SEC guidance.
2. Assess your organization’s current state of compliance.
   • Once you understand the SOX requirements, you need to assess your organization’s current state of compliance. This will help you to identify any areas where you need to improve.
3. Develop a SOX compliance program.
   • The next step is to develop a SOX compliance program. This program should include the following elements:
     1. A risk assessment process
     2. A process for designing and implementing internal controls
     3. A process for monitoring and testing internal controls
     4. A process for remediating any deficiencies in internal controls
4. Implement the SOX compliance program.
   • Once you have developed a SOX compliance program, you must implement it. This includes putting the program in place across your organization and training your employees on the program requirements.
5. Monitor and maintain the SOX compliance program.
   • The final step is to monitor and maintain your SOX compliance program. This includes regularly reviewing the program to ensure that it is effective and making updates to the program as needed.

The Role of Internal and External Audits in Compliance

Both the company’s internal and external auditors have a role to play in ensuring SOX compliance. 

The role of external auditors is well laid out and straightforward. 

According to the provisions of the Sarbanes-Oxley Act, external auditors are required to test management’s assertions regarding the presence and effectiveness of internal controls.

When it comes to internal audits, however, the Sarbanes-Oxley Act is less explicit.

Regardless, according to sections 404 and 302 of the Act, management is responsible for establishing and maintaining internal controls and should disclose significant internal control deficiencies. 

This is where the internal audit function comes in.

By their nature of training, internal auditors are a vital cog in the wheel of the internal control ecosystem. They are best placed to assess the adequacy of internal controls and procedures.

Moreover, internal auditors have more knowledge regarding internal control frameworks such as COSO, the framework used by an overwhelming majority of publicly traded companies.

Use of SOX Compliance Software and Tools

SOX compliance software solutions are crucial for every company legally required to comply with the Sarbanes-Oxley Act. 

One advantage of SOX compliance software is that it combines documents and content management, workflow, and monitoring to help map the process of SOX compliance.

Essentially, you’ll need a SOX compliance software solution that will attach supporting documentation directly to controls, besides storing all SOX-related program documents, including your Risk Control Matrix. 

Here’s the truth, companies are always looking for a simple and single application that can seamlessly manage their SOX audits. While the search may be long and frustrating, it’s well worth it.

Challenges and Solutions in SOX Compliance

In this section, we’ll discuss: 

• Common challenges companies face during compliance

• Practical solutions to SOX-compliance challenges

Common Challenges Companies Face During SOX Compliance 

While every experience will be different, the following are some challenges public companies face in achieving SOX compliance. 

• Inadequate Appreciation of SOX Compliance By Top Management: If the top management does not appreciate the importance of SOX compliance, they may not lend much-needed support for activities meant to get there.
  
  Consequently, that ambivalent attitude may cascade to the rest of the organization. The result is that the one-person efforts of the CFO may not be effective. 

• Inadequate Resources: Getting SOX-compliant will be easier if the company devotes sufficient resources towards the goal.
  
  Often, this is because of a lack of appreciation for the importance of SOX compliance. Internal control recommendations such as segregation of duties may be viewed as expensive and unnecessary. And at times, the company lacks enough resources and is torn between funding operating activities and achieving SOX compliance. 

• Failure to Perform Robust Risk Assessment: Companies that fail to perform a robust risk assessment often fail to identify processes, account balances, and relevant financial risks. This may lead to unfavorable findings during audits and hinder SOX compliance.

• Ineffective IT Environment: A reliable and effective IT infrastructure can go a long way in supporting the day-to-day operations of the company, besides facilitating financial reporting requirements.
  
  And SOX compliance will require IT systems to provide audit trails, data integrity and accuracy, and effective disaster recovery. All of these need to be well documented and replicable for external auditor testing. 

• Ever-evolving Risks: Today, the business environment is defined by unprecedented levels of fluidity. The risk landscape is particularly ever-evolving. As a result, SOX compliance is rarely the same year to year. 

Practical Solutions to SOX Compliance Challenges

Drawing on our experience of successfully aiding thousands of companies in streamlining their SOX compliance processes, we have found the following to be the most effective solutions:

1. The CFO should educate the company’s top leadership regarding the importance of SOX compliance.
   
   Part of this education should be about the fact that implementing SOX controls goes beyond complying with the law and reducing risk.
   
   If the top management appreciates the need for SOX compliance, they may open the purse strings and provide the necessary financial support to ensure its success.
2. The CFO must be involved in the risk assessment. In turn, they should see to it that all key company stakeholders are brought on board, including those outside the fields of accounting and finance, so that all process owners can appreciate the overarching objective of SOX compliance.
3. Experienced IT experts should be brought in to design and execute an effective IT environment that includes sourcing an application or software program tailored to the company’s unique needs. 
4. Get support from experts. While it may be expensive in the short term, getting expert help from experienced SOX risk professionals will ensure you’ve set up excellent structures for sustainable SOX compliance.

The Impact of Non-Compliance with Sarbanes-Oxley

The impact of non-compliance with the Sarbanes-Oxley Act can be grouped into two broad categories.

• Legal penalty for non-compliance
• Impact on corporate reputation and investor confidence

Legal Penalty for Non-compliance

The Sarbanes-Oxley Act prescribes a range of legal penalties for non-compliance. Some are imposed on executives, like CEOs and CFOs, and some are imposed on the company as a whole.

Penalties and legal consequences for SOX non-compliance include:

1. Civil penalties and fines
2. Disgorgement of profits
3. Barred from serving as an Officer or Director of a public company
4. Criminal charges that can result in 20-year prison sentences
5. Shareholder lawsuits
6. Loss of stock exchange listing

The type of legal outcome will be dependent on the severity of the non-compliance. 

Intentional fraud will garner a stern response, likely with criminal charges. While improper internal control documentation may result in a civil fine.

Impact on Corporate Reputation and Investor Confidence

A non-compliance issue can shatter a company’s value and reputation, leading to a monumental loss of business opportunities.

According to a survey conducted by Deloitte, 87% of the executives ranked reputation risk as an important strategic risk their company faces.

Non-compliance doesn’t only degrade a company or executive’s public image. Increased scrutiny and oversight by regulatory authorities will add to a company’s compliance burden.

Case Study: Successful SOX Compliance

In this section, we’ll briefly cover:

• A company that successfully implemented SOX compliance measures
• Lessons learned and key takeaways

An Overview of a Company That Successfully Implemented Sox Compliance Measures

Qualys Inc. was founded in 1999 and provides cloud computing security and compliance solutions. The California-based company boasts a client portfolio with more than 70% of Forbes Global 50 companies spread over 130 countries.

Qualys claims to have the largest vulnerability management deployment in the world at a Fortune Global 50 company.

Because managing its month-end financial Close using Excel was proving increasingly challenging, the company searched for accounting workflow automation software that could meet its financial reporting and workflow automation needs.

“The spreadsheet served its purpose, but it wasn’t efficient,” the company’s Director of Finance and Compliance, Valerie Cardozo, commented. 

This, according to Cardozo, was partly because the growth of Qualys had made the Close schedule more complex and time-sensitive, especially considering the accounting team was spread out on opposite sides of the world.

In 2019, the American technology firm settled on FloQast.

“I felt FloQast was more flexible and able to manage our needs as a global team,” Cardozo recalled, adding that FloQast’s close checklist was more streamlined and granted the geographically disparate teams more visibility into the close process.

After seeing how well FloQast worked for the operational side of things, the Qualys team decided to use FloQast’s accounting workflow automation tools for SOX compliance as well.

Today, the company Finance Director assigns the controls to a team member and doesn’t have to look at Excel or send out reminders, adding that FloQast gives peace of mind “knowing controls are signed off, and the evidence and data are readily available.”

Finally, according to Qualys, SOX compliance has become even more accessible by the fact the company granted licenses to both its internal and external auditors so they can promptly get the information they need, including the reconciliations and analysis that support the sign-offs.

Lessons Learned and Key Takeaways

Looking at the experience of Qualys, the following lessons emerge.

1. Spreadsheets have their place, but there is a level of complexity and timeliness at which they will prove inefficient.
2. Companies should look for customizable software that fits their unique needs.
3. Companies may want to focus on software that gives both day-to-day operational efficiency, including workflow automation tools, and SOX compliance.

Conclusion: The Future of SOX Compliance

In this section, we’ll look at: 

• Predicted changes and their impacts
• How companies can stay ahead of future changes

Predicted Changes and Their Impacts

While the fundamentals of SOX compliance haven’t changed since 2002, identifying the ongoing risks impacting financial reporting has changed tremendously and will continue to change.

• Risks: Increasing risks in cybersecurity and data governance will continue to be major factors in SOX compliance in the future. Identifying risks and establishing controls to prevent or mitigate damages will require companies to assess control environments continually.

Companies will move away from annual SOX compliance assessments and towards continuous monitoring. 

• AI and machine learning: Companies are looking to use AI and machine learning to automate more SOX compliance tasks. This would free up compliance professionals to focus on more value-added activities.
  
• International harmony: For companies operating globally, risk management and compliance means more than SOX compliance. There are IFRS (Internal Financial Reporting Standards), AML (Anti-Money Laundering) regulations, KYC (Know Your Customer) rules, and Basel III frameworks to follow.
  
  Companies must stay current on all the regulatory requirements they face and find software solutions that will provide SOX compliance and compliance with all its regulatory rules. 

How Companies Can Stay Ahead of Future Changes

The following are three ways businesses can stay ahead of future changes. 

• Define a clear compliance vision and strategy: Companies should have a compliance strategy that’s focused on the areas of the highest compliance risk.
• Invest in technology: Companies should invest in technologies that can help them automate SOX compliance tasks, identify and mitigate risks, and improve the quality of their financial reporting.
• Complete regular risk assessments: Companies should continuously monitor their risk environment to proactively catch a risk before it has a detrimental impact on financial reports.

Internal controls and SOX compliance have been around for over 20 years. Whether your company is new to the SOX game or a veteran, the key to winning in the SOX game is always to be monitoring and accessing. 

Don’t leave SOX compliance until year-end when you have hundreds of other tasks to complete. You’ll regret it. 

Stefan van Duyvendijk

Stefan van Duyvendijk is the Accounting Operations Evangelist at FloQast. Previously, Stefan served as the Corporate Controller for Kodiak Cakes, a private equity owned, leading consumer packaged food company, and as a Controller for Skullcandy, a multinational headphone CPG. These positions followed his five years at KPMG. His experience includes ASC 606 implementation, reduction of financial close timelines, accounting operational improvements, business combinations, financial statement audits, SOX audits and implementation, management reporting, debt, treasury, and systems integrations/implementation.