If you’ve ever been a finance executive in a publicly traded company for more than a few days, you’re probably more than familiar with SOX Law. As regulations go, it’s one of the most prominent prudential regulations for public companies in the United States. Especially for those who want to avoid any sort of financial scandal or corporate fraud. More formally known as the Sarbanes-Oxley Act, its introduction in 2002 has led to established accountability trails, new levels of financial transparency, and lower rates of fraud.
At Trustpair, we help finance professionals respect SOX Law by maintaining the integrity of supplier data. This means that your people can be 100% confident in data security when performing international account validations, avoiding any risk of fraud. Want to learn more? Talk to one of our experts and ask for a demo!
A little bit of context about SOX law…
Around the millennium, the financial sector was rocked by accounting scandal after scandal. In particular, accounting fraud cases at Enron and Worldcom led to a lack of trust from investors. Something had to change.
Two Congress officers, Senator Paul Sarbanes, and Representative Michael G Oxley, came up with this act and pushed it through to pass in 2002. Their solution, coined as SOX Law, aimed to provide transparency in the market and prevent public companies from misleading potential shareholders.
SOX Law applies to US-based publicly traded companies and international public companies that do work in the US. Plus, organizations that are preparing for an initial public offering (IPO) must be SOX Law compliant.
How to be SOX compliant: key provisions and requirements
There are 11 separate sections of the Sarbanes-Oxley Act. But here are some of the most important provisions:
- Financial report requirements
- Disclosures
- Whistleblowing protections
Financial Reporting Requirements
Each financial statement must be reviewed and passed through the internal control system within 90 days of publishing. They must also be free of false or misleading omissions – truthfully representing the genuine financial health of the company.
Having the role of CFO at your company makes compliance with this requirement even more pressing. It’s the CEOs and CFOs who have the responsibility of validating each and every official financial document. This leaves CFOs finding themselves exposed if found non-compliant – with their professional reputations on the line.
Moreover, records must be kept for a minimum of five years.
Disclosures
Because it’s a prudential regulation, your finance team should show that you’re doing your best to be honest and transparent about the state of the company finances. Even if the specific documents aren’t written into SOX Law.
For example, as a senior accountant in your company, you might notice that certain debts and liabilities haven’t been reported, since they don’t fit on your standard financial report. Even though it’s not included in the SOX Act documentation, it should still be disclosed to avoid penalties like fines.
The CEO and CFO of QSGI Inc, a computer parts and equipment company based in Florida, were fined for this exact reason in 2014.
Compliance requirements also compel companies to urgently disclose any drastic changes to their operations of financial health to the public.
Imagine you’re the CFO of a company whose board is about to oust the CEO. In the eyes of SOX Law, it’s the investors who deserve to know about this first as it can significantly affect the price of their shares, and they should get as much notice as possible to make an informed financial decision instead of a reaction.
Whistleblower Protections
The SOX whistleblowing law was what really made this a groundbreaking piece of legislation. It protects employees who report financial misconduct against retaliation, such as unfair dismissal or discrimination at work.
For example, a junior accountant who notices that insider fraud is being committed by one of their managers would be protected when they raise the issue with other senior leaders. Furthermore, all conversations of this nature would be diligently recorded in order to protect the whistleblower and the integrity of the firm, with the SEC later being informed.
Both traditional whistleblowers and ‘up-the-ladder’ reporters are afforded protections under Federal Law. Moreover, companies must adopt a standard internal control policy and attorneys are under a Federal court obligation to report security violations.
As a senior financial executive, it means that you must build ‘whistleblower-friends’ policies into your operations. For example, by fostering a culture for your team to speak up when errors are noticed, training employees, and even creating an anti-retaliation policy.
How does auditing under the SOX Law work?
After the law was passed, a new regulator was created: the Public Company Accounting Oversight Board (PCAOB). One of the requirements of this act is that regulated public companies must be audited by external PCAOB auditors on an annual report basis (under a management assessment).
Not only does this board set the standard for audit reports across the industry, but they also investigate non-compliance and enforce SOX laws among regulated public companies. The four requirements for SOX audit are:
- Establishing control in a digital environment: as a CFO, you could be performing regular stress tests using different threats to evaluate your team’s operational resilience and ability to remain in control against cybercrimes.
- Risk assessment: as a financial executive, you could classify each of the potential threats to your department and create a strategy to reduce the risks of fraud. An auditor would look at how well you’ve identified those risks and how efficiently your team follows the policies you’ve created.
- Examination of information and communications: do your junior accountants follow the same official communications as the senior team members? How are you ensuring your data is secure and that the right information is being disclosed?
- Monitoring of ongoing changes: in this rapidly changing environment, CFOs, accountants, and treasurers alike should have one ear to the ground. Are you utilizing horizon-scanning technology to plan for what’s around the corner?
What are the key benefits of the Sarbanes-Oxley Act?
The primary benefit of the SOX Act is that it significantly reduced accounting fraud across the board. The implementation of accounting standards combined with the idea of regular audits meant that finance departments completely overhauled their processes and systems to comply.
Likewise, investor confidence has increased knowing that auditor independence is genuine and that there are minimum standards of compliance that align with public interest. This means that your all-important financial supporters are better equipped to make decisions regarding their hard-earned cash.
Are there any common criticisms of SOX Law?
The largest criticism of SOX Law is the cost of compliance. At the time in 2002, this was the largest operational change that most companies had ever made. Remaining operational under the SOX compliance requirements came at a costly price. CFOs jumped to buy new software subscriptions that would help, and finance team members spent lots of extra hours creating the documentation templates that are still used today.
Plus, the entire workforce had to be trained up on new systems, thanks to a huge learning curve. This took focus away from company growth and is likely to have cost companies millions of dollars.
SOX Law became a barrier for companies who wanted to go public and led to significant delays. Compliance costs disproportionately affected small businesses, which led them to turn to alternative financing methods like venture capital instead of going public.
For example, Slack Technologies is a prominent example of a company that chose to fund through venture capital instead of an IPO, due to SOX Law. Slack’s 2014 press release stated,
“The Sarbanes-Oxley Act of 2002 requires significant efforts and expense to comply with its requirements, and we believe that it is better for our company and our shareholders to remain a private company and to raise capital privately than to pursue an initial public offering at this time.”
How can your company become SOX Law compliant?
SOX Law compliance is mandatory for regulated entities. But it is also a good opportunity for corporate governance, applying the best internal accounting controls to prevent corporate fraud. While the cost of such compliance has been widely criticized, it’s not an optional choice for a publicly traded company.
As a fraud expert, we help protect your company from B2B payments fraud. Having kept confirmed fraud cases at zero since we began, we ensure security at every stage of the procurement process. Want to learn more about fraud and how you can avoid it? Check out our free fraud survey with tips and recommendations.
