SOX

Who it applies to

Companies with securities registered with the SEC, their executives and their external auditors.

Key requirements

• Section 302: the CEO and CFO certify the accuracy of financial reports and the effectiveness of disclosure controls.
• Section 404: management assesses internal control over financial reporting, and larger filers get an auditor attestation.
• IT general controls over access, change management, operations and backups for financially significant systems.
• Segregation of duties and evidence that controls operated throughout the period.
• Record retention rules for audit work papers.

Breach and incident notification

No breach notification duty in SOX itself. Material cybersecurity incidents at public companies are disclosed under the SEC cybersecurity rules.

Penalties

Civil enforcement by the SEC, and criminal penalties including fines and imprisonment for knowingly certifying false financial reports.

Go deeper