The Sarbanes-Oxley Act of 2002

The Sarbanes-Oxley Act of 2002 is the most significant Federal law that impacts public companies to be introduced since the Securities Acts of 1933 and 1934. This legislation set new or enhanced standards for all U.S. public company Board of Directors, top management, and the public accounting firms that audit public companies. The Sarbanes-Oxley Act of 2002 (“SOX”) was introduced in response to a number of accounting scandals around the turn of the millennium, including Enron, Tyco, and WorldCom. Since 2002, SOX has had significant impacts on internal controls, financial reporting, and the accounting profession.

For most public companies, SOX required increased process-level and entity-level controls in order to comply. This has had both direct costs, in terms of direct and indirect compliance costs, as well as benefits, such as enhanced understanding of control design and control operating effectiveness. Moreover, the type or category of internal controls has changed since the introduction of SOX. Prior to SOX, many companies, and their internal audit departments, focused mostly on the internal controls such as segregation of duties, controls over cash and inventory, and cut-off. This type of internal controls focuses on process controls and tends to look at transactions in isolation. Further, these are controls over transactions that are rather common. However, many of the lapses in internal controls that contributed to the aforementioned accounting scandals involved revenue recognition and “less-routine” accounting transactions that were company or industry specific and thus both internal and external auditors were familiar with the internal controls involving these transactions and how to test them. These controls were also more process driven and less like to be performed at the entity-level. Therefore, since SOX, at the bequest of their external auditors in order to comply with the new regulations, companies have focused their internal controls design efforts towards revenue recognition and entity-level controls.

SOX legislation’s purpose was to improve the reliability of financial reporting. It has done so by requiring that every public company have an audit committee that is independent of management, and that the committee have at least one financial expert. The external auditor’s report itself has changed, and now has a paragraph where the external auditor opines on the effectiveness of internal controls over financial reporting. Also, the company’s CEO and CFO must certify financial reports and there are strict penalties if those reports are later found to be fraudulent.