Sarbanes-Oxley Act
/ SAR-baynz OX-lee /
Around 2001 and 2002, a string of huge American companies — Enron and WorldCom the most famous — collapsed after it emerged that their financial statements had been deliberately faked, wiping out investors and employees' savings. Public trust in corporate numbers cracked. In response, the U.S. Congress passed a law in 2002, named after its two sponsors, Senator Sarbanes and Representative Oxley, to force public companies to clean up how they report and to make executives personally accountable. Everyone just calls it SOX.
SOX changed several things at once. It created a new watchdog, the Public Company Accounting Oversight Board (PCAOB), to inspect and regulate the firms that audit public companies — auditing could no longer police itself. It required top executives (the CEO and CFO) to personally certify, under threat of criminal penalty, that their financial statements are accurate. Its famous Section 404 requires management to assess and report on the effectiveness of the company's internal control over financial reporting, and requires the external auditor to attest to that as well. SOX also tightened auditor independence — for example, banning audit firms from selling certain lucrative consulting services to the same companies they audit — and strengthened the role of the independent audit committee.
SOX matters because it reshaped the whole accountability landscape for U.S. public companies and influenced rules around the world; it is why CEOs now sign their own statements and why internal control documentation became a major annual exercise. The honest, balanced view: SOX clearly raised the bar for control discipline and executive accountability, but it is not free. Compliance — especially Section 404 — is expensive and burdensome, hitting smaller companies hardest, and like any rulebook it cannot stop a determined fraudster, only raise the cost and the consequences of getting caught.
Under SOX, the CEO and CFO of a U.S.-listed company must personally sign a certification that the annual financial statements are accurate and that internal controls have been evaluated. If they knowingly certify false statements, they face fines and possible prison — accountability that did not exist in the same form before 2002.
SOX put executives' own names — and freedom — behind the numbers.
SOX raised accountability but is costly to comply with, especially Section 404 and especially for smaller firms. Like any rule, it raises the cost of fraud rather than making fraud impossible.