SOX compliance: Requirements, controls, and audit prep

SOX compliance is the process of meeting the financial reporting, internal-control, and audit requirements created by the Sarbanes-Oxley Act of 2002.

Failing to meet certain SOX requirements can expose individuals to significant criminal penalties, including up to $5 million in fines and up to 20 years in prison for a willfully false Section 906 certification. Covered public companies must also maintain accurate financial reporting, provide required executive certifications, and comply with applicable internal-control and audit requirements.

What is SOX compliance?

SOX compliance means meeting the corporate reporting, internal-control, auditor-oversight, and recordkeeping requirements that apply under the Sarbanes-Oxley Act and related SEC and PCAOB rules. In practice, it means that covered issuers maintain reliable financial records, make required certifications and disclosures, and support independent audits.

SOX, short for the Sarbanes-Oxley Act of 2002, is a U.S. federal law. Congress enacted it after major accounting scandals, including Enron and WorldCom, to strengthen investor protection and oversight of public-company reporting.

The stakes can be personal for leadership. Under Section 906, an executive who willfully certifies a periodic report knowing it does not meet the Act's requirements can face fines of up to $5 million and up to 20 years in prison. The statute distinguishes knowing and willful false certifications.

SOX vs. GAAP

SOX and generally accepted accounting principles (GAAP) work together but do different jobs: SOX is a federal law addressing accountability and controls, while GAAP is the accounting framework used to prepare financial statements. SEC reporting requirements generally require GAAP-compliant financial statements; SOX adds executive-certification, internal-control, auditor-oversight, and enforcement provisions.

In short, GAAP guides financial-statement preparation, while SOX establishes accountability and control requirements around public-company reporting.

Who needs to comply with SOX?

SOX primarily applies to issuers that file reports with the SEC under the Securities Exchange Act of 1934, as well as to PCAOB-registered firms that audit public companies. The precise obligations vary by issuer type, filing status, and SOX provision. A private subsidiary may not itself be an SEC reporting issuer, but its processes and controls can be in scope for its public parent’s consolidated reporting.

SEC reporting companies and exchange-listed issuers

Companies with SEC reporting obligations, including companies listed on the New York Stock Exchange (NYSE) or Nasdaq, are generally subject to applicable SOX requirements. Obligations can differ for smaller reporting companies, emerging growth companies, foreign private issuers, and non-accelerated filers. Compliance supports reliable financial reporting and can help protect investors from expense fraud.

Subsidiaries of public companies

A subsidiary is not automatically a separate SOX reporting issuer merely because its parent is public. However, the parent’s management must evaluate internal control over financial reporting for the consolidated business. That often makes subsidiary financial processes, systems, and controls relevant to the parent’s SOX program.

Accounting firms auditing public companies

Firms that prepare or issue audit reports for SEC issuers must be registered with the PCAOB and comply with applicable PCAOB standards and SEC rules. The PCAOB inspects registered firms and can impose disciplinary sanctions; legal consequences depend on the facts and applicable law.

Foreign companies with U.S. reporting obligations

Foreign private issuers that are subject to SEC reporting requirements can be covered by key SOX provisions, although certain reporting forms and requirements differ from those for domestic issuers. Exchange listing alone is not the only trigger; the company’s SEC registration and reporting status matter.

Private companies preparing for IPOs

Private companies generally are not legally required to comply with SOX. If a company plans to go public, however, adopting documented controls early can make IPO preparation more manageable. Investors, lenders, buyers, and boards may also expect disciplined financial oversight before a transaction.

Key SOX compliance requirements

The Sarbanes-Oxley Act (SOX) establishes requirements for executive certifications, management’s assessment of internal control over financial reporting, auditor oversight, timely disclosures, and recordkeeping. The Securities and Exchange Commission (SEC) administers the federal securities laws, while the Public Company Accounting Oversight Board (PCAOB) oversees registered public-company audit firms.

Section 302: Corporate responsibility for financial reports

Section 302 requires a company’s principal executive and principal financial officers to certify each quarterly and annual report filed under Exchange Act Sections 13(a) or 15(d). The certification addresses, among other things, the report’s accuracy, disclosure controls and procedures, and internal control over financial reporting. Officers must disclose significant deficiencies, material weaknesses, and fraud involving management or employees with a significant role in internal control to the auditors and audit committee, as specified in the certification rules.

Section 404: Management assessment of internal controls

Section 404 requires management’s annual report to include management’s responsibility for internal control over financial reporting and management’s assessment of its effectiveness. The external auditor’s attestation on management’s assessment is not universal: SEC rules exempt non-accelerated filers from the auditor-attestation requirement, and certain other exemptions or transition periods may apply. PCAOB AS 2201 governs integrated audits when an auditor attestation is required.

This work can be costly and time-consuming. Costs depend on company size, complexity, control maturity, technology, and whether an auditor attestation is required. Budget estimates should rely on a current, directly sourced benchmark that matches the company’s profile.

Many programs use the COSO internal control framework to design and evaluate internal control. COSO describes five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. Using a recognized framework can help management document its basis for assessment.

If management identifies a material weakness, it must disclose that conclusion in its annual internal-control report. Where an auditor attestation is required, the auditor expresses an opinion on the effectiveness of internal control over financial reporting; an adverse opinion may result when one or more material weaknesses exist.

Section 409: Rapid disclosure of material changes

Section 409 requires issuers to disclose material changes in financial condition or operations on a rapid and current basis. It does not itself set a universal “real-time” deadline or turn every material event into an eight-K filing. Form 8-K has its own item-specific requirements—many require filing within four business days—and companies must also consider other disclosure obligations.

The SEC’s 2023 cybersecurity-disclosure rules are separate from SOX. They generally require domestic registrants to disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days after determining the incident is material, subject to limited exceptions. Incident-response and disclosure-control processes may intersect with SOX-related governance, but the cybersecurity rule is not a SOX requirement.

Section 802: Criminal penalties and recordkeeping

Section 802 includes criminal provisions for knowingly altering, destroying, concealing, or falsifying records with the intent to impede or influence a federal investigation or bankruptcy case. Conviction under 18 U.S.C. § 1519 can carry fines and up to 20 years in prison.

Section 802 also established a five-year statutory retention requirement for certain audit or review work papers. SEC Rule 2-06 generally requires accountants to retain specified audit and review records for seven years. That requirement does not mean every company financial record has a single five- or seven-year SOX retention period; records schedules should be based on the applicable legal, regulatory, tax, contractual, and litigation-hold requirements.

Section 906: Certification of financial statements

Section 906 requires the CEO and CFO to certify periodic reports containing financial statements. The certification states that the report fully complies with the Exchange Act’s periodic-report requirements and fairly presents, in all material respects, the issuer’s financial condition and results of operations. A knowing false certification can result in up to $1 million in fines and 10 years in prison; a willful false certification can result in up to $5 million and 20 years.

The four types of SOX controls

Teams commonly use four practical categories to organize SOX-related controls: preventive, detective, corrective, and IT general controls. SOX does not prescribe this as a mandatory four-part taxonomy, and IT general controls can also be preventive or detective.

• Preventive controls stop errors or fraud before they happen. Examples include segregation of duties and approval limits that keep one person from authorizing and recording the same transaction.
• Detective controls identify problems after the fact. Reconciliations and audit-log reviews can surface discrepancies that slipped past preventive checks.
• Corrective controls address issues once identified. Remediation plans and, where necessary, corrected reporting can address control failures.
• IT general controls (ITGCs) govern the systems that process financial data. Access management and change management help ensure that only authorized people can affect records supporting financial statements.

Most SOX programs layer multiple controls so a weakness in one can be detected or addressed by another. The right design depends on the risk, the financial-statement assertion, and the process being controlled.

Penalties for SOX non-compliance

Penalties depend on the provision, conduct, and enforcement authority involved. Executives who willfully make a false Section 906 certification can face personal fines of up to $5 million and imprisonment for up to 20 years. The SEC may bring civil enforcement actions, while the Department of Justice can pursue criminal cases where the law provides for them.

• False certification (knowing): Up to $1 million in fines and 10 years’ imprisonment under Section 906
• False certification (willful): Up to $5 million in fines and 20 years’ imprisonment under Section 906
• Document destruction or alteration: Fines and up to 20 years’ imprisonment can apply under 18 U.S.C. § 1519 when the statute’s intent elements are met
• Whistleblower retaliation: Section 806 provides employee-protection remedies; related criminal retaliation statutes can carry additional penalties depending on the conduct
• SEC civil enforcement: Potential remedies can include injunctions, disgorgement, civil penalties, and officer-and-director bars, subject to the applicable law and case facts
• Listing consequences: Material reporting or control failures can lead to increased scrutiny and, in some circumstances, exchange-compliance consequences

Beyond legal exposure, control failures can erode investor confidence and impair a company’s ability to report reliably.

Benefits of SOX compliance

SOX compliance can strengthen financial operations and support investor confidence beyond the legal baseline. The controls used for financial reporting may also support operational discipline and security when designed and maintained effectively.

• Investor confidence: Transparent reporting and independent assurance can support confidence in financial statements.
• Fraud deterrence and detection: Internal controls and segregation of duties can make improper activity harder to conceal and easier to investigate.
• Stronger internal processes: Documenting and testing controls can reveal inefficiencies, unclear ownership, and inconsistent processes.
• Better security governance: Access management, audit logging, and change management can also support cybersecurity and data-governance objectives, though SOX is not a comprehensive cybersecurity framework.

How to achieve SOX compliance

Start with a risk assessment and build a repeatable process for maintaining controls. When an integrated audit is required, the auditor uses a top-down, risk-based approach under PCAOB AS 2201; management can use a similar risk-based approach to focus its own assessment and testing.

1. Assess financial risks and map internal controls

Map financial-reporting processes and identify risks of material misstatement, fraud, or reporting error. Review transaction approvals, data access, financial close, and reporting workflows to identify the controls that address those risks.

Test and document control design and operation through walkthroughs, control testing, and gap analyses. If you find weaknesses, update policies, strengthen security controls, or automate procurement processes where appropriate.

Under Section 404, management’s annual report must include its assessment of internal control over financial reporting. Maintain documentation that supports the assessment, including control descriptions, evidence, results, deficiencies, and remediation.

Many finance teams use established frameworks. The COSO internal control framework supports internal-control design; COBIT can support IT governance. Choose a framework that fits your risks, systems, and reporting obligations.

A practical deliverable is a risk-and-control matrix that maps financial processes and assertions to control objectives, owners, evidence, and testing plans. It can help management focus its assessment on the controls that matter most.

2. Document and test internal controls

Strong internal controls help prevent errors and support reliable financial reporting. Define approval processes, restrict access, and separate duties for financial transactions where practical.

A key control principle is segregation of duties: avoid giving one person the ability to authorize, record, and reconcile the same transaction without an effective compensating control.

Standardize and document procedures across relevant departments. Every transaction, from expense approvals to revenue tracking, should follow policies appropriate to the risk and process.

Set a testing cadence based on risk, control frequency, change, and audit requirements. Management’s Section 404 assessment is annual, but high-risk or frequently changing controls may warrant more frequent monitoring and testing.

3. Implement compliance technology

Technology can help centralize control documentation, collect evidence, monitor exceptions, and reduce manual work. Integrate audit-management and financial-reporting tools where that improves traceability and control operation.

Four tool categories are worth evaluating:

• GRC (governance, risk, and compliance) platforms: Centralize risk, control, testing, and issue management.
• DLP (data loss prevention) tools: Help protect sensitive financial data.
• SIEM (security information and event management) systems: Centralize security-event logging and monitoring.
• IAM (identity and access management) solutions: Help enforce appropriate access and permissions.

The right SOX technology depends on the company’s size, complexity, risks, and existing systems.

Automated preventive controls can reduce reliance on after-the-fact manual review. Ramp's Policy Agent, an always-on AI reviewer trained on your actual expense policy, reviews 100% of transactions and catches 7x more out-of-policy spend than traditional rule-based systems at 99%+ accuracy, enforcing policy before spend happens instead of flagging it later.

Set up access controls and data-security measures appropriate to your systems and risks. Role-based permissions, encryption, and audit logs can help prevent unauthorized access to financial records. Retention periods should follow the applicable records schedule rather than a single blanket SOX period.

Use automated monitoring where it improves control operation, and retain evidence that shows how alerts, exceptions, and remediation were handled. AI accounting software can support monitoring and workflow automation, but it does not replace management’s responsibility to design, operate, and evaluate controls.

Only about 1 in 5 organizations currently use AI to support SOX compliance, according to a Protiviti poll of more than 1,500 audit and finance professionals, which reported that 78% were not yet using it. The result describes the surveyed group and should not be read as a universal adoption rate.

Document system updates and security changes that could affect in-scope controls. Management and the audit committee should have appropriate visibility into significant control changes and deficiencies.

4. Train employees on SOX requirements

Employees who understand their responsibilities can help identify and escalate compliance risks. Build role-appropriate training that covers documentation, reporting responsibilities, control operation, and escalation paths.

Tailor training to the role: finance teams may focus on reporting and audit preparation; IT teams on access and change controls; executives on their certification and disclosure responsibilities.

Use examples and exercises that reflect the company’s actual risks and processes, then document completion where training is a control.

5. Conduct regular internal and external audits

Regular reviews help management determine whether controls are designed and operating effectively. The frequency of internal audit work should reflect risk, organizational structure, and the annual management assessment; SOX does not mandate that every issuer conduct a separate internal audit once each year.

After each review, document findings, assess their severity, and track remediation. External auditors will evaluate relevant evidence when auditing financial statements and, where applicable, attesting to internal control over financial reporting.

When required, the external financial-statement audit is conducted by an independent, PCAOB-registered firm. An auditor attestation on internal control is required for many (but not all) issuers. Use a top-down, risk-based scope that starts with material accounts and disclosures, then identifies the controls that address the risk of material misstatement.

6. Maintain accurate financial records

Detailed, accurate financial records support reliable reporting and audit readiness. Organize financial documents, including transaction records, invoices, payroll data, and expense reports, according to a documented retention schedule.

Use recordkeeping systems that preserve appropriate access, versioning, and searchability. Automation can reduce manual error, but companies should validate that their records remain complete, accurate, and retrievable.

Limit access to sensitive data with role-based permissions and appropriate security safeguards. External auditors may evaluate records and controls relevant to the audit, so organized, supportable evidence strengthens readiness.

SOX compliance checklist

SOX readiness commonly spans financial reporting, IT and access controls, audit preparation, and documentation. Apply each item according to your issuer status, risks, and applicable SEC and PCAOB requirements.

Financial reporting controls

• CEO and CFO certifications prepared for applicable quarterly and annual Exchange Act reports
• Management’s annual internal-control report included where required
• Material changes disclosed under applicable SEC requirements, including Form 8-K where an item is triggered
• Financial statements prepared under the applicable accounting framework, including U.S. GAAP where required
• Off-balance-sheet arrangements and other required disclosures evaluated under applicable SEC rules

IT and access controls

• Role-based access controls applied to in-scope financial systems
• Strong authentication applied to privileged accounts where appropriate to risk
• Change-management process documented for in-scope financial-system updates
• Audit logs retained and reviewed according to control design and records requirements
• Data-protection controls applied to sensitive financial records
• Security and vulnerability processes aligned to the company’s risk assessment

Audit preparation

• Management assessment and control testing planned around reporting deadlines
• Evidence retained for each key control, such as logs, approvals, reconciliations, and sign-offs
• Independent PCAOB-registered audit firm engaged when required
• Control deficiencies evaluated, documented, and remediated on an appropriate timeline
• Audit committee oversight maintained as required by applicable rules and governance practices

Documentation and retention

• Audit and review work papers retained for the period required by applicable law and SEC rules
• Financial records retained under a documented schedule that accounts for legal, tax, regulatory, contractual, and litigation-hold requirements
• Records indexed and retrievable for audit and regulatory requests
• Whistleblower reporting process and anti-retaliation protections maintained as required by applicable law
• Internal-control documentation updated for relevant process or system changes

Automate SOX controls with Ramp's built-in approval workflows and audit trails

SOX compliance requires rigorous internal controls over financial reporting, but manual approval processes and scattered documentation can make consistent oversight harder. Automated controls can help teams enforce policy, create audit trails, and scale processes without adding headcount.

Ramp supports SOX-relevant spend controls within your spend-management workflow, so transactions can follow your approval matrix and create a complete audit trail automatically. You set spending limits, define approval chains, and enforce policy at the point of purchase.

Here's how Ramp can strengthen internal controls:

• Multi-level approval workflows: Configure approval chains based on amount thresholds, departments, or vendors so high-risk spend routes to the right stakeholders before it is authorized.
• Real-time policy enforcement: Block out-of-policy purchases automatically and require manager approval for exceptions, so controls are applied consistently across transactions.
• Immutable audit trails: Capture who approved what, when, and why for every transaction, with timestamped records that can't be altered or deleted after the fact.
• Automated receipt collection: Require receipts and memos at the point of purchase, so supporting documentation is attached to every transaction before it posts to your books.
• Role-based access controls: Restrict who can view, approve, or modify transactions based on their role, so segregation of duties is enforced automatically.

Ramp's accounting automation software can help teams automate parts of their control workflow and maintain the documentation needed for audit readiness. It does not replace management’s responsibility to assess controls or determine SOX compliance.

Try an interactive demo to see how Ramp automates internal controls and supports audit-ready spend workflows.