Sarbanes-Oxley Act

Sarbanes-Oxley, commonly called SOX, restructured how public companies report and how their reports are audited. Its central premise is that accurate financial statements depend on three things working together: management being personally accountable for what it publishes, internal controls being strong enough to catch errors and fraud, and auditors being independent enough to challenge management.

Several provisions carry most of the exam weight. Section 302 requires the CEO and CFO to personally certify that each periodic report is accurate and that they have evaluated the company's disclosure controls. Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting, with the external auditor attesting to that assessment for larger filers. Section 802 sets record-retention requirements and criminal penalties for destroying or altering documents, and Section 806 protects employees who report suspected fraud from retaliation.

SOX also changed the auditing profession itself. It created the Public Company Accounting Oversight Board (PCAOB) to register, inspect, and discipline the firms that audit public companies, ending the profession's self-regulation. To protect independence, it bars audit firms from providing many non-audit services — such as bookkeeping, internal audit outsourcing, and certain systems design work — to the same client, requires rotation of the lead audit partner, and places the audit committee, composed of independent directors, in charge of hiring and overseeing the auditor.

On the CMA Part 1 exam, Sarbanes-Oxley appears in the internal control and governance section alongside the COSO framework and external audit requirements. Know which section imposes which obligation, the role of the PCAOB and the audit committee, and how SOX shapes management's responsibility for internal control over financial reporting.