The Sarbanes-Oxley Act of 2002 (SOX) was enacted in response to the Enron and WorldCom financial scandals. SOX imposes financial reporting requirements on all publicly traded companies and any company that registers with the Securities and Exchange Commission (SEC).
The Sarbanes-Oxley Act does not explicitly require private companies to undergo a SOX audit for Sox certification. However, many private companies choose to do so to instill investor confidence and demonstrate their commitment to good governance. Additionally, some lenders may require a SOX audit to provide financing.
What Is a SOX Audit?
As we mentioned, a SOX audit is an annual audit of a public company’s financial statements. The auditor will review the company’s internal controls and procedures to ensure they are adequate and effective. The auditor will also ask whether the financial statements are free of material misstatement.
SOX audits are generally conducted in two phases:
Phase 1: In the first phase of the audit, the auditor will assess the design of the company’s internal controls over financial reporting. The auditor will also test the effectiveness of those controls.
Phase 2: In the second phase of the audit, the auditor will test selected transactions to determine whether they were correctly recorded in the financial statements.
Required Financial Reporting for Public Companies
To comply with SOX, public companies must file financial reports with the SEC quarterly and annually. These reports must include an auditor’s opinion on the fairness of the financial statements and whether they were prepared by Generally Accepted Accounting Principles (GAAP).
In addition to the financial reports, public companies must also establish internal controls over financial reporting and disclose any material weaknesses in these controls. Finally, public companies must maintain accurate documentation of their financial records.
Types of SOX Audits
Two SOX audits are internal control over financial reporting (ICFR) and financial statement audits. ICFR audits are focused on a company’s internal controls, while financial statement audits focus on the veracity of the financial statements.
ICFR audits are typically conducted annually, while financial statement audits are conducted quarterly. However, companies may opt to have their ICFR audit and financial statement audit conducted at the same time if they feel it would be more efficient and cost-effective to do so.
PCAOB Standards for SOX Audits
To ensure that SOX audits are adequately performed, the PCAOB has issued several standards that auditors must follow. These standards address planning, audit performance, and audit results reporting.
To plan and perform the audit effectively, auditors must have a good understanding of the company’s business and its internal controls. They must also identify and assess the risks of material misstatement, whether due to error or fraud. After identifying and evaluating these risks, auditors must develop an appropriate audit strategy designed to mitigate them.
Once the audit is complete, auditors must issue a report on their findings. This report must include an opinion on whether or not the financial statements are presented fairly in accordance with GAAP. If there are any material weaknesses in internal controls, these must also be reported.
Voluntary Financial Reporting for Private Companies
Although private companies are not required by law to undergo a SOX audit, many choose to do so to improve investor confidence and show their commitment to good corporate governance. A SOX audit can also help attract new investors and secure financing from lenders.
Why Comply with SOX?
So why go through the hassle of compliance if you’re not required to? For one thing, it could make your company more attractive to investors. Publicly traded companies are subject to more scrutiny, so by voluntarily complying with SOX certification standards, you signal that your company is committed to high governance standards. This could give potential investors more confidence in your company and make them more likely to invest.
Additionally, compliance can help prevent fraud before it happens. The procedures and controls put in place by SOX are designed to deter and detect fraudulent activity. By implementing these procedures, you can create a culture of transparency and accountability that will help reduce the risk of fraud at your company.
What Does Compliance Look Like?
If your company is subject to SOX compliance, there are a few things you need to do. First, you’ll need to appoint a Chief Executive Officer (CEO) and Chief Financial Officer (CFO). These officers will certify that your financial statements are accurate and complete. You’ll also need to establish internal controls over financial reporting and maintain documentation of those controls. Finally, you’ll need an independent auditor to review your financial statements and confirm their accuracy.
Final Thoughts
The Sarbanes-Oxley Act of 2002 protects investors from fraud and deception by requiring publicly traded companies to submit accurate and reliable financial reports. While private companies are not required by law to undergo a SOX audit, many choose to do so voluntarily to improve investor confidence and demonstrate their commitment to good corporate governance. Ultimately, whether or not to subject a private company to a SOX audit is a decision that should be made on a case-by-case basis.
