What is Sarbanes-Oxley Act?

A law that was passed in 2002 in response to a number of corporate scandals. The law sets new standards for all U.S. public companies, including requirements for internal controls and financial reporting.

Since SOX's enactment, firms have made significant changes to their corporate governance and financial reporting practices. Many companies have implemented SOX compliance programs, which typically include the establishment of internal controls over financial reporting (ICFR) and other related procedures. In order to comply with SOX 404, management must assess the effectiveness of the company's ICFR on an ongoing basis.

The costs associated with SOX compliance have been significant, especially for smaller companies. A study by the U.S. Government Accountability Office (GAO) found that public companies spent an average of $4.36 million on SOX compliance in 2010, while smaller companies spent an average of $1.13 million.

Despite the costs, many companies believe that SOX has had a positive impact on corporate governance and financial reporting. In a 2012 survey of public company finance executives by Protiviti, 76 percent of respondents said SOX had improved the quality of financial reporting at their companies, while only 4 percent said it had made financial reporting worse.

What is section 404 of Sarbanes Oxley?

Section 404 of the Sarbanes-Oxley Act (SOX) requires public companies to establish and maintain internal controls over financial reporting (ICFR). The goal of this section is to prevent fraud and ensure the accuracy of financial statements.

Section 404 applies to all public companies, including those that are listed on U.S. stock exchanges and those that are not. It also applies to foreign companies that file periodic reports with the U.S. Securities and Exchange Commission (SEC).

The requirements of section 404 are often referred to as the "internal control over financial reporting" or "ICFR" requirements.

What are the requirements of section 404?

There are two main requirements of section 404:

1) Public companies must establish and maintain ICFR.

2) Management must assess the effectiveness of the company's ICFR on an ongoing basis.

The first requirement, known as the "establishment requirement," requires public companies to put in place ICFR that are designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles (GAAP).

The second requirement, known as the "assessment requirement," requires management to assess the effectiveness of the company's ICFR on an ongoing basis. This assessment must be documented in a written report that is filed with the SEC.

The report must include a description of the company's ICFR, a statement from management regarding the effectiveness of the ICFR, and any material weaknesses in the ICFR that were identified during the assessment.

What are the penalties for non-compliance with section 404?

The penalties for non-compliance with section 404 can be severe. Public companies that fail to comply with the ICFR requirements may be subject to civil and criminal liability.

In addition, the SEC may impose financial penalties on public companies that do not comply with the ICFR requirements. The maximum penalty that the SEC can impose for each violation is $5 million.

The Sarbanes-Oxley Act also gives the SEC the authority to bar individuals from serving as officers or directors of public companies if they are found to have violated the ICFR requirements.

What is SOX compliance training?

SOX compliance training is a type of training that helps employees understand the requirements of the Sarbanes-Oxley Act (SOX) and how to comply with them. SOX compliance training programs vary in content and length, but most include an overview of the law, an explanation of the company's internal controls, and guidance on how to identify and report potential compliance issues.

SOX compliance training is not required by law, but it can be helpful in preventing compliance problems and reducing the risk of financial penalties. In addition, many investors and analysts view SOX compliance as a positive sign of a company's commitment to good corporate governance.

Sarbanes Oxley Compliance Training Program

SOX Compliance Course overview:

The Sarbanes Oxley Compliance Training Program is designed to help organizations comply with the Sarbanes-Oxley Act of 2002. The program includes four modules that cover the requirements of the Sarbanes-Oxley Act, including internal control evaluation and testing, disclosure controls and procedures, and management's assessment of internal control.

Who should take this course:

The Sarbanes Oxley Compliance Training Program is designed for accountants, auditors, and financial professionals who need to understand the requirements of the Sarbanes-Oxley Act and how to comply with them.

SOX Compliance Course objectives:

By the end of the course, participants will be able to:

- Understand the requirements of the Sarbanes-Oxley Act

- Evaluate and test internal controls

- Implement disclosure controls and procedures

- Assess management's assessment of internal control

Course outline:

Module 1: Introduction to the Sarbanes-Oxley Act

- Overview of the Sarbanes-Oxley Act

- Purpose of the Act

- Key provisions of the Act

Module 2: Internal Control Evaluation and Testing

- The requirements for an effective internal control program

- Evaluating internal controls

- Testing internal controls

Module 3: Disclosure Controls and Procedures

- The requirements for disclosure controls and procedures

- Implementing disclosure controls and procedures

Module 4: Management's Assessment of Internal Control

- Management's responsibility for assessing internal control

- The components of an effective assessment program

- Conducting the assessment

- Reporting the results of the assessment

Course Materials:

The course materials include the Sarbanes-Oxley Compliance Training Manual, which provides an overview of the Act and its requirements, as well as guidance on how to comply with the Act. The manual also includes templates and checklists for evaluating and testing internal controls, implementing disclosure controls and procedures, and assessing management's assessment of internal control.

Glossary:

SOX compliance: Meeting the requirements of the Sarbanes-Oxley Act of 2002.

Internal control: A system of procedures, policies, and people that helps an organization achieve its objectives.

Disclosure controls and procedures: Procedures designed to ensure that information required to be disclosed in an organization's financial reports is recorded, processed, summarized, and reported on a timely basis.

Management: The individuals who are responsible for the day-to-day operations of an organization.

Internal control evaluation and testing: The process of assessing whether a company's internal controls are designed and operating effectively.

Testing: A process of examining a company's internal controls to determine whether they are operating effectively.

Assessment: The process of determining whether a company's internal controls are effective.

Financial data: Information that is used to make financial decisions.

Non-financial data: Information that is not financial in nature, but which may be important to an organization's operations.

Publicly traded companies: Companies that are listed on a stock exchange and whose shares can be bought and sold by members of the public.

Stock exchange: A marketplace where stocks (pieces of ownership in businesses) and other securities are traded between investors.

Securities: Financial instruments, such as stocks and bonds, that represent an investment in a company or organization.

Internal control structure: The policies and procedures that an organization has in place to ensure that its internal controls are effective.

Inadequate internal control structure: A situation in which an organization does not have adequate policies and procedures in place to ensure that its internal controls are effective.

Material weakness: A significant deficiency or a combination of significant deficiencies in an organization's

SOX compliance audit: An audit of a company's financial statements and internal controls, conducted by an independent public accounting firm, to ensure that the company is in compliance with the Sarbanes-Oxley Act.

SEC: The US Securities and Exchange Commission, a government agency that regulates the securities industry.

PCAOB: The Public Company Accounting Oversight Board, a non-profit corporation established by the Sarbanes-Oxley Act to oversee the auditors of public companies.

Sarbox: A nickname for the Sarbanes-Oxley Act.

Financial records: Records that document an organization's financial transactions.

Banking records: Records that document an organization's banking transactions.

Assets: Items of value that are owned by an organization.

Liabilities: Money that is owed by an organization.

Maintaining adequate records: Having enough records to support the information reported in an organization's financial statements.

Proper books and records: Accurate and complete financial records that are maintained in accordance with generally accepted accounting principles.

GAAP: Generally accepted accounting principles, a set of guidelines for financial reporting.

Preventing and detecting fraud: Having procedures and controls in place to prevent and detect fraudulent activity.

Data protection: Having procedures and controls in place to protect an organization's data from unauthorized access or disclosure.

IT security: Having procedures and controls in place to protect an organization's information technology infrastructure from attack or unauthorized access.

Physical security: Having procedures and controls in place to protect an organization's physical assets from theft, vandalism, or other damage.

Internal control report: A report that is prepared by an organization's management, detailing the results of the evaluation and testing of the company's internal controls.

Filing requirements: The requirements that a company must meet in order to file its financial statements with the SEC.

Audit committee: A committee of a company's board of directors that is responsible for overseeing the company's financial reporting process and its compliance with legal and regulatory requirements.

CEO: Chief executive officer, the head of an organization.

CFO: Chief financial officer, the head of an organization's finance department.

Financial statements: Statements that show an organization's financial position, performance, and cash flow.

Balance sheet: A financial statement that shows an organization's assets, liabilities, and equity at a specific point in time.

Income statement: A financial statement that shows an organization's revenue, expenses, and net income for a specific period of time.

Statement of cash flows: A financial statement that shows an organization's cash inflows and outflows for a specific period of time.

Footnotes: Explanatory notes that are included with financial statements.

Independent public accounting firm: A firm that is not affiliated with the company being audited.

Audit: An examination of an organization's financial statements and internal controls by an independent public accounting firm.

Financial statement audit: An audit of an organization's financial statements.

Internal control audit: An audit of an organization's internal controls.

Trial balance: A list of all the account balances in an organization's accounting system.

Chart of accounts: A list of all the accounts in an organization's accounting system.

Ledger: A record of an organization's financial transactions.

Journal: A record of an organization's financial transactions that is used to create ledgers.

Accrual basis accounting: An accounting method in which revenue is recognized when it is earned and expenses are recognized when they are incurred, regardless of when the cash is received or paid.

Data security: Having procedures and controls in place to protect an organization's data from unauthorized access or disclosure.

SOX compliance requirements: Requirements that public companies must meet in order to comply with the Sarbanes-Oxley Act.

SOX internal controls: Internal controls that are required by the Sarbanes-Oxley Act.

SOX compliance objectives: Objectives that must be met in order to comply with the Sarbanes-Oxley Act.

SOX audit: An audit of an organization's compliance with the Sarbanes-Oxley Act.