The Sarbanes-Oxley Act (SOX) of 2002 was passed to prevent accounting fraud and help shore up investor confidence in securities markets. It was created in response to a series of corporate scandals involving companies such as Enron, WorldCom, Peregrine Systems and Tyco International. Investors were misled by these companies’ financial reports, and those of others like them, and lost a significant amount of money when these stocks took a nosedive.
For example, Enron, once one of the most successful companies in the world, collapsed once fraud was discovered. According to Investopedia, Enron shares that once traded as high as $90.75 descended to around $0.26 after company management’s deception was revealed.
Table of Contents
1. The purpose of SOX: Reducing corporate fraud
2. Understanding SOX 404
2.1. What are internal controls?
2.2. Top-down risk assessment
2.3. SOX compliance basics
2.4 How to prepare for a SOX compliance audit
3. Why document management provides a foundation for meeting SOX 404 requirements
4. Compliance checklist for SOX 404
5. Resources
The purpose of SOX: Reducing corporate fraud
The Act states that the chief executive officer (CEO) and the chief financial officer (CFO) must sign statements certifying the accuracy of financial reports that will be shared with regulators, shareholders and the public at large. SOX sparked the creation of a Public Company Accounting Oversight Board (PCAOB) which oversees the audits of public companies and SEC-registered brokers and dealers.
SOX also increased fines and criminal sentences for fraudulent reporting. Although there is no legal obligation for nonprofits and private companies to adhere to SOX, many of them consider it a best practice.
Understanding SOX 404
SOX is divided into 11 titles. However, some sections will be more significant than others due to their scope and cost. SOX 404 is important because it focuses on analysis of internal controls and financial reporting procedures. It established new accountability standards for corporate boards and auditors. This section requires companies to ensure that they have adequate internal controls over financial reporting and that those controls are documented, tested, and maintained to ensure their effectiveness.
What are internal controls?
Internal controls seek to guarantee the accuracy of financial statements by building processes that ensure adherence to legal regulations. They encompass all the measures that mitigate risk. Internal controls are critical in recognizing and preventing unlawful activities while safeguarding tangible assets like equipment and real estate and intangible resources like a good reputation and trademarks.
Both physical and electronic controls can be used to reduce the risk of financial transactions. Physical controls include separation of duties so that fewer people or processes are involved. Electronic controls range from basic two-step verification to encryption and cybersecurity protocols.
At the transaction level, internal control involves taking steps to accomplish a particular goal, such as ensuring that the organization only pays for legitimate third-party services. By decreasing potential financial errors, internal controls reduce the risk of irregularities that can be called into question in an audit.
To ensure the effectiveness of internal controls, they should be reviewed to monitor their long-term performance. This can be done through continuous assessment, periodic evaluations or a combination of both methods
Top-down risk assessment
.jpg?width=600&height=398&name=Clarity%2011%208%20(1).jpg)
Top-down risk assessment (TDRA) is a problem-solving method where a complex issue is examined as a whole and then broken down into smaller, more understandable sections. The aim is to split a complicated system into more manageable segments and address each one independently, ultimately finding the solution to the entire issue.
An auditor from a registered public accounting firm uses a TDRA to determine the quality of a company’s internal controls. This approach begins at the financial statement level. Then it focuses on companywide controls and drills down to significant accounts and disclosures. This process examines the transactions that are most likely to cause errors in financial statements and related information.
Uncovering potential risks, assessing current controls, and determining whether these controls are sufficient to meet SOX standards are the ultimate objectives of TDRA analysis. If the present controls are not deemed adequate, the follow-up is to establish new procedures to incorporate the necessary controls.
SOX compliance basics
The Sarbanes-Oxley Act requires that companies:
- Provide financial statements to the Security and Exchange Commission (SEC) with accuracy confirmed by an external auditor from a registered public accounting firm.
- Report changes, which may affect the prevention of errors in financial reporting, to the public through an annual report.
- Design, implement, and test internal controls which often involve improvements to a company’s IT infrastructure.
- Compose an annual statement on internal controls and their performance signed by management and audited by the external auditor.
How to prepare for a SOX compliance audit
-1.jpg?width=600&height=406&name=Tangled%20string%20and%20string%20in%20straight%20line%20(1)-1.jpg)
Planning in advance eliminates the element of surprise and will reduce the cost of SOX auditing. Your action plan can be broken up into four major phases.
1. Research Sarbanes-Oxley compliance requirements.3. Decide on the internal controls that will be implemented.
4. Apply and test these controls.
5. Perform an internal audit.
Why document management provides a foundation for meeting SOX 404 requirements
.jpg?width=600&height=416&name=Man%20with%20three%20umbrellas%2011_8%20(1).jpg)
Document management systems can be instrumental in:
- Maintaining complete, auditable electronic records.
- Enforcing the limits your company sets on internal and external access to confidential information
- Providing secure, automated document and data backup
- Preventing one, single employee from changing and transferring data without oversight.
- Delivering data security via the HTTPS protocol for transferring data over the web. And using (AES) 256-bit encryption, the most secure data encryption method which is used by the US government to protect confidential information.
- Supplying cybersecurity with built-in features to protect your data and documents from hackers, data leaks, malware, ransomware and phishing
- Adhering to rules about which financial records should be stored and enforcing required retention schedules.
Compliance checklist for SOX 404
With document management your company can meet these SOX 404 requirements:
√ Provide secure storage and automate retention schedules
SOX compliance requires different data storage period requirements for different types of data. It needs to be indexed, searchable, easily retrievable, and encrypted.
√ Restrict access to confidential data
Access controls limit who can access certain files or documents based on their job role or unique login credentials. For example, people in sales do not need to see all the invoices that the accounting department works with. Restricting document access protects confidential information and maintains customer and employee privacy.
√ Access a detailed audit trail
Data security is subject to the same standards as financial records are. Document management systems feature audit logs that can be searched and filtered, with controls to prevent tampering. Audit logs can help you meet compliance requirements by allowing you to keep track of who views, edits, or prints documents.
√ Enforce segregation of duties
To comply with SOX one person cannot have sole control over the lifecycle of a transaction. For example, managers will want to make sure that a single user does not both order and receive inventory or initiate and approve a transaction.
√ Apply version management
Version management is the process of keeping track of changes made to a document. When someone starts editing a document that has version control turned on, it becomes read-only for others and is identified as checked out. Once the editing is finished, the document is checked back in, and it automatically receives a new version number. There is also a record of who created each version.
√ Prevent data breaches
Document management software is usually subject to vulnerability and penetration testing. If it’s hosted in the cloud, it is also supported by a team of cybersecurity experts provided by its cloud platform.
√ Implement fail-safe backup systems
Multiple instances of data ensure that it can be restored even if the active system becomes unavailable. At the very least, your data must be stored with backups in two different regions for geo-redundancy.
Document management provides an automated system that underlies and simplifies your SOX compliance efforts. Its flexible digital workflows make it easier to create and enforce internal controls required by SOX.
Resources for SOX compliance
Committee of Sponsoring Organizations (COSO)
COSO’s goal is to provide thought leadership dealing with three interrelated subjects: Enterprise Risk Management (ERM), Internal Control, and Fraud Deterrence. COSO has published internal control frameworks and guides.
Information Systems Audit and Control Association (ISACA)
ISACA provides training and certification for members who work in digital trust fields such as information security, governance, assurance, risk, privacy and quality. ISACA created Control Objectives for Information and Related Technologies (COBIT) the most commonly used framework for achieving SOX compliance.
Public Company Accounting Oversight Board (PCAOB)
The PCAOB regulates the audits of public companies and SEC-registered brokers and dealers in order to protect investors and further the public interest in the preparation of informative, accurate, and independent audit reports.
