SOX

SOX stands for the Sarbanes-Oxley Act, a United States federal law that took effect in 2002. It was passed after major American corporations such as Enron and WorldCom were found to have falsified their financial statements and subsequently collapsed — causing massive losses for hundreds of thousands of investors. The law is named after its two authors in the US Congress: Senator Paul Sarbanes and Representative Michael Oxley. It requires all companies listed on a US stock exchange to strictly document their internal accounting processes and have them regularly audited. This means SOX applies not only to American companies, but to any company worldwide that issues US stock.

SOX as a response to accounting scandals

Before 2002, corporate executives could publish figures in annual reports without being held personally accountable for them. If the figures turned out to be wrong, it was difficult to hold individuals liable. SOX fundamentally changed that. Since then, a company’s CEO and CFO must personally certify in writing that their financial reports are accurate. Anyone who knowingly lies in doing so risks up to 20 years in prison. This sent a signal: figures in annual reports are not estimates, but promises.

External auditors — so-called accounting firms — were also subjected to stricter regulation. They are no longer allowed to provide extensive consulting services to a company they audit at the same time. This conflict of interest had played a role at Enron: the auditing firm Arthur Andersen had audited Enron while simultaneously receiving lucrative consulting contracts from Enron — and both companies disappeared from the market as a result of the scandal.

What SOX requires in practice

The best-known section of SOX is Section 404. It requires a company to document every year how its internal control systems for financial reporting are structured — and whether they actually work. In concrete terms, this means: Who is authorized to approve payments? What dual-control principles are in place? How is it prevented that a single person could manipulate bookings? These questions must be answered in writing and confirmed by an independent auditor.

For IT departments, SOX has significant consequences. Systems that process or store financial data must maintain complete logs of who changed which data and when. Unauthorized access must be detected and reported. This is why many companies have strict rules about who may access certain databases — SOX forces them to. A violation of these requirements can result in the auditor’s entire certification, i.e., the auditor’s attestation, being withheld.

Smaller companies may be exempt from certain individual requirements. As a general rule: the larger a company is and the more active it is in US markets, the more fully SOX applies.

SOX in tech news and AI debates

SOX frequently appears in tech media in connection with AI and automation. When a company uses AI systems to create bookings or generate financial reports, the question arises: who is responsible if the system makes a mistake? SOX answers this clearly — the executive signs off, so the executive is liable. This discourages some companies from integrating AI into financial processes without oversight.

Cloud services and software-as-a-service providers are also affected by SOX. If a company runs its accounting software in the cloud, it must be able to demonstrate that the cloud provider also complies with the necessary security and access controls. Major providers such as Amazon Web Services or Microsoft Azure therefore specifically advertise that they deliver SOX-compliant infrastructure — for many of their corporate customers, this is a prerequisite for purchase.

When you read in business news that a company has reported “weaknesses in its internal controls,” it is almost always in the context of SOX. Such reports can move a stock’s price, because investors view them as a warning sign: if a company doesn’t have its own processes under control, how reliable are its numbers?