SOX compliance requirements are front-of-mind for any public US business today. With stringent requirements and severe penalties — including the threat of jail for non-compliant CEOs and CFOs — it’s no surprise that compliance with SOX is a priority.
Any company that is listed on the New York Stock Exchange needs to comply with SOX — whether a US or foreign company. Any company planning to go public should therefore make SOX compliance requirements a consideration in their pre-IPO preparation.
And with other jurisdictions such as the UK planning to introduce their own SOX-equivalent legislation, it’s not just companies listed in the US that should be alive to the requirements of Sarbanes-Oxley.
Accounting and auditing firms are also required to meet SOX compliance requirements. Generally, private companies, charities and non-profit organizations do not have to comply with SOX in its entirety. However, several SOX compliance requirements (for instance, the rules around falsifying or destroying financial records) also apply to private companies.
SOX compliance requirements do not just affect a business’s financial department, accountants, and auditors within an organization. They are also fundamentally impacting the IT department due to SOX’s requirement that a company’s IT department takes responsibility for storing the business’s electronic records.
It is section 404 above that relates directly to the IT department and is also seen as “the most intensive part of a SOX audit,” covering:
A key aspect of SOX compliance is the yearly audit. SOX mandates that companies complete an annual audit carried out by an external, independent auditor to verify the organization’s financial statements. The auditor will compare current and past financial statements. Additionally, they will be checking that the business has sufficient compliance controls, which ensure SOX compliance standards are maintained.
Companies can prepare for a SOX compliance audit by ensuring their reporting and internal auditing processes are up to date and working correctly.
In 2021 SOX compliance saw costs rise for most companies, and the time spent on SOX compliance requirements increased across the board. With SOX compliance a costly and resource-intensive exercise, it’s no wonder organizations are looking to best practices to make SOX compliance more streamlined and efficient.
Implementing these best practices doesn’t just help with your business’s legal obligations around SOX. Instead, increasing the robustness of your financial security controls can help reduce risks relating to areas including data theft or cyberattack, something recognized as one of the critical business risks for 2022.
It’s worth looking at best practices across some of the core elements of SOX compliance. If you want to meet best practice standards, your organization will want to:
While there are no changes to SOX compliance requirements in 2022, the need for companies to complete an annual audit means that compliance and finance teams must maintain rigor around their financial controls and processes every year.
Having confidence in your controls, testing and oversight is key to meeting your SOX compliance obligations. Creating a robust control environment not only gives you the assurance that your financial reporting and process are compliant, but it will also smooth your relationship with external auditors by enhancing your ability to deliver the data and evidence they need.
Leveraging technology to make SOX compliance more consistent, efficient and reliable will bring your audit processes up to date, ensuring you follow best practices for SOX compliance.
Find out more about how Diligent can help support modern audit approaches for today’s businesses and help your organization meet its SOX compliance requirements.
