Sarbanes Oxley Made Executives Personally Sign for the Numbers
After Enron and WorldCom, Congress decided the problem was not missing accounting rules but the absence of anyone individually accountable for whether the controls worked.
What It Was Responding To
Enron collapsed in late 2001 and WorldCom followed in 2002 with an accounting fraud of roughly eleven billion dollars. Arthur Andersen, auditor to both, was destroyed in the aftermath.
The failures were not caused by ambiguous accounting standards. They were caused by controls that did not function, an auditor with a large consulting relationship to protect, and an audit profession that supervised itself.
The Sarbanes Oxley Act, signed in July 2002, addressed those three things directly.
Certification
Sections 302 and 906 require the chief executive and chief financial officer to personally certify each periodic report: that they reviewed it, that it contains no material misstatement, and that they are responsible for establishing and maintaining internal controls.
The 906 certification carries criminal penalties for knowing falsity.
The point of a personal signature is to remove the defence that the numbers came from somewhere below and nobody senior could reasonably have known. Delegation of the work remained available. Delegation of responsibility did not.
Section 404, the Expensive One
Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting, and requires the external auditor to attest to that assessment separately.
The distinction matters. The auditor is no longer only opining on whether the statements are right. It is opining on whether the process that produced them is capable of producing right answers.
This is where nearly all of the cost landed. Companies had to document control processes formally, test them, and remediate deficiencies, which built a permanent internal audit and controls function where many firms previously had almost nothing.
| Finding | Meaning |
|---|---|
| Deficiency | A control gap, disclosed internally |
| Significant deficiency | Serious enough to report to the audit committee |
| Material weakness | Reasonable possibility of a material misstatement going undetected, disclosed publicly |
A disclosed material weakness is a genuine negative signal for an analyst. It says the company itself concluded its process could miss something material.
The Auditor Changes
The law created the Public Company Accounting Oversight Board, ending self regulation of the audit profession, with authority to inspect firms and set audit standards.
It also restricted auditors from providing most consulting services to audit clients, attacking the conflict where audit fees were small relative to consulting revenue from the same client. Partner rotation requirements followed the same logic of limiting familiarity.
The Cost Argument
Compliance cost more than anticipated, particularly 404 in its early years, and fell hardest on smaller companies where the burden is close to fixed regardless of size.
Congress responded twice. Smaller reporting companies were permanently exempted from the auditor attestation portion while keeping management assessment, and 2012 legislation gave newly public emerging growth companies a phase in period.
Whether it deterred listings is genuinely contested. Listing counts did decline, and so did small company listings globally, in markets with no equivalent rule. Attributing the trend to one statute is harder than the argument usually admits.
What Changed in Practice
The durable effects are structural. Audit committees became genuinely independent bodies with financial expertise requirements and direct authority over the auditor relationship. Internal controls documentation became a permanent corporate function. Restatement rates rose initially as weak controls were found, then declined.
For anyone joining a finance function, this is the origin of the control environment they will work inside: sign offs, segregation of duties, documented reconciliations and quarterly certification chains all trace back to one statute.
The Bottom Line
Sarbanes Oxley put personal criminal liability on the executives who sign the statements, required an audited opinion on internal controls, and replaced auditor self regulation with an oversight board while cutting the consulting conflict. Section 404 carried nearly all of the cost and built the controls infrastructure that finance departments still run on. A disclosed material weakness remains one of the more informative negative signals in a filing.