Certified Risk and Compliance Management Professional (CRCMP) - Sarbanes-Oxley International Standards and Global Standards

The Origin and Evolution of Sarbanes-Oxley

• Catalyst for Legislation: The Sarbanes-Oxley Act (SOX) was enacted in response to massive and public failures in corporate governance that led to a crisis of confidence. Major corporate scandals involved organizations such as Enron, WorldCom, Global Crossing, Adelphia Communications, and Tyco.

• Wealth Destruction:

  • Enron Scandal: Destruction of shareholder wealth totaling approximately $60,000,000,000$.

  • WorldCom Scandal: Destruction of shareholder wealth totaling approximately $175,000,000,000$.

• Internal Governance Gaps: Many executives and board members were unaware of the risks facing their companies due to a lack of knowledge and experience. They relied almost entirely on unsupported assurances from auditors and often claimed that a lack of knowledge equated to a lack of responsibility.

• Legislative Timeline:

  • Drafted by Senator Paul Sarbanes and Representative Michael Oxley.

  • The Act was signed into federal law on $July 30, 2002$.

  • Until early $June 2002$, the passage of the Act was considered unlikely and was not a priority for the administration; however, the WorldCom scandal served as the political tipping point that rushed the legislation into law.

• Regulatory Significance: SOX is considered the most substantial piece of corporate regulation since the original securities laws of the $1930$s.

Purpose and Scope of the Sarbanes-Oxley Act

• Primary Objective: To protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to security laws.

• Enforcement and Penalties:

  • Senior management faces up to $20$ years in prison and penalties as high as $5,000,000$ for non-compliance.

  • External auditors will not sign attestations if material weaknesses exist in internal control systems, which can lead to immediate drops in stock prices.

• Presidential Mandate: The Act was designed to punish fraud and corruption, ensure justice for wrongdoers, and protect workers' interests, including pensions and jobs.

• Affected Entities:

  • U.S. publicly traded companies.

  • Global companies with U.S. publicly traded operations.

  • All corporations under the jurisdiction of the U.S. Securities and Exchange Commission (SEC).

  • Private firms seeking to go public or those targeted for acquisition/merger by public firms.

  • Non-Profits: While not legally required, many non-profits voluntarily comply to maintain public trust and demonstrate due diligence.

/

Reporting Requirements and SEC Filings

• Applicability: Provisions vary based on the type of issuer. Some apply to all issuers, others only to domestic firms, and some specifically to "reporting companies" (foreign companies registered with the SEC).

• Core Filing Forms:

  • Form 10-K: Annual report for U.S. domestic firms only.

  • Form 10-Q: Quarterly report for U.S. domestic firms only.

  • Form 20-F: Annual report for Foreign Private Issuers (FPIs). Due $6$ months after the end of the fiscal year. FPIs do not file quarterly reports but must provide audited financial statements for the last $3$ years.

  • Form 8-K: Current report for significant events (e.g., Alphabet Inc. filing from $June 6, 2025$).

  • Form 6-K: Used by FPIs for disclosures already made public in their local jurisdictions.

• Foreign Private Issuer (FPI) Criteria:

  • More than $50 / 100$ (or $50\%$) of outstanding voting securities held by non-U.S. residents.

  • AND one of the following:

    • Majority of officers/directors are not U.S. citizens/residents.

    • More than $50\%$) of assets are located outside the U.S.

    • The business is administered principally outside the U.S.

• EDGAR System: The Electronic Data Gathering, Analysis, and Retrieval system is the SEC's automated collection and indexing system. All domestic and foreign filing registration statements and prospectuses are accessible briefly after filing.

American Depository Receipts (ADR) and Cross-Listing

• The ADR Solution: American Depository Receipts allow U.S. investors to purchase shares of foreign companies using U.S. dollars during U.S. trading hours. This eliminates risks associated with cross-border transactions and currency conversion (e.g., buying Deutsche Bank shares without needing a German brokerage account or converting dollars to euros).

• Benefits for Foreign Firms:

  • Increased visibility in the U.S. market.

  • Diversification of the shareholder base.

  • Expanded market and global liquidity.

  • Facilitation of Mergers and Acquisitions (M&A).

• ADR Levels:

  • Level 1 ADR: Establishes a trading presence on the over-the-counter (OTC) market. Requires Form F-6. No issuer information available on the SEC system.

  • Level 2 ADR: Establishes a presence on a U.S. securities exchange. Requires Form 20-F filing and full SOX compliance.

  • Level 3 ADR: Used to raise capital. Requires full registration and adherence to strict rules similar to those of U.S. domestic companies.

• Volume: As of the end of $2017$, there were more than $2,000$ ADRs representing companies in over $70$ countries (compared to $434$ companies in $1990$).

Title I: Public Company Accounting Oversight Board (PCAOB)

• Establishment (Sec. 101): The PCAOB is a non-profit corporation established to oversee the audit of public companies. It is tasked with protecting investor interests through the promotion of high professional standards.

• Core Duties:

  • Registration of public accounting firms (Sec. 102).

  • Establishment of auditing, quality control, ethics, and independence standards (Sec. 103).

  • Conducting inspections of registered firms (Sec. 104).

  • Conducting investigations and disciplinary proceedings (Sec. 105).

• Frequency of Inspections:

  • Annual inspections for firms providing audit reports for more than $100$ issuers.

  • Triennial (every $3$ years) for firms with $100$ or fewer issuers.

• Sanctions and Penalties:

  • Registration revocation and individual bars.

  • Censure and required additional training.

  • Civil money penalties: Up to $750,000$ for natural persons and up to $15,000,000$ for other entities per violation.

• Foreign Firm Applicability (Sec. 106): Any foreign public accounting firm preparing or furnishing audit reports for an issuer is subject to the Act. They must consent to produce audit work papers for the Board or the SEC.

Title II: Auditor Independence

• Prohibited Relationships: Auditors are deemed non-independent if they act as an advocate for the client, audit their own work, or act as management.

• Statutory Prohibitions (Sec. 201): Registered firms cannot provide non-audit services contemporaneously with an audit, including:

  • Bookkeeping and financial information systems design.

  • Appraisal, valuation, or actuarial services.

  • Internal audit outsourcing.

  • Management or HR functions.

  • Legal and investment banking services.

• Partner Rotation (Sec. 203): The lead (coordinating) audit partner and the reviewing partner must rotate every $5$ fiscal years.

• Reporting to Audit Committees (Sec. 204): Auditors must report critical accounting policies, alternative GAAP treatments discussed with management, and material written communications (e.g., management letters).

• Cooling-Off Period (Sec. 206): A firm cannot audit an issuer if the CEO, CFO, or Controller worked for the audit firm and participated in the issuer's audit within the $1$ year preceding the audit initiation.

Title III: Corporate Responsibility

• Audit Committees (Sec. 301): Directly responsible for the appointment, compensation, and oversight of external auditors. Auditors report directly to the committee. Committees must establish procedures for handling complaints and anonymous employee submissions regarding accounting/auditing (Whistleblower/Hotline).

• Certification Requirements (Sec. 302): CEO and CFO must certify in annual and quarterly reports that:

  • They have reviewed the report.

  • The report contains no untrue material facts or misleading omissions.

  • Financial statements fairly present the financial condition and results of operations.

  • They are responsible for establishing and maintaining internal controls.

  • They have evaluated control effectiveness within $90$ days prior to the report.

  • They have disclosed all significant deficiencies and frauds to auditors and the audit committee.

• Rules for Attorneys (Sec. 307): Requires attorneys to report evidence of material violations "up-the-ladder" to the Chief Legal Counsel or CEO. If no appropriate response is received, they must report to the audit committee or the board. SEC rules allow attorneys to reveal confidential information to prevent material violations resulting in substantial financial injury.

Title IV: Enhanced Financial Disclosures

• Off-Balance Sheet Transactions (Sec. 401): Reports must disclose all material off-balance sheet transactions (e.g., guarantee contracts, letters of credit) that may have current or future material effects. This section was specifically informed by the Enron case, where Special Purpose Entities (SPEs) were used to conceal massive losses.

• Personal Loans (Sec. 402): Issuers are prohibited from extending personal loans to directors or executive officers.

• Management Assessment of Internal Controls (Sec. 404):

  • Annual reports must contain an internal control report stating management's responsibility for maintaining controls.

  • Includes an assessment of the effectiveness of the internal control structure.

  • External auditors must attest to and report on management's assessment.

• Code of Ethics (Sec. 406): Issuers must disclose whether they have adopted a code of ethics for senior financial officers; if not, they must explain why.

• Real-Time Disclosure (Sec. 409): Additional information concerning material changes in financial condition must be disclosed to the public on a rapid and current basis (approximately $2$ business days).

Corporate and Criminal Fraud Accountability

• Title VIII - Sec. 802: Imposes up to $20$ years in prison for the destruction, alteration, or falsification of records in federal investigations and bankruptcy. Auditors must maintain work papers for $5$ years (PCAOB AS 3 raises this to $7$ years).

• Title VIII - Sec. 806 (Whistleblower Protection): Prohibits companies from discharging, demoting, or harassing employees who assist in fraud investigations. This includes "Qui Tam" provisions, allowing private citizens to bring actions on behalf of the government.

• Dodd-Frank Amendments: Strengthened SOX by providing monetary incentives for whistleblowers ($10\%$) to $30\%$) of sanctions) and enhanced remedies (e.g., $2$ times back pay).

• Title IX - White Collar Crime Enhancements:

  • Sec. 906 Certification: A third criminal certification by the CEO/CFO accompanying financial reports. Penalties include:

    • "Knowing" certification of non-compliant reports: Up to $1,000,000$ and $10$ years.

    • "Willful" certification: Up to $5,000,000$ and $20$ years.

• Title XI - Corporate Fraud (Sec. 1106): Increased criminal penalties under the Securities Exchange Act. Maximum fines were increased from $1,000,000$ to $5,000,000$ and corporate fines from $2,500,000$ to $25,000,000$.

Steering and Disclosure Committees

• Steering Committee: Focuses on the success of compliance with Section 404.

  • Members include: CEO, CFO, unit heads, and heads of IT, Security, HR, and Internal Audit.

  • Tasks: Approves project plans, reviews findings, and ensures resource availability.

• Disclosure Committee: Concerned with accuracy and timeliness of public reports. Reports to the Steering Committee.

  • Members include: Principal Accounting Officer, General Counsel, Risk Management Officer, Investor Relations Officer, and the CIO.

  • Tasks: Reviews SEC filings, evaluate disclosure controls, and reviews press releases.

PCAOB Auditing Standards (AS 2 - AS 16)

• AS 2 (Integrated Audit): Governs the audit of internal control over financial reporting performed in conjunction with a financial statement audit. Defines "more than remote" as either "reasonably possible" or "probable."

• AS 3 (Documentation): Requires the retention of audit documentation for $7$ years.

• AS 5 (Integrated Audit Standard): Replaced portions of AS 2; utilizes a top-down, risk-based approach to select controls for testing. Emphasizes that controls should prevent/detect management override.

• AS 7 (Engagement Quality Review): Requires a second partner review (concurring approval of issuance) for every audit report. Reviewers must be associated persons with sufficient competence and objectivity.

• AS 8 (Audit Risk): Audit risk is a function of the risk of material misstatement (inherent risk + control risk) and detection risk.

• AS 9 (Audit Planning): Establishes requirements for strategy and audit plan development. Emphasizes that planning is a continual, iterative process.

• AS 11 (Materiality): Defines material facts as those with a "substantial likelihood" of being viewed by a reasonable investor as significantly altering the "total mix" of information.

• AS 12 (Risk Assessment): Requires risk assessment procedures including obtaining an understanding of the company, its environment, and internal control.

• AS 16 (Communications with Audit Committees): Requires auditors to communicate responsibilities, audit strategy, and significant observations to the audit committee prior to the issuance of the report.

Career and Job Market in SOX Compliance

• Current Relevance: As of $2025$, SOX remains a cornerstone of corporate accountability. There is a persistent demand for professionals in internal controls, risk management, and financial reporting.

• Job Vacancies (April 2025):

  • United States: $34,402$ vacancies.

  • India: $4,308$ vacancies.

  • European Union: $14,212$ vacancies.