Sarbanes-Oxley Act (SOX)

The Sarbanes-Oxley Act of 2002 (SOX) was enacted by the U.S. Congress after the Enron and WorldCom scandals to restore confidence in financial reporting. It applies to publicly listed companies in U.S. markets and their auditors, and imposes governance, certification, and internal-control requirements. Section 302 makes executives personally certify financial statements; Section 404 requires management to assess — and external auditors to attest to — the effectiveness of internal control over financial reporting (ICFR). IT general controls (access management, change management, backup, and logging) underpin SOX compliance, and the law is enforced by the SEC and the Public Company Accounting Oversight Board (PCAOB).