Sarbanes-Oxley: Internal Controls over Financial Reporting#

Who it applies to#

SOX applies to companies that are registered with the US Securities and Exchange Commission (SEC), including foreign companies that file annual reports on Form 20-F. Several UK banks have US-listed shares or American depositary receipts, and they are within scope for their group financial reporting. A UK bank with no US listing is not subject to SOX, but the same ideas appear in UK rules, covered below.

The main sections#

Sections of SOX that matter for financial reporting#
Section	What it requires
302	The chief executive and the chief financial officer certify each periodic report. They confirm that they have reviewed it, that it contains no material misstatement, that it fairly presents the financial position, and that they are responsible for the disclosure controls. They must also report significant deficiencies and fraud to the auditors and the audit committee.
404(a)	Management assesses the effectiveness of the internal control over financial reporting (ICFR) at the year end, and reports its conclusion in the annual report.
404(b)	The external auditor gives a separate opinion on the effectiveness of the ICFR. It applies to larger companies, and smaller ones are exempt.
906	Criminal penalties for officers who certify a report that they know does not comply with the requirements.
802	Criminal penalties for destroying or altering records to obstruct an investigation, so records of the evidence must be kept.

SOX also created the Public Company Accounting Oversight Board (PCAOB), which inspects the auditors of listed companies and sets the auditing standards that apply to them.

Internal control over financial reporting#

ICFR is the process that gives reasonable assurance that the financial statements are reliable and that they are prepared in line with the accounting standards. In practice, most companies use the COSO Internal Control Integrated Framework, which has five components:

The COSO components#
Component	Meaning
Control environment	The tone from the top, the structure of responsibility and the standards of conduct.
Risk assessment	Identifying the risks to reliable reporting, and which accounts and processes are significant.
Control activities	The actions that reduce the risks, such as approvals, reconciliations and reviews.
Information and communication	The information that is needed to operate the controls, and how it reaches the right people.
Monitoring	Ongoing and separate evaluations, to check that the controls continue to work.

How it works in practice#

The company works through a cycle each year:

Scoping: identify the material accounts and disclosures, such as derivative assets and liabilities, and the processes and systems that produce them.
Risk and control mapping: for each significant risk of misstatement, identify the key controls that address it. The documentation set out in a risk and control matrix lists the risk, the control, its owner, its frequency and the evidence.
Design assessment: check, often through a walkthrough, that the control as designed would prevent or detect a material misstatement.
Operating effectiveness testing: test a sample of the control’s operation over the period, to see that it worked in practice. The sample size depends on the frequency of the control.
Deficiency evaluation: the results are graded, as described below.
Remediation and reporting: the deficiencies are fixed and retested, and the conclusion is reported to the audit committee and in the annual report.

Grading deficiencies#

Severity of control failures#
Grade	Meaning
Control deficiency	A control that does not allow management to prevent or detect misstatements in the normal course of its work.
Significant deficiency	A deficiency, or a combination of them, that is less severe than a material weakness but important enough to be reported to those who oversee the financial reporting.
Material weakness	A deficiency, or a combination of them, such that there is a reasonable possibility that a material misstatement of the financial statements would not be prevented or detected in time. A material weakness means that management cannot conclude that the ICFR is effective, and it must be disclosed.

Timeliness, completeness and accuracy#

SOX testing relies on the same three tests as the data rules in Governance: Model Risk, Accountability and Data. Auditors and control testers use them for any information that a control depends on, which they call information produced by the entity (IPE):

Completeness: the report or data includes all the items that it should. A control that reviews a list of exceptions is of little value if the list leaves out some of the items.
Accuracy: the items are recorded at the right amounts and in the right periods.
Timeliness: the control operates when it should, as often as it is designed to, and before the financial statements are issued.

A control can therefore fail not because the review was careless, but because the report that fed it was incomplete. This is why testing the data behind a control is as important as testing the review itself.

Management review controls#

Many valuation controls are reviews by experienced people of results or of differences between sources. Auditors expect evidence of the precision of such a review: what threshold triggers a challenge, what was investigated, and how the issue was resolved. A review that says “reviewed, no issues” without a threshold or evidence is unlikely to be accepted as a key control.

UK, EU and US compared#

Internal control over financial reporting by region#
Topic	UK	EU	US
Requirement	The UK Corporate Governance Code requires the board to monitor the risk management and internal control systems. Provision 29 of the 2024 Code requires an annual declaration on the effectiveness of the material controls, for financial years beginning on or after 1 January 2026.	No single equivalent. The Accounting Directive requires a description of the main features of the internal control and risk management systems in the corporate governance statement, and national rules vary.	SOX sections 302 and 404.
Who is responsible	The board, and under the SM&CR the named senior managers. See Governance: Model Risk, Accountability and Data.	The board and the audit committee.	The chief executive and chief financial officer certify personally, and are open to criminal penalties.
Auditor	Reports on the accounts. There is no separate opinion on the controls.	Reports on the accounts, and the audit committee oversees the controls.	A separate audit opinion on the ICFR for larger companies.
Penalties	Regulatory action, and under the SM&CR against individuals.	National enforcement.	Civil and criminal penalties.

The UK government proposed a stronger regime, with a new audit regulator and a requirement for directors to report on controls, but the legislation was not taken forward. The change in the Code is therefore the main route, and it is a lighter requirement than SOX, since it does not require an auditor opinion.

A valuation control view#

IPV and the related controls over fair value are among the key controls that are tested every year:

Key controls: the IPV process itself, the review and approval of the results, the escalation and resolution of differences, the review of Level 3 inputs and of the reserves, and the reconciliation of the valuation to the ledger. Each should be in the risk and control matrix with an owner, a frequency and evidence.
Scope: instruments at fair value are material accounts, so the full chain is in scope: the trade capture, the market data, the pricing models, the valuation adjustments, and the final posting to the accounts.
Data feeding the controls: the IPV reports, the lists of positions and the sources of market data must be shown to be complete and accurate, and produced in time. A change to a report or a source should be controlled.
Evidence: the screenshots, the quotes, the consensus data and the sign-offs should be kept in a form that a tester can inspect, and for as long as the records rules require.
Models and spreadsheets: end-user computing tools, such as spreadsheets that calculate a reserve, need controls over their access, their changes and their logic, as they are a frequent source of findings.
Deficiencies: a missed IPV, an unresolved difference, or an unreviewed model reserve may be a deficiency. Several together on the same population can be a significant deficiency or a material weakness.

The three lines of defence in Governance: Model Risk, Accountability and Data all play a part: the first line operates the controls, the second line tests and challenges them, and internal audit and the external auditor give independent assurance. The classification of the inputs in Fair-value hierarchy: Levels 1, 2 and 3 decides how much evidence the auditor expects for each position, and the Level 3 population receives the most attention.