Lifesciences
Every time a public company files its annual report (Form 10-K) or quarterly report (Form 10-Q) with the SEC, its CEO and CFO sign a statement saying the report is accurate and the controls behind it work. That’s SOX Section 302. Section 404 asks whether you can prove those controls work, every year, with evidence an auditor can check.
Most of the pain people link to SOX comes from that evidence. Policies sit in one system, approvals in email, transaction data somewhere else, and someone in finance stitches it all together each January. Software that manages the documents, the data and the approval workflows in one place removes most of the stitching.
What are SOX 302 and 404?
The Sarbanes-Oxley Act is a US law passed in July 2002. Sections 302 and 404 both deal with internal controls, meaning the checks that make sure the numbers in a company’s reports can be trusted. They apply to companies that file periodic reports with the SEC, which means the annual Form 10-K and quarterly Form 10-Q. The financial statements mentioned below are the ones included in those reports.
What do SOX 302 and 404 actually require?
Section 302: the quarterly signature
• Certify the report. The CEO and CFO certify each annual and quarterly report. They’ve reviewed it, it contains no untrue statement or material omission to their knowledge, and the financial statements fairly present the company’s position.
• Own the controls. They’re responsible for establishing and maintaining internal controls, designed so that material information reaches them while reports are prepared.
• Test the controls. They’ve evaluated how well the controls work within 90 days before the report, and presented their conclusions in it.
• Report problems. They’ve told the auditors and audit committee about significant deficiencies, identified any material weaknesses for the auditors, and disclosed any fraud involving management or employees with a significant role in the controls, whether or not it’s material. They also say whether controls changed significantly after their evaluation.
Section 404: the annual proof
• Management reports. Each annual report includes an internal control report. It states management’s responsibility for adequate controls over financial reporting and assesses how effective they were at the end of the fiscal year.
• No “effective” with a material weakness. Under the SEC’s rules, management can’t conclude its controls are effective if there’s a material weakness. That’s a gap where there’s a reasonable possibility a material misstatement won’t be prevented or caught in time.
• The auditor checks. The external auditor attests to and reports on management’s assessment. Emerging growth companies are exempt, as are companies that are neither accelerated nor large accelerated filers, so check which group you’re in.
In short, 302 is the signature and 404 is the file behind it.
What if the certification is wrong?
The headline criminal penalties people attach to Section 302 sit in Section 906. It requires the CEO and CFO to certify that each periodic report complies with securities law and fairly presents the company’s finances. Knowingly certifying a report that doesn’t comply carries a fine of up to $1 million or up to 10 years in prison. Doing it wilfully raises that to $5 million or 20 years.
What does the SEC’s guidance say about evidence?
The SEC’s 2007 guidance on management’s assessment is the best plain-language source. It isn’t a checklist, and following it is one way to meet the rules rather than the only way. It makes four useful points.
• Keep reasonable support. Management has to maintain evidence, including documentation, to support its assessment. That evidence also lets the external auditor consider management’s work.
• Document how controls are designed. That can mean policy manuals, flowcharts, job descriptions, forms and memos, on paper or in electronic form.
• Focus on what matters. You don’t need to document every control, only those you rely on to address the risk of a material misstatement.
• Update, don’t rebuild. After the first year, documentation should be updated rather than recreated from scratch.
How document, data and workflow management supports SOX compliance
By that we mean one system that manages three things together. There are the documents (policies, approvals and supporting evidence), the structured data those documents relate to, and the workflows that route work for review and approval. SOX evidence usually lives across all three. When they sit in separate tools, proving a control worked means joining them by hand. A system that connects them links the approval, the supporting document and the record from the start.
| What the system does | Why it matters for SOX |
| Holds policies, process maps and control descriptions in one governed repository, with version history | The SEC’s guidance expects documentation of control design, updated each year. Version history shows exactly what applied when. |
| Runs approvals, reviews and sign-offs as automated workflows | Each approval is recorded as it happens, with who and when. That’s evidence a control operated, without a scramble at year end. |
| Links documents to the data and process steps they relate to | The supporting document, the approval and the record it relates to can be found together, which shortens auditor requests. |
| Applies role-based permissions across content and data | You control who can view, edit and approve, and can keep preparing and approving separate. The SEC guidance lists access to programs and data among the IT general controls that can be relevant. |
| Logs every action in an audit trail | You get a history of who created, changed, approved or deleted what. It supports your evidence and helps with improper override of controls, a fraud risk the SEC guidance calls out. |
| Applies retention rules and holds to records | Evidence stays available when the auditor asks and can’t be deleted early by accident. Retention periods are for your finance and legal teams to set. |
| Tracks deficiencies and fixes as configurable workflows | One place shows open issues, owners and remediation, which feeds the 302 duty to report deficiencies to auditors and the audit committee. |
One caveat is worth saying plainly. The system holding your evidence becomes part of what gets tested. The SEC guidance says management should consider the IT general controls that matter to the proper operation of other controls, so your system’s own access, change and logging controls will be looked at too. Software supports your controls and doesn’t replace them.
Choosing a system for SOX compliance
Five questions are worth asking any vendor. Can you trace every document and action to a named user and time? Can approvals and sign-offs run as workflows that leave evidence behind? Can documents, data and process steps be linked rather than held in separate systems? Can you give an auditor controlled, read-only access? And if the system uses AI, does it follow the same permissions and logging as everything else?
At Generis, our CARA platform manages content, structured data and workflow automation together on one governed platform, with role-based access, audit trails and records management built in for regulated environments. If you’d like to see how that applies to your SOX evidence and controls, get in touch and we’ll walk you through it.
Read the rule yourself
For the legislation, see Section 302 (15 U.S.C. 7241) and Section 404 (15 U.S.C. 7262). The criminal certification penalties are in 18 U.S.C. 1350.
The SEC’s interpretive guidance on management’s report on internal control explains what management has to document and evidence. The Federal Register version is the official publication.
If you’re new to the reports themselves, the SEC’s investor education page on reading a Form 10-K covers the annual and quarterly filings.
This article is a general introduction and doesn’t constitute legal or accounting advice. Check your obligations with your finance, compliance or legal team and your auditors.
