Sarbanes Oxley Act

A number of bankruptcy cases have hit the headlines in recent years. The reasons for the decline of the company were at least partly due to violation of accounting principles, serious accounting errors or fraud. The consequences were fatal for both the investors as well as for the employees. Against this background, legislators in the U.S.A. created a legal basis with the so-called "Sarbanes-Oxley Act (SOX)" on the 30th July 2002 with the objective of enhancing security in Financial Reporting. The law applies to all companies listed on a U.S. stock market. It contains 11 chapters which extend from increasing responsibility of company management through new standards for clearances by external auditors to certification requirements for CEO's and CFO's.

Essential requirements of the Sarbanes-Oxley Act
The law has a significant impact on the financial management of enterprises. The following 3 articles are of particular importance:

Sec. 302: Corporate Responsibility for Financial Reports
The management must produce a certificate to confirm that the financial figures presented reflect the actual financial condition of the company.

Sec. 404: Management Assessment of Internal Controls
Requires an annual "internal control report" which, on the one hand, confirms the responsibility of management for implementation/operation of an internal control system (ICS) and, on the other hand, includes an assessment of the effectiveness of this ICS.

Sec. 906: Certification of Periodic Financial Reports
A certificate from the CEO and CFO must be provided with each periodic financial report to confirm the fulfilment of legal requirements and the material completeness of the financial figures presented.

In essence, SOX wants to ensure that appropriate internal controls are being implemented for all processes involved in the preparation of the external report. Thus management must implement an internal control system for the financial process and which must include the following checks:
» checks to detect or prevent false statements or omissions
» checks with respect to the arrangement, booking in, processing or balancing of accounts, transaction grouping and related assumptions in the financial statements
» checks of the booking in and processing of non-routine and non-systematic transactions
» checks with respect to the selection and application of appropriate accounting rules
» checks to prevent, detect or identify fraud


Who is affected by SOX?
Initially, because of the legal jurisdiction, only companies listed on a U.S. stock exchange are obliged to meet the complex requirements of SOX and thus implement an internal control system for the financial process.
EU regulators, however, have ratified similar legislation, e.g. Article 41 of the EU Financial Statement Auditors' Directive by which a similar legal basis, the so-called EuroSOX, is created for EU-listed companies.
Regardless of regulatory requirements, corporations are exposed to increased pressure from financial analysts and investors to ensure that their assessment of the company depends to an ever greater extent on the quality of corporate governance. In addition, many investors increasingly welcome the basic ideas and concepts which have been implemented by SOX and which require the management and supervisory boards and top management to exercise a higher degree of accountability with respect to the financial figures presented. The installation of an internal control system (ICS) is a way to minimise the risk of liability resulting from the external financial reporting in the light of these rules. An ICS is responsible for ensuring organisational security measures, performing an internal audit, production of documentation and compliance with directives and regulations. It should also function as an early warning system based on defined risk indicators and independent checks.


How can you successfully comply with SOX?
For reporting in accordance with SOX, assessment of the internal checks should be effected by using a generally accepted framework. LCM Legal offers support for SOX 404 guidelines by giving users a revision-proof checklist e.g. for contract drafting and contract approval. This checklist may be defined in accordance with internal compliance policies and the SOX guidelines. Based on the contract checklist, standardised procedures may be used for the control of risks.