SOX Attestation & Compliance Guide 2026

What Is the Sarbanes-Oxley Act?

The Sarbanes-Oxley Act (SOX) — formally the Public Company Accounting Reform and Investor Protection Act of 2002 — was signed into law on July 30, 2002 by President George W. Bush. It was enacted in response to the Enron, WorldCom, Tyco, and Adelphia accounting scandals that cost investors hundreds of billions of dollars. (Congress.gov)

SOX established sweeping reforms to corporate governance, financial disclosure, and the public accounting profession. It created the PCAOB to oversee auditors of public companies and imposed personal criminal liability on CEOs and CFOs who certify materially false financial statements.

Who Must Comply with SOX?

SOX applies to all issuers registered with the SEC under the Securities Exchange Act of 1934, including: (SEC.gov)

• U.S. publicly traded companies — all domestic public companies regardless of size
• Foreign private issuers — non-U.S. companies listed on U.S. exchanges (NYSE, Nasdaq)
• Accounting firms — any firm auditing public companies must register with PCAOB
• Subsidiaries — material subsidiaries of public companies are typically subject to SOX controls
• Private companies (limited): Sections 802 and 1107 (document destruction, whistleblower retaliation) apply to all companies, public and private

Note on Section 404 exemptions: Non-accelerated filers (public float < $75M) are exempt from the external auditor attestation requirement under Section 404(b), though management assessment is still required.

Section 302 — CEO/CFO Certification Requirements

Section 302 requires the principal executive officer (CEO) and principal financial officer (CFO) to personally certify each annual (Form 10-K) and quarterly (Form 10-Q) report filed with the SEC. (SEC Rule 13a-14)

The CEO/CFO must certify that:

1. They have reviewed the report
2. The report does not contain any material misstatement or omission
3. Financial statements and disclosures fairly present the financial condition
4. They are responsible for establishing and maintaining disclosure controls and procedures (DC&P)
5. They have evaluated the effectiveness of DC&P within 90 days prior to the report
6. They have disclosed to auditors and audit committee all significant deficiencies, material weaknesses, and fraud in ICFR

Section 404 — Internal Control Over Financial Reporting (ICFR)

Section 404 is the most operationally intensive SOX provision. It requires management to annually assess and report on the effectiveness of internal control over financial reporting (ICFR). (SEC Rule 13a-15)

Section 404(a) — Management Assessment (all accelerated filers + non-accelerated)

• Management must use a recognized control framework — most companies use COSO (Committee of Sponsoring Organizations)
• Assessment must cover all business processes that affect financial reporting
• Any identified material weakness must be disclosed; management cannot conclude ICFR is effective if a material weakness exists
• Management's assessment must be included in the annual report

Section 404(b) — External Auditor Attestation (accelerated filers only)

• External auditors must independently attest to management's ICFR assessment under PCAOB AS 2201
• Required for: Large accelerated filers (public float ≥ $700M) and accelerated filers (public float $75M–$700M)
• Exempted: Non-accelerated filers (public float < $75M), smaller reporting companies (SRCs) for 404(b) only

Key ICFR Deficiency Levels

Criminal Penalties Under SOX

Source: Public Law 107-204, Sections 802, 906, 1102, 1107. congress.gov

SOX Compliance Checklist

• CEO and CFO have signed Section 302 certifications for all 10-K and 10-Q filings
• Disclosure Controls & Procedures (DC&P) documented and evaluated quarterly
• ICFR assessment completed using COSO 2013 framework (or COBIT for IT controls)
• All material weaknesses and significant deficiencies identified and disclosed to audit committee
• External auditor engaged for Section 404(b) attestation (accelerated filers)
• Audit committee composed entirely of independent directors; financial expert designated
• Lead and concurring audit partners rotated at least every 5 years
• Non-audit services reviewed and pre-approved by audit committee; prohibited services not performed by auditor
• Code of ethics for senior financial officers adopted and disclosed
• Whistleblower hotline established; anonymous complaints can be submitted to audit committee
• Document retention policy in place; litigation hold procedures documented
• Form 8-K filed within 4 business days of material events (Section 409)
• No personal loans to executives or directors (Section 402)
• Insider trading policy and Section 16 reporting procedures current

PCAOB — Public Company Accounting Oversight Board

SOX Title I created the PCAOB as a non-profit corporation to oversee auditors of public companies. The PCAOB operates under SEC oversight and has authority to set auditing standards, inspect audit firms, and impose sanctions. (PCAOB)

Key PCAOB functions:

• Registration: All accounting firms auditing public companies must register (over 1,800 registered globally as of 2024)
• Inspection: Annual inspections of firms auditing 100+ issuers; triennial inspections for smaller firms
• Standard-setting: Issues auditing standards (e.g., AS 2201 for ICFR, AS 2301 for audit planning)
• Enforcement: Can impose sanctions, revoke registration, bar individuals, and impose fines up to $15M per violation (firms) or $750K (individuals)

AI in SOX / ICFR Audits 2026 — What's Allowed?

The question "Is AI prohibited in SOX ICFR audits?" is one of the fastest-growing compliance queries of 2026 — and the answer is nuanced. Here's what public companies and auditors actually need to know:

PCAOB Position (2023–2026)

• PCAOB Staff Spotlight (2023): AI use in audits flagged for active monitoring; firms must ensure AI tools are subject to their quality control systems
• PCAOB Concept Release (2024): Sought comment on AI in audits; final rulemaking expected 2025–2026
• Current stance: AI cannot substitute for auditor professional judgment; any AI-generated output in an ICFR engagement must be reviewed, tested, and signed off by a licensed auditor

What Auditors Can Do with AI (Current Guidance)

• ✅ Use AI for risk assessment support — analyzing large datasets to identify anomalies for auditor review
• ✅ Use AI for audit documentation drafting — subject to auditor review and sign-off
• ✅ Use AI for sampling and data analytics — expanding test coverage, not replacing judgment
• ⚠️ AI-generated ICFR opinions are not permitted — the Section 404(b) attestation must be signed by a licensed CPA applying PCAOB standards
• ⚠️ Big 4 caution on generative AI in sign-off: Several major audit firms have paused use of generative AI for final ICFR conclusions pending clearer PCAOB guidance

What Management Must Do When AI Is in ICFR Processes

• If your company uses AI in financial close or ICFR processes, that AI tool is itself a key internal control — it must be documented, tested, and included in management's Section 404(a) assessment
• Change management controls must cover model updates, retraining, and version changes to AI systems in scope
• SOC 2 or equivalent reports for AI vendors used in ICFR scope should be obtained and reviewed
• Disclose material use of AI in ICFR processes in your annual report where relevant to understanding the control environment

The Bottom Line

AI is not categorically prohibited in SOX ICFR. It is, however, uncharted regulatory territory. Companies and auditors using AI in ICFR must apply heightened professional skepticism, treat AI tools as controls requiring testing, and watch closely for PCAOB rulemaking through late 2026.

Ask our AI below: "What are the PCAOB requirements for AI use in SOX audits?" or "How do I document AI tools in my Section 404 assessment?"

Frequently Asked Questions

Related Tools & Resources

Related Compliance Guides

Deeper compliance coverage: For broader regulatory compliance programs, compliance program design, and enterprise compliance frameworks, see ComplianceStack.ai — a sister site in the StackNetwork.