SOX compliance: the complete 2026 guide

On August 5, 2026 the SEC established a Financial Reporting and Accounting Unit inside its Division of Enforcement, the first specialized unit in the division's modern structure dedicated solely to accounting and financial reporting fraud. It supersedes the SOX Group announced five months earlier, and practitioners expect the staff to generate cases proactively instead of waiting for restatements, tips, or referrals.

The Sarbanes-Oxley Act of 2002 requires public companies to maintain internal control over financial reporting, certify their filings personally, and in most cases have those controls attested to by an external auditor. This guide covers who falls in scope, the five sections that generate the work, what it costs, what changed in 2026, and the shift from documenting controls to proving they operated.

SOX compliance, defined

SOX compliance means meeting the obligations of the Sarbanes-Oxley Act, formally the Public Company Accounting Reform and Investor Protection Act. In practice it comes down to three things: controls that produce reliable financial statements, executives who personally certify them, and evidence the controls worked.

The law followed the collapses of Enron and WorldCom in 2001 and 2002, which exposed how little independent verification sat behind reported numbers. Congress made financial reporting a matter of personal executive accountability and created the Public Company Accounting Oversight Board to oversee the auditors. The architecture underneath comes from internal control frameworks, with COSO's framework the one most US issuers apply.

Who SOX applies to

SOX reaches further than most summaries suggest, and obligations split by category.

• US-listed companies fall in scope from their first annual report
• Subsidiaries carry no separate obligation, but their transactions feed the parent's consolidated statements, so their controls sit inside the parent's scope
• Foreign private issuers listed on a US exchange comply through Form 20-F
• Accounting firms auditing public companies register with the PCAOB and follow its standards
• Pre-IPO companies typically begin readiness work 12 to 18 months before filing

The sharper distinction separates management's obligation from the auditor's. Every SEC reporting company complies with Section 404(a); only some face the auditor attestation under 404(b).

Losing the exemption is the moment that hurts. Analyzing 98 companies that crossed the threshold, the US Government Accountability Office found a median audit fee increase of $219,000, or 13%, in the transition year.

The five sections that drive compliance work

Most coverage stops at 302 and 404. The other three carry criminal exposure and shape how documents and people are handled.

Section 302 puts the CEO and CFO on the hook quarterly, certifying that the report contains no material misstatement and that they have evaluated disclosure controls. The signature is individual and cannot be delegated.

Section 404 is where the work volume sits. Part (a) requires management to assess the effectiveness of internal control over financial reporting and report on it annually. Part (b) requires the external auditor to attest to that assessment. The governing auditing standard is PCAOB AS 2201, originally adopted as Auditing Standard No. 5 in November 2007 and renumbered in 2015 without substantive revision.

Section 802 makes record destruction a felony and obliges auditors to retain audit and review workpapers for five years from the end of the fiscal period. It sets the retention architecture an audit trail depends on.

Section 806 protects employees who report suspected fraud from retaliation, with remedies including reinstatement and back pay. Whistleblower information feeds directly into the SEC's new enforcement unit.

Section 906 adds criminal certification on top of Section 302's civil one. Knowingly certifying a non-compliant report carries up to $1 million and 10 years; doing so willfully raises the ceiling to $5 million and 20 years.

Material weakness vs. significant deficiency

Both are control deficiencies. Severity separates them, and only one triggers an adverse ICFR opinion on its own.

A material weakness is a deficiency, or combination of deficiencies, such that a reasonable possibility exists that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. One material weakness is enough for management to conclude that ICFR is ineffective. Example: a single person can post and approve journal entries to material accounts because segregation of duties was never enforced in the ERP.

A significant deficiency is less severe than a material weakness, yet important enough to merit the attention of those responsible for oversight of financial reporting. Example: a quarterly balance sheet reconciliation performed two weeks late on an account too small to produce a material misstatement, caught and corrected before close.

The distinction is a judgment about potential magnitude, not about whether an error occurred. KPMG's 2025 study, drawing on Audit Analytics data, found 238 public companies disclosing a material weakness, with imprecise management review controls, weak journal entry review, and incomplete documentation the most frequent financial close issues. Weaknesses in IT general controls, particularly user access management, led the systems themes.

What SOX compliance costs

Published figures vary because Section 404 costs resist isolation. Internal effort blends into finance salaries, software serves several purposes, and 404(b) fees sit inside a single integrated audit fee that is never itemized. The usable benchmarks come from Protiviti's annual survey of more than 500 SOX-compliant companies, as analyzed by the GAO:

• Companies operating from a single location averaged around $700,000 in internal compliance costs
• Companies with 10 or more locations averaged around $1.6 million
• Companies with $1 billion to $10 billion in revenue averaged $1 million to $1.3 million
• Companies above $10 billion in revenue averaged around $1.8 million

One widely repeated claim deserves correction. SOX costs are often described as having risen sharply in recent years. The evidence points both ways. Protiviti told the GAO that internal compliance costs stayed relatively flat from 2016 to 2023, attributing this to outsourcing and offshoring, and the GAO's own analysis found audit fees did not change significantly between 2019 and 2023.

The counter-evidence comes from practitioners. Auditors, financial executives, and audit committee members interviewed by the GAO reported rising 404(b) costs driven by PCAOB inspection findings and heavier documentation demands. One audit committee member described auditor hours spent testing controls climbing from 3,000 in 2012 to 8,000 in 2024, taking fees from roughly $900,000 to $3 million, a rise out of proportion to company growth.

Both accounts can hold. Aggregate spend stays flat while the effort behind each tested control rises, because automation and offshoring absorb the increase.

What's changing in 2026

Two shifts land in the same year.

Enforcement has been restructured. The SEC's Financial Reporting and Accounting Unit, announced August 5, 2026 and led by Timothy Zimmerman under Enforcement Director David Woodcock, consolidates what the March 2026 SOX Group began. It is staffed with both attorneys and accountants, and Woodcock has named financial reporting among his top enforcement priorities. The SEC filed 456 enforcement actions in fiscal 2025, its lowest total in at least 20 years, which makes a dedicated accounting unit a deliberate reallocation rather than part of a general expansion.

Audit firm standards tighten. PCAOB QC 1000, requiring registered firms to design, implement, and operate a risk-based quality control system with annual reporting to the Board, takes effect December 15, 2026 after a one-year postponement. AS 2901, covering how firms respond to engagement deficiencies found after a report is issued, takes effect the same day, as do amendments to AS 2201.

The consequence for issuers is indirect but real. Firms under tighter quality control obligations push evidence requests downstream, landing more documentation demands on finance teams through the 2026 and 2027 audit cycles.

What happens when compliance fails

The financial path runs from a material weakness disclosure to restatement, delayed filings, higher audit fees, and financing consequences. Of 100 restatements reviewed by the GAO for 2022 and 2023, management cited ineffective internal control over financial reporting in 93 cases. The Center for Audit Quality found 97% of ICFR reports issued within a year of a material restatement disclosed at least one material weakness.

Enforcement follows the same pattern. Of 55 SEC enforcement cases involving accounting violations in 2022 and 2023, the GAO found 47 involved weak or insufficient internal controls or materially misleading statements, and 37 of those were fraud-related. The Association of Certified Fraud Examiners reported in 2024 that the most common contributors to occupational fraud were a lack of internal controls at 32% and the override of existing controls at 19%.

Criminal exposure sits with individuals under Sections 802 and 906. Reputational damage usually arrives before any penalty, through lenders, auditors, and index providers.

Silicon Valley Bank is the instructive recent case, though not for the reason usually given. Its SOX file was clean: the CEO and CFO certified no significant deficiencies or material weaknesses in ICFR, and KPMG issued an unqualified opinion with no going concern qualification. The bank failed weeks later, having been rated deficient on governance and controls by the Federal Reserve in September 2022. Wirecard, often cited alongside it, was listed in Frankfurt and outside SOX scope entirely.

A compliant SOX file certifies that controls over financial reporting were designed and operating. It does not certify that the controls covered the risk that mattered.

From documenting to proving: the 2026 shift

Traditional SOX programs produce documentation: a control matrix, a narrative, a walkthrough, and a sample of test results, assembled once a year for the auditor. That model made sense when testing meant pulling paper.

Two pressures are breaking it. PCAOB inspections have pushed auditors from evidence of design toward evidence of operation, and the SEC's new unit is positioned to open cases from filings and data rather than waiting for a restatement to surface. Both point the same way: the question moves from whether a control exists to whether it ran, on which transactions, and what happened to the exceptions.

Sampling struggles with that question. A sample does give statistical assurance about the population it was drawn from. What it misses is the rare event, because fraud is not evenly distributed across the tested population. It also surfaces exceptions weeks after the period closed, when correction means reopening a closed book.

Continuous controls monitoring changes the arithmetic. Tests run on every data extraction across the full population, so exceptions appear within days and the evidence accumulates as a by-product. An audit request becomes a retrieval instead of a reconstruction.

SOX compliance checklist

Scope and design. Map the material financial statement line items, trace each back to the processes and systems feeding it, identify the key controls, and confirm which entities fall inside the boundary.

Documentation. Keep process narratives and control descriptions current, document the ITGCs supporting every automated control, make management review evidence specific enough to show what was reviewed and against what threshold, and retain records under Section 802.

Testing. Test design and operating effectiveness separately, spread testing through the year, cover the full population where the data supports it, and track exceptions to remediation with dates and owners.

Governance and reporting. Set the certification chain supporting Sections 302 and 906, brief the audit committee on deficiencies as they arise, agree remediation deadlines with owners, and keep a defect log showing which weaknesses recurred. That last point matters: across 2021 to 2025, 36% of companies reporting a material weakness reported one in more than a single year.

Tooling follows from scope. A comparison of internal control software sets out the options, and Supervizor's compliance solution tests the full transaction population across procure-to-pay, order-to-cash, and record-to-report.

Conclusion

SOX compliance in 2026 turns on evidence, not documentation. Controls that leave a record each time they run satisfy an auditor and a regulator; control matrices describing intended behavior increasingly do not. The timing is specific: the SEC's accounting enforcement unit began staffing in August 2026, and PCAOB QC 1000 takes effect on December 15, 2026, which places both changes inside the audit cycle now in progress.