The Sarbanes-Oxley Act of 2002 (SOX) applies to public companies listed on US stock exchanges and their subsidiaries, as well as accounting firms auditing those companies. It imposes requirements on the accuracy and integrity of financial reporting - and on the internal controls that produce that reporting.SOX created significant personal liability for CFOs and CEOs who certify the accuracy of financial statements. As a result, internal control frameworks have become critical corporate infrastructure - and the audit evidence supporting those controls must be verifiable.ROOTKey addresses the audit trail and evidence integrity requirements that underpin SOX Section 302 and 404 compliance.
Section 302 - Corporate Responsibility for Financial Reports
Section 302 requires the principal executive officer and principal financial officer to personally certify the accuracy of financial reports and the effectiveness of internal controls - every quarter. The certification covers:
Certification requirement
ROOTKey capability
Internal controls are designed to ensure material information flows to certifying officers
Anchor information flow records - tamper-evident evidence that material information was available when claimed
Material weaknesses in internal controls are disclosed
Anchor deficiency records at identification - blockchain timestamp proves when weaknesses were identified, not when they were disclosed
Changes to internal controls that materially affect financial reporting are reported
Anchor change records - immutable evidence of when and what changed
Section 404 - Management Assessment of Internal Controls
Section 404 requires management to annually assess and report on the effectiveness of internal controls over financial reporting (ICFR). External auditors must then attest to that assessment.
ICFR requirement
ROOTKey capability
Controls are operating effectively
Anchor control operation evidence - each control event is timestamped and tamper-evident
Control testing records are maintained
Anchor testing records at completion - verifiable by external auditor without relying on management assurance
Exceptions and deviations are documented
Anchor exception records at identification - cannot be retroactively removed
Remediation of deficiencies is documented
Anchor remediation records - evidence of action timing and outcome
Section 409 requires companies to disclose material changes in financial condition or operations on a rapid and current basis. ROOTKey anchors disclosure records at submission - providing independently verifiable proof of timing.
SOX compliance increasingly depends on IT General Controls - the controls over the IT systems that produce financial data. External auditors and their IT auditors examine:
