Sarbanes-Oxley requires management of US public companies to assess and attest to the effectiveness of internal control over financial reporting, with auditor attestation alongside. Sections 302 and 404 are the operative ones, and between them they created the modern governance, risk and compliance software market.
Sarbanes-Oxley
Statute United States
Sarbanes-Oxley is the origin of the GRC industry. Requiring management to attest, personally, that controls over financial reporting are effective turned control testing from an internal-audit activity into a continuous, evidenced, software-supported discipline — and created demand for every platform that automates it.
- Section 302 - Officer certification of disclosure controls, with personal liability attached.
- Section 404 - Management assessment of internal control over financial reporting, with auditor attestation.
- Evidence over assertion - Controls must be tested and the testing documented, which is what the software exists to do.
- The PCAOB - An audit regulator created by the Act, which sets the standards auditors apply.
- Beyond public companies - Private companies approaching an IPO, and their suppliers, adopt the discipline early.
SOX created the market that The State of Legal & Compliance APIs scores at 24.1 with 28.6% publishing a machine-readable contract, inside a market whose governance facet is 9.1 with two-thirds at zero. The obligation SOX creates — evidence a control operated, repeatably, in a form an auditor accepts — is exactly what OSCAL was built to make exchangeable. Twenty-four years on, most of that evidence still moves as documents.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Legal & Compliance APIs
The origin of the GRC market — which scores 24.1 with 28.6% publishing a contract, in a market whose governance facet is 9.1.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
OSCAL
The format that would make SOX control evidence exchangeable between systems rather than re-keyed.
