The Sarbanes-Oxley Act of 2002 was Congress's response to the financial reporting scandals at large public companies (Enron, WorldCom). It imposed new responsibilities on issuers (public companies) and their auditors, and created the Public Company Accounting Oversight Board (PCAOB), which sets auditing standards for registered public accounting firms auditing issuers.

Audit committee requirements

  • Each audit committee member must be an independent director — not affiliated with the company and receiving no compensation except shareholder-approved director fees.
  • The committee must have at least three fully independent members.
  • At least one member must be a financial expert.
  • The committee — not management — appoints, compensates, and oversees the independent auditor. The auditor reports directly to the committee.
  • The committee must establish procedures for receiving and handling complaints about accounting, internal controls, or auditing (whistleblower procedures).

Section 201: Services outside the scope of practice of auditors

An auditor generally may not perform non-audit services for an audit client — only with advance audit committee approval. Prohibited services include:

  • Bookkeeping related to the client's accounting records or financial statements
  • Financial information systems (ERP) design and implementation
  • Appraisal or valuation services
  • Internal audit outsourcing
  • Management functions or human resources
  • Broker/dealer, investment adviser, or investment banking services
  • Legal services and expert services unrelated to the audit
  • Any other service the PCAOB declares impermissible

Note: tax services are NOT prohibited by Section 201. Pre-approval by the audit committee is required for any permitted non-audit service.

Section 203: Audit partner rotation

The lead audit partner may not perform audit services for the same client for more than 5 consecutive fiscal years. Firms must rotate partners so no single individual supervises a client's audit indefinitely.

Section 204: Auditor reports to audit committees

The audit firm must report to the audit committee on a timely basis:

  • All critical accounting policies and practices to be used
  • All alternative treatments and disclosures within GAAP that were discussed with management
  • Other material written communications with management — e.g., the management letter and schedule of unadjusted differences

Section 302: Corporate responsibility for financial reports

The CEO and CFO (signing officers) must certify each periodic report:

  • They have reviewed the report.
  • It contains no untrue statement of material fact and omits no material fact needed to keep statements from being misleading.
  • The financial statements fairly present the company's financial condition and results.
  • They are responsible for establishing and maintaining internal controls, evaluated their effectiveness within 90 days before the report, and present their conclusions.
  • They have disclosed to auditors and the audit committee all significant deficiencies and any fraud — material or not.
  • They report whether significant changes in internal controls occurred after the evaluation, including corrective actions.

Section 407: Disclosure of audit committee financial expert

The issuer must disclose whether its audit committee includes at least one financial expert. A financial expert understands GAAP and financial statements, has experience preparing or auditing statements, applying accounting principles (estimates, accruals, reserves), working with internal controls, and understanding audit committee functions.

Exam tips: how CMA tests this topic

  • Memorize by number: 201 = non-audit services, 203 = 5-year partner rotation, 204 = reports to committee, 302 = CEO/CFO certification, 407 = financial expert.
  • The 'tax services are NOT prohibited' exception is a classic trick option.
  • 'Reasonable assurance, not absolute assurance' language also appears in SOX-related questions.
  • Know who the auditor reports to (audit committee, not management) — tested often.

Frequently asked questions

Why was the Sarbanes-Oxley Act passed?

In response to major financial reporting scandals at large public companies in the early 2000s; it created the PCAOB and tightened auditor independence and corporate accountability.

How long can a lead audit partner serve one client under SOX?

No more than 5 consecutive fiscal years (Section 203).

What does SOX Section 302 require?

The CEO and CFO must personally certify periodic reports — including the effectiveness of internal controls.

Can an audit firm provide tax services to its audit client?

Yes — tax services are not prohibited by Section 201, though audit committee pre-approval is required for non-audit services.

Study CMA (USA) with Knowledge Valley

These notes come straight from our CMA (USA) live classes. If you want the full Section E — taught live, with exam-focused short notes, 4,000+ practice MCQs and 14 mock exams — book a free orientation and trial class at knowledgevalley.net. 10+ years coaching CMA candidates across Pakistan, the Gulf and worldwide.