The beginning of the 21st century ushered in a new financial, commercial and industrial era. It was the beginning of the internet age. Powerful computer processors, along with instant, digital, worldwide communication, allowed global business to be conducted (literally) at the speed of light and put previously unfathomable amounts of data at our fingertips. No one can deny that it was a time of great opportunity, but at least as much opportunity for crime and malfeasance was also present.
Our 20th-century laws and antiquated supervisory regimes proved inadequate for the rapidly modernizing times. Bad actors in once-respected, now infamous companies like Enron, WorldCom and Global Crossing found new ways to manipulate and cheat our outdated systems. Much damage was done, and hundreds of billions of dollars of investor capital were lost or stolen. Government regulators responded with their own modernizations, quickly updating their systems, methods and laws.
One of the most consequential changes of that time was the passage and implementation of The Sarbanes-Oxley Act of 2002, known by risk, audit and accounting professionals as "SOX."
Section 302: Executive Certification
The goal of SOX was (and still is) to protect the commercial and financial system as well as individual and institutional investors from fraud, deception, misrepresentation and other criminality in financial and corporate reporting. Among other things, it required public companies to institute and document stringent accounting and risk controls for all financial reporting. Further, it enhanced criminal penalties for violators and protected "whistleblowers" from harassment and retaliation.
Most of the act comprised important but fairly typical updates to the law. However, SOX Section 302 represented some of the most substantial and significant changes to corporate governance since the Securities & Exchange Act of 1933. Section 302 required top executives — up to and including the CEO — of a company to personally certify the accuracy and completeness of financial reports and hold them accountable for mistakes both of commission and of omission. Previously, C-suite executives were seen as a kind of "consumer" of financial reports in the eyes of the law. As bosses, they oversaw the creation of quarterly financial reports but were not held directly responsible for their defects. That all changed with Section 302.
The Imperative of SOX Section 302 Compliance
The potential for the criminal exposure of top executives had the desired effect. Directors, executives and officers would not risk being punished for the crimes of underlings. Subsequently, Section 302 necessitated the design and implementation of comprehensive SOX Section 302 policies. CEOs and boards of directors mandated that sweeping SOX Section 302 procedures be put in place immediately and be strictly adhered to.
The consequences of being found liable under SOX Section 302 are grave. They include fines, penalties, criminal sanctions and even prison time for serious violations. In short, SOX Section 302 best practices became an integral part of good corporate governance. Compliance instantly became an imperative, and it remains one to this day.
Step One: Access Risk
Upon assuming an executive position, one of the first actions of an officer and the compliance, risk, audit and accounting professionals they employ should be to undertake a complete SOX Section 302 risk assessment. The objectives should include the following:
- Identify requirements specific to SOX Section 302 as opposed to other sections of SOX.
- Enumerate all essential SOX Section 302 mandates.
- Identify all executives subject to the certification requirements of SOX Section 302.
- List all existing SOX Section 302 controls.
- Separate disclosure controls from internal controls.
- Develop a set of SOX Section 302 processes recommendations.
- Create an action plan with specific steps covered executives should take.
Risks must be identified, and affected executives should know where they stand and what will be expected of them before they start the process of certifying financials.
Ask the Right Questions of the Right People
It's always been true that executives are responsible for producing high-quality, accurate financial (and other) corporate reports. Sarbanes-Oxley, however, has changed the overall dynamic. Today's C-suite executives are more than just responsible in the general sense. They are responsible in the much broader and more dangerous sense of also being liable.
Put bluntly, under SOX, the risks are much higher, and the costs of failure are much higher. Regulators and the American public have little sympathy for wayward corporate officers in today's political and cultural environment.
This means it is more important than ever to ask the right questions and get full, complete and honest answers.
To that end, KnowledgeLeader has created several invaluable tools for officers and directors who come under the jurisdiction of SOX. In fact, its subscription-based library has over 250 publications that touch on the subject of executive certification. They're all available to subscribers for instant download and customizable for applications to different companies and industries.
Section 302 Executive Certification Questionnaire
The first one recommended to executives and accounting professionals is our Sarbanes-Oxley Section 302: Executive Certification Questionnaire.
Each of the dozens of questions included in this resource is designed to address a critical aspect of the Section 302 executive certification requirement. It's much more than an out-of-context list of questions. It explains precisely who each set of questions is for — who should be asking and who should be answering — and gives helpful suggestions in the form of hypothetical examples.
This resource is, of course, extremely valuable as a checklist and as a way to document that all due diligence has been observed, but subscribers often refer back to it and find it quite useful as a "follow-up" reminder tool.
Below are just a few of the areas the questionnaire addresses:
- Management discussion of disclosure controls
- Process reviews by management and compliance
- Internal and disclosure control quality assessment
- Control operational effectiveness
- Critical steps prior to certification
Additional Content
KnowledgeLeader's parent company, Protiviti, is one of the most highly regarded global consulting firms in the world. Its periodic publication The Bulletin is regularly consulted by top risk, audit and accounting professionals around the globe. Volume 1, Issue 3 of The Bulletin is entirely dedicated to the topic of executive certifications. The issue is titled “Executive Certifications: Same Responsibilities, Higher Stakes.” It's full of the highest quality intelligence from the best minds in the business.