Sarbanes-Oxley (SOX)

What is Sarbanes-Oxley (SOX)?

Sarbanes-Oxley (SOX) is the 2002 US law that requires public companies to maintain and report on internal controls over financial reporting, with CEO and CFO certification of results. The Act also created the Public Company Accounting Oversight Board to oversee auditors. Section 404 requires management to assess those controls in the annual report. At larger companies, the outside auditor also reports on them.

Why it matters to a revenue leader

Revenue is one of the largest numbers in the financial statements, and many of the controls behind it start in the sales process: who can approve a discount, who signs a nonstandard contract, when a deal counts as closed and whether the CRM matches billing. Side letters and undocumented promises to customers can become control problems. A CRO at a public company inherits these controls with the job. A PE-backed company planning an IPO should start building them well before it lists.

A services company preparing for an IPO finds that branch managers approve discounts by email, with no record in the quoting system. Finance moves discount approvals into the system and starts matching signed contracts to billing each month. The CRO explains the change to sellers as part of becoming a public company and builds it into deal reviews.