Sarbanes-Oxley and Treasury Controls

Why This Topic Matters

The Sarbanes-Oxley Act of 2002 (SOX) fundamentally reshaped how public companies in the United States govern themselves, report financial results, and design internal controls. For the treasury professional, SOX is not an abstract legal topic that belongs to the legal or audit department. Treasury controls cash, the single most liquid and most easily misappropriated asset in any organization. Treasury also executes payments, manages bank accounts, borrows money, hedges exposures, and invests surplus funds. Every one of these activities touches the financial statements and therefore falls squarely within the scope of SOX internal control requirements.

On the AFP Certified Treasury Professional (CTP) exam, this topic sits within the Financial Regulatory and Operational Risk domain. Candidates are expected to understand the purpose of SOX, the key sections that affect treasury, the control frameworks used to comply, and the specific control activities treasury must implement. Questions tend to be practical rather than purely legal: the exam wants to know whether you can recognize a control weakness, identify the appropriate control to fix it, and understand who is accountable for what. Mastering this material also makes you a better practitioner, because strong treasury controls protect the organization from fraud, error, and reputational damage regardless of whether SOX legally applies.

What Sarbanes-Oxley Is

SOX was enacted in July 2002 in response to a wave of corporate accounting scandals, most notably Enron, WorldCom, Tyco, and Adelphia. These failures exposed weak board oversight, conflicted auditors, misleading disclosures, and executives who claimed ignorance of fraud occurring under their watch. Congress responded with legislation designed to restore investor confidence by making senior management personally accountable for financial reporting, strengthening auditor independence, and mandating robust internal controls.

Key structural features of SOX include:

Public Company Accounting Oversight Board (PCAOB): SOX created the PCAOB to oversee the audits of public companies. Before SOX, the accounting profession was largely self-regulated. The PCAOB sets auditing standards, inspects audit firms, and can discipline auditors.

Applicability: SOX applies to companies with securities registered with the U.S. Securities and Exchange Commission (SEC), including foreign private issuers listed on U.S. exchanges. Private companies are not legally bound by most provisions, but many adopt SOX-style controls voluntarily, especially if they anticipate an IPO, have lenders or investors who demand them, or are subsidiaries of public parents.

The Sections You Must Know

Section 201 - Auditor Independence: Prohibits external auditors from providing certain non-audit services to audit clients, such as bookkeeping, financial information systems design, appraisal services, internal audit outsourcing, and management functions. The intent is to prevent auditors from auditing their own work. For treasury, this means the external auditor cannot design or implement your treasury management system and then audit it.

Section 301 - Audit Committee Requirements: Requires that the audit committee be composed entirely of independent directors, be directly responsible for hiring and overseeing the external auditor, and establish procedures for receiving and handling complaints, including anonymous whistleblower submissions regarding accounting or auditing matters.

Section 302 - Corporate Responsibility for Financial Reports: Requires the CEO and CFO to personally certify each quarterly and annual report. They must certify that they have reviewed the report, that it contains no material misstatements or omissions, that the financial statements fairly present the financial condition of the company, and that they are responsible for establishing and maintaining disclosure controls and internal controls. They must also disclose to the auditors and audit committee any significant deficiencies, material weaknesses, or fraud involving management or employees with a significant role in internal control.

Section 401 - Enhanced Disclosures: Requires disclosure of all material off-balance-sheet arrangements, obligations, and relationships. This was a direct response to Enron's use of special purpose entities. Treasury must be aware of this because operating leases, guarantees, letters of credit, and certain derivative structures can create off-balance-sheet exposures that require disclosure.

Section 404 - Management Assessment of Internal Controls: This is the most significant and most costly section. It has two parts. Section 404(a) requires management to include in the annual report an assessment of the effectiveness of internal control over financial reporting (ICFR), identifying the framework used. Section 404(b) requires the external auditor to attest to and report on management's assessment. The 404(b) auditor attestation requirement applies to accelerated and large accelerated filers; smaller reporting companies and emerging growth companies are exempt from 404(b) but must still comply with 404(a).

Section 409 - Real-Time Disclosure: Requires companies to disclose material changes in financial condition or operations on a rapid and current basis, typically via Form 8-K. Treasury events such as a covenant breach, a credit facility default, a major debt issuance, or a significant impairment may trigger this requirement.

Section 802 - Document Retention and Criminal Penalties: Makes it a crime to alter, destroy, or falsify records with intent to obstruct a federal investigation. Requires auditors to retain audit workpapers for seven years. Treasury must maintain documented policies on record retention covering bank statements, payment authorizations, confirmations, and hedge documentation.

Section 806 - Whistleblower Protection: Protects employees who report suspected fraud from retaliation. Treasury staff who observe irregularities in payments or bank activity are protected if they report through proper channels.

Section 906 - Criminal Penalties for Certification: Imposes criminal penalties of up to 20 years in prison and fines up to 5 million dollars for executives who knowingly or willfully certify false financial reports. This is the provision that gives Section 302 its teeth and explains why CEOs and CFOs demand sub-certifications from treasurers and controllers.

How SOX Compliance Works: The COSO Framework

SOX requires management to use a recognized control framework when assessing ICFR. The overwhelmingly dominant framework is the one published by the Committee of Sponsoring Organizations of the Treadway Commission, commonly called COSO. The 2013 updated COSO Internal Control - Integrated Framework defines five interrelated components of internal control:

1. Control Environment: The tone at the top, including integrity, ethical values, board oversight, organizational structure, and commitment to competence. In treasury, this means a documented treasury policy approved by the board, clear delegation of authority, and a culture where controls are respected rather than bypassed for convenience.

2. Risk Assessment: The process of identifying and analyzing risks that could prevent the organization from achieving its objectives, including the risk of fraud. Treasury must assess where cash could be misappropriated, where errors in recording debt or derivatives could occur, and where system failures could disrupt payments.

3. Control Activities: The policies and procedures that mitigate identified risks. This is where most treasury controls live, including segregation of duties, authorizations, reconciliations, and physical and logical access controls.

4. Information and Communication: Ensuring that relevant, quality information flows up, down, and across the organization. Treasury must communicate policies to staff, report positions and exceptions to management, and provide accurate data to the accounting function.

5. Monitoring Activities: Ongoing evaluations and separate evaluations to determine whether controls are present and functioning. This includes internal audit reviews of treasury, management review of exception reports, and periodic control self-assessments.

The 2013 COSO framework also articulates 17 principles underlying these five components. A control system is effective only when all five components and all relevant principles are present and functioning together.

The Section 404 Compliance Process

Compliance with Section 404 follows a repeatable annual cycle that the exam may test at a conceptual level:

Scoping: Management identifies significant accounts, disclosures, and business processes using a top-down, risk-based approach. Cash, debt, investments, and derivatives are almost always in scope because of their materiality and susceptibility to misstatement.

Documentation: For each in-scope process, management documents the flow of transactions, identifies points where misstatements could occur (risk points), and maps the controls that address each risk. Process narratives, flowcharts, and risk-control matrices are common documentation tools.

Identification of Key Controls: Not all controls are equal. Key controls are those that, if they failed, would create a reasonable possibility of material misstatement. Management focuses testing on key controls to make compliance cost-effective.

Testing: Management tests both the design effectiveness (is the control capable of preventing or detecting a misstatement if it operates as designed?) and operating effectiveness (did the control actually operate consistently throughout the period?). Testing methods include inquiry, observation, inspection of documents, and reperformance.

Evaluation of Deficiencies: Any control failure is classified by severity. A control deficiency exists when the design or operation of a control does not allow management or employees to prevent or detect misstatements on a timely basis. A significant deficiency is less severe than a material weakness but important enough to merit attention by those responsible for oversight of financial reporting. A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A material weakness must be publicly disclosed and results in an adverse opinion on ICFR.

Remediation: Deficiencies are corrected and the corrected controls are retested before year-end if possible.

Reporting: Management issues its assessment, and for applicable filers, the auditor issues an attestation report under PCAOB Auditing Standard 2201.

Treasury Controls in Detail

Treasury is one of the highest-risk functions in any organization from a control perspective because it combines access to cash, authority to move funds, and complex instruments that are difficult for non-specialists to understand. The following control categories appear repeatedly on the CTP exam.

Segregation of Duties (SoD): This is the foundational treasury control. No single individual should be able to initiate, approve, execute, and record a transaction. In treasury, the critical separations are between the person who initiates a payment and the person who approves it; between the person who executes trades and the person who confirms and settles them; between the person who manages bank accounts and the person who reconciles them; and between treasury operations and the accounting function that records the entries. In small treasury departments where full segregation is impractical, compensating controls such as enhanced management review and independent reconciliation are required.

Dual Authorization and Approval Limits: Payments above defined thresholds require two independent approvals. Approval limits are documented in a delegation of authority matrix approved by the board or a board committee. Wire transfers in particular should require dual authorization with callback verification for new or changed beneficiary instructions.

Bank Account Management: Opening and closing bank accounts should require board or senior management authorization. Treasury should maintain a central inventory of all bank accounts, authorized signers, and signing limits. Signers must be removed promptly when employees leave or change roles. Dormant accounts should be closed because they are a fraud risk.

Reconciliations: Bank reconciliations should be performed promptly, by someone independent of cash handling and payment processing, and reviewed by a supervisor. Unreconciled items should be aged and investigated. Reconciliations also apply to investment positions, debt balances, and derivative portfolios, which should be reconciled to counterparty confirmations.

Confirmation Matching: All trades, including FX, money market investments, and derivatives, should be confirmed with the counterparty by someone other than the trader. Confirmations should be matched to internal trade records and discrepancies escalated. Unconfirmed trades are a classic red flag that the exam may describe in a scenario.

System Access Controls: Treasury management systems and bank portals must enforce role-based access, strong authentication (ideally multi-factor), unique user IDs, and automatic audit logs. Access rights should be reviewed periodically and revoked immediately upon termination. Shared passwords and generic user accounts are control deficiencies.

Treasury Policy and Procedures: A board-approved treasury policy should define objectives, permitted instruments, counterparty limits, risk limits, approval authorities, and reporting requirements. Written procedures translate policy into daily practice. Policy exceptions should require documented approval and be reported to the appropriate oversight body.

Investment Policy Compliance: Controls should verify that investments comply with policy regarding permitted instruments, credit quality, concentration limits, and maturity limits. Compliance should be monitored independently of the person making the investment decisions.

Debt and Covenant Compliance: Treasury should maintain a covenant compliance calendar, calculate covenant ratios independently, and report results to management and lenders on time. A covenant breach that is not detected and disclosed can be both a control failure and a Section 409 disclosure issue.

Hedge Documentation: Under hedge accounting standards (ASC 815 in the U.S.), formal documentation must exist at inception identifying the hedged item, the hedging instrument, the risk being hedged, and how effectiveness will be assessed. Missing or late documentation is a common cause of restatements and a frequent SOX finding.

Exception Reporting and Management Review: Automated reports flagging policy violations, limit breaches, unusual payments, and failed reconciliations should be reviewed by management with evidence of review retained. The exam often emphasizes that a review control is only effective if there is evidence it was performed.

Preventive versus Detective Controls: Preventive controls stop errors or fraud before they occur, such as approval requirements, access restrictions, and system edit checks. Detective controls identify problems after they occur, such as reconciliations, exception reports, and audits. A robust control environment uses both, and the exam may ask you to classify a given control.

Sub-Certifications: Because the CEO and CFO must certify under Section 302, most companies implement a cascade of sub-certifications in which the treasurer and other functional leaders certify to the CFO that controls in their areas are operating effectively and that no known material issues are unreported. Treasurers must understand that signing a sub-certification carries personal professional accountability.

Fraud Risk in Treasury

The exam may frame SOX questions around fraud. Common treasury fraud schemes include fictitious vendor payments, altered wire instructions (including business email compromise), unauthorized trades concealed through unconfirmed transactions, kiting between accounts, and misappropriation from dormant accounts. The control response in each case follows the same logic: segregate duties, require independent authorization, confirm with third parties, reconcile independently, and monitor exceptions. Recognizing which control would have prevented or detected a described fraud is a core exam skill.

Costs, Benefits, and Criticisms

SOX compliance is expensive, particularly in the first years of implementation. Critics argue that Section 404 imposes disproportionate costs on smaller companies and has discouraged some firms from listing in the U.S. In response, the SEC and PCAOB issued guidance encouraging a top-down, risk-based approach that focuses on key controls, and the Dodd-Frank Act permanently exempted smaller reporting companies from 404(b). The JOBS Act later exempted emerging growth companies from 404(b) for up to five years after IPO. Supporters point to improved financial reporting quality, reduced restatements over time, and strengthened investor confidence. For treasury specifically, SOX has driven investment in treasury management systems, formalized policies, and raised the professional standing of the function.

Exam Tips: Answering Questions on Sarbanes-Oxley and Treasury Controls

Tip 1 - Match the section number to its purpose. The exam frequently tests whether you know what each major section does. Memorize these pairings: 302 equals management certification of reports; 404 equals internal control assessment and auditor attestation; 401 equals off-balance-sheet disclosure; 409 equals real-time disclosure; 802 equals document retention and penalties for destruction; 806 equals whistleblower protection; 906 equals criminal penalties for false certification; 201 equals auditor independence; 301 equals audit committee independence. If a question describes the CEO and CFO signing off, think 302. If it describes an auditor opining on controls, think 404(b).

Tip 2 - Know who is responsible for what. Management, not the auditor, is responsible for establishing, maintaining, and assessing internal control. The auditor attests to management's assessment. The audit committee oversees the auditor and the whistleblower process. The PCAOB oversees the auditors. If an answer choice places primary responsibility for internal control on the external auditor, it is wrong.

Tip 3 - Segregation of duties is almost always the best answer to a single-person-does-everything scenario. When a question describes one employee who initiates wires, approves them, and reconciles the bank account, the control deficiency is lack of segregation of duties and the remedy is to separate those functions or implement compensating controls. Do not be distracted by answer choices about training or system upgrades when the root issue is concentration of duties.

Tip 4 - Distinguish deficiency severity correctly. A control deficiency is the least severe, a significant deficiency is in the middle, and a material weakness is the most severe and requires public disclosure and an adverse ICFR opinion. The defining feature of a material weakness is a reasonable possibility of a material misstatement not being prevented or detected on a timely basis.

Tip 5 - Classify controls as preventive or detective when asked. Approvals, authorization limits, access restrictions, and dual signatures are preventive. Reconciliations, exception reports, audits, and confirmation matching are detective. Some questions will ask which type of control a scenario describes, and others will ask which type is more appropriate for a given risk.

Tip 6 - Remember that COSO is the framework, SOX is the law. SOX does not itself prescribe specific controls. It requires management to use a recognized framework, and COSO is the standard choice. Know the five COSO components: control environment, risk assessment, control activities, information and communication, and monitoring. A question asking which element represents tone at the top is pointing to control environment.

Tip 7 - Understand applicability. SOX applies to SEC registrants. Private companies are not legally required to comply, though many adopt the practices voluntarily. Smaller reporting companies must comply with 404(a) management assessment but are exempt from 404(b) auditor attestation. If a question asks whether a private company must obtain a 404(b) attestation, the answer is no.

Tip 8 - Evidence of review matters. The exam reflects a key audit principle: a control that is not documented as having been performed is treated as not having been performed. When evaluating answer choices about management review controls, prefer the option that includes documented sign-off, retained evidence, or an audit trail.

Tip 9 - Connect treasury events to disclosure obligations. A covenant breach, a default, a major new borrowing, or a significant hedging loss may trigger Section 409 real-time disclosure through Form 8-K. Off-balance-sheet guarantees and letters of credit trigger Section 401 disclosure considerations. Be ready to identify these linkages.

Tip 10 - Read scenario questions for the control that failed, not the symptom. If a fraudulent wire went out, the symptom is the loss, but the exam wants the failed control, such as lack of callback verification on changed beneficiary details or absence of dual authorization. Identify the root cause first, then choose the answer that addresses it.

Tip 11 - Watch for auditor independence traps. If a question describes the external audit firm designing the treasury management system or performing internal audit work for the same client, that is a Section 201 prohibited service. Independence violations are a favorite distractor.

Tip 12 - Eliminate extreme or absolute answer choices. Options stating that SOX eliminates all fraud, that controls guarantee accuracy, or that the treasurer has no responsibility under SOX are almost always incorrect. Internal control provides reasonable, not absolute, assurance.

Quick Review Summary

SOX was passed in 2002 after Enron and WorldCom to restore investor confidence. It created the PCAOB, strengthened auditor independence, made CEOs and CFOs personally accountable through Sections 302 and 906, and required management assessment and auditor attestation of internal control over financial reporting through Section 404. Companies comply using the COSO framework with its five components. Treasury is a high-risk area requiring segregation of duties, dual authorization, independent reconciliation, confirmation matching, system access controls, board-approved policies, and documented management review. Deficiencies are graded as control deficiencies, significant deficiencies, or material weaknesses, with material weaknesses requiring public disclosure. On the exam, focus on matching sections to purposes, assigning responsibility correctly, identifying failed controls in scenarios, and remembering that internal control provides reasonable rather than absolute assurance.