Sarbanes-Oxley at the Two-Decade Mark: What Still Matters and What Quietly Changed

The Sarbanes-Oxley Act was enacted in 2002 in response to the accounting scandals at Enron, WorldCom, and the other public-company failures that defined the early years of this century. At the time, it was characterized as the most consequential change to the federal securities laws since 1934. More than two decades on, that characterization holds, but the substantive landscape of SOX-related litigation and enforcement has evolved in ways that practitioners who have not stayed close to the area may not fully appreciate.

I have litigated SOX matters since shortly after the statute’s enactment, including internal controls disputes, whistleblower retaliation claims, certification exposure for senior executives, and the auditor liability cases that the statute reshaped. The legal architecture of SOX has remained substantially intact across multiple administrations and SEC chairs, but the application has shifted in ways that matter to defendants. Certain provisions have become more important than the legislative history would have suggested. Certain enforcement priorities have intensified. Certain doctrines have quietly hardened in ways that constrain defense positions that were viable in the early years of the statute. A senior practitioner’s perspective on what has actually changed — and what has not — is useful for the general counsel and audit committee members who continue to live with the statute’s reach.

The Certification Provisions Remain the Heart of the Statute

Section 302 and Section 906 of SOX require chief executive officers and chief financial officers to personally certify the accuracy and completeness of their companies’ periodic reports. The certifications include attestations about disclosure controls, internal controls over financial reporting, the absence of fraud or material misstatement, and the design and operation of the company’s reporting systems. These certifications are not boilerplate. They are personal representations by named executives that, if false, can support both civil enforcement actions and criminal prosecution.

The enforcement record under Sections 302 and 906 has been more measured than the original legislative debate predicted, but it has been substantial. Executives who have certified financial statements that subsequently required restatement face the prospect of personal exposure that did not exist before SOX. The SEC’s analytical framework asks whether the executive knew or should have known of the misstatement at the time of certification, whether the disclosure controls and internal controls that supported the certification were in fact reasonable, and whether the restatement reflects a failure of the systems the executive certified.

The defense of certification matters requires substantial preparation of the contemporaneous record. The executive’s actual involvement in the financial reporting process, the basis for the executive’s reliance on the controls and the staff that operated them, the materiality of the matters that subsequently required restatement, and the steps the executive took to verify the accuracy of the reports before certification — all of these are central to the defense. The defense team that has not built this record in real time, before any restatement issue arose, will struggle to construct it after the fact.

For general counsel and audit committees, the practical implication is that the certification process should be treated as the substantive responsibility it is, not as the documentary exercise it sometimes becomes. The sub-certifications obtained from operating executives, the disclosure committee process, the documentation of management’s review of the financial reporting — all of these should be designed to produce a contemporaneous record that supports the executive certifications. The companies that have built robust certification processes have produced executives who are defensible if questions later arise. The companies that have treated certification as a formality have produced executives who are not.

Internal Controls and the Materiality of Material Weaknesses

Section 404 of SOX requires management to assess and report on the effectiveness of the company’s internal controls over financial reporting, and requires the company’s external auditor to attest to that assessment for accelerated filers and large accelerated filers. The assessment framework has produced a substantial body of enforcement activity around material weaknesses, significant deficiencies, and the disclosures companies make about their control environments.

The enforcement priorities in this area have shifted over time. In the early years after Section 404’s implementation, enforcement focused on companies that failed to identify and disclose obvious deficiencies. More recent enforcement has focused on companies that identified deficiencies but characterized them as significant deficiencies rather than material weaknesses, or that identified material weaknesses but described them in disclosure language that minimized their import. The current enforcement posture treats the characterization of control deficiencies as a substantive judgment subject to scrutiny, not as a discretionary matter for management.

This shift has implications for how companies should approach their Section 404 assessments and their disclosures about identified deficiencies. The assessment process should be conducted with attention to the criteria for material weakness as the enforcement staff applies them, not as management would prefer to apply them. The disclosure should be candid about the nature of any material weakness identified, the remediation steps being undertaken, and the timing of expected remediation. Companies that have hedged on these disclosures — describing material weaknesses in language that minimized their significance — have produced enforcement matters that the candid disclosure would have avoided.

The litigation implications are similar. In private securities litigation, the adequacy of internal controls disclosures is a frequent battleground. Plaintiff lawyers argue that material weaknesses were known to management before disclosure, that the disclosures when made were inadequate, and that the company’s stock price reflected the inflation produced by the inadequate disclosures. The defense requires the contemporaneous record of how the controls assessment was performed, what management knew when, and how the disclosure decisions were made. As with the certification matters, this record cannot be created after the litigation begins. It must exist in the company’s contemporaneous documentation of its controls assessment process.

Section 1514A Whistleblower Retaliation Claims

Section 806 of SOX, codified as 18 U.S.C. § 1514A, provides a private right of action for employees of public companies and certain related entities who suffer retaliation for reporting securities law violations. The statute has produced a substantial body of litigation that affects public companies, their subsidiaries, and increasingly their contractors and agents.

The 1514A framework has been more litigation-friendly to whistleblowers than the original drafters likely anticipated. The protected activity element has been interpreted broadly, covering reports of conduct that the employee reasonably believed violated the securities laws, even if the conduct did not in fact constitute a violation. The contributing factor causation standard requires only that the protected activity contributed in some way to the adverse employment action, which is substantially easier to establish than the but-for causation standard applicable in many other employment law contexts. The damages framework includes back pay, front pay, reinstatement, and the litigation costs of pursuing the claim, producing financial exposure that often exceeds the original employment dispute.

The defense of 1514A claims requires understanding the procedural framework — administrative filing with OSHA, eventual federal court litigation if the administrative process does not resolve the matter — and the substantive standards the statute applies. The defense must address the employee’s protected activity (whether the activity actually qualified as protected under the statute), the employer’s knowledge of the protected activity (the basis for arguing that the decisionmakers did not know about the protected activity), the legitimate business reasons for the adverse action (the documented performance issues or business circumstances that would have produced the adverse action regardless of the protected activity), and the same-decision defense (proof that the adverse action would have been taken in the absence of the protected activity).

This is fact-intensive defense work that depends on the quality of the employer’s documentation and the credibility of the witnesses involved in the employment decisions. The employer that has documented performance issues consistently and contemporaneously is in a different defense posture than the employer whose first performance documentation appears in the weeks after the protected activity. The companies that defend these matters successfully are the ones whose HR practices and documentation standards reflect the seriousness of the exposure the statute creates.

The Auditor Liability Provisions

SOX restructured the auditor liability framework substantially, both directly through the Public Company Accounting Oversight Board’s authority over auditing standards and indirectly through changes to the audit committee’s oversight of the external auditor. The litigation between issuers and their auditors, and the regulatory enforcement actions involving audit firms, have shifted in ways that affect both auditors and the audit committees that oversee them.

Audit committees face exposure under several theories. The Caremark duty applies to the audit committee’s oversight of the external audit, with the committee responsible for ensuring that the audit was conducted competently and that the auditor’s findings were properly addressed. Federal securities law claims may name audit committee members personally if the committee’s oversight is alleged to have been deficient. Stockholder derivative claims may target audit committee decisions about auditor retention, scope of services, and response to identified issues.

The defense of audit committee members requires understanding the committee’s actual responsibilities, the documentation of how those responsibilities were discharged, and the standards under which the committee’s conduct will be evaluated. The audit committee that has conducted its oversight rigorously, documented its work carefully, and engaged effectively with both management and the external auditor is in a different position than the committee that has been less attentive to these matters. As with so much of SOX practice, the contemporaneous record is the defense.

The Clawback Provisions and Their Recent Expansion

Section 304 of SOX has always required reimbursement of certain executive compensation in the event of restatement caused by misconduct. The reach of Section 304 has been litigated extensively, including the question of whether the executive subject to clawback must have personally engaged in the misconduct that caused the restatement.

The clawback landscape has expanded significantly with the SEC’s adoption of the Rule 10D-1 listing standard required by the Dodd-Frank Act. The Rule 10D-1 framework, which has been implemented by the exchanges over the past several years, requires listed companies to adopt clawback policies that recover incentive compensation following accounting restatements, without the misconduct trigger that limits Section 304’s application.

The implications for executives are substantial. The compensation that was earned, paid, and reported as income may be subject to clawback if a subsequent restatement establishes that the compensation was calculated on inflated financial results. The clawback applies regardless of fault, which means that executives who had no knowledge of the misstatement and no involvement in the underlying conduct can still face the recovery of compensation they had assumed was theirs.

Defense counsel advising executives on compensation matters must now address the clawback exposure as part of the engagement framework. The negotiation of severance agreements, the structuring of compensation in ways that account for clawback risk, and the engagement with the company over the application of clawback policies after restatement all require legal sophistication that the prior framework did not require to the same extent.

What Senior Practitioners See That Newer Lawyers Often Miss

Two decades into SOX practice, a few things are clear that may not have been obvious in the early years.

The statute has not produced the wave of executive prosecutions that the original legislative rhetoric anticipated, but it has produced sustained civil enforcement that has materially raised the exposure for senior executives and audit committee members. The defense of these matters depends on contemporaneous records that companies must create deliberately, not on after-the-fact arguments about the reasonableness of conduct that was not documented.

The whistleblower provisions have become a more significant source of litigation exposure than the certification or controls provisions, particularly for companies with employee populations large enough to produce a steady flow of protected reports. The companies that manage this exposure well are the ones that treat the protected activity framework as the substantive legal obligation it is, not as an HR matter to be handled by employee relations.

The clawback regime has fundamentally changed the relationship between executives and their compensation in ways that the original SOX provisions did not. The combination of Section 304, Rule 10D-1, and the various contractual clawback provisions that companies have adopted produces a framework in which executive compensation is materially contingent on the long-term accuracy of financial reporting in ways it was not before.

For general counsel, audit committee members, and senior executives, the practical lesson is that SOX is not a stable, mature regulatory regime that no longer requires close attention. It is an evolving body of law that has shifted meaningfully in the years since its enactment and continues to shift today. The companies and the individuals who treat it as solved are the ones who are surprised when the enforcement matter or the litigation arrives. The ones who treat it as the substantive obligation it has become are the ones whose defenses, when needed, are ready.

—

Otto K. Hilbert, II is a Trial Attorney with AEGIS Law. He brings over 36 years of first-chair trial and appellate experience to representing clients in complex commercial litigation, securities defense, and regulatory enforcement matters. He has tried cases in 23 states and is admitted before the United States Supreme Court and multiple United States Courts of Appeals.

This article is provided for general informational purposes and does not constitute legal advice. Readers facing specific legal matters should consult qualified counsel.