Section 404 of the Sarbanes-Oxley Act requires management to assess internal controls over financial reporting.
Enacted in 2002 after major corporate scandals, Sarbanes-Oxley sought to strengthen financial reporting, executive accountability, auditing, and corporate governance. Section 404 requires a reporting company’s annual report to include management’s responsibility for establishing and maintaining adequate internal control over financial reporting, along with management’s assessment of effectiveness.
For many public companies, an independent registered public accounting firm must also attest to and report on management’s assessment. The Public Company Accounting Oversight Board sets the relevant auditing standards. Section 404 compliance therefore involves documenting controls, testing their operation, identifying deficiencies, and disclosing material weaknesses.
The other sections describe different protections or duties. Section 302 addresses chief executive and chief financial officer certifications, Section 806 protects certain whistleblowers, and Section 402 concerns loans to executives. Those provisions are related to corporate accountability, but they do not contain the central management-control assessment requirement.