What US federal law requires public companies to maintain internal controls over financial reporting?

The Sarbanes-Oxley Act requires public companies to maintain and report on internal controls over financial reporting.

Enacted in 2002, the law followed major corporate scandals involving companies such as Enron and WorldCom. Its goal was to improve the reliability of public-company disclosures, strengthen executive accountability, and restore investor confidence. Section 404 is the provision most directly associated with internal control over financial reporting.

Under Section 404, management must accept responsibility for establishing and maintaining adequate controls and must assess their effectiveness. In many cases, an independent auditor also reports on management’s assessment, although regulatory rules provide differing requirements for certain smaller reporting companies. Internal controls can include procedures for authorization, recordkeeping, account reconciliation, access restrictions, and detection of material errors or fraud.

The Securities Act of 1933 primarily governs public offerings, while the Gramm-Leach-Bliley Act focuses heavily on financial privacy and information security. Dodd-Frank, enacted after the 2008 financial crisis, addressed broader financial regulation and consumer protection. None is the canonical answer to this internal-controls question.