IT Suppliers! Are Your Services SOX Compliant?

The US Sarbanes-Oxley Act 2002 ("SOX") applies to many UK companies often because they have a US listed parent and so must comply with the "Group’s" requirements.

If you are a supplier of IT software or services or software to such companies, from July 2006 customers may well be asking you if your products and services are SOX compliant.

The rationale of SOX is to ensure that a company’s financial reporting is accurate and, consequently, that the company has systems (including IT systems) and controls which ensure the reliability and integrity of such reporting. Section 404 of SOX requires a company’s management to report on its assessment of the controls it has in place over its financial reporting. Registered external auditors must then attest the management report. These are known in the US as "Section 404" audits.