What SOX taught finance about disclosure controls, and what carries over to climate

In 2004, finance teams in US-listed companies spent a year documenting things they had been doing informally for decades. Who approves a journal entry. Who reconciles the bank account. What happens when the person who normally does it is on leave.

Most of them thought it was bureaucratic. Twenty years on, that work is simply how finance operates.

Climate reporting is at the start of the same road. Not the same statute, and not the same penalties. But the same problem: numbers that matter, produced by a process nobody wrote down.

Why look at a statute from 2002

Because it is the only large-scale natural experiment we have in making companies evidence their reporting process.

The Sarbanes-Oxley Act followed a run of accounting failures. Its response was structural rather than punitive: if you cannot show how a number was produced and checked, the number is not trustworthy, whatever it says.

That is the same claim an assurance provider makes about your Scope 2 figure.

What Sections 302 and 404 actually require

Two provisions do most of the work, and they are often confused.

Section 302 required the SEC to adopt rules under which a company's principal executive and principal financial officers certify in each quarterly and annual report filed with the Commission. The certification covers the report's truthfulness and the state of the company's disclosure controls and procedures — controls addressing the quality and timeliness of disclosure.

Section 404 goes further. Management assesses internal control over financial reporting, and the external auditor reports on that assessment.

The distinction matters. Section 302 is a personal statement by two named officers. Section 404 brings an outside party in to test whether the statement holds.

Management assertion, and why it changed behaviour

The interesting part is not the paperwork. It is the assertion.

Before SOX, a CFO could reasonably say the numbers came from the system and the system was maintained by the team. Afterwards, two named individuals had to state that the controls were adequate, in a document with their signature on it.

That single change did more than any control matrix. Once a named person carries the consequence, that person starts asking who checked what — which is the behaviour the framework was trying to produce all along.

There is no climate equivalent today. Nobody signs a personal certification that the emissions controls are adequate. Whether that stays true is a policy question, and not one to plan around.

Deficiency, significant deficiency, material weakness

This vocabulary is the most useful thing finance can lend to climate reporting, because it turns a binary argument into a graded one.

Under PCAOB AS 2201, a deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of their assigned functions, to prevent or detect misstatements on a timely basis.

A significant deficiency is less severe than a material weakness, but important enough to merit attention by those responsible for oversight of financial reporting.

A material weakness is a deficiency, or a combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

Read the third one again. It is not about whether an error happened. It is about whether one could happen and go unnoticed. A control gap is a finding even in a year when the numbers came out right.

One more mechanic worth borrowing. AS 2201 asks the auditor to consider whether individual deficiencies affecting the same account, assertion or component collectively amount to a material weakness. Small problems aggregate. Four minor gaps in the same figure can be worse than one moderate gap spread thinly.

What carries over to climate disclosure

The control cycle. Identify where a misstatement could occur, design something that prevents it, operate it every period, and be able to show that it ran. That sequence is not specific to financial reporting.

The severity language. Grading a gap rather than arguing about whether it is a problem is a large practical improvement over the conversations most sustainability teams currently have.

The documentation habit. SOX taught finance that an undocumented control is treated as a control that did not operate. That principle transfers exactly.

Separation of duties. Preparer, reviewer and approver as distinct people, covered in who signs off on a climate disclosure figure.

What does not carry over

Being precise here matters, because overstating the parallel is the easiest way to lose a controller's trust.

There is no certification. IFRS S2 tells you what to disclose. It does not require a named officer to assert that your climate controls are effective.

There is no auditor attestation on controls. Nothing in the climate regime mirrors Section 404(b). Your assurance provider forms a conclusion on the information, not on your control environment. ISSA 5000 broadens tests of controls and encourages a controls-based approach, but it does not produce a public opinion on your controls.

The penalties are different in kind. SOX carries statutory consequences for false certification. Climate disclosure failure today mostly produces a modified assurance conclusion, regulator correspondence, and reputational damage.

The maturity gap is real. ICFR has had two decades of practice, case law and tooling. Climate control practice has almost none. Anyone selling you a mature methodology is describing an aspiration.

The honest limits of the analogy

SOX applied to a defined population of registrants, with a single regulator and a single enforcement mechanism. Climate disclosure is fragmented across jurisdictions with different timetables, different assurance requirements and, in several cases, unresolved policy.

There is also a data difference that matters more than people admit. Financial data mostly originates inside systems the company controls. A large share of emissions data originates outside — a landlord's apportionment, a supplier's factor, a utility's meter. You cannot test a control over a process you do not run.

So the transfer is partial. The mechanics and the vocabulary carry. The legal architecture does not, and the data problem is genuinely harder.

The position worth taking: borrow the discipline, not the framework. Companies that wait for a climate SOX before writing down who approves what will spend the intervening years producing numbers they cannot defend. The discipline was always the useful part. The statute was only what forced it.

Common questions

Does IFRS S2 require SOX-style internal control over climate data?

No. IFRS S2 sets out what to disclose. It does not impose a control framework on the reporting entity, and there is no climate equivalent of a Section 404 management report on internal control. The pressure comes indirectly, through the assurance engagement, because a practitioner who finds no controls to test must do more substantive testing instead.

What is the difference between a control deficiency and a material weakness?

Under PCAOB AS 2201, a deficiency exists when the design or operation of a control does not allow staff to prevent or detect misstatements on a timely basis. A material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A significant deficiency sits between the two: less severe than a material weakness, but important enough to merit attention from those overseeing reporting.

Can several small control problems add up to a material weakness?

Yes, and this is the part preparers usually miss. PCAOB AS 2201 requires the auditor to consider whether individual deficiencies affecting the same account, assertion or component of internal control collectively amount to a material weakness. Four minor gaps in the same figure can be worse than one moderate gap spread across four.

Is climate disclosure heading toward a SOX-style regime?

That is not something anyone can state as fact today. What is observable is that climate information is moving into the general purpose financial report and into the scope of assurance. Whether jurisdictions add a management certification or an auditor attestation on controls is a policy question that has not been settled, and we would not plan on either.