US · us statute
Sarbanes-Oxley sections 302 and 404
In force
Management assessment and, where required, auditor attestation are issuer duties. A private vendor can support a customer's controls without becoming certified. Control evidence needs an owner, a period, a sample, a reviewer who is not the preparer, and a record of exceptions.
Applies to. Relevant SEC reporting issuers. Section 404(b) auditor attestation is not universal.
Verification. No fixed per-late-report fine is stated in this catalogue.
Reviewed in the research snapshot on 2026-11-08. A qualified legal reviewer has not been appointed.