In the corporate world, ensuring the reliability of financial information and preventing fraud is not just a good practice: in many jurisdictions, it is a legal obligation. Two of the most influential frameworks and regulations in this area are ARENA and the Sarbanes–Oxley Act (SOX)Although they perform distinct functions, their interrelationship is key to a strong internal control system, especially in companies listed on the United States stock exchange or reporting to international investors.
1. What is COSO?
ARENA (Committee of Sponsoring Organizations of the Treadway Commission) is a internal control framework internationally recognized.
Its objective is to provide principles and guidelines for:
- Design and evaluate internal control systems.
- Identify and manage risks.
- Ensure regulatory compliance and operational effectiveness.
The best known model is the COSO 2013, which establishes five components:
- Control environment.
- Risk assessment.
- Control activities.
- Information and communication.
- Monitoring activities.
2. What is SOX?
The Sarbanes–Oxley Act (SOX) is a US federal law enacted in 2002, following corporate scandals such as Enron and WorldCom.
Its purpose is protect investors ensuring that the financial information of public companies is accurate, complete and free from manipulation.
Key points:
- It applies primarily to publicly traded companies in the US.
- Introduces severe penalties for falsification or manipulation of financial data.
- The Section 404 requires management and external auditors to evaluate and report on the effectiveness of internal control over financial reporting (Internal Control over Financial Reporting or ICFR).
3. How COSO and SOX interrelate
Although SOX does not impose a specific framework, in practice COSO is the most widely used standard to meet its requirements, especially in Section 404. This is because COSO:
- Provides a clear methodology for identifying and mitigating risks affecting financial information.
- Establishes principles and measurable criteria to evaluate the effectiveness of controls.
- Facilitates the documentation and evidence required for audits and certifications.
In simple terms:
- SOX establishes the “what”: requires effective and verifiable internal controls.
- COSO provides the “how”: offers practical guidance for designing, implementing and evaluating these controls.
4. Practical application in companies
In a company subject to SOX, the typical process is:
- Evaluate risks: COSO guides the identification of risks relevant to financial reporting.
- Design controls: Preventive and detective controls are implemented following the COSO framework.
- Document processes: Policies, procedures and approval flows are recorded.
- Test effectiveness: Periodic tests are performed to verify that the controls are working.
- Report results: Management certifies compliance to the SEC, with evidence supported by the COSO framework.
5. Benefits of using COSO to comply with SOX
- Standardization: provides a common language for managers, auditors and regulators.
- Comprehensive approach: covers not only financial aspects, but also operational and compliance aspects.
- Solid evidence: facilitates the generation of reliable reports that support annual certification.
- Continuous improvement: promotes the constant review and optimization of internal control processes.
6. Real example
Let's imagine a Mexican company listed on the New York Stock Exchange.
- Under SOX, you must report annually on the effectiveness of your internal control over financial reporting.
- You decide to implement the COSO framework to map risks, document key processes (sales, purchasing, payments, accounting closing), and establish specific controls.
- Thanks to the COSO methodology, the company not only complies with SOX, but also improves its operational efficiency and reduces the likelihood of errors or fraud.
Conclusion
COSO and SOX are two pieces that fit together perfectly:
- SOX establishes the legal obligation to have effective and verifiable internal controls.
- ARENA provides the proven methodology to implement, evaluate and demonstrate their effectiveness.
In an increasingly regulated corporate environment, understanding this interrelationship is not only vital for regulatory compliance, but also for strengthening the confidence of investors, customers, and business partners.
0 Comments