Certifications
Sarbanes-Oxley sections 302 and 906 certifications explained
Short answer
- Section 302 codified at
- 15 U.S.C. 7241 1
- Section 906 codified at
- 18 U.S.C. 1350 2
- Who signs
- Chief executive officer and chief financial officer, or officers with equivalent functions 1,2
- Reports covered by 302
- Each annual or quarterly report 1
- Maximum 906 penalty, knowing
- US$1,000,000 fine, 10 years in prison, or both 2
- Maximum 906 penalty, willful
- US$5,000,000 fine, 20 years in prison, or both 2
- Section 906 enacted
- 30 July 2002, Pub. L. 107-204 2
Two certifications, two statutes
The Sarbanes-Oxley Act of 2002 created two separate certification duties. Section 302 is codified at 15 U.S.C. 7241. It told the Securities and Exchange Commission to write rules requiring the principal executive officer and principal financial officer, or people performing similar functions, to certify each annual or quarterly report 1. The SEC rules had to take effect no later than 30 days after 30 July 2002 1.
Section 906 is codified in the criminal code at 18 U.S.C. 1350. It requires every periodic report containing financial statements filed under section 13(a) or 15(d) of the Securities Exchange Act to be accompanied by a written statement by the chief executive officer and chief financial officer 2. Section 906 was added by Pub. L. 107-204 on 30 July 2002 2.
What a section 302 certificate says
Under section 302 the signing officers certify six groups of matters 1. The list below follows the statute.
- The signing officer has reviewed the report 1.
- Based on the officer's knowledge, the report contains no untrue statement of a material fact and omits no material fact needed to make the statements not misleading 1.
- Based on the officer's knowledge, the financial statements and other financial information fairly present the financial condition and results of operations in all material respects 1.
- The signing officers are responsible for internal controls, designed them so that material information reaches them, evaluated them within 90 days before the report and presented their conclusions in the report 1.
- They have disclosed to the auditors and the audit committee all significant deficiencies and material weaknesses in internal controls, and any fraud, material or not, involving management or other employees with a significant role in internal controls 1.
- The report states whether there were significant changes in internal controls after the evaluation, including corrective actions 1.
What a section 906 statement says
The section 906 statement is shorter. It certifies that the periodic report fully complies with section 13(a) or 15(d) of the Exchange Act. It further certifies that the information in the report fairly presents, in all material respects, the financial condition and results of operations of the issuer 2.
The difference matters for what a signature attests to. A 302 certificate covers the officer's own review, knowledge and work on internal controls 1. A 906 statement is a direct statement about the report itself and is backed by criminal penalties written into the same section 2.
Penalties under section 906
Section 906 sets two levels of criminal penalty for a person who certifies a statement knowing that the periodic report does not comply with the section 2.
Moving offshore does not remove the duty
Section 302 says that an issuer cannot lessen the legal force of the certifications by reincorporating or moving its domicile or offices from inside the United States to outside it 1.
Equivalent rules outside the United States
Canada has its own certification rule. National Instrument 52-109 requires each chief executive officer and chief financial officer of a reporting issuer to file a separate signed certificate with annual and interim filings 3. Non-venture issuers use Form 52-109F1 for annual filings and Form 52-109F2 for interim filings. Venture issuers use Forms 52-109FV1 and 52-109FV2, or may file the non-venture forms instead 3. Non-venture issuers must establish and maintain disclosure controls and procedures and internal control over financial reporting 3.
In the European Union the Transparency Directive takes a different route. Instead of a named CEO and CFO certificate, the annual financial report must include statements by the persons responsible within the issuer, with their names and functions, that the financial statements give a true and fair view and that the management report includes a fair review 4. The Certifications directory on this site compares these rules side by side.
Common questions
Who signs a Sarbanes-Oxley certification?
The chief executive officer and chief financial officer, or the officers who perform equivalent functions, sign both the section 302 certificate and the section 906 statement 1,2.
What is the difference between SOX 302 and SOX 906?
Section 302 is an SEC rule-based certificate covering review, accuracy, fair presentation and internal controls 1. Section 906 is a criminal statute requiring a written statement that the report complies with the Exchange Act and fairly presents the financial condition, with fines and prison terms for false certification 2.
What is the penalty for a false SOX 906 certification?
Up to US$1,000,000 and 10 years in prison for a knowing false certification, and up to US$5,000,000 and 20 years for a willful one 2.
Does Canada require CEO and CFO certification?
Yes. National Instrument 52-109 requires each chief executive officer and chief financial officer to file a separate signed certificate with annual and interim filings 3.
Do EU listed companies sign SOX-style certificates?
No single CEO and CFO certificate is required by the Transparency Directive. The annual financial report must include responsibility statements by the persons responsible within the issuer, with their names and functions 4.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@whosignedwhat.com.
Sources
- Legal Information Institute: 15 U.S. Code 7241, Corporate responsibility for financial reports
- Legal Information Institute: 18 U.S. Code 1350, Failure of corporate officers to certify financial reports
- Ontario Securities Commission: Unofficial Consolidation, National Instrument 52-109 Certification of Disclosure in Issuers' Annual and Interim Filings
- EUR-Lex: Directive 2004/109/EC on the harmonisation of transparency requirements (15 December 2004)
Related
- What a signature attests to
A signature can mean agreement, authentication, certification of accuracy or a decision. How laws in the US, EU, UK and at the UN define each meaning.
- Signatory, witness and decision-maker explained
The difference between the person who signs a document, the witness who attests the signature and the body that made the decision, with sourced examples.
- Company signing authority compared
Who may sign documents for a company under the UK Companies Act 2006 sections 43 and 44 and Delaware corporate law, and what a buyer may assume.
- Notarisation and the apostille explained
What an apostille certifies under the 1961 Hague Convention, how it differs from legalisation and notarisation, and how the UK and US issue them.