Money & Finance › Fraud, scams & enforcement › Enron's accounting fraud (2001)
Sarbanes–Oxley Act (2002)
July 2002· Law or rule
Fact, law or dataA rule, statute, definition or measured number.
Passed in July 2002 after Enron and WorldCom, Sarbanes–Oxley made executives personally vouch for financial reports and put auditors under an inspector.
See it on the Money & Finance map →How it works
Named for Senator Paul Sarbanes and Representative Michael Oxley, it passed the Senate 99–0. CEOs and CFOs must certify each report; willfully false certification carries up to 20 years in prison. Section 404 requires companies to test their internal controls, with outside auditors attesting at larger firms. A new Public Company Accounting Oversight Board (PCAOB) registers and inspects audit firms, ending self-regulation. Auditors may no longer sell most consulting to clients they audit. Employees who report fraud gained legal protection.
Why it matters
It is a main reason US public-company numbers are trusted by default, and it raised the cost of being public, especially for small companies.
Facts, rules and data
The statute (Public Law 107-204), SEC and PCAOB rules and inspection reports, and studies of compliance costs and of restatements, which spiked as companies cleaned up their books, then fell.
Debates and risks
Economists disagree on how much fraud it prevented and whether its costs pushed companies to stay private or list abroad. Small companies were exempted from the outside audit of controls in 2010.
Connections (2)
▸Enron's accounting fraud (2001) led to Sarbanes–Oxley Act (2002)Fact, law or data
The connection
Enron showed executives could hide debt with help from an auditor that also earned consulting fees from them. WorldCom's roughly $11 billion fraud, exposed in mid-2002, removed resistance. Congress answered point by point: executive certifications, internal-control audits, an auditor regulator, limits on auditor consulting, and harsher penalties for destroying documents.
When and why
Washington, early 2002 to July 30, 2002, when President George W. Bush signed it.
How we know
Congressional hearings and committee reports explicitly cite Enron, Andersen's document shredding and WorldCom.
Debates and risks
How much Enron alone drove the law, versus WorldCom's collapse weeks before the vote, is debated.
▸Sarbanes–Oxley Act (2002) set audit rules overseen by Securities and Exchange Commission (SEC)Fact, law or data
The connection
The act put the new PCAOB under the SEC, which appoints its board and approves its rules and budget; the board inspects audit firms and sets auditing standards. The SEC also wrote the certification and internal-control rules companies follow.
When and why
The PCAOB began work in 2003; SEC rules for Section 404 were adopted in 2003 and phased in from 2004.
How we know
SEC releases approving PCAOB standards, and the Supreme Court's 2010 Free Enterprise Fund decision, which kept the board but let the SEC remove its members at will.
Debates and risks
Proposals to fold the PCAOB into the SEC resurfaced in Congress in 2025; whether that would weaken audit oversight is debated.