Sarbanes-Oxley Rebuilt Corporate Trust After Enron

President Bush signed the Sarbanes-Oxley Act into law on July 30, 2002, less than a month after telecommunications giant WorldCom disclosed it had improperly capitalized $3.8 billion in ordinary operating expenses as long-term investments — a fraud eventually found to total roughly $11 billion once the full accounting was completed — following Enron's collapse into bankruptcy the previous December after its extensive use of off-balance-sheet partnerships to hide billions in debt came fully to light.

Section 302 of the new law required chief executives and chief financial officers to personally certify the accuracy of their company's financial statements each quarter; Section 404 required companies to document and rigorously test internal financial controls, with an independent outside auditor separately attesting to that documentation's adequacy. Accounting oversight, previously treated largely as a staff-level function, became something top officers now signed their names to under explicit criminal liability for knowing misstatements.

The Public Company Accounting Oversight Board, created by the same legislation, began inspecting audit firms directly for the first time — a direct response to Arthur Andersen's collapse after its Enron audit work led to an obstruction-of-justice conviction in 2002 that was later overturned on appeal by the Supreme Court in 2005, though only after the firm, once one of the 'Big Five' accounting firms, had already ceased operating entirely and laid off tens of thousands of employees.

Compliance officers, internal auditors, and the surviving 'Big Four' accounting firms gained substantial new billable work and organizational influence within corporations. Smaller public companies and prospective IPO candidates absorbed real costs from the new requirements — studies conducted in the years after passage estimated that Section 404 compliance alone could run into several million dollars annually for a mid-sized public company, a burden Congress later eased somewhat for smaller issuers through the 2012 JOBS Act's scaled-disclosure provisions.

Business press coverage in 2002 dwelled heavily on compliance costs and warnings that IPO activity would migrate to London or Hong Kong exchanges specifically to avoid the new certification burdens. That critique substantially understated how thoroughly the law's certification model — a named, identifiable executive personally attesting to internal controls under legal risk — would become a template that other jurisdictions and other domains of corporate governance would later copy wholesale.

The European Union's own statutory audit reforms adopted over the following decade, Japan's so-called J-SOX law enacted in 2006, and even modern cybersecurity-disclosure rules adopted by the SEC in 2023 requiring named executives to attest to material-incident reporting timelines all borrow Sarbanes-Oxley's core idea directly: institutional trust is maintained through documented, testable controls and identifiable signatories, not through narrative reassurance from a company's leadership.

The Sarbanes-Oxley Act, signed in July 2002 after Enron and WorldCom collapsed, imposed CEO/CFO certification of financial statements, created the Public Company Accounting Oversight Board, and tightened auditor independence rules. Compliance costs became a standing line item for public companies, especially Section 404 internal-control attestations that smaller issuers argued were disproportionate.

The law's deeper effect was cultural: financial reporting shifted from a behind-the-scenes craft to a personally signed risk for executives. Restatements, whistleblower channels, and audit-committee scrutiny intensified. Later crises showed SOX was not a vaccine against fraud, but it raised the default cost of casual accounting fiction in U.S. public markets.

Section 404 internal-control attestation forced companies to map processes auditors could test — expensive for mid-caps, transformative for how CFOs talked about risk. Audit committees gained statutory muscle; auditors faced limits on consulting work that had compromised independence at Arthur Andersen's Enron engagement.

Foreign private issuers debated delisting from U.S. exchanges to avoid SOX costs, a reminder that regulation is also a competitive parameter among capital markets. The law did not prevent 2008's credit crisis — different failure mode — but it raised the personal legal temperature around signed financial statements.

Compliance software and Big Four advisory lines boomed because the law turned internal control into a billable surface. Critics called it costly theater; defenders called theater the point — a ritual that raises the personal cost of signed falsehoods. Markets still price U.S. listings partly on that ritual’s credibility.

Every annual report that now carries a CEO and CFO certification of its own financial accuracy is operating inside a legal structure built in the roughly six weeks between WorldCom's fraud becoming public and the bill reaching the president's desk — a rare case of financial scandal producing durable, specific, still-functioning law rather than a temporary regulatory crackdown that fades within a few budget cycles.

Century Signals note: Sarbanes-Oxley Act text; PCAOB founding materials; contemporaneous CFO/compliance trade coverage; Enron/WorldCom investigation reporting. Editorial judgment about what still structures the present — not a comprehensive history.