SOX Compliance: What It Actually Involves
For US-listed companies with an India or UAE subsidiary, branch, GCC/GBS centre, or outsourced finance function, Sarbanes-Oxley compliance does not stop at the US parent's boundary — it extends into every location where financial data is processed, transactions are initiated, or controls are performed. At PNPC Global, we support the India and UAE side of SOX Section 302 and Section 404 programmes: documenting process narratives and control matrices, testing design and operating effectiveness of local controls, remediating deficiencies before they roll up into a parent-level material weakness, and coordinating directly with the US external auditor and the parent company's internal audit or SOX PMO team. We do not issue the SOX opinion — that responsibility sits with US management and the company's PCAOB-registered external auditor — but we are the on-the-ground CA team that makes the India/UAE component of that opinion defensible.
Understanding the Service
The Sarbanes-Oxley Act of 2002 (SOX) is a United States federal law enacted in response to the Enron and WorldCom accounting scandals, administered by the US Securities and Exchange Commission (SEC) with auditing standards set by the Public Company Accounting Oversight Board (PCAOB). It applies to companies that are required to file periodic reports with the SEC under the Securities Exchange Act of 1934 — principally companies listed on a US stock exchange (NYSE, Nasdaq) or otherwise SEC-registered, including foreign private issuers in many cases. Two provisions dominate the compliance workload: Section 302 requires the CEO and CFO to personally certify, in each quarterly (Form 10-Q) and annual (Form 10-K) filing, that they have reviewed the report, that it does not contain material misstatements, and that they have evaluated the effectiveness of the company's disclosure controls and procedures.
For the full scope, current process and what PNPC includes, see the dedicated SOX Compliance service page.
When You'd Need This
- You are the India or UAE subsidiary, branch, or GCC/GBS (Global Capability Centre) of a US-listed parent, and your location has been flagged as in-scope by the parent's SOX scoping exercise
- Your location processes financial transactions, maintains books of account, or operates IT systems that feed into the US parent's consolidated financial statements
- Your company is preparing for a US listing (IPO, direct listing, or de-SPAC transaction) and wants ICFR and control documentation in place well ahead of the first mandatory Section 404 assessment
- You are a portfolio company of a US private equity sponsor that requires SOX-readiness as part of pre-exit or pre-IPO governance discipline
Before You Assume You Need This
- You need the actual SOX 404 attestation opinion issued on your consolidated US financial statements — that requires a PCAOB-registered external auditor engaged directly by the US parent; PNPC supports the India/UAE control environment but does not issue the attestation opinion
- Your company is Indian or UAE-incorporated, has no US listing, no US SEC filing obligation, and no US-listed parent or PE sponsor requiring SOX-equivalent discipline — the relevant India framework is Internal Financial Controls (IFC) under Section 143(3)(i) of the Companies Act 2013, a related but separate and India-specific requirement
- You need a broad, entity-wide governance and enterprise risk review rather than a financial-reporting-controls-specific programme — our GRC Assurance engagement covers governance and risk management more broadly, of which SOX/ICFR testing is one component
Quick Answers
What is SOX compliance, in plain terms?
The Sarbanes-Oxley Act is a US federal law that requires companies listed on US stock exchanges (and other SEC-registered filers) to certify the accuracy of their financial reports and to assess — and in most cases have independently attested to — whether their internal controls over financial reporting actually work. Section 302 is the CEO/CFO's personal certification on each quarterly and annual filing. Section 404 is the broader annual assessment of internal control effectiveness, plus (for most larger filers) an independent auditor's attestation on that assessment.
Does SOX apply to my company if we are incorporated in India or the UAE and not listed in the US?
SOX itself is a US law and does not directly regulate an Indian or UAE company as such. However, SOX obligations flow down to you if you are a subsidiary, branch, or shared-service centre of a US-listed parent — because the parent's consolidated financial statements and its Section 404 assessment must cover controls at every significant location, wherever it is incorporated. If your India/UAE entity's transactions and account balances are material to the US parent's consolidated statements, your location is very likely in scope for the parent's SOX programme even though your entity itself files nothing with the SEC.
Does PNPC issue the SOX attestation opinion for our company?
No. The SOX Section 404(b) attestation opinion on internal control over financial reporting must be issued by a PCAOB-registered public accounting firm engaged directly by the US-listed parent, and the underlying management assertion is made by the parent's own CEO and CFO. PNPC's role is management-side support at the India/UAE location — documentation, self-testing, remediation, and coordination with whichever firm holds the actual attestation engagement. We are explicit about this boundary with every client so there is no ambiguity about what PNPC's engagement does and does not cover.
Where PNPC Fits In
Give your US parent's SOX PMO and external auditor an India/UAE control environment they can rely on without a scramble. Speak with a PNPC engagement partner — a practising Chartered Accountant who understands both the Indian/UAE operating reality on the ground and the documentation standard a PCAOB-registered auditor actually expects.
PNPC Global has advised Chennai, Bangalore and Hyderabad businesses since 1986. Explore the full Risk Advisory practice for related services, or go straight to the SOX Compliance page for specifics.
Specific rates, fees, thresholds and deadlines are set by the relevant authority and change over time — this article deliberately does not quote figures that could go stale. Confirm current numbers directly with PNPC or the official source before you act.