Contrary to popular impression, SOX did not mandate any particular change in companies’
control systems. In 1977, the Foreign Corrupt Practices Act required public companies to have an
IC system that would provide ‘‘reasonable assurances’’ that ‘‘transactions are recorded as necessary
to permit preparation of financial statements in conformity’’ with GAAP, and nothing in SOX
changed this requirement. Even after SOX, a public company can, if it chooses, adopt any IC
system it believes meets that requirement—even one with what its auditors believe are significant
weaknesses.