SOX Compliance Pulse — Issue #1: Section 302 Quarterly Certification Guide, May 2026

Q: What does SOX Section 302 actually require CEO and CFO to certify?

SOX Section 302 (15 U.S.C. § 7241) requires the CEO and CFO to personally attest that the periodic report fully complies with Exchange Act requirements and that the financial statements 'fairly present in all material respects the financial condition and results of operations of the issuer.' Beyond the numbers, this includes certification of: DC&P effectiveness as of the report date, ICFR effectiveness and accuracy, disclosure of any known material weaknesses (not just material ones to the financials), material changes in ICFR during the quarter, and any fraud involving management or those with significant roles in financial reporting.

Q: What are the most common ways certifying officers fail Section 302?

The five most common failure patterns are: (1) Rubber-stamp DC&P review — signing without documented evidence of actual MD&A, footnote, and subsequent-events review; (2) Undisclosed control deficiencies — failing to disclose known weaknesses because they were not 'material to the financials' — Section 302 requires disclosure of any weakness; (3) Missing subsequent-events review — not formally reviewing material events between filing date and sign-off date; (4) Inadequate audit committee communication — verbally communicating fraud or control issues but failing to document them formally; (5) Rushed Q2 close — shortening the certification window during July earnings season when PCAOB inspectors are specifically watching timing.

Q: When is the Q2 2026 10-Q filing deadline and who does it apply to?

For the June 30, 2026 fiscal quarter-end: accelerated filers, large accelerated filers, and EGCs must file by August 14, 2026. Non-accelerated filers have until August 29, 2026. The recommended Section 302/906 certification sign-off date is August 7, 2026. Companies should begin their DC&P review now — not at the financial close. With earnings season ending mid-July, the temptation to shorten the certification window is high. PCAOB inspectors look at the timing of sign-offs.

Q: What does PCAOB AS 1220 (Engagement Quality Review) mean for SOX filers in 2026?

AS 1220 is now in effect for engagements beginning after December 31, 2024. Auditors must document significant findings and conclusions for all audit engagements. If your external auditor has changed their approach to your 2025 audit — which most did due to this standard — that change directly affects your Section 404 assertion process. The auditor must now document more granular findings, which means more detailed requests to management and potentially longer audit committee discussions about control deficiency severity.

Q: Are cybersecurity incidents now a Section 302 certification obligation?

Yes. The SEC's cybersecurity disclosure rules (now fully effective) require material incidents to be disclosed on Form 8-K within 4 business days. Every time a reportable cybersecurity incident occurs, it creates a direct Section 302 certification obligation — the CEO and CFO must evaluate whether the incident affects DC&P effectiveness and whether any ICFR weaknesses emerged. This means the DC&P review process must now explicitly include a cybersecurity incident check as a standing agenda item.

Q: Why is Q2 2026 specifically a higher-risk period for SOX certifications?

Q2 is a high-stakes period because: (1) Q1 10-Q filings from May are already in the PCAOB's inspection selection pipeline — the next 6–8 weeks are when scrutiny builds; (2) The June 30 quarter-end means a compressed July earnings season followed by the August 14 filing deadline; (3) Companies that filed Q1 10-Q in May are already being flagged for review; (4) No new enforcement this week means the enforcement pipeline is lagging the filing calendar — which historically correlates with a spike in late summer. This is the window to self-correct before the next enforcement wave.

ComplianceStack; ComplianceStack

SOX Enforcement Watch

No New SEC/PCAOB Enforcement Actions — Week of May 19–26, 2026

Why This Matters

Q2 is a high-stakes period for SOX-certified officers. No new enforcement doesn't mean no risk — it means the enforcement pipeline is lagging behind the filing calendar. Companies that filed their Q1 10-Q in May are already in the PCAOB's crosshairs for inspection selection. The next 6–8 weeks are when scrutiny builds.

Context: SEC enforcement trend through 2025 showed increased focus on CEO/CFO certification accuracy, particularly around financial statement footnotes and MD&A disclosures. PCAOB 2025 inspection cycle flagged revenue recognition, management estimates, and audit committee communications as top deficiency areas — all directly relevant to Section 302 sign-off scope. Multiple SEC cases in prior quarters involved companies certifying "no known weaknesses" in DC&P when internal reviews had identified control deficiencies that were never remediated.

Q2 enforcement is a lagging indicator. The absence of new cases this week means the pipeline is filling. Your filing calendar is the risk clock — not the enforcement docket.

Controls Intelligence

Section 302 Deep Dive: What Quarterly Certification Actually Requires

Citation: 15 U.S.C. § 7241

Section 302 certification is the CEO/CFO's personal attestation that the periodic report fully complies with Exchange Act requirements and that the financial statements and disclosures "fairly present in all material respects the financial condition and results of operations of the issuer."

Most certifying officers believe they are signing off on the numbers. They are also signing off on:

Certification Element	What it means in practice
DC&P effectiveness	Disclosure controls and procedures were evaluated as of the report date — not just the financial close
ICFR effectiveness	Management's assessment of internal controls over financial reporting is current and accurate
Material weaknesses disclosed	Any known weakness must be disclosed — this is where certifying officers get into trouble
Changes in ICFR	Material changes to controls during the quarter must be described in the filing
Fraud disclosure	Any fraud involving management or those with significant roles in financial reporting must be reported to the audit committee and disclosed

Top 5 Section 302 Failure Patterns

Based on PCAOB inspection findings and SEC enforcement cases:

1

"Rubber-stamp" DC&P review

Certification signed without documented review of MD&A, footnotes, and subsequent events. Inspectors now look for evidence of actual review, not just a checklist. If your DC&P process produces no contemporaneous documentation, your certification has a gap.

2

Undisclosed control deficiencies

Known weaknesses identified during the quarter but not disclosed because they "weren't material to the financials." Section 302 requires disclosure of any weakness — not just material ones to the financial statements. A control deficiency that doesn't affect the numbers still needs to be in the filing.

3

Missing subsequent-events review

Certifying officers who don't formally review material events between filing date and sign-off date. The certification date and the events date matter — PCAOB inspectors check the gap between them. A two-week gap with no documented review is a deficiency in itself.

4

Inadequate audit committee communication

Fraud or control issues communicated verbally but not formally documented, leaving the CEO/CFO without a paper trail to show they met their obligations. If you told the audit committee about an issue verbally, get it in writing — memo, email, or board minutes with specific reference to the issue and the action taken.

5

Rushed Q2 close

With earnings season ending mid-July, the temptation to shorten the certification window is high. Don't. PCAOB inspectors look at the timing of sign-offs — a certification date that falls within 48 hours of the filing deadline draws scrutiny. Build the process lead time in now.

Q2 2026 Specific Alert

Action Item of the Week

Conduct a DC&P "Readiness Flash" Before Q2 Books Close

Most companies run their disclosure controls review after the financial close. Leading companies run a pre-close check 2–3 weeks before quarter-end to identify control gaps while there's still time to address them.

What to do this week:

Pull the DC&P checklist from your last 10-Q filing (Q1 2026, filed May 2026)

Review each control against current operations — new systems, headcount changes, new revenue streams, cybersecurity incidents since last filing

Identify any gaps with enough lead time to address them before management certifies on August 7 (recommended sign-off date)

Document your findings in a memo to the audit committee — contemporaneous evidence of review is Section 302's best defense

Need a shortcut? Run your SOX Pulse readiness check to get a Section 302 readiness score in 60 seconds — no login required → Get your personalized SOX readiness score at /sox-compliance-pulse

Regulatory Radar

Q2 2026 Filing Season — Upcoming Deadlines

Date	Who	What
June 30, 2026	All fiscal year-end June 30	Q2 Fiscal Quarter-End — begin DC&P pre-close review now
Week of July 14–18, 2026	All Q2 filers	Earnings season 8-Ks — financial results season begins
August 7, 2026	All certifying officers	Recommended Section 302/906 certification sign-off date — build in audit committee review time before this date
August 14, 2026	Accelerated / LAF / EGC filers	10-Q filing deadline — Q2 results. Section 302 certification required.
August 29, 2026	Non-accelerated filers	10-Q filing deadline — Q2 results. Section 302 certification required.

SEC Rulemaking Watch

Rule 10b5-1 amendments — Final rule expected 2026; affects insider trading plan disclosures, indirectly affects CFO/CAO workflow documentation. Review your existing 10b5-1 plans now — the new rules may require amendments.
Cybersecurity disclosure rules — Now fully effective; material incidents must be disclosed on Form 8-K within 4 business days. This creates a direct Section 302 certification obligation every time a reportable incident occurs — DC&P review must include cybersecurity as a standing item.
Climate disclosure rules — Pending litigation outcome; if finalized, would trigger new Section 302/404 assessments for large accelerated filers. Monitor as the courts rule.

PCAOB Standards Update — AS 1220

The Engagement Quality Review standard (AS 1220) is now in effect for engagements beginning after December 31, 2024. Auditors must document significant findings and conclusions for all audit engagements. If your external auditor has changed their approach to your 2025 audit, that change affects your Section 404 assertion process. Request a briefing from your audit firm on their new AS 1220 approach before the Q2 close.

AS 1220 is live. Cybersecurity incidents are a standing DC&P agenda item. The August 7 certification sign-off date is not a suggestion — it's the date your documentation must be complete. Start the DC&P review this week.

SOX Compliance Pulse — Issue #1: Section 302 Quarterly Certification Guide