SOX compliance shows up in a public company's annual report in four fixed places: the Section 302 certifications filed as Exhibit 31, management's Section 404 report on internal control in Item 9A, the auditor's Section 404(b) attestation next to the audit opinion, and the Section 906 statement furnished as Exhibit 32. Across the 819 roster 10-Ks whose filing index the record read, all 819 list an Exhibit 31 certification, 818 an Exhibit 32 statement, and 618 say on the cover that the auditor attested to internal control.

The Sarbanes-Oxley Act of 2002 is mostly about what happens inside a company: controls, audit committees, the auditor's independence. The 10-K is where it has to be shown. This guide maps each provision to its page, using 3M Company's 10-K for 2024 as the worked example, and counts how the roster's 10-Ks carry each piece. What each certification says, sentence by sentence, is in the guide to who signs the 10-K; this one is about where the pieces sit and what the filings show.

Four provisions, four places in the filing

The provisions that reach the annual report are written into three codes: the Act's own text in Title 15 and Title 18 of the U.S. Code, the SEC's rules in Title 17 of the Code of Federal Regulations, and the form itself.

Figure 1

Each Sarbanes-Oxley provision a 10-K carries, and where it is printed

  1. Cover page

    Section 404(b) check box

    Whether the auditor's attestation on internal control is filed. Tagged in XBRL as the ICFR Auditor Attestation Flag.

  2. Item 8

    Section 404(b): the auditor's attestation

    The registered firm's report on internal control, combined with or next to the audit opinion. Accelerated and large accelerated filers that are not emerging growth companies.

  3. Item 9A

    Section 404(a): management's report

    Regulation S-K Item 308(a): responsibility, framework, the effectiveness conclusion and any material weakness. Item 307's disclosure controls conclusion sits beside it.

  4. Exhibit 31

    Section 302: certifications

    Rule 13a-14(a). One for each principal executive and principal financial officer, filed with the report.

  5. Exhibit 32

    Section 906: statements

    18 U.S.C. 1350 and Rule 13a-14(b). Furnished with the report; one joint statement is allowed.

The four provisions in the order a reader meets them in 3M Company's 10-K for 2024, with the rule that puts each one there. Exhibit 97, the clawback policy, sits in the same exhibit list but comes from a later rule. Source: 15 U.S.C. 7241 and 7262; 18 U.S.C. 1350; Exchange Act Rules 13a-14 and 13a-15; Regulation S-K Item 308; Form 10-K, Items 8, 9A and 15 (govinfo.gov, sec.gov).

Section 302 is 15 U.S.C. 7241. It told the SEC to require "the principal executive officer or officers and the principal financial officer or officers" to certify each annual and quarterly report, and Rule 13a-14(a) does so: the certifications "must be filed as an exhibit to such report." Section 404 is 15 U.S.C. 7262. Subsection (a) requires an internal control report in each annual report; subsection (b) requires the auditor to "attest to, and report on, the assessment made by the management." Section 906 is 18 U.S.C. 1350, a criminal statute, which requires a written statement by "the chief executive officer and chief financial officer (or equivalent thereof)" to accompany each periodic report. Rule 13a-14(b) says that statement is "furnished as an exhibit."

Regulation S-K numbers the exhibits. In 3M's filing index for its 2024 10-K, filed February 5, 2025, they are the 7th through 10th documents: EX-31.1, EX-31.2, EX-32.1 and EX-32.2, one of each for the chief executive and the chief financial officer. A twelfth document, EX-97, is the company's recoupment policy, the clawback exhibit. It is not a Sarbanes-Oxley provision, but it sits in the same exhibit list, and it is counted below for that reason.

Section 302: Exhibit 31

The Section 302 certification is the longer of the two. In 3M's Exhibit 31.1 it runs to five numbered paragraphs, the third of which is the one most finance leaders can recite:

Figure 2: annotated excerpt

“Based on my knowledge1, the financial statements, and other financial information included in this report2, fairly present in all material respects3 the financial condition, results of operations and cash flows of the Registrant”
  1. 1The certification is personal. Rule 13a-14(c) says it may not be signed on the officer's behalf under a power of attorney.
  2. 2Not only the audited statements: the certification reaches the financial information in the whole 10-K, including management's discussion and analysis.
  3. 3The same standard the auditor's opinion uses, now stated by the officers.
Verbatim, from sec.gov.

Paragraphs 4 and 5 are the ones that connect Section 302 to the controls. In them the officers state that they are responsible for disclosure controls and internal control over financial reporting, that they evaluated the disclosure controls, and that they have told the auditors and the audit committee about "all significant deficiencies and material weaknesses" in internal control and about wrongdoing by anyone with a significant role in it. Rule 13a-14(a) lets a company that is not yet subject to the internal control rules omit the internal control language from paragraph 4, which is why a newly public company's certification can be shorter.

Each certifying officer signs an Exhibit 31 certification, usually filed as a document of its own. The record counts certifications, not documents: a document holds as many as it has opening sentences ("I, ..., certify that") or signature blocks, whichever is more. In the roster, 792 of the 819 10-Ks carry two or more Exhibit 31 certifications: 773 file them as two or more documents, and 19 file the officers' certifications together in one document. The other 27 carry a single certification, the form a filing takes when one person certifies in both capacities. A few carry many more: a 10-K filed jointly by a parent and its subsidiary registrants carries a set of certifications for each, and 8 roster 10-Ks carry 8 or more. The principal executive officer guide counts who signs them.

Section 404: Item 9A and the audit report

Section 404 has two halves, and they land in two places.

Management's report is in Item 9A, Controls and Procedures, which Form 10-K fills with "the information required by Item 307 and 308 of Regulation S-K." Item 308(a) sets out four things the report must contain: management's responsibility for internal control, the framework used to evaluate it, management's assessment of whether it is effective at year end, and, for accelerated and large accelerated filers, a statement that the auditor has issued an attestation report.

Figure 3: annotated excerpt

“Management is not permitted to conclude1 that the registrant's internal control over financial reporting is effective if there are one or more material weaknesses2 in the registrant's internal control over financial reporting”
  1. 1The one bright line in Item 308. A single material weakness means the conclusion must be that internal control is not effective.
  2. 2The weakness has to be disclosed too: the assessment "must include disclosure of any material weakness" identified by management.
Verbatim, from govinfo.gov.

3M's Item 9A follows the order of the rule. Paragraph a reports the disclosure controls evaluation under Item 307, made "with the participation of its management, including the Chief Executive Officer and Chief Financial Officer." Paragraph b is the Item 308(a) report: management's responsibility, the COSO 2013 framework, the conclusion that internal control "is effective," and the sentence that PricewaterhouseCoopers LLP has audited it. Rule 13a-15(c) is what makes the evaluation an annual duty; Rule 13a-15(b) makes the disclosure controls evaluation a quarterly one.

The auditor's half is the attestation report. Item 308(b) requires it in the annual report of an accelerated or large accelerated filer that is not an emerging growth company. Section 404(c) exempts the rest. 3M's auditor combined the two opinions in one report, on the financial statements and on internal control, which opens Item 8. The attestation sits with the financial statements, not in Item 9A.

The cover page states which case applies. A check box asks whether the registrant has filed the auditor's attestation "under Section 404(b) of the Sarbanes-Oxley Act," and the answer is tagged in the cover's XBRL as the ICFR Auditor Attestation Flag. Of the 812 roster 10-Ks whose cover the record read, 791 carry the flag: 618 answer yes and 173 no. The guide to what an auditor does breaks that down by filer category.

Section 906: Exhibit 32

The Section 906 statement is short, and it is the one with the criminal penalty attached. 18 U.S.C. 1350(c) provides fines of up to $1,000,000 and imprisonment of up to 10 years for an officer who certifies knowing the report does not comply, and up to $5,000,000 and 20 years for doing so willfully. 3M's Exhibit 32.1 is two numbered sentences:

Figure 4: annotated excerpt

“The Report fully complies1 with the requirements of Section 13(a) or 15(d) of the Securities Exchange Act of 1934; and 2. The information contained in the Report fairly presents, in all material respects2, the financial condition”
  1. 1The first statement 18 U.S.C. 1350(b) prescribes: compliance with the reporting sections of the Exchange Act.
  2. 2The second statement. Note what is missing: "cash flows" is in the Section 302 certification, not in the statute's Section 906 wording.
Verbatim, from sec.gov.

Rule 13a-14(b) says the requirement "may be satisfied by a single certification signed by an issuer's principal executive and principal financial officers." In the roster, 496 10-Ks list two or more Exhibit 32 documents and 322 list one. The rule's verb for Exhibit 32 is "furnished," where Exhibit 31 is "filed."

The signature page and the principal financial officer

The signature page is not a Sarbanes-Oxley provision. It comes from General Instruction D of Form 10-K, which requires the report to be signed on behalf of the registrant by its principal executive officer, principal financial officer, controller or principal accounting officer, and a majority of the board. The roster is built from it: each seat is the principal financial officer as that page prints the name and title.

The certifications and the signature page meet in the same person. The officer who signs as principal financial officer is the one who signs the second Exhibit 31 and, in 3M's filing, the second Exhibit 32. That is why a CFO change matters to the filing calendar. An incoming officer who joins weeks before a 10-K is due certifies a year of controls someone else ran, and an outgoing officer's Item 5.02 filing can tie the departure to the next periodic report, as CalciMedica, Inc.'s did in October 2026 (twenty Item 5.02 filings, annotated).

What the roster shows

The record read the filing index of the 10-K each roster seat cites, 819 of the 831 seats, and the XBRL cover page of 812.

Figure 5

All 819 roster 10-Ks read list a Section 302 certification exhibit; 98 list a clawback policy

All 819 roster 10-Ks read list a Section 302 certification exhibit; 98 list a clawback policy. Roster 10-Ks: Exhibit 31: Section 302 certifications: 819; Two or more Exhibit 31 certifications: 792; Exhibit 32: Section 906 statements: 818; Cover: auditor attested to internal control: 618; Exhibit 97: clawback policy: 98.Exhibit 31: Section 302 certifications819Two or more Exhibit 31 certifications792Exhibit 32: Section 906 statements818Cover: auditor attested to internal control618Exhibit 97: clawback policy98Roster 10-Ks
Roster 10-Ks whose filing index could be read, by the SOX-related items each carries: exhibit types from the filing index, Exhibit 31 certifications counted inside each document, and the attestation flag from the XBRL cover page. Source: CFO Tribune roster record (verified 10-K signature seats); the filing index, Exhibit 31 and 32 documents and XBRL cover page (R1.htm) of the 10-K each verified roster seat cites, read once each from sec.gov. As of November 11, 2026.

Three things stand out. Exhibit 31 is universal, as it should be: every one of the 819 indexes lists one, and only 1 lists no Exhibit 32. The attestation count follows filer status: 574 of the 579 large accelerated filers with a readable flag carry it, and 1 of the 111 non-accelerated filers does. And Exhibit 97, the clawback policy, is attached to 98 of the 819. That is a count of attachments, not of policies: the filing index lists only documents filed with this 10-K, and a policy filed with an earlier report and incorporated by reference does not appear in it. 3M shows the difference. Its 2024 10-K attached the recoupment policy as EX-97; the index of its 2025 10-K, filed February 3, 2026, lists no EX-97 document.

The roster's filing calendar shows when all of this is assembled.

Figure 6

449 of the roster's 10-Ks were filed in February 2026, in the weeks before the 60-day deadline

449 of the roster's 10-Ks were filed in February 2026, in the weeks before the 60-day deadline. Roster 10-Ks: Sep '25: Large accelerated filer 2, Accelerated filer 0, Non-accelerated filer 0, Category not established 0; Oct '25: Large accelerated filer 7, Accelerated filer 0, Non-accelerated filer 1, Category not established 0; Nov '25: Large accelerated filer 26, Accelerated filer 0, Non-accelerated filer 0, Category not established 3; Dec '25: Large accelerated filer 13, Accelerated filer 2, Non-accelerated filer 2, Category not established 2; Jan '26: Large accelerated filer 21, Accelerated filer 0, Non-accelerated filer 0, Category not established 1; Feb '26: Large accelerated filer 424, Accelerated filer 13, Non-accelerated filer 9, Category not established 3; Mar '26: Large accelerated filer 39, Accelerated filer 20, Non-accelerated filer 81, Category not established 37; Apr '26: Large accelerated filer 2, Accelerated filer 4, Non-accelerated filer 10, Category not established 13; May '26: Large accelerated filer 9, Accelerated filer 0, Non-accelerated filer 3, Category not established 0; Jun '26: Large accelerated filer 6, Accelerated filer 3, Non-accelerated filer 3, Category not established 1; Jul '26: Large accelerated filer 7, Accelerated filer 1, Non-accelerated filer 1, Category not established 2; Aug '26: Large accelerated filer 24, Accelerated filer 0, Non-accelerated filer 1, Category not established 0; Sep '26: Large accelerated filer 4, Accelerated filer 2, Non-accelerated filer 7, Category not established 5; Oct '26: Large accelerated filer 4, Accelerated filer 0, Non-accelerated filer 1, Category not established 0.Large accelerated filerAccelerated filerNon-accelerated filerCategory not established01252503755002Sep '258Oct '2529Nov '2519Dec '2522Jan '26449Feb '26177Mar '2629Apr '2612May '2613Jun '2611Jul '2625Aug '2618Sep '265Oct '26Month filedRoster 10-Ks
The 10-K each roster seat cites, by the month it was filed and the filer category EDGAR reports for the company. The category sets the deadline: 60, 75 or 90 days after fiscal year end. Source: CFO Tribune roster record (verified 10-K signature seats); filing date and category from the EDGAR submissions JSON (data.sec.gov), read once per company. As of November 11, 2026.

The deadlines sort the months. Large accelerated filers with December year ends file by early March; non-accelerated filers by the end of March; companies with other fiscal years spread across the rest of the calendar. 449 of the roster's 10-Ks were filed in February 2026.

What sits outside the filing

The 10-K shows the outputs of SOX compliance, not the work. Item 308 instruction 2 says the registrant "must maintain evidential matter, including documentation, to provide reasonable support for management's assessment," and none of that documentation is filed. Neither are the control descriptions, the testing, the deficiency logs, any internal sub-certifications from business unit controllers, or the audit committee minutes. What the reader of a 10-K sees is the conclusion: "effective" or "not effective," a material weakness described or none, an auditor's opinion or the exemption.

That conclusion is enough to compare companies. A 10-K that reports a material weakness, a cover that changes its attestation answer from one year to the next, or a certification signed by an interim officer are all visible on sec.gov the day the 10-K is filed.

Method

  • The roster. The record's 831 verified roster seats at November 11, 2026, each tied to a 10-K by the sec.gov link in its source.
  • Exhibits. The filing index of that 10-K, read once from sec.gov through the site's EDGAR client in November 2026. An exhibit is counted when the index lists a document of that type (EX-31.1, EX-32.2, EX-97 and so on). Exhibit 31 certifications are counted inside each document, as the larger of its opening sentences ("I, ..., certify that") and its /s/ signature blocks, and at least one, so a document that holds two officers' certifications counts as two.
  • Attestation. The "ICFR Auditor Attestation Flag" on the 10-K's XBRL cover page (R1.htm). A cover that could not be read, or carries no flag, is not counted either way.
  • Filing month and category. The filing date and the category field of EDGAR's submissions file, as read for the filer status guide.
  • Not counted. Item 9A's text was not read for each 10-K, so the count of management reports and of material weaknesses waits for a later pass.
  • Recomputing. scripts/articles/fetch-roster-exhibits.mjs reads the indexes and covers and saves what it read; node scripts/articles/compute.mjs --only sox writes every figure here.