SOX applies directly only to companies listed on a US exchange or registered with the SEC. It doesn't regulate private UK companies. But if you're a subsidiary of a US-listed parent, your numbers roll into their SOX-audited consolidated accounts, so your controls, including statement reconciliation, get tested as part of that audit.
For the full picture of what a reconciled, audit-ready process looks like day to day, see our guide to supplier statement reconciliation.
SOX doesn't regulate private UK companies directly. But if your numbers roll into a US-listed parent's accounts, your controls get tested anyway.
SOX comes up in UK finance conversations more often than the law itself would suggest, usually because someone, a US parent company, a PE investor, a prospective US customer doing due diligence, has asked whether the reconciliation process is "SOX-compliant." The honest answer starts with who SOX actually covers.
Who SOX actually applies to
SOX applies primarily to companies whose securities trade on a US exchange or that are registered with the SEC, including foreign private issuers with US-listed securities. A private UK company with no SEC registration sits outside that direct scope.
That's not the end of the story, though. Where a UK business is a subsidiary of a US-listed parent, its results are typically material to that parent's consolidated accounts, which brings it into scope indirectly. Section 404 of the Act requires the parent to assess internal controls for the entire consolidation, including all material subsidiaries, and the external auditor's attestation tests those controls directly rather than just reviewing management's own assessment. In practice, that means a UK subsidiary's statement reconciliation process can end up being tested as part of its US parent's annual SOX audit, even though the UK entity itself was never required to register with the SEC.
Why it matters even if you're not in scope
Plenty of UK finance teams that aren't SOX-scoped at all still get asked about it: ahead of a PE-backed exit, during due diligence from a US acquirer, or when a US-based customer's procurement team runs a supplier audit. ICAEW guidance on internal controls treats regular reconciliation as a core control regardless of which regulatory framework a business sits under, which is the more useful frame for most private UK companies: build the control discipline because it's good practice, and the SOX-readiness comes along with it if it's ever needed.
What an auditor actually looks for
A SOX-style review of a reconciliation process isn't checking whether the numbers are right on the day of the audit. It's checking whether the control operated consistently, every period, with evidence to prove it. That means:
- A complete record of who reconciled which supplier account, and when.
- Every discrepancy found, and how it was resolved.
- Sign-off at each period close, not just a reconciled total.
- No gaps where an account was skipped because of time pressure.
Manual spreadsheet reconciliation rarely produces this cleanly. Sheets get overwritten, versions multiply, and the evidence an auditor wants often has to be reconstructed from email threads after the fact.
Building the audit trail in from the start
Automated reconciliation generates this evidence as a by-product of running the process, rather than as separate documentation work. Every match, every exception and every sign-off is logged automatically with a timestamp and a user identity attached. Auditors get a complete, reviewable history without anyone building a reporting pack specifically for them.
Read-only auditor access
The other piece auditors typically ask for is direct access to the record, rather than a static export someone has prepared for them. Giving an external auditor read-only access to the reconciliation history, rather than a point-in-time spreadsheet extract, shortens the audit itself: they can see the full trail for any account they choose to sample, instead of asking the finance team to pull evidence for each one individually.
