Which of the following is a requirement of the Sarbanes-Oxley Act?

• A. Internal audit reports must be published
• B. All employees must certify their financial statements
• C. Senior management must file a code of ethics with the SEC
• D. Audits are optional for small firms

Answer: (C)

Sarbanes-Oxley requires that publicly traded companies establish a code of ethics specifically for senior financial officers and disclose it to investors, typically by filing it with the SEC or including it in the annual report. This provision aims to strengthen ethical standards and accountability in financial reporting at the top levels of leadership. That’s why this option is the best fit: it directly reflects the mandated ethics framework for those most responsible for the company’s financial statements.

Other statements aren’t aligned with SOX. For example, the act does not require internal audit reports to be published publicly, nor does it mandate that every employee certify financial statements—the certifications are required from the CEO and CFO (senior management) specifically. Audits are not optional for small firms; publicly traded companies must undergo independent audits, with certain phased or scaled requirements not making audits optional.