The Q2 2026 Form 10-Q is due August 11 for large accelerated filers and accelerated filers. August 14 for non-accelerated filers. Today is July 27. Fifteen days remain.
The SOX Section 302 certification is the document a CFO signs to personally attest that the filing does not contain material misstatements or omissions, that the financial statements fairly present the company's financial condition and results, and that disclosure controls and procedures are effective. It is not a formality. SEC Rules 13a-14 and 15d-14 require it for every periodic report, and the consequences of signing an inaccurate certification are personal: Section 302 violations carry criminal penalties of up to $1 million and 10 years imprisonment for knowing violations, and up to $5 million and 20 years for wilful violations.
The Q2 2026 10-Q carries more simultaneous new disclosure obligations than any recent quarter. The Iran war ceasefire collapse on July 8, the OBBBA's first full quarter affecting the income tax provision, tariff costs requiring quantification in MD&A, the Fed rate hike probability reaching 68.8%, the California SB 253 deadline on November 10, and SEC Chair Atkins's July 9 speech on disclosure materiality all create verification obligations that were not present in prior quarters.
This post covers what the SOX 302 certification actually requires, why Q2 2026 carries unusual certification risk, and the seven specific verifications every CFO should complete before signing.
What Does the SOX Section 302 Certification Actually Require the CFO to Confirm?
Section 302 of the Sarbanes-Oxley Act of 2002, implemented through SEC Rules 13a-14 and 15d-14, requires the principal executive officer and principal financial officer of every public reporting company to certify each periodic report filed with the SEC.
The certification requires the certifying officer to confirm six specific matters, each of which creates a verification obligation.
First: the certifying officer has reviewed the report. This is the baseline obligation. A CFO who signs without actually reading the filing in its final form has violated the certification regardless of the filing's accuracy.
Second: based on the officer's knowledge, the report does not contain any untrue statement of material fact or omit to state a material fact necessary to make the statements made not misleading. This is the materiality standard. The word knowledge limits the obligation to what the officer actually knew or should have known, but it is a demanding standard for an officer whose role encompasses oversight of all material financial and business developments.
Third: based on the officer's knowledge, the financial statements and other financial information in the report fairly present in all material respects the financial condition, results of operations, and cash flows of the company. This covers every footnote, every line item in every financial statement, and every quantification in MD&A.
Fourth: the certifying officers are responsible for establishing and maintaining disclosure controls and procedures and have designed them to ensure that material information is made known to them. This is the disclosure controls design obligation.
Fifth: the certifying officers have disclosed to the audit committee and external auditors all significant deficiencies and material weaknesses in internal controls, and any fraud that involves management or other employees with a significant role in internal controls.
Sixth: the certifying officers have indicated whether there were any significant changes in internal controls since the last evaluation, including any corrective actions taken. For Q2 2026, any internal control changes related to the OBBBA tax provision, new AI-assisted workflows, or the addition of new disclosure processes for SB 253 must be addressed.
Why the Q2 2026 10-Q Carries Unusually High 302 Certification Risk
The 302 certification risk in any given quarter is a function of two variables: the volume of new or changed material facts that the certification must accurately represent, and the quality of the disclosure controls that captured and processed those facts before the filing was prepared.
Q2 2026 has the highest volume of simultaneously new material developments of any recent quarter. The specific developments that create certification risk are those where the required disclosure is new, where the accounting or legal standard was recently changed, or where the SEC's expectations for specificity and quantification are more demanding than prior practice.
Seven developments in Q2 2026 fall into one or more of these categories. Each is covered in a dedicated verification section below. The summary of why each creates elevated certification risk:
The Iran ceasefire collapse on July 8 is a subsequent event to the June 30 balance sheet date that may require disclosure and may affect multiple financial statement line items (impairment assessments, fair value inputs, oil price-sensitive cost disclosures). Companies that did not have a disclosure control process specifically designed to capture post-quarter geopolitical developments risk certifying a filing that omits material subsequent events.
The OBBBA's first full quarter creates ASC 740 provision complexity that is new for every CFO and tax director. The OBBBA's Section 174A, Section 163(j) EBITDA restoration, 100% bonus depreciation, and NCTI changes all affect the Q2 provision. Errors in the provision, the valuation allowance, or the rate reconciliation flow directly into the financial statements the CFO is certifying.
The tariff disclosure standard, confirmed by the SEC's comment letter practice and by OCA statements at SEC Speaks 2026, requires company-specific quantification of tariff impacts, not generic risk factor language. A CFO who certifies a Q2 filing with generic tariff language risks both a comment letter and a 302 certification that did not satisfy the materiality standard.
The Fed rate environment shifted materially on July 8. The 10-year Treasury yield reached 4.57% (up 19 basis points in a single session) and September rate hike probability reached 68.8%. These are known trends that must be assessed for Item 303 disclosure if material to the company's interest rate exposure.
California SB 253 has a November 10, 2026 GHG reporting deadline. While the filing itself is not part of the 10-Q, any sustainability disclosures in the 10-Q that are inconsistent with the data being prepared for the SB 253 filing create a disclosure consistency risk.
SEC Chair Atkins's July 9 materiality speech specifically stated that companies must take responsibility for removing non-material boilerplate from their filings. A CFO who certifies a Q2 10-Q loaded with outdated, non-material risk factors and generic MD&A language is certifying a filing that the SEC Chairman has explicitly identified as inconsistent with his disclosure reform agenda.
New Q2-related internal control considerations: any new AI-assisted workflow added to the reporting process, any new control over OBBBA-related tax positions, and any new stablecoin or crypto treasury holdings (following the Peirce statement on July 22) may represent changes to ICFR that must be evaluated and disclosed under Certification Element 6.
Verification #1: Did Your Disclosure Controls Capture All Material Iran War Developments Through July 8?
The Iran ceasefire collapse on July 8, 2026 is the most operationally complex disclosure control question in the Q2 2026 filing. The event occurred eight days after the June 30 balance sheet date, meaning it is a subsequent event rather than a Q2 period event. But subsequent events that are material must be captured and disclosed, and the disclosure control system that was designed for routine quarterly reporting may not have been specifically designed to capture breaking geopolitical developments in the final days before a 10-Q filing.
The SOX 302 Certification Element 4 requires the CFO to confirm that disclosure controls are designed to ensure material information is made known to the certifying officers. If a material subsequent event occurred after June 30 and before the filing date, the disclosure control system must have captured it and routed it for disclosure committee review and disclosure decision.
The specific verification: did the disclosure committee specifically review the July 8 ceasefire collapse, the resulting oil price spike to approximately $75-78 per barrel WTI, the 10-year Treasury yield movement to 4.57%, the IMO's recommendation to halt Strait of Hormuz transit, and the revocation of Iran's oil sanctions waiver? For each of those developments, was a materiality assessment made and documented? Were the relevant financial statement footnotes (subsequent events, going concern, fair value measurements) updated to reflect the conclusion of that assessment?
The blogs from this cluster that address the substance of these disclosures provide the detailed analysis. For the 302 certification specifically, the relevant question is process: can the CFO confirm that the disclosure controls produced a documented, reviewed, and signed-off materiality assessment for each of these developments before signing the certification?
Verification #2: Are Your OBBBA Tax Provisions Reflected Correctly in the ASC 740 Footnote You Are Certifying?
The OBBBA's provisions took effect January 1, 2026, but Q2 2026 is the first full half-year for which the provision must be finalised and certified. The specific OBBBA changes that affect the Q2 ASC 740 footnote are: Section 174A domestic R&E immediate expensing, 100% bonus depreciation on qualifying assets, Section 163(j) EBITDA restoration for interest expense deductibility, NCTI replacing GILTI, CAMT interaction with the new bonus depreciation schedules, and Section 162(m) expanded aggregation rules.
The ASC 740 valuation allowance blog from this cluster covers the seven red flags auditors are focusing on in Q3 2026 related to OBBBA-affected provisions. For the 302 certification, the CFO's verification obligation is different from the auditor's: the CFO must confirm, based on personal knowledge, that the provision memos, reversing DTL schedules, and disclosure footnotes in the Q2 10-Q accurately reflect the OBBBA positions the company has taken.
The specific questions the CFO should be able to answer before certifying: has the reversing DTL schedule been updated for all OBBBA changes? Has the valuation allowance assessment been reassessed in light of those changes? Does the effective tax rate reconciliation in the 10-Q footnote include all material OBBBA-driven items as separate reconciling items? Has the CAMT DTA been assessed separately from the regular income tax DTA?
If the CFO cannot answer any of these questions because the provision work is not complete, the filing should not be signed until the work is done. Certifying a provision that has not been verified is certifying an unknown.
Verification #3: Does Your MD&A Tariff Disclosure Meet the SEC's Quantification Standard, or Will It Draw a Comment Letter?
The OCA confirmation at SEC Speaks 2026 that tariff costs must be separately quantified in MD&A, and that tariff costs should not be excluded from non-GAAP measures as non-recurring items, creates a specific certification risk for companies with material tariff exposure.
A CFO who certifies an MD&A that describes tariff impacts generically, without separately attributing the dollar or basis-point impact of tariff costs to the relevant line items, is certifying a disclosure that is likely to draw an SEC comment letter and that may fail the materiality standard for this specific company's situation.
The SEC comment letter trends 2026 blog in this cluster describes exactly what generic tariff language looks like and what the SEC staff expects instead. For the 302 certification, the CFO should be able to confirm: does the Q2 MD&A results of operations discussion separately quantify the contribution of tariff costs to the period-over-period change in cost of goods sold, gross margin, or other material affected line items? Is that quantification based on actual tariff cost data from the company's supply chain and sourcing records, not on an estimate or prior-period assumption?
The Iran war's interaction with tariff costs is particularly relevant for Q2: fuel and logistics costs increased during the Iran conflict, and for some companies those cost increases overlap with or are amplified by tariff-driven cost increases. If both are material drivers of Q2 margin performance, both must be separately attributed in MD&A.
Verification #4: Have You Updated the Fed Rate Environment Disclosure to Reflect the 69% Hike Probability?
On July 8, 2026, the market-implied probability of a Federal Reserve rate hike by September 2026 rose to 68.8% per the CME FedWatch Tool. The 10-year Treasury yield rose to 4.57%, up 19 basis points in a single session. Both of these are material changes in the interest rate environment from what was priced in at June 30.
The ASC 820 fair value blog in this cluster explains why the June 30 rate environment (approximately 4.38% 10-year Treasury yield) is what applies to the balance sheet measurements in the Q2 financial statements. But the Item 305 market risk quantitative disclosure, the Item 303 known trends discussion of interest rate exposure, and the subsequent event assessment under ASC 855 must each address the post-June 30 rate movement.
For the 302 certification, the CFO's verification: does the Q2 10-Q's market risk section (Item 305) include a rate sensitivity scenario that reflects the current rate environment? Has the MD&A known trends section been assessed for material interest rate exposure that would be affected if the September hike occurs? Has the July 8 rate movement been evaluated as a subsequent event and, where material, disclosed?
The certifying officer must confirm, based on personal knowledge, that the interest rate disclosures in the Q2 10-Q reflect the rate environment as of both the balance sheet date and the filing date, with the distinction between the two clearly drawn.
Verification #5: Did California SB 253 (November 10) Affect Any Sustainability Disclosures in the 10-Q?
California SB 253 requires covered companies (US-based entities with over $1 billion in global revenue doing business in California) to report Scope 1 and Scope 2 GHG emissions by November 10, 2026. The SB 253 GHG report blog in this cluster covers the mechanics.
The direct connection to the SOX 302 certification is this: if the Q2 10-Q contains any sustainability-related disclosures, including human capital disclosures, environmental risk factors, or carbon footprint references, those disclosures must be consistent with the GHG data the company is preparing for the November 10 SB 253 filing.
A CFO who certifies a Q2 10-Q that describes the company's environmental commitments or GHG reduction progress in a way that is inconsistent with the underlying GHG data being prepared for CARB is certifying a potentially misleading disclosure. The SEC comment letter practice on ESG disclosures is increasingly focused on consistency between different disclosure vehicles: SEC filings, sustainability reports, and regulatory filings must not contain inconsistent characterisations of the same underlying facts.
The specific verification: if the Q2 10-Q contains any sustainability-related content, has the disclosure committee reviewed that content against the GHG data currently being compiled for SB 253? Are there any inconsistencies that must be resolved before the 10-Q is filed?
For companies with no sustainability disclosures in their Q2 10-Q, this verification is a one-line confirmation that no such disclosures exist, documented in the disclosure committee minutes.
Verification #6: Is Your ICFR Assessment Current for the New Risk Areas Introduced in Q2 2026?
SOX 302 Certification Element 5 requires the certifying officers to confirm they have disclosed to the audit committee and external auditors all significant deficiencies and material weaknesses in internal controls. Certification Element 6 requires identification of any significant changes in ICFR since the last evaluation.
Q2 2026 introduced several new risk areas that may have changed the company's ICFR profile without those changes having been formally assessed.
The OBBBA created new tax positions and calculation methodologies. Has the company identified the controls over those new positions and tested them, or at least documented that existing controls over the income tax provision cover the new OBBBA-related calculations?
The Peirce statement on crypto vault products (July 22) may be relevant if the company holds yield-bearing stablecoin products in its treasury. Have the controls over the classification and measurement of those treasury positions been assessed in light of the Peirce statement's regulatory uncertainty?
Any new AI-assisted workflows introduced in Q2 for close processes, disclosure preparation, or financial reporting must be evaluated for ICFR relevance. Under the PCAOB inspection framework (addressed in the PCAOB blog in this cluster), auditors are specifically assessing whether auditor use of AI is adequately supervised and documented. The same question applies to company use of AI in its financial reporting process: is there a control over the AI output that ensures it is reviewed by a qualified professional before it enters the financial statements?
Any control weaknesses identified during the Q2 external auditor review that have not been formally assessed for severity (deficiency, significant deficiency, or material weakness) must be assessed before the certification is signed, because the certification requires disclosure of all significant deficiencies and material weaknesses.
Verification #7: Did You Review the SEC Chair's July 9 Materiality Speech and Remove Any Non-Material Boilerplate?
SEC Chair Atkins's July 9 speech at the Society for Corporate Governance Conference in Nashville specifically stated that companies must take ownership of the clarity, volume, and usefulness of their disclosures, including by removing outdated, non-material information. He warned of a "disclosure death spiral" in which unnecessary disclosure continually expands because no one is willing to remove outdated information.
The materiality standard Atkins invoked, the TSC Industries v. Northway test, is the same standard that underlies the SOX 302 certification's "no material misstatement or omission" requirement. If a disclosure is not material under TSC Industries (it would not be considered important by a reasonable investor in making an investment decision), it has no place in the filing under Atkins's standard.
This creates a specific pre-certification action: the disclosure committee should review the Q2 10-Q against a materiality filter. For each risk factor and each section of the MD&A, the question should be: does this disclose material information specific to this company, or is it generic language that could apply to any company in any industry?
Risk factors that were added in response to a prior-year SEC comment or regulatory trend but that no longer reflect material risks to this company should be removed or substantially revised. MD&A language that describes generic macro conditions without connecting them to this company's specific Q2 experience should be replaced with company-specific, quantified analysis.
Atkins specifically confirmed at the SCG conference: "The issuer remains responsible for the information it puts out." The 302 certification is the legal mechanism through which the CFO personally accepts that responsibility.
The 10 Questions to Ask Your Disclosure Committee Before You Sign
These ten questions should be put to the disclosure committee, with documented responses in the committee minutes, before the SOX 302 certification is executed.
One: has the disclosure committee reviewed the final, filed version of the Q2 10-Q (not the penultimate draft) and confirmed it is complete and accurate?
Two: has a written materiality assessment been completed for every material development that occurred between June 30 and the filing date, specifically including the July 8 Iran ceasefire collapse, the July 8 Treasury yield movement, and the July 22 SEC Commissioner Peirce statement on crypto vaults?
Three: has the OBBBA tax provision been reviewed and signed off by the tax director and, where applicable, the company's outside tax advisor? Does the sign-off specifically confirm the Section 174A, Section 163(j), 100% bonus depreciation, NCTI, and CAMT positions are correctly reflected?
Four: has the MD&A tariff disclosure been reviewed against the OCA quantification standard from SEC Speaks 2026? Can we separately quantify the tariff impact on each material affected line item?
Five: has every risk factor been reviewed against the TSC Industries materiality standard? Has any risk factor that does not satisfy that standard been revised or removed?
Six: has the ICFR assessment been updated for all Q2 control changes, including any new AI-assisted workflows, new crypto treasury controls, and new OBBBA-related tax provision controls?
Seven: have all significant deficiencies and material weaknesses identified during the Q2 audit review been communicated to the audit committee and external auditors?
Eight: are the sustainability-related disclosures in the Q2 10-Q consistent with the GHG data being compiled for the November 10 SB 253 CARB filing?
Nine: has outside securities counsel reviewed any new or materially revised disclosures in the Q2 10-Q, specifically including the Iran war geopolitical risk disclosures, the OBBBA tax footnote, and any new cryptocurrency or stablecoin treasury disclosures?
Ten: has the CFO personally read, in its complete and final form, the version of the Q2 10-Q that will be filed?
Frequently Asked Questions
What does the SOX 302 certification require a CFO to personally confirm?
SOX Section 302, implemented through SEC Rules 13a-14 and 15d-14, requires the CFO to certify six things: that they have reviewed the report; that based on their knowledge it contains no material misstatements or omissions; that based on their knowledge the financial statements fairly present the company's financial condition and results; that they have established and designed disclosure controls and procedures to capture material information; that they have disclosed all significant deficiencies and material weaknesses to the audit committee; and that they have identified any significant changes in ICFR since the last evaluation.
What is the personal liability exposure for a CFO who certifies an inaccurate Q2 10-Q?
Section 302 violations carry criminal penalties of up to $1 million and 10 years imprisonment for knowing violations, and up to $5 million and 20 years for wilful violations, under Section 906 of Sarbanes-Oxley. Civil liability under Section 10(b) and Rule 10b-5 of the Exchange Act applies for material misstatements or omissions in a certified filing. The personal liability is the CFO's, not the company's alone.
When is the Q2 2026 10-Q deadline for large accelerated filers?
August 11, 2026 for large accelerated filers and accelerated filers. August 14, 2026 for non-accelerated filers.
What new Q2 2026 disclosures create the most 302 certification risk?
The highest-risk new disclosure areas are: the Iran war ceasefire collapse on July 8 as a subsequent event, the OBBBA income tax provision for the first full half-year, the SEC's tariff quantification standard for MD&A, the July 8 Treasury yield movement and its effect on interest rate disclosures, and any sustainability disclosures that must be consistent with SB 253 GHG data. Each of these requires a specific verification before the certification is signed.
What is the difference between SOX 302 and SOX 404 certification obligations?
SOX Section 302 requires quarterly certification by the certifying officers that the periodic report does not contain material misstatements, that the financial statements fairly present results, and that disclosure controls and ICFR are maintained. SOX Section 404(a) requires annual management assessment of the effectiveness of ICFR, and 404(b) requires external auditor attestation on that assessment for large accelerated filers. The 302 certification is required every quarter. The 404 assessment is annual. For Q2 quarterly reports, the Section 302 certification is required; Section 404 is evaluated at year-end.
Key Takeaways
- The Q2 2026 Form 10-Q is due August 11 for large accelerated and accelerated filers, August 14 for non-accelerated filers. The SOX 302 certification personally attests that the filing contains no material misstatements, the financial statements fairly present results, and disclosure controls are effective.
- Q2 2026 carries the highest volume of simultaneously new and complex disclosure obligations of any recent quarter: the Iran war ceasefire collapse on July 8 (subsequent event), OBBBA first full half-year income tax provision, tariff quantification required in MD&A, Fed rate hike probability reaching 68.8%, SB 253 GHG data consistency, and the SEC Chair's materiality speech affecting the boilerplate review.
- The seven verifications every CFO should complete before signing: (1) Iran war subsequent events assessment documented and signed off; (2) OBBBA ASC 740 provision reviewed and confirmed by tax director; (3) MD&A tariff disclosure meets OCA quantification standard; (4) Fed rate environment disclosure updated for July 8 movement; (5) Sustainability disclosures consistent with SB 253 GHG data; (6) ICFR assessment current for Q2 new risk areas; (7) Boilerplate review applied the TSC materiality standard to every risk factor and MD&A section.
- The disclosure committee must document its review process and conclusions before the certification is executed. The CFO must personally read the final, complete, filed version of the 10-Q. A certification signed without personal review of the final document violates Certification Element 1.
- SOX 302 violations carry criminal penalties up to $1 million and 10 years for knowing violations, and up to $5 million and 20 years for wilful violations. The personal liability is real and is the CFO's.
- SEC Chair Atkins confirmed at the SCG Conference on July 9: "The issuer remains responsible for the information it puts out. The buck stops with you." The SOX 302 certification is the legal mechanism through which the CFO personally accepts that responsibility for every word in the Q2 10-Q.
