SOX Section 302 Certification Requirements: A Practitioner Walkthrough

Signing a SOX Section 302 certification is not a rubber stamp. It is a personal legal assertion, backed by civil and criminal liability, that you have actually done the work the five paragraphs describe. This guide walks through exactly what that work is, quarter by quarter, so you can sign with confidence or identify gaps before the filing window closes.

For a side-by-side comparison of Section 302 and Section 404 obligations, see SOX 302 vs 404 Certification: The Complete Comparison Guide. For IPO-specific timing, see SOX Compliance Timeline After an IPO: By Filer Type (2026). This article focuses on the operational steps a CFO's office must complete before the pen touches the signature line.

Who Must Sign the SOX Section 302 Certification?

Every principal executive officer and every principal financial officer must sign, separately, as Exhibits 31.1 and 31.2. The statutory language covers "persons performing similar functions," which has two practical implications most general articles miss.

First, if the CEO or CFO role is vacant at filing, the person actually performing those functions signs. Leaving the role empty does not suspend the obligation. Second, if the company has co-CEOs or co-CFOs, PwC's SEC Reporting Guide (Section 3126) confirms that each must sign. A company with two co-CEOs files four Exhibit 31 certifications.

The certification applies to every Form 10-K, 10-Q, 20-F, and 40-F filed under Sections 13(a) or 15(d) of the Exchange Act. It cannot be incorporated by reference from another filing, it must appear as a standalone exhibit every single time, per the 2003 SEC adopting release (Release Nos. 33-8238, 34-47986).

Two filing categories are commonly misunderstood:

• Form 11-K (employee benefit plans): Does NOT require a Section 302 certification. PwC's Employee Benefit Plans guide states this explicitly. Plan administrators who assume otherwise are adding an obligation that does not exist.
• Foreign private issuers on Form 20-F: Subject to identical Section 302 obligations. The five-paragraph structure is the same; the exhibit number differs (often filed as Exhibit 12.1 rather than 31, as seen in Continental Energy Corporation's Form 20-F on EDGAR).

When Does the Obligation Begin? The EGC Trap

Emerging growth companies must comply with Section 302 from their very first periodic report after going public. There is zero deferral. EY's IPO readiness guidance is clear: Section 302 certification is required immediately, even though Section 404(b) external auditor attestation can be deferred for up to five years.

This catches newly public companies off guard. The first 10-Q filed after the IPO effective date requires a signed Exhibit 31, and the CEO and CFO must have actually evaluated disclosure controls and procedures (DCP) as of that quarter-end. EY advises using the 404(b) deferral period to build the controls infrastructure, not to treat the entire SOX regime as optional.

Key takeaway: Section 302 applies on day one of public company life. Section 404(b) auditor attestation can wait. Confusing the two is one of the most common IPO compliance errors.

The Five Certification Paragraphs: What You Must Have Done Before Signing

The Bristol-Myers Squibb CFO certification (Exhibit 31b, Form 10-Q, Q1 2010) is a canonical example of the required form. Here is what each paragraph actually obligates you to have done, not just what the words say.

Paragraph 1: "I have reviewed this report"

This sounds obvious. It is not. "Review" means you have read the full periodic report, not just the financial statements, but the MD&A, risk factors, legal proceedings, and all quantitative disclosures. The Section 302 certification covers "other financial information included in this report," which is broader than the Section 404 ICFR scope (limited to financial statement preparation). EPS tables, selected financial data, and MD&A quantitative disclosures are all within your certification perimeter.

Before signing paragraph 1: Confirm you have read the complete draft filing, including all exhibits incorporated by reference. Document that review with a dated sign-off in your disclosure committee records.

Paragraph 2: No material misstatements or omissions ("based on my knowledge")

The "based on my knowledge" standard is subjective, not strict liability. The SEC's August 2002 final rule (Release Nos. 33-8124, 34-46427) confirms that certifying officers are not required to independently verify every fact. But the SEC and DOJ have prosecuted officers who certified reports they knew or should have known were false, using the certification as evidence of scienter in securities fraud cases. Willful ignorance is not a defense.

Before signing paragraph 2: Your sub-certification process (see below) must have surfaced any known misstatements or omissions from business unit finance leaders. The disclosure committee should have reviewed and cleared all open items.

Paragraph 3: Financial statements fairly present financial condition and results

This paragraph extends to cash flows, not just the income statement and balance sheet. It covers all periods presented in the report, including comparative prior-period figures.

Before signing paragraph 3: The audit committee should have reviewed the financial statements. Management's review of significant accounting estimates, judgments, and non-routine transactions should be documented. Any open accounting policy questions should be resolved before filing.

Paragraph 4: Responsibility for DCP and ICFR design, evaluation, and change disclosure

This is the most operationally complex paragraph. It has four sub-parts, each with distinct requirements.

4(a) and 4(b): Design of DCP and ICFR

Here is the distinction that trips up first-time filers and IPO companies:

A material weakness in ICFR does not automatically render DCP ineffective, but in practice the SEC and auditors treat it as strong evidence of DCP ineffectiveness. The reverse is also true: a DCP failure (say, a disclosure that was late or incomplete due to a process breakdown) does not necessarily mean ICFR is deficient.

Paragraph 4(a) explicitly requires that DCP be designed to capture material information from "consolidated subsidiaries", this is the regulatory basis for requiring sub-certifications from subsidiary CFOs and controllers.

4(c): Evaluation of DCP effectiveness

The evaluation must be conducted as of the end of the period covered by the report, the quarter-end or fiscal year-end date, not the filing date. Events occurring between quarter-end and filing that affect DCP effectiveness must be considered for the paragraph 4(d) change disclosure, but they do not retroactively change the DCP conclusion as of period-end.

There is no prescribed evaluation framework for DCP (unlike ICFR, which uses COSO). This latitude creates compliance risk if documentation is thin. At minimum, document:

1. The scope of the evaluation (which entities, processes, and systems were included)
2. The evidence reviewed (sub-certifications, internal audit results, control testing outputs)
3. The conclusion reached and the basis for it
4. Any deficiencies identified and their classification

4(d): Quarterly ICFR change disclosure

This is a quarterly obligation, not just an annual one. Every 10-Q and 10-K must disclose any change in ICFR during the most recent fiscal quarter that has materially affected, or is reasonably likely to materially affect, ICFR. The evaluation obligation is codified in Exchange Act Rules 13a-15(d) and 15d-15(d).

What counts as a "material" change? The SEC has not defined a bright line, but changes that typically require disclosure include:

• Implementation of a new ERP system affecting financial close processes
• Remediation of a previously disclosed material weakness
• Significant changes to entity-level controls following a restatement
• Acquisition or divestiture that materially changes the control environment

Changes that are routine (normal staff turnover, minor process improvements) generally do not require disclosure. Document the evaluation of each quarter's changes and the conclusion reached.

Before signing paragraph 4: Your DCP evaluation must be complete, documented, and dated as of period-end. The paragraph 4(d) change analysis must be current. If a material weakness exists, paragraph 4 must reflect that ICFR is not effective, you cannot certify effectiveness when a material weakness is present.

Paragraph 5: Disclosure to auditors and the audit committee

Paragraph 5 has two sub-parts, and the second one is broader than most practitioners realize.

5(a): Significant deficiencies and material weaknesses

You must disclose to your external auditors and the audit committee all significant deficiencies and material weaknesses in ICFR design or operation. This obligation exists independently of the annual Section 404(a) management assessment. It applies every quarter. If a significant deficiency emerges in Q2, it must be disclosed to the audit committee and auditors before the Q2 10-Q is filed, not held until the year-end 404 assessment.

5(b): Fraud disclosure, "whether or not material"

This is the paragraph that most compliance guides quote without explaining. The certification requires disclosure of "any fraud, whether or not material, that involves management or other employees who have a significant role in the company's internal control over financial reporting."

The "whether or not material" language is deliberate and consequential. A $50,000 misappropriation by a controller who has significant ICFR responsibilities must be disclosed to the auditors and audit committee before you can sign. The materiality threshold that governs most other disclosure obligations does not apply here.

Before signing paragraph 5: Confirm with internal audit, legal, and HR that no fraud involving management or key ICFR personnel has been identified or is under investigation. Document that confirmation. If anything has been identified, it must be disclosed before the certification is signed.

How to Build a Sub-Certification Program

CFOs of multi-subsidiary companies cannot personally verify every control in every entity. The SEC's 2002 final rule explicitly permits reliance on the work of others, internal audit, controllers, business unit management, as long as there is a reasonable basis for the conclusions. That reasonable basis is the sub-certification program.

A practical sub-certification program works as follows:

1. Identify the population. Every business unit controller, subsidiary CFO, and process owner with significant DCP or ICFR responsibilities should be in scope. The paragraph 4(a) "consolidated subsidiaries" language sets the floor.
2. Design the questionnaire. The sub-certification questionnaire should mirror the five paragraphs of the Section 302 certification, translated into the respondent's operational context. Ask specifically about known misstatements, control failures, fraud, and ICFR changes during the quarter.
3. Set the timeline. Sub-certifications should be collected and reviewed before the disclosure committee's final pre-filing meeting, typically five to seven business days before the filing deadline.
4. Review and escalate exceptions. Any "yes" answer to a question about a control failure, fraud, or significant deficiency must be escalated immediately. The CFO cannot sign until each exception is resolved or disclosed.
5. Archive everything. Sub-certification responses, exception logs, and resolution documentation should be retained for at least seven years. These are the evidence base if the SEC or DOJ ever questions the basis for the certification.

For a quarter-specific checklist aligned to the 10-Q filing process, see the SOX 302 Sign-Off Checklist for Q2 2026 Form 10-Q.

Section 302 vs. Section 906: Different Liability, Different Exhibit Treatment

Both certifications are required in every periodic report, but they are not the same document and do not carry the same legal consequences.

The "furnished" status of Exhibit 32 matters for Securities Act purposes: a Section 906 certification is not automatically incorporated by reference into a registration statement on Form S-3 or S-11. The Section 302 certification, filed as Exhibit 31, is incorporated. This distinction affects liability exposure in securities offerings.

For a deeper look at how these interact with the Section 404 management assessment, see SOX 302 vs 404 Certification: The Complete Comparison Guide.

What a Material Weakness Means for Your Section 302 Certification

If a material weakness in ICFR exists, the paragraph 4 conclusion must reflect that ICFR is not effective. The SEC's 2003 adopting release confirmed that management cannot conclude ICFR is effective when one or more material weaknesses exist. This is non-negotiable.

The practical sequence when a material weakness is identified:

1. Disclose to auditors and the audit committee under paragraph 5(a) before filing.
2. Reflect the material weakness in the paragraph 4 ICFR effectiveness conclusion.
3. Assess whether the material weakness also renders DCP ineffective (it often does, but the analysis must be documented separately).
4. Disclose the material weakness in the body of the periodic report (Item 4 of the 10-Q or Item 9A of the 10-K).
5. Describe remediation steps and timeline.

For guidance on classifying control deficiencies, see Design vs Operating Effectiveness Testing Under SOX: 2026 Practitioner Walkthrough.

AI-Assisted Reporting and the "Based on My Knowledge" Standard

As AI tools take on larger roles in financial close, variance analysis, and disclosure drafting, a practical question has emerged: does using AI-generated outputs affect what "based on my knowledge" means for the certifying officer?

The short answer is no, the standard does not change, but the risk profile does. The "based on my knowledge" language is subjective and has always permitted reliance on the work of others. AI tools are, in that sense, analogous to relying on a controller's analysis. The certifying officer is still responsible for the conclusions.

The risk is that AI-generated outputs can be wrong in ways that are not immediately obvious, and the volume of outputs can create a false sense of coverage. If an AI tool drafts MD&A language or flags disclosure items, the human review process must be robust enough that the CFO genuinely has a basis for the certification, not just a printout from a model.

For a framework on governing AI in the SOX context, see AI Tools for SOX Compliance and Internal Audit: 2026 Evaluation Framework and AI-ICFR Framework: Key Controls for CFOs Explained.

Key takeaway: AI does not lower the certification bar. It shifts where the human review effort must be concentrated.

FAQ

Can the CEO delegate the Section 302 certification to the General Counsel or Controller?

No. The certification must be signed by the principal executive officer and principal financial officer, or persons performing those functions. It cannot be delegated to someone who does not hold or perform those roles. If the CEO is temporarily unavailable, the person actually serving as acting CEO signs.

Does a restatement automatically mean a prior Section 302 certification was false?

Not automatically. The "based on my knowledge" standard is subjective. A restatement arising from a genuine accounting error that was not known to the certifying officers at the time of filing does not, by itself, establish that the prior certification was false. However, the SEC may investigate whether the officers knew or should have known of the error, and the restatement itself becomes evidence in that inquiry.

What happens if the CEO and CFO disagree about whether to sign?

Both must sign independently. If either officer believes the report contains a material misstatement or that DCP is ineffective and that fact is not disclosed, they should not sign. The practical resolution is to delay filing, correct the issue, or make the required disclosure before signing.

Is the DCP evaluation required to use COSO or another specific framework?

No. Unlike ICFR (where COSO is the de facto standard for the Section 404 management assessment), there is no prescribed framework for the DCP evaluation. Companies have wide latitude in how they structure and document it. That latitude is also a trap: thin documentation leaves the certifying officer exposed if the adequacy of the evaluation is ever questioned.

Does Section 302 apply to registered investment companies (mutual funds)?

Yes. The 2003 SEC rulemaking confirmed that registered investment companies are subject to Section 302 certification requirements under Investment Company Act Rule 30a-2.

What is the evaluation date for the DCP conclusion, quarter-end or filing date?

Quarter-end (or fiscal year-end). The evaluation must be conducted as of the end of the period covered by the report. Events between period-end and filing date are relevant only for the paragraph 4(d) ICFR change disclosure, not for retroactively changing the DCP effectiveness conclusion.