It's one of the most ridiculous theories I've ever heard. Sarb-Ox 906 in conjunction with Section 13 of the Securities Exchange Act requires bank CEOs to certify that the bank:

"maintain[s] a system of internal accounting controls sufficient to provide reasonable assurances that— (i) transactions are executed in accordance with management’s general or specific authorization; (ii) transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets; (iii) access to assets is permitted only in accordance with management’s general or specific authorization; and (iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences"

"Reasonable assurances" does not mean "free of problems." Imagine a law that required Program Managers at tech companies to certify that they had controls that gave "reasonable assurances" that the software performed as designed. That would just mean they had a Q&A procedure--not that the procedure was perfect or that the software was perfect. It would not violate the law for Satya Nadella to sign such a certification, even though everyone knows Windows (like all software) is full of bugs that need to be fixed.