SOX Compliance Checklist: A Practical Guide to Section 404, ITGCs, and Readiness
A SOX compliance checklist turns Section 404 of the Sarbanes-Oxley Act into the tasks a public company completes each year to assess and report on its internal control over financial reporting, known as ICFR. The work is the same in outline for every filer: scope the accounts and systems that matter, document and test the controls over them, evaluate deficiencies, and report. What differs is who must do what, and when, depending on filer status. This guide gives the checklist in order, explains the IT general controls that auditors test, and sets out the rules for companies preparing to go public. SOX Compliance Requirements by Filer Type The Three Sections That Matter Section What it requires Who it applies to Timing for a newly public company 302 The CEO and CFO certify the financial reports and disclosure controls All public companies From the first periodic report 404(a) Management assesses and reports on the effectiveness of ICFR each year All public companies From the second annual report after the IPO 404(b) The external auditor attests to management’s assessment Accelerated and large accelerated filers; non-accelerated filers and emerging growth companies are exempt After the transition, and only if not exempt The table shows why filer status decides the workload. Every public company owes the certifications and the management assessment, but only accelerated and large accelerated filers owe the auditor’s attestation, which roughly doubles the rigor the control population must withstand. A non-accelerated filer is permanently exempt from 404(b), and an emerging growth company is exempt for up to five years after its IPO. A newly public company also cannot be an accelerated filer in its first year, so the attestation arrives later than the management assessment. The Framework Behind the Assessment Most companies assess ICFR against the COSO Internal Control, Integrated Framework (2013), which organizes controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The external auditor’s attestation follows PCAOB Auditing Standard 2201. Management’s report names the framework used, states a conclusion on effectiveness, and discloses any material weakness. The SOX Compliance Checklist, Step by Step Scope the Significant Accounts and Systems Identify the financial statement accounts and disclosures that are significant, the assertions that matter for each, and the processes and applications that produce them. Scope also includes locations and service providers. A scope that is too broad drowns the team in low-risk controls, and one that is too narrow leaves a material account untested. Assess the Risk of Misstatement For each significant process, identify what could cause a material misstatement, including fraud risk. This assessment tells you which controls are key controls, the ones that actually prevent or detect a material error, and which are supporting. Elevate’s risk assessment approach applies the same discipline to financial reporting risk. Document Processes and Controls Write process narratives or flowcharts and build a risk and control matrix that lists each key control with its owner, frequency, type, and the evidence it produces. A control that has no owner or produces no evidence cannot be tested, so the matrix is also the first check on whether the design is complete. Design and Test Controls Walk through each process to confirm the control is designed to address the risk, then test operating effectiveness with samples sized to how often the control runs. Testing should be performed by someone independent of the control owner, such as internal audit. When a control fails, remediate it and retest it, because a fix that is not retested is not evidence. Evaluate Deficiencies Every exception is evaluated by severity. A control deficiency is a failure in design or operation. A significant deficiency is less severe than a material weakness but merits attention from those who oversee financial reporting. A material weakness is a deficiency, or a combination of them, that creates a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A material weakness at year end must be disclosed and means ICFR is not effective. Remediate and Report Remediate deficiencies before year end where possible, brief the audit committee, and prepare management’s report for the annual filing. The quarterly certifications continue throughout, supported by sub-certifications from process owners. Elevate’s continuous monitoring guide describes how to keep control evidence current across the year instead of assembling it in the final quarter. SOX ITGC: What Auditors Test The Four ITGC Domains IT general controls support the reliability of the applications that produce financial data, so a weakness in them can undermine every automated control above. There is no mandated SOX ITGC list, but the conventional structure has four domains. Domain What is tested A common deficiency Access to programs and data User provisioning, privileged access, terminations, and periodic access reviews Terminated users still active, or no evidence of access reviews Program change management Changes are authorized, tested, approved, and moved to production by someone other than the developer Changes without approval or testing evidence, or developers with production access Program development New systems and major implementations are tested and approved before use Missing validation of migrated data Computer operations Job scheduling, backups, and incident handling Failed jobs not monitored, or backups never tested The table shows that most ITGC deficiencies are about evidence and separation of duties, not about missing technology. A system can be well built and still fail an ITGC test because the approval was never recorded or the access review was never signed. An ITGC audit tests each domain with samples across the period, which is why the controls need to operate consistently throughout the year. Elevate’s IT audit services cover this testing. How ITGC Scope Is Set Management scopes the ITGCs that support the in-scope applications, along with the databases, operating systems, and infrastructure underneath them. Service providers that process financial data add a further dependency. Their SOC 1 reports describe the controls at the provider, and the customer must still confirm that its own complementary controls operate. Elevate’s SOC 1 service