A SOX compliance checklist turns Section 404 of the Sarbanes-Oxley Act into the tasks a public company completes each year to assess and report on its internal control over financial reporting, known as ICFR. The work is the same in outline for every filer: scope the accounts and systems that matter, document and test the controls over them, evaluate deficiencies, and report. What differs is who must do what, and when, depending on filer status. This guide gives the checklist in order, explains the IT general controls that auditors test, and sets out the rules for companies preparing to go public.
SOX Compliance Requirements by Filer Type
The Three Sections That Matter
| Section | What it requires | Who it applies to | Timing for a newly public company |
|---|---|---|---|
| 302 | The CEO and CFO certify the financial reports and disclosure controls | All public companies | From the first periodic report |
| 404(a) | Management assesses and reports on the effectiveness of ICFR each year | All public companies | From the second annual report after the IPO |
| 404(b) | The external auditor attests to management’s assessment | Accelerated and large accelerated filers; non-accelerated filers and emerging growth companies are exempt | After the transition, and only if not exempt |
The table shows why filer status decides the workload. Every public company owes the certifications and the management assessment, but only accelerated and large accelerated filers owe the auditor’s attestation, which roughly doubles the rigor the control population must withstand. A non-accelerated filer is permanently exempt from 404(b), and an emerging growth company is exempt for up to five years after its IPO. A newly public company also cannot be an accelerated filer in its first year, so the attestation arrives later than the management assessment.
The Framework Behind the Assessment
Most companies assess ICFR against the COSO Internal Control, Integrated Framework (2013), which organizes controls into five components: control environment, risk assessment, control activities, information and communication, and monitoring activities. The external auditor’s attestation follows PCAOB Auditing Standard 2201. Management’s report names the framework used, states a conclusion on effectiveness, and discloses any material weakness.
The SOX Compliance Checklist, Step by Step
Scope the Significant Accounts and Systems
Identify the financial statement accounts and disclosures that are significant, the assertions that matter for each, and the processes and applications that produce them. Scope also includes locations and service providers. A scope that is too broad drowns the team in low-risk controls, and one that is too narrow leaves a material account untested.
Assess the Risk of Misstatement
For each significant process, identify what could cause a material misstatement, including fraud risk. This assessment tells you which controls are key controls, the ones that actually prevent or detect a material error, and which are supporting. Elevate’s risk assessment approach applies the same discipline to financial reporting risk.
Document Processes and Controls
Write process narratives or flowcharts and build a risk and control matrix that lists each key control with its owner, frequency, type, and the evidence it produces. A control that has no owner or produces no evidence cannot be tested, so the matrix is also the first check on whether the design is complete.
Design and Test Controls
Walk through each process to confirm the control is designed to address the risk, then test operating effectiveness with samples sized to how often the control runs. Testing should be performed by someone independent of the control owner, such as internal audit. When a control fails, remediate it and retest it, because a fix that is not retested is not evidence.
Evaluate Deficiencies
Every exception is evaluated by severity. A control deficiency is a failure in design or operation. A significant deficiency is less severe than a material weakness but merits attention from those who oversee financial reporting. A material weakness is a deficiency, or a combination of them, that creates a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A material weakness at year end must be disclosed and means ICFR is not effective.
Remediate and Report
Remediate deficiencies before year end where possible, brief the audit committee, and prepare management’s report for the annual filing. The quarterly certifications continue throughout, supported by sub-certifications from process owners. Elevate’s continuous monitoring guide describes how to keep control evidence current across the year instead of assembling it in the final quarter.
SOX ITGC: What Auditors Test
The Four ITGC Domains
IT general controls support the reliability of the applications that produce financial data, so a weakness in them can undermine every automated control above. There is no mandated SOX ITGC list, but the conventional structure has four domains.
| Domain | What is tested | A common deficiency |
|---|---|---|
| Access to programs and data | User provisioning, privileged access, terminations, and periodic access reviews | Terminated users still active, or no evidence of access reviews |
| Program change management | Changes are authorized, tested, approved, and moved to production by someone other than the developer | Changes without approval or testing evidence, or developers with production access |
| Program development | New systems and major implementations are tested and approved before use | Missing validation of migrated data |
| Computer operations | Job scheduling, backups, and incident handling | Failed jobs not monitored, or backups never tested |
The table shows that most ITGC deficiencies are about evidence and separation of duties, not about missing technology. A system can be well built and still fail an ITGC test because the approval was never recorded or the access review was never signed. An ITGC audit tests each domain with samples across the period, which is why the controls need to operate consistently throughout the year. Elevate’s IT audit services cover this testing.
How ITGC Scope Is Set
Management scopes the ITGCs that support the in-scope applications, along with the databases, operating systems, and infrastructure underneath them. Service providers that process financial data add a further dependency. Their SOC 1 reports describe the controls at the provider, and the customer must still confirm that its own complementary controls operate. Elevate’s SOC 1 service and its comparison of SOC 1 and SOC 2 explain which report applies where.
How to Prepare for SOX Before and After an IPO
Newly Public Companies Get a Transition, Not an Exemption
A newly public company does not have to include management’s ICFR report in its first annual report, because SEC rules provide a transition period. The first annual report states that no assessment is included. The Section 302 certifications start with the first periodic report, however, and management’s assessment is required in the second annual report. The transition is therefore one year to build a program, not a reason to wait.
A Readiness Timeline
Before the IPO, scope the significant accounts, document the processes, design the key controls, and fix the worst ITGC gaps. In the first year as a public company, operate the controls and test them, and run the quarterly certifications on top of them. By the second annual report, the program should have a full cycle of tested, remediated controls behind management’s assessment. Companies that start the documentation only after the IPO usually compress all of this into months.
Where Outside Help Fits
Elevate performs SOX readiness assessments for pre-IPO and newly public companies, builds right-sized compliance roadmaps, and offers co-sourcing and outsourcing to complement an existing finance and audit team. Its SOX service and internal audit practice are described on those pages, and a published SOX IT internal audit case study shows the work in practice. To scope a readiness review, book a call with an Elevate advisor.
Conclusion
SOX compliance is a repeatable annual cycle built on a short list of disciplines: scope what matters, document the key controls, test them with independent samples, evaluate every deficiency honestly, and report. The details that vary are filer status and timing, which decide whether an auditor attests and when management’s own assessment begins.
IT general controls deserve early attention because they sit under every automated control, and because their failures are usually missing evidence, not missing technology. For companies heading toward an IPO, the transition period is best used to build the program and run at least one full cycle before the first assessment is due.
Elevate Consult supports SOX readiness and internal audit programs for public and pre-IPO companies, and does not perform the external audit or issue the auditor’s attestation. Book a call with an Elevate advisor to plan your readiness work.
Key Takeaways
SOX Section 404 is an annual cycle, and the work is similar for every filer even though the obligations differ.
- Filer status decides the workload. Everyone owes the certifications and management’s assessment, while only accelerated and large accelerated filers owe the auditor’s attestation.
- Newly public companies get a transition. Management’s ICFR report starts with the second annual report, but the certifications start at once.
- Scope drives everything. Identify significant accounts, assertions, and systems before documenting controls.
- Test with independence and retest fixes. A remediation that is not retested is not evidence.
- ITGC failures are usually about evidence. Access reviews, change approvals, and backups need records.
- Start before the IPO. The transition year is for building the program, not for starting it.
Frequently Asked Questions
What is a SOX compliance checklist?
A SOX compliance checklist lists the tasks a public company completes each year to assess and report on internal control over financial reporting under Section 404. The core steps are scoping significant accounts and systems, assessing risk, documenting processes and controls, designing and testing controls, evaluating deficiencies, remediating them, and reporting. Companies also support the CEO and CFO certifications required under Section 302.
What are the SOX compliance requirements?
Section 302 requires the CEO and CFO to certify financial reports and disclosure controls. Section 404(a) requires management to assess and report on the effectiveness of internal control over financial reporting each year. Section 404(b) requires the external auditor to attest to that assessment, and it applies to accelerated and large accelerated filers. Non-accelerated filers are exempt from 404(b), and emerging growth companies are exempt for up to five years.
What are SOX ITGCs?
SOX ITGCs are the IT general controls that support the reliability of the applications and data used in financial reporting. They are usually organized into four domains: access to programs and data, program change management, program development, and computer operations. There is no mandated list, and management scopes the ITGCs that support the in-scope applications, along with the databases and infrastructure beneath them.
When does a newly public company need to comply with SOX 404?
A newly public company is not required to include management’s ICFR report in its first annual report, because SEC rules provide a transition period. Management’s assessment is required starting with the second annual report. The Section 302 certifications apply from the first periodic report. The auditor’s attestation, where it applies, comes later and only if the company is not exempt.
What is the difference between a significant deficiency and a material weakness?
A significant deficiency is a control deficiency, or a combination of them, that is less severe than a material weakness but important enough to merit attention from those responsible for overseeing financial reporting. A material weakness creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. A material weakness at year end must be disclosed and means ICFR is not effective.