Key Takeaways
- SOX Section 404 concerns internal control over financial reporting.
- Section 404(a) addresses management's assessment and reporting; Section 404(b), when applicable, adds external auditor attestation.
- A workable program connects risk assessment, control design, evidence of operation, testing, deficiency evaluation, and management review.
- AI can assist with the work but does not assume those responsibilities.
What is internal control over financial reporting?
Internal control over financial reporting, or ICFR, addresses the reliability of financial reporting. It includes the people, processes, and systems used to record transactions and prepare financial statements. A SOX program should therefore start with financial-reporting risks, not with a generic checklist of every operational activity in the company.
Keep operational control performance distinct from the audit or assessment of that performance. A manager reviewing a reconciliation performs a control. An auditor inspecting that review and related support performs a test. Both records matter, but they answer different questions.
Who is responsible under Section 404?
Management owns the company's controls and its assessment. External auditor attestation is a separate requirement when applicable. The SEC's filer and reporting status guide explains why filer status matters. Emerging growth companies and non-accelerated filers may have an attestation exemption; reporting and transition details require company-specific evaluation.
Do not equate 'smaller reporting company' with an automatic exemption. The SEC's smaller reporting company guidance explains that some smaller reporting companies are accelerated filers. Confirm applicability and timing with the company's advisers rather than relying on a blog summary.
How do design and operating effectiveness differ?
Design asks whether the control, performed as described by appropriately authorized and competent people, could address the relevant risk. Operating effectiveness asks whether it actually operated as designed. PCAOB AS 2201 distinguishes these concepts for integrated external audits.
For example, a policy may require a reviewer to investigate unusual reconciliation items. The design could be reasonable, but the operating evidence may show only a signature with no record of the investigation. Alternatively, a well-documented review may still be designed at too high a level to address the relevant risk.
What does a practical SOX cycle include?
| Activity | Practical output |
|---|---|
| Assess risk and scope | Approved account, assertion, entity, and system coverage |
| Document controls | RCM, narratives, owners, frequencies, and dependencies |
| Evaluate design | Walkthroughs and documented design conclusions |
| Plan and perform testing | Population, selection rationale, procedures, and evidence |
| Review results | Resolved review notes and supported conclusions |
| Evaluate and remediate gaps | Severity assessment, action plan, and retesting |
Sequence the work around control operation and reporting dates. A dashboard status is a coordination aid; it does not establish effectiveness on its own.
What evidence should the team retain?
Retain the source records used, the applicable period, the population and selection basis, the procedures performed, results, and review history. Where a control depends on a report, document why the report is suitable for its purpose. Separate evidence of the control from evidence used to validate the report.
A missing approval, a report filter error, and an unexplained variance are different issues. Capture the facts before assigning severity. Management's evaluation may need to consider related deficiencies together, not just count individual exceptions.
Where can AI help without overstating assurance?
AI can help draft control descriptions, extract support, propose attribute-level test results, and prepare workpaper narratives. Reviewers should verify important source references, investigate inconsistent evidence, and approve the final conclusion. No tool guarantees compliance or eliminates professional skepticism.
IABuddy connects the SOX compliance workflow from RCM and phase planning through requests, testing, workpapers, follow-up, and review. Evaluate that connection using a control with a real exception so the demonstration includes the work after the first-pass result. This article is educational and does not replace advice on a company's reporting obligations.
Frequently asked questions
Is SOX compliance only an annual exercise?
No. Controls operate according to their design and frequency, while planning, evidence collection, testing, and remediation may occur throughout the year. Annual reporting does not mean that all relevant work can be left until year-end.
Can AI approve management's SOX assessment?
No. AI may assist with analysis and documentation, but management remains responsible for its assessment and applicable reporting. External auditor responsibilities remain separate.
