Audit & Internal Controls
The SOX Compliance Checklist that actually holds up in an audit
Every SOX control, every audit procedure, and every certification step a U.S. public company needs — explained with real corporate failures, working diagrams, and the exact paperwork an auditor will ask to see.
What SOX Compliance Actually Means
If you've ever wondered why your company suddenly needs three people to approve a single journal entry, or why IT can't push a code change to the finance system without a ticket, an approval, and a digital paper trail — you're looking at SOX in action.
The Sarbanes-Oxley Act of 2002, almost always shortened to SOX or SarBox, is a U.S. federal law that governs how publicly traded companies handle financial reporting, internal controls, and corporate accountability. It was passed by Congress in the aftermath of the Enron and WorldCom accounting scandals, and it remains one of the most consequential pieces of financial regulation in American history.
The state of meeting the legal requirements set out in the Sarbanes-Oxley Act of 2002 — primarily accurate financial reporting, documented internal controls over financial reporting (ICFR), executive certification of those controls, and an independent external audit of the controls themselves, not just the numbers.
SOX compliance is not optional for the companies it covers, and it is not a one-time project. It is an ongoing operating discipline — closer to how a hospital maintains sterile procedures than how a company files a one-time tax form. You don't become "SOX compliant" once. You demonstrate, quarter after quarter and year after year, that your controls are designed properly and operating effectively.
Who actually has to comply?
SOX applies to:
- All U.S. public companies registered with the Securities and Exchange Commission (SEC)
- Wholly-owned subsidiaries of public companies
- Foreign companies that are listed on U.S. stock exchanges
- Accounting firms that audit public companies (they have their own SOX obligations, overseen by the PCAOB)
Private companies are not directly bound by SOX, but many adopt SOX-style controls anyway — usually because they're preparing for an IPO, because a private equity owner demands it, or because their bank covenants and insurers expect it. A private company "voluntarily SOX compliant" is a common phrase in finance job postings for exactly this reason.
SOX is not an accounting standard like GAAP or IFRS. It does not tell you how to record a transaction. It tells you how to prove that the process that recorded the transaction is trustworthy, documented, and tested. GAAP governs the numbers; SOX governs the machine that produces the numbers.
Why the Law Exists: The Scandals That Built It
Laws this strict rarely get written in calm times. SOX exists because, in 2001 and 2002, the United States watched two giant companies collapse almost overnight — and discovered that the very people meant to catch the fraud had been the ones enabling it.
Enron Corporation, 2001
Enron was once the seventh-largest company in the United States by revenue, an energy-trading giant celebrated on magazine covers as the future of business. Its executives, with the help of its outside auditor Arthur Andersen, used a web of off-balance-sheet special purpose entities to hide billions of dollars in debt and inflate reported profits.
When the scheme unraveled in late 2001, Enron's stock fell from roughly $90 to under $1 within a year. Thousands of employees lost their jobs and their retirement savings, which had been heavily invested in Enron stock through the company's own 401(k) plan. Arthur Andersen — one of the five largest accounting firms in the world at the time — was convicted of obstruction of justice for shredding Enron-related documents and effectively ceased to exist as an audit firm.
Source: SEC litigation releases and U.S. Senate Committee on Governmental Affairs investigation records, 2002.
WorldCom, Inc., 2002
While Enron was still dominating headlines, telecom giant WorldCom revealed an even larger accounting fraud. The company had improperly classified roughly $3.8 billion in ordinary operating expenses as capital expenditures — a classification trick that let it spread costs over many years instead of recognizing them immediately, making the company look profitable when it was actually losing money.
WorldCom's internal auditor, Cynthia Cooper, and her small team uncovered the fraud themselves, working at night and without telling senior management, because they no longer trusted the chain of command. WorldCom filed for what was then the largest bankruptcy in U.S. history. CFO Scott Sullivan was later sentenced to prison.
Source: SEC v. WorldCom, Inc. (2002) and subsequent U.S. House Financial Services Committee hearings.
Congress responded fast. Senator Paul Sarbanes and Representative Michael Oxley co-sponsored a bill that passed the Senate 99–0 and was signed into law by President George W. Bush on July 30, 2002 — barely weeks after WorldCom's fraud became public. The speed itself tells you something: this wasn't a law negotiated over years of lobbying. It was a law built to make sure the people running public companies could never again say "I didn't know" and have that be a defense.
The Sections of SOX That Actually Matter Day-to-Day
SOX has eleven titles and dozens of sections, but in practice, compliance teams live inside four of them. If you remember nothing else from this guide, remember these four numbers.
| Section | Common name | What it requires |
|---|---|---|
| §302 | Corporate Responsibility for Financial Reports | The CEO and CFO must personally certify each quarterly and annual report, confirming they've reviewed it and it doesn't contain material misstatements. |
| §404 | Management Assessment of Internal Controls | Management must document and test internal controls over financial reporting (ICFR), and an external auditor must independently opine on those controls. This is the section that creates most of the actual checklist work. |
| §409 | Real-Time Issuer Disclosures | Material changes in financial condition must be disclosed to the public on a "rapid and current basis" — not buried until the next quarterly filing. |
| §802 | Criminal Penalties for Document Destruction | Knowingly destroying, altering, or falsifying records to obstruct a federal investigation carries criminal penalties of up to 20 years. This section exists directly because of the Arthur Andersen shredding. |
| §906 | Criminal Certification | A criminal-law companion to §302. Knowingly certifying a false report can mean fines up to $5 million and up to 20 years in prison for executives. |
Sections 302 and 906 are why you sometimes hear people describe SOX as "the law that makes the CEO go to jail." That's an oversimplification, but the underlying truth is real: before SOX, a CEO could plausibly claim ignorance of the numbers. After SOX, ignorance is no longer a usable defense, because the CEO has signed a certification saying they reviewed the report personally.
SOX Controls, Explained Without the Jargon
"Controls" is the single most-used word in any SOX conversation, and also the most loosely used. Let's fix that.
A process designed to provide reasonable assurance that financial statements are reliable and prepared in accordance with accounting standards. A control can be a step in a process, an approval, a system permission, or a reconciliation — anything whose job is to catch or prevent an error or a fraud before it reaches the financial statements.
Every SOX control falls into one of a few practical buckets. Knowing which bucket a control belongs to tells you how it gets tested.
1. Preventive vs. Detective Controls
- Preventive controls stop an error before it happens. Example: the accounting system simply will not let an employee approve their own expense report.
- Detective controls catch an error after it happens. Example: a monthly bank reconciliation that flags a transaction nobody can explain.
2. Manual vs. Automated (ITGC-dependent) Controls
- Manual controls rely on a person doing something correctly and consistently — reviewing a report, signing off on a journal entry, comparing two numbers by eye.
- Automated controls are built into software: a system that won't post a journal entry unless the debits equal the credits, or that automatically routes any invoice over $50,000 to a second approver.
Automated controls are only as trustworthy as the IT systems running them — which is why ITGCs (IT General Controls) exist as their own control category. If a programmer can quietly change the $50,000 approval threshold to $5,000,000 without anyone noticing, the automated control is worthless. ITGCs cover access management, change management, and backup/recovery — the controls that protect the controls.
3. Entity-Level Controls (ELCs)
These sit above any single process — the "tone at the top." Examples: a code of conduct, a whistleblower hotline, board-level oversight of the audit committee, segregation-of-duties policy. Auditors test ELCs first, because weak ELCs put a question mark over every control underneath them.
4. Key vs. Non-Key Controls
Not every control gets tested every year. A key control is one that, if it failed, could lead to a material misstatement on its own. Auditors and management focus testing effort on key controls; non-key controls exist but carry lower individual risk.
Segregation of Duties (SoD), in practice: At a mid-sized SaaS company, the same employee used to both create new vendors in the accounting system and approve payments to those vendors. A SOX readiness assessment flagged this as a control gap — that single person could theoretically create a fake vendor and pay it. The fix wasn't firing anyone; it was a configuration change: vendor creation and payment approval were split into two different system roles held by two different people. That one change became a tested, documented SOX control, referenced in the company's control matrix as "AP-03: Segregation of vendor master maintenance and payment approval."
Diagram: How SOX Controls Are Layered
Controls aren't a flat list — they stack, with weaknesses at a lower layer undermining everything above it.
The Complete SOX Compliance Checklist
This is the actual working checklist — organized the way a controller or internal audit manager would build it, phase by phase, across a SOX compliance cycle.
Phase 1 — Scoping & Risk Assessment
- Identify all "significant accounts" based on materiality thresholds set with the audit committee
- Map significant accounts to the business processes that feed them (revenue, procure-to-pay, payroll, financial close, etc.)
- Identify in-scope locations, subsidiaries, and systems
- Perform a fraud risk assessment specific to each significant process
- Update the scoping memo and get sign-off from the CFO and audit committee
Phase 2 — Documentation
- Document process narratives for every in-scope process
- Build or update process flowcharts showing control points
- Maintain a Risk and Control Matrix (RACM) mapping each risk to a specific control, control owner, and control frequency
- Tag each control as key/non-key and preventive/detective
- Document all ITGCs covering in-scope financial systems
Phase 3 — Control Design & Remediation
- Review the RACM for gaps — risks with no mapped control
- Confirm segregation of duties across all financially sensitive system roles
- Remediate any control design deficiencies found in the prior testing cycle
- Re-certify access rights for all financial systems (who can do what, and why)
- Update control documentation for any process or system change made during the year
Phase 4 — Testing
- Build a testing plan with sample sizes appropriate to control frequency (daily, weekly, monthly, quarterly, annual)
- Perform management's own testing (the "first line" or "second line" test, ahead of external audit)
- Document every test with evidence — screenshots, signed approvals, system logs, not just a checkbox
- Log every exception found, however minor, with a root-cause note
- Track remediation status for every open exception until it's closed
Phase 5 — Certification & External Audit
- Prepare the §302 quarterly sub-certifications from process owners up to the CFO
- Prepare management's §404 assessment of ICFR effectiveness for the annual report
- Coordinate with the external auditor on the Public Company Accounting Oversight Board (PCAOB)-standard audit of ICFR
- Resolve any auditor-identified deficiencies before the reporting deadline
- File the CEO/CFO §302 and §906 certifications with the SEC alongside the 10-K or 10-Q
Phase 6 — Continuous Monitoring
- Monitor control performance throughout the year, not just at testing time
- Maintain a SOX issue/deficiency tracker visible to the audit committee
- Reassess scoping whenever the business changes materially (acquisition, new ERP system, new revenue stream)
- Refresh training for control owners annually
- Conduct a lessons-learned review after each audit cycle and feed it into next year's plan
SOX Audit Procedures: What Auditors Actually Do
People outside accounting often picture an audit as someone reading through spreadsheets looking for typos. A SOX audit is structurally different: the auditor isn't just checking whether the numbers are right, they're checking whether the process that produced the numbers would catch an error if one occurred — even if, this particular year, none did.
An independent examination, performed by a PCAOB-registered external audit firm, of whether a company's internal controls over financial reporting are both suitably designed and operating effectively as of the reporting date. For large accelerated filers, this audit is integrated with — but legally distinct from — the audit of the financial statements themselves.
The standard audit procedures, step by step
1. Walkthroughs
The auditor follows a single transaction from start to finish — say, one customer invoice — sitting with the employee who actually performs each step, asking them to demonstrate (not just describe) what they do. Walkthroughs frequently surface gaps that documentation alone hides, because what's written in the process narrative and what an employee actually does under deadline pressure are not always the same thing.
2. Test of Design (TOD)
Before testing whether a control worked, the auditor checks whether it was even capable of working. A control that says "manager reviews the report monthly" but never specifies what the manager is checking for is poorly designed — even if the manager dutifully reviews it every month.
3. Test of Operating Effectiveness (TOE)
This is the heart of SOX audit work: pulling a sample of instances where the control should have operated, and checking the evidence. For a monthly control, the auditor might sample 2–3 months out of 12. For a control that operates on every transaction (like an automated three-way match in procurement), the sample size and method are different — often relying on data analytics across the full population rather than a handful of samples.
4. Inquiry, Observation, Inspection, Re-performance
These are the four classic evidence-gathering techniques, in increasing order of reliability:
- Inquiry — simply asking someone how the control works (weakest evidence on its own)
- Observation — watching the control happen in real time
- Inspection — examining the actual documentation or system record left behind
- Re-performance — the auditor independently redoes the control themselves to confirm the same result (strongest evidence)
5. Deficiency Evaluation
Any gap found gets classified by severity:
| Severity | Meaning | Typical consequence |
|---|---|---|
| Deficiency | A control didn't operate as designed, in a minor or isolated way | Logged, monitored, often fixed without disclosure |
| Significant Deficiency | A deficiency, or combination of deficiencies, important enough to merit attention from those overseeing financial reporting | Reported to the audit committee; remediation plan required |
| Material Weakness | A reasonable possibility exists that a material misstatement won't be prevented or detected on time | Must be publicly disclosed in the 10-K; can trigger an adverse ICFR opinion |
6. The Audit Opinion
The audit concludes with a formal opinion on ICFR — separate from the opinion on the financial statements themselves. A company can, in theory, have accurate financial statements for the current year and still receive an adverse ICFR opinion, if the auditor concludes the control environment itself can't be relied on going forward. That distinction surprises a lot of first-time SOX program owners.
Diagram: The Annual SOX Compliance Cycle
SOX work isn't seasonal — it runs continuously, with intensity rising toward year-end.
Try It: The §302 Certification, In Miniature
Every quarter, a real CFO has to put their name — and their personal legal liability — behind a statement like this one. Click the stamp to see what they're actually certifying.
This stamp is illustrative — no data is sent or stored.
Real Examples: SOX Working (and Failing)
The best way to understand a control is to see what happens in its absence — or watch it catch something before it becomes a scandal.
General Electric's internal control disclosures, 2009
In its 2009 annual report, General Electric disclosed a material weakness related to its hedge accounting for interest rate swaps inside its financial services subsidiary — the controls had not been designed to capture an unusual transaction structure correctly. The key detail: GE caught and disclosed this itself, as part of its own §404 self-assessment, restated the affected periods, and remediated the control. No fraud was alleged. This is what SOX disclosure is supposed to look like when it works as designed — a company finding its own gap and being transparent about it, rather than an outside investigation uncovering concealment.
Source: General Electric Company, Form 10-K filings and related 8-K disclosures, 2009.
Wells Fargo's fake-accounts scandal, 2016
Wells Fargo employees opened millions of unauthorized deposit and credit card accounts in customers' names to meet aggressive sales quotas. This wasn't primarily a financial-misstatement scandal in the Enron sense — but it became a textbook case study in SOX training programs for a different reason: it showed how entity-level controls (incentive structure, tone at the top, whistleblower handling) can fail even while transaction-level accounting controls look technically fine. The bank paid a combined $185 million in penalties in 2016, and the long-tail consequences — leadership resignations, a Federal Reserve-imposed asset cap, and ongoing remediation orders — stretched on for years afterward.
Source: Consumer Financial Protection Bureau consent order, September 2016; subsequent Federal Reserve enforcement actions.
The "ghost employee" control: A mid-cap manufacturing company's internal audit team, during routine SOX payroll testing, sampled the active employee list against badge-swipe data and found one employee who had been terminated eight months earlier but was still receiving direct deposits. The root cause wasn't fraud by the original employee — it was a broken handoff between HR and payroll: termination paperwork was filed, but no automated trigger removed the employee from the payroll system. The fix became a new key control: an automated monthly reconciliation between the HR system's active-employee list and the payroll system's pay-run list, with any mismatch routed to a manager for same-day review.
Who Owns What: SOX Roles & Responsibilities
A surprising number of SOX programs stall not because the controls are wrong, but because nobody is clearly assigned to own them. Here's how responsibility should be distributed across a typical public company.
| Role | SOX Responsibility |
|---|---|
| Board / Audit Committee | Ultimate oversight; receives deficiency reports; approves external auditor engagement and independence |
| CEO & CFO | Personally certify quarterly/annual reports (§302) and bear criminal liability for false certification (§906) |
| Internal Audit | Independent testing of controls throughout the year; reports directly to the audit committee, not to management being tested |
| SOX / Internal Controls Team | Owns documentation, the RACM, scoping, testing coordination, and remediation tracking day-to-day |
| Control Owners | The actual employees performing a control (e.g. a manager reviewing a reconciliation) — accountable for executing and evidencing it |
| External Auditor | Independent PCAOB-registered firm; issues the formal opinion on ICFR; legally barred from also designing the controls they audit |
| IT / InfoSec | Owns ITGCs — access provisioning, change management, system backups for in-scope financial applications |
SOX explicitly restricts what non-audit services an external audit firm can sell to a company it also audits — partly because Arthur Andersen earned significant consulting fees from Enron alongside its audit fees, which critics argued softened its willingness to push back. Today, an auditor that designed your internal control system generally cannot also be the firm that audits it.
Diagram: From Risk to Tested Control
This is the core logical chain every SOX control documentation follows — and the one auditors trace backward during testing.
The Mistakes That Show Up Most in Audits
1. "Check-the-box" testing with no real evidence
A spreadsheet marked "Tested — Pass" with no attached screenshot, approval email, or system log is not evidence. Auditors will ask to see the underlying artifact, and a checklist alone won't survive that request.
2. Treating SOX as an annual fire drill
Programs that wake up every October and scramble through documentation updates consistently produce worse audit outcomes than programs that monitor controls continuously. Auditors can usually tell the difference within the first few walkthroughs.
3. Forgetting to update the RACM after a system change
A new ERP module, a changed approval workflow, or a new revenue stream from an acquisition all change the control landscape. Controls documented for a system that no longer matches reality are a documentation gap auditors flag immediately.
4. Letting one person hold too much access
Segregation-of-duties violations are one of the most commonly cited deficiency types across public company 10-Ks, frequently surfacing after a system migration when old access roles get carried over without review.
5. Closing deficiencies without addressing the root cause
Fixing a single bad transaction without fixing the process that allowed it just guarantees the same finding next year, on a different transaction.
Diagram: Deficiency Severity Ladder
Tools That Support a SOX Program
Spreadsheets can run a SOX program for a small filer, but most mid-size and large public companies use dedicated governance, risk, and compliance (GRC) platforms to manage the RACM, route testing workflows, and maintain a permanent audit trail. Categories worth knowing:
- GRC platforms — centralize the RACM, control testing workflow, and evidence storage in one auditable system
- Identity & access management (IAM) tools — support segregation-of-duties enforcement and periodic access recertification
- Continuous controls monitoring (CCM) tools — automatically test certain controls (like duplicate payments or unusual journal entries) on every transaction rather than a sample
- Document/version management — keeps process narratives and control documentation under change control, with a history of who edited what and when
The tool matters far less than the discipline behind it. A company with a clean spreadsheet-based RACM, consistent evidence, and genuine management ownership will out-perform a company with an expensive GRC platform nobody actually updates.
What Non-Compliance Actually Costs
- Criminal penalties for knowing false certification under §906 — fines up to $5 million and imprisonment up to 20 years for individual executives
- Civil penalties and SEC enforcement actions against the company, which can include disgorgement of bonuses tied to misstated results (a "clawback" mechanism under §304)
- Delisting risk from major exchanges if a company can't file timely, certified reports
- Reputational and market damage — disclosure of a material weakness routinely triggers stock price declines and increases a company's cost of capital, since lenders and investors price in governance risk
- Increased audit fees in subsequent years, since auditors typically expand testing scope after finding a material weakness
The financial cost of running a disciplined SOX program is almost always smaller than the cost of remediating after a public failure — which is the entire logic the law was built on.
Test Yourself: SOX Compliance Quiz
Ten questions covering the law, the controls, and the audit procedures from this guide. Answers are revealed below — no peeking until you've made your best guess.
What year was the Sarbanes-Oxley Act signed into law?
Which two corporate scandals are most directly credited with prompting SOX?
Which SOX section requires the CEO and CFO to personally certify financial reports?
Section 404 of SOX primarily requires what?
A control that stops an error before it happens (e.g., the system won't let someone approve their own expense report) is called a:
What does ITGC stand for?
In audit evidence terms, which technique provides the strongest evidence?
A control gap serious enough that it must be publicly disclosed in the 10-K is classified as:
Which body oversees and registers the accounting firms that audit public companies under SOX?
Are private companies legally required to comply with SOX?
Reveal the Answer Key
Frequently Asked Questions
Does SOX apply to small public companies, or only large ones?
SOX applies to all U.S. public companies regardless of size, but the rules scale. Smaller reporting companies and "non-accelerated filers" are generally exempt from the requirement that an external auditor separately opine on ICFR (the §404(b) auditor attestation), even though management's own §404(a) assessment is still required. Large accelerated filers face the fullest version of the requirements.
How long does it take to become SOX compliant?
For a company going through an IPO, building a SOX-ready control environment from scratch typically takes 12–18 months, covering scoping, documentation, a "soft launch" testing year, and remediation before the first real attestation. Companies that are already public refresh and re-test their existing program every fiscal year rather than starting over.
What's the difference between SOX and GAAP?
GAAP (Generally Accepted Accounting Principles) tells you how to record and present a transaction. SOX tells you how to prove the process behind that recording is reliable, documented, and independently tested. A company can follow GAAP correctly and still fail a SOX audit if its controls aren't properly designed or evidenced.
Who actually performs SOX testing — internal audit or the external auditor?
Both, at different points. Management (often through an internal SOX/controls team, sometimes supported by internal audit) tests its own controls first, throughout the year. The external auditor then performs independent testing — sometimes relying partly on management's work where allowed, but always performing enough independent testing to support their own opinion.
Can a company be SOX compliant and still have a financial scandal?
Yes — SOX reduces the likelihood and shortens the time-to-detection of financial misstatement, but it isn't a guarantee against fraud, especially collusive fraud where multiple people deliberately override controls together. SOX programs are also evaluated as of a point in time; a control environment can be sound in one quarter and degrade after an unmonitored system change.
What's a "compensating control"?
A control that doesn't fully eliminate a risk on its own but reduces it to an acceptable level when a primary control can't be implemented — for example, if true segregation of duties isn't possible due to a small team size, a compensating control might be a mandatory secondary review by someone outside the immediate team for any transaction over a set dollar threshold.
How often do controls need to be tested?
It depends on the control's frequency. A control that operates daily is typically tested with a sample drawn across the year; a control that operates monthly might be tested for 2–4 selected months; an annual control (like an annual impairment review) is typically tested once, with extra scrutiny on its design given the limited testing opportunity.