A SOX compliance checklist for a newly public company should cover nine things: who must comply and when, scoping from the financial statements down, entity level controls, process documentation, the IT general controls, segregation of duties, the key reports your controls rely on, the precision of management review controls, and how deficiencies are rated and fixed. For each one, the useful question is what the external auditor will test and what evidence will pass. A control that exists but cannot be evidenced is treated as a control that does not exist.
This guide is written from the side of the table that defends audit work through PCAOB inspection. Inspectors review the auditor's work, and the auditor reviews yours. So the standard your evidence has to meet is the one the inspector applies to the auditor.
This page is general information, not legal or accounting advice. Confirm how the rules apply to your company with your securities counsel and your external auditor.
Who has to comply, and when year one starts
Section 302 applies to every company filing periodic reports with the SEC. The CEO and CFO certify each quarterly and annual report. They state that they are responsible for disclosure controls and internal control over financial reporting, that they have evaluated the disclosure controls, and that they have disclosed any material changes, significant deficiencies and fraud involving internal control.
Section 404 has two parts. Under 404(a), management assesses internal control over financial reporting (ICFR) and reports on it in the annual report. Under 404(b), the external auditor attests to that assessment. Management's report is required of all filers. The auditor's attestation is required only of accelerated and large accelerated filers that are not emerging growth companies.
Filer status depends mainly on public float, measured as of the last business day of the second fiscal quarter. Since 2020, a smaller reporting company with annual revenue under $100 million generally is not an accelerated filer, even if its float is higher. Emerging growth companies are exempt from 404(b) for up to five fiscal years after the IPO. The exemption ends earlier if the company stops qualifying as an EGC, for example by becoming a large accelerated filer. None of these exemptions removes the duty to maintain ICFR or to complete management's own assessment.
Newly public companies get a transition period. Management's first ICFR report, and the auditor's attestation where required, are due with the second annual report after the company becomes public. That sounds generous. In practice the controls must operate across most of that second fiscal year before they can be tested, so the real start is close to the offering itself.
ICFR versus disclosure controls
The two terms are often used interchangeably. They are not the same.
Disclosure controls and procedures cover everything a company must disclose in its Exchange Act reports, financial and nonfinancial. They make sure that information is recorded, processed, summarized and reported on time. Management, with the certifying officers, evaluates them every quarter.
ICFR is narrower. It covers the reliability of financial reporting and the financial statements prepared for outside users. Each quarter, the company discloses material changes in ICFR; the full assessment is annual.
The overlap is large, and a weakness in ICFR usually means disclosure controls are not effective either. Your program should treat them as one system with two reporting cycles.
The checklist
1. Risk assessment and scoping
What the auditor tests. Auditors work top down: from the financial statements, to entity level controls, to significant accounts, disclosures and their relevant assertions, and then to the controls that address those risks. Auditors focus testing on the controls that address a reasonable possibility of material misstatement in a relevant assertion. Controls that do not address that kind of risk generally do not need to be tested.
What passes. A written scoping document that links each significant account and disclosure to its assertions, the processes that feed it, the applications those processes run on, and the key controls. Every location, account and application should show why it is in or out. First year programs that skip this step tend to test too much in the wrong places and too little where the risk is.
Check: Can you trace any line on the balance sheet to a named key control and a named owner?
2. Entity level controls and tone at the top
What the auditor tests. The control environment and the other COSO 2013 components: risk assessment, information and communication, and monitoring, alongside control activities. Expect testing of the code of conduct and its acknowledgment, the whistleblower process, audit committee oversight, the fraud risk assessment and the period end close. Ineffective audit committee oversight of financial reporting and internal control is an indicator of a material weakness.
What passes. Dated evidence that these things happened, not that a policy exists: audit committee minutes showing the controls were discussed and questioned, a fraud risk assessment with named risks and responses, signed acknowledgments for the population, and a hotline log with each matter tracked to closure.
3. Process narratives and control documentation
What the auditor tests. Walkthroughs. The auditor follows a transaction from origination through your processes and systems until it is reflected in your financial records, using the same documents and IT your staff use, and combines inquiry, observation, inspection and re-performance.
What passes. A narrative per process that matches what actually happens, and a risk and control matrix where every control states who performs it, what they do, how often, using which information, and what evidence it leaves. "The controller reviews the reconciliation" will not pass. "Monthly, the assistant controller compares the subledger to the general ledger, investigates differences over the stated threshold, and signs and dates the reconciliation in the close tool" can be tested.
4. IT general controls that support key controls
What the auditor tests. Access to programs and data, program changes, IT operations and, where relevant, program development, for each application and database that supports a key control or produces a key report. IT risks are identified as part of the top down approach, not as a separate exercise.
What passes. Complete populations. User access reviews where the reviewer received a full user list, generated from the system with its parameters shown, and documented what was changed. New user and termination evidence tied to HR records. Every production change in the period tied to an approved ticket, with a test record and someone other than the developer moving it to production. Where change runs through pull requests and deployment pipelines, the pipeline settings are the evidence.
ITGCs come first because automated controls, system enforced segregation of duties and system generated reports all depend on them. If the ITGCs fail, much of what sits above them has to be tested again by other means.
5. Segregation of duties and compensating controls
What the auditor tests. Whether one person can initiate, approve, record and reconcile the same transaction, both in the role design and in the access the system actually grants.
What passes. A conflict matrix run against real system access, not job titles, with each conflict either removed or covered by a documented compensating control. Small finance teams cannot always separate duties. Common compensating controls are:
- An independent review of all manual journal entries posted by people with conflicting access, using a system generated report of every entry they posted.
- A periodic review of that user's activity log by someone outside the process.
- Independent review of vendor master and bank detail changes against a change report.
- A user access review performed by someone who does not hold the access.
Auditors generally accept a compensating control when it is precise enough to catch a material error from the conflict, runs at a frequency matching the risk, and rests on a complete report. A month end glance at the trial balance does not compensate for unrestricted posting access. Where the compensating control is weaker than the risk, expect the conflict to be evaluated as a deficiency.
6. Completeness and accuracy of key reports and spreadsheets
Whenever a control relies on company produced information, the auditor must test that the information is complete and accurate, or test the controls over it, including ITGCs and automated controls. Weak testing of company produced reports, along with untested precision of review controls, has been among the recurring deficiencies PCAOB inspectors find in ICFR audits.
What passes. Start with an inventory: every report and spreadsheet used in a key control, its source system, its owner and the controls that use it. Then, for each:
- Tie to source. Agree report totals to the general ledger or subledger, and trace a selection both ways: from report to source for accuracy, from source to report for completeness.
- Parameters and logic. Capture the run date, period, entity and filter settings on the face of the report or in a screen shot. For custom reports and queries, document the logic and have someone other than the author check it.
- Version control. For spreadsheets, lock formulas, keep a change log, and record which version was used for the period's control.
- ITGC dependence. A standard report out of a system with effective change control may need a baseline test and a check that it has not changed. A custom report, or one from a system with weak ITGCs, needs testing each time it is relied on.
Retest when the report logic, the source system or the parameters change, and at least once in each period the auditor relies on.
7. Management review controls: precision and evidence
What the auditor tests. Whether the review is precise enough to catch a material misstatement. The threshold for investigating differences, relative to materiality, is a key measure of precision; a review that looks only at items near materiality is less precise than one with a lower threshold, and consistent reviews are more precise than occasional ones.
A worked example. A monthly review of operating expense variances.
- Expectation. Each line is compared with the prior month and the budget, adjusted for known events such as a new lease or an annual bonus accrual.
- Threshold. Any variance above a stated amount or a stated percentage, whichever is lower, is investigated. The amount is set well below planning materiality and written into the control description, so every reviewer applies the same one.
- Information. The variance report carries its parameters and has been tested for completeness and accuracy, as in item 6.
- Follow up. Each flagged line has a written explanation with support attached: an invoice, a contract, a corrected entry. "Timing" with nothing behind it does not count.
- Resolution. Errors found are corrected, with the journal entry referenced in the review.
- Sign off. The reviewer signs and dates the package after the follow up is complete, not before.
An auditor reading that file can see what the reviewer looked at, what they questioned and what they did about it. A signature on a report, with no trail between, shows only that someone held the paper.
8. Rating and fixing deficiencies
How deficiencies are rated. A control deficiency exists when a control does not prevent or detect misstatements on time. A significant deficiency is less severe than a material weakness but important enough to merit the attention of those overseeing financial reporting. A material weakness is a deficiency, or combination of deficiencies, that creates a reasonable possibility that a material misstatement will not be prevented or detected on time, and it can exist even when the financial statements contain no error.
Deficiencies are evaluated together. Several small failures in the same account, assertion or COSO component can combine into a significant deficiency or a material weakness. Your own deficiency log should group them that way before the auditor does.
One or more material weaknesses means ICFR is not effective, and the auditor's opinion on ICFR cannot be qualified; it is adverse. The auditor must also report significant deficiencies and material weaknesses in writing to management and the audit committee.
What credible remediation looks like. A redesigned control, a compensating control while it is built, and enough operation of the new control to test it: a few quarters for a quarterly control, fewer months for a monthly one, depending on the auditor's sampling approach. Practice varies, so agree the remediation period with your auditor early.
The year one timeline
The first annual report after an offering carries no management ICFR report, but it is not a free year. The auditor still learns about your controls through the financial statement audit and must report any material weakness it finds to management and the audit committee. Companies generally disclose such weaknesses, and the quarterly certifications continue, though in a slightly reduced form during the transition. Use that first year to scope, document, fix the ITGCs and get controls operating, so the second year is spent testing rather than building.
Testing cadence and what drives cost
How much a control must be tested depends on how often it runs, how long it is relied on, how relevant and reliable the evidence is, and the nature of the control. Inquiry alone is never enough to conclude a control works; inspection and re-performance carry more weight. A typical cadence is design and walkthroughs in the first half, interim testing in the third quarter, and roll forward testing through year end, with quarterly updates for any control that changed.
Cost is driven less by company size than by a handful of choices:
- Number of key controls. Programs that call every control key test far more than they need to.
- Manual versus automated controls. Automated controls with effective ITGCs need far less testing than manual ones.
- Number of systems and locations in scope.
- Report testing. Undocumented custom reports get retested every period.
- Rework. Evidence that fails the first time is the most expensive testing there is.
- Auditor reliance. Management testing built to the auditor's standard may let the auditor use more of it. How much is their decision.
Where outside help fits
Your external auditor will tell you a control failed. Independence rules keep the auditor from designing or building the fix, so that work sits with management. We are an advisory firm, not a CPA firm. We do not audit or issue opinions; we help management get ready for the auditor who does.
Our audit readiness and ICFR work covers each item above: readiness reviews, ITGC and business process testing, key report and SOC 1 reviews, deficiency remediation, pre IPO roadmaps and a fractional compliance lead. The work is led by someone who spent thirteen years in public accounting defending audit work through PCAOB inspections, and it starts with a free two hour scoping call followed by a short letter with deliverables, dates and a fixed fee. If an auditor, examiner or regulator writes up a deficiency on a control we documented and tested, we remediate it at no charge, and twenty percent of each fixed fee waits until the controls in scope pass testing. More on how we work is on the home page.
If an offering date or audit planning meeting is set, send us the date and a line about what is coming.
Frequently asked questions
Does an emerging growth company need a SOX program?
Yes. An EGC can be exempt from the auditor's attestation for a period, but management still certifies quarterly under Section 302 and still assesses ICFR once the transition period ends. A weak program also shows up in financial statement audit findings, lender diligence and the audit committee's questions.
How many key controls should a first year program have?
There is no right number. It depends on the accounts, processes and systems in scope after top down scoping. The useful test is whether each key control addresses a named risk to a relevant assertion that no other key control already covers. Duplicates and controls that map to no risk add testing cost without adding assurance.
Can the external auditor rely on management's testing?
Sometimes, to a degree the auditor decides. Reliance is more likely when the testing is done by competent, objective people and documented to the auditor's own standard, with complete populations, appropriate samples and evidence the auditor can re-perform. Ask your auditor early which areas they would consider.
What is the most common reason controls fail testing in year one?
Evidence, more often than design. Review controls with no record of what was examined, reports used without completeness and accuracy testing, and access reviews performed on incomplete user lists are frequent causes. Each is fixable before testing if found early.
Do you perform the SOX audit?
No. We work for management as advisors, are not affiliated with any audit firm, and will confirm that in writing for your auditor's independence file. The audit and the opinion stay with your CPA firm.