How to perform a SOX risk assessment and build the RCM

To perform a SOX risk assessment, work top down, starting with materiality set from the financial statements. Then identify the significant accounts, disclosures and relevant assertions, and map each one to the processes, locations and systems that produce it. Next, write down what could go wrong at each step, and choose the few controls that would catch it, along with the IT general controls those controls depend on. The risk and control matrix (RCM) is where the second half of that chain is recorded. The risk assessment is the reasoning behind it, and an auditor reads both.

This guide walks the chain the way it has to be defended in front of an external auditor and, behind the auditor, a PCAOB inspection team. It is general information. Your external auditor and qualified advisers should confirm how it applies to your company.

Risk assessment vs risk and control matrix

People use the two terms as if they meant the same thing. They do not.

The risk assessment decides scope. It records the materiality you used, which accounts and disclosures are significant and why, which assertions are relevant, which locations and business units are in, which systems matter, and where fraud could occur. It is a judgment document, and its value lies in the reasons it gives.

The RCM turns that scope into something you can operate and test. Each row links a risk (what could go wrong for an assertion in a process) to the control that addresses it, with enough detail for someone to perform the control, test it, and conclude on it.

The connection between them is traceability. Every risk in the RCM should trace back to a significant account and assertion in the risk assessment. Every significant account and relevant assertion should trace forward to at least one risk and control. If a line breaks in either direction, an auditor will find it. A control with no risk behind it is cost. A risk with no control is a gap.

Under PCAOB AS 2201, risk assessment underlies the whole audit of internal control. It drives which accounts are significant, which controls get tested, and how much evidence each control needs. The SEC's 2007 interpretive guidance for management describes the same top-down, risk-based approach. Following it is one way to satisfy management's evaluation requirement, but it is voluntary.

Step 1: Set materiality for scoping

Begin with the same materiality your auditor uses. AS 2201 has the auditor plan the controls audit on the materiality used for the annual financial statement audit. If you scope on a different number, you can end up testing a set of controls the auditor will not rely on. Ask for the planning materiality and the benchmark behind it at the audit planning meeting.

Building it yourself goes like this:

1. Pick a benchmark that reflects what users of the statements watch. That is often pre-tax income from continuing operations. Revenue, total assets or equity may fit better for a company near break-even, a growth company or a financial institution.
2. Apply a percentage as a starting point, not a rule. SEC Staff Accounting Bulletin 99 accepts a percentage such as 5% as a rule of thumb for a preliminary assumption. It also warns that the percentage is only where the analysis begins. SEC staff have since said materiality should not be mechanical or purely quantitative.
3. Set a scoping threshold below materiality. Accounts are compared to a lower threshold so that misstatements across several accounts are not missed when added together. The fraction differs by firm and by risk. Document the one you chose and why.
4. Write it down once. Record the benchmark, the figure, the threshold and the reasoning in the risk assessment, and leave them alone unless the facts change.

Step 2: Map the trial balance to significant accounts, assertions and processes

Group the general ledger accounts into the line items and disclosures in the financial statements. Then decide which are significant. An account is significant if there is a reasonable possibility it could contain a misstatement that would be material, alone or together with others. That covers both overstatement and understatement, and it is judged on inherent risk, before considering any controls.

Size is the first filter, not the only one. The worked example below compares each balance to the scoping threshold, adds the qualitative factors, and then names the assertions, process and systems.

Do the same for disclosures. Under AS 2201, significant accounts and relevant assertions are the same for the controls audit as for the financial statement audit, so your list should match the auditor's.

The PCAOB lists the assertions as existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure. An auditor may group them differently, as long as all of these areas are covered. Not every assertion is relevant to every account. Say which ones are and why.

Step 3: Weigh the qualitative risk factors

AS 2201 has the auditor weigh qualitative factors alongside size. Examples include:

• the volume, complexity and homogeneity of transactions
• possible significant contingent liabilities
• related party transactions in the account
• changes in the account's characteristics from the prior period

In practice, also look for:

• estimates and judgments, such as reserves, impairments and fair values
• manual journal entries and spreadsheets in the path
• new contract types, products or accounting standards
• prior year audit adjustments or deficiencies

A small account with heavy judgment can be significant. A large, routine account still is. Write down the factor that made the call.

Step 4: Build fraud risk into the assessment

A separate fraud memo that never reaches the RCM will not hold up. COSO Principle 8 asks you to consider the types of fraud that could occur, along with incentives and pressures, opportunities, and attitudes and rationalizations. AS 2201 has the auditor consider the fraud risk assessment and evaluate whether controls address fraud risk and management override.

Make it concrete:

• Name the schemes that fit your business: revenue recognized early, reserves smoothed, expenses capitalized, payments to fictitious vendors.
• Flag the RCM rows that answer each fraud risk.
• Cover override directly. Include journal entry review, controls over top-side and post-close entries, and segregation of duties in the ERP.

The PCAOB notes that override controls may matter most at smaller companies, where a few people hold a lot of access.

Step 5: Scope locations and business units

With multiple locations, identify significant accounts and assertions from the consolidated statements first. Then decide location by location. A practical tiering:

• Full scope. Locations that carry a significant account on their own, or show high risk such as a recent system change, weak oversight or history of error. Test process level controls.
• Specific scope. Locations where only certain accounts reach the threshold. Test those accounts.
• Entity level only. Lower-risk locations, where testing entity-level controls may be enough.
• Excluded. Locations that present no reasonable possibility of material misstatement, alone or combined with others, may be dropped from further consideration.

The words "combined with others" are where most errors happen. Twenty small locations that each fall below the threshold can be material together. Add them up before you exclude them, and document what entity-level or centralized controls reach them.

Many teams track the share of consolidated revenue and assets that in-scope locations cover, as a check on judgment. The standards set no fixed percentage, so treat coverage as evidence for your reasoning, not a target.

A few special cases:

• Acquisitions. Entities acquired on or before the assessment date belong in scope. SEC staff have allowed a current-year acquisition to be excluded from management's assessment when it cannot be assessed in time. The exclusion is limited to one year from the acquisition date and one annual report, and it must be disclosed.
• Discontinued operations on the assessment date stay in scope.
• Equity method investees. Scope covers your controls over reporting the investment, ordinarily not the investee's own controls.

Step 6: Scope systems, ITGCs and service organizations

Identifying IT risks is part of the same top-down approach, not a separate exercise. For each significant process, list the applications, databases and interfaces that do any of the following:

• initiate, record or process transactions
• calculate amounts
• enforce segregation of duties
• produce reports used in controls

Those systems are in scope. The ITGCs over them are in scope too, because automated controls, IT-dependent manual controls and system-generated reports only work as well as the access and change controls beneath them.

The SEC's management guidance names four ITGC areas:

• access to programs and data
• program changes
• computer operations
• program development

Map each in-scope system to the ITGCs that cover it, at every layer that matters: application, database, operating system, and the cloud platform where relevant. If change control runs through pull requests and deployment pipelines, the evidence lives there.

Service organizations need their own line. Where a provider runs a process or hosts a system in scope, such as payroll, a billing platform or a data center, you need a SOC 1 Type 2 report for the right period. You also need to check what it actually covers:

• the opinion and the exceptions
• any subservice organizations carved out of the report
• the complementary user entity controls your team must operate

Map those user entity controls into your RCM as real controls. Cover the data flowing to and from the provider with interface or reconciliation controls. Where the report stops short of your year end, plan for a bridge letter.

Step 7: Write the RCM

Keep the key control set lean. SEC staff observed that early Section 404 programs listed too many controls that did not matter to financial reporting objectives. A key control is one you would defend as the reason a risk is covered.

The columns an auditor expects to read:

• Risk ID and risk statement. What could go wrong, in a specific process step.
• Account, disclosure and relevant assertion the risk affects.
• Process and subprocess.
• Fraud risk flag, where applicable.
• Control ID and description. Who performs it, what they do, when, using what, and to what threshold.
• Control owner, by name and role.
• Frequency. Per transaction, daily, weekly, monthly, quarterly, annual.
• Type. Preventive or detective.
• Nature. Manual, automated or IT-dependent manual.
• Key or non-key.
• Systems and the ITGCs relied on.
• Information produced by the entity (IPE). The reports and spreadsheets the control uses.
• Precision. Threshold, level of aggregation, and what triggers investigation.
• COSO component and principle.
• Evidence retained, and the test procedure reference.

Precision, thresholds and IPE in management review controls

Management review controls, such as flux analysis, reserve reviews and impairment memos, draw the most inspection comments. PCAOB staff guidance ties precision to five things:

• the control's purpose
• the level of aggregation
• consistency of performance
• correlation to the assertion
• the investigation threshold

A review that only investigates differences near financial statement materiality is less precise and riskier. Write the threshold into the control description. Say what the reviewer compares against, what counts as follow-up, and what evidence shows the follow-up happened.

For every report or spreadsheet the review uses, name it in the IPE column. Then say how its completeness and accuracy are addressed: either a direct test, or reliance on the ITGCs and application controls over it. AS 1105 requires the auditor to test IPE's accuracy and completeness or the controls over it, and to check that it is precise and detailed enough.

Keep it current: the annual refresh and mid-year triggers

Refresh the risk assessment every year, before the audit planning meeting, against the new materiality and the new trial balance. COSO Principle 9 also asks you to identify changes that could significantly affect internal control as they happen.

Events that should reopen scope mid-year:

• an acquisition or divestiture
• an ERP migration or major system change
• a new accounting standard
• a reorganization or shared service move
• a new revenue stream or contract type
• turnover in a key finance or IT role
• AI introduced into the close

A sensible approval path:

1. The control owner proposes the change.
2. The SOX lead reviews the risk link.
3. The controller or CFO approves.
4. The auditor hears about it early.
5. The audit committee is told when scope moves materially.

Note one date in the planning calendar. Note one date in the planning calendar. Amendments to AS 2201, AS 2110 and AS 2101 that came with the PCAOB's new quality control standard, QC 1000, take effect on December 15, 2026, after a one-year postponement. They are mostly conforming changes, but ask your auditor what changes in their approach. Ask your auditor what changes in their approach.

Common deficiencies in RCMs

• Risk statements that are the control turned around. "Risk: invoices are not approved." That says nothing about the misstatement.
• Control descriptions that restate a policy, with no performer, threshold or evidence.
• Significant accounts or relevant assertions with no risk mapped, or risks mapped to no assertion.
• Review controls with no stated precision, or a threshold close to materiality.
• IPE missing from the matrix, so nobody tests the reports the reviews rely on.
• ITGCs listed but not linked to the applications and controls that depend on them.
• Complementary user entity controls from SOC 1 reports that never made it into the RCM.
• Unmapped COSO principles. No control maps to a principle, often fraud risk or change identification.
• Bloated key control counts: duplicates, orphans, and controls with owners who left.
• Spreadsheets in the close with no access or change control. ISACA reports that access over end-user computing tools and the integrity of IPE remain common sources of material weakness.

Remember that several deficiencies on the same account, assertion or COSO component can add up to a material weakness, even when none is severe alone.

Where we come in

We do this work with management, before the auditor tests it. Our SOX and ICFR readiness review typically runs three to five weeks. It ends with:

• the in-scope process and application list, with the reason each item is in
• a gap list with an owner and a date on every line
• a one-page summary for the audit committee

From there, we document and test the controls starting with the ITGCs, or rationalize an RCM that has outgrown its platform. The details are on our services page. The standard we build to comes from years of defending this kind of scoping through PCAOB inspections, described on our experience page. We are an advisory firm, not your auditor. The opinion stays with your CPA firm.

Start with a free two-hour scoping call. Send the date of your audit planning meeting and a sentence on what has changed this year. More about how we work is on the home page.

Frequently asked questions

What is the difference between a SOX risk assessment and an RCM?

The risk assessment decides what is in scope and why: materiality, significant accounts, assertions, locations, systems and fraud risk. The RCM records how each in-scope risk is controlled and tested. Every row of the RCM should trace back to the risk assessment.

Is there a required materiality percentage for SOX scoping?

No percentage is a rule. SAB 99 treats a percentage such as 5% as a preliminary rule of thumb that has to be followed by a full review of qualitative factors. Most companies start from their auditor's planning materiality and set a scoping threshold below it.

Can we exclude small locations from scope?

You can exclude locations that present no reasonable possibility of material misstatement, alone or combined with others. Test the aggregate first, and document the entity-level or centralized controls that still reach them.

How do ITGCs fit into the risk assessment?

They come from it. Once you know which systems support significant processes, controls and reports, the access, change, operations and development controls over those systems are in scope. Test them first, because the controls above them depend on them.

How often should the RCM be updated?

Every year before audit planning, and whenever a trigger occurs: an acquisition, a system migration, a new accounting standard, a reorganization or a new revenue stream. Changes should be approved by finance leadership and shared with the auditor early.

Will you perform our SOX audit?

No. We are an advisory firm working for management, and our work is not an attest engagement. We build and test the program so your external auditor finds it ready. The audit and the opinion remain with your CPA firm.