# Sox Compliance > SOX Compliance - Skill: `brainbytes-dev/sox-compliance` (Agent Skill) - Install (CLI): `npx skillmds@latest add brainbytes-dev/sox-compliance` - Raw SKILL.md: https://api.skillmd.com/api/skills/brainbytes-dev/sox-compliance/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: brainbytes-dev (https://skillmd.com/u/brainbytes-dev) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/brainbytes-dev/sox-compliance --- # SOX Compliance > Internal controls over financial reporting — Section 302/404, COSO framework, control testing, deficiency classification. ## When to Activate - SOX compliance program design or assessment - Internal control documentation (narratives, flowcharts, RCMs) - COSO framework application to financial reporting controls - Control testing strategy (design and operating effectiveness) - Deficiency evaluation (material weakness, significant deficiency) - Remediation planning for control deficiencies - SOX scoping and risk assessment - Management certification (Section 302) preparation - External auditor coordination for Section 404 integrated audit ## Core Concepts ### SOX Key Sections **Section 302 — Corporate Responsibility for Financial Reports:** - CEO and CFO must personally certify each quarterly and annual filing - Certify they have reviewed the report and it contains no material misstatements - Certify they are responsible for establishing and maintaining ICFR - Certify they have disclosed any significant changes in internal controls - Criminal penalties for knowingly false certification **Section 404(a) — Management Assessment:** - Management must assess the effectiveness of ICFR as of fiscal year-end - Must include a statement of management's responsibility for ICFR - Must identify the framework used (typically COSO) - Must include management's conclusion: effective or material weakness exists **Section 404(b) — Auditor Attestation:** - External auditor must attest to and report on management's assessment - Applies to accelerated filers and large accelerated filers - Non-accelerated filers and EGCs permanently exempt from 404(b) - Auditor issues opinion on effectiveness of ICFR (integrated audit) **Section 906 — Criminal Penalties:** - Enhanced criminal penalties for certifying non-compliant reports - Up to $5M fine and 20 years imprisonment for willful violations ### COSO Framework — Internal Control — Integrated Framework (2013) **Five Components:** 1. **Control Environment** — The tone at the top - Integrity and ethical values (Principle 1) - Board independence and oversight (Principle 2) - Organizational structure, authority, responsibility (Principle 3) - Commitment to competence (Principle 4) - Accountability (Principle 5) 2. **Risk Assessment** — Identifying and analyzing risks - Specify suitable objectives (Principle 6) - Identify and analyze risks (Principle 7) - Assess fraud risk (Principle 8) - Identify and assess significant changes (Principle 9) 3. **Control Activities** — Policies and procedures that address risks - Select and develop control activities (Principle 10) - Select and develop technology controls (Principle 11) - Deploy through policies and procedures (Principle 12) 4. **Information and Communication** — Relevant, quality information flows - Use relevant, quality information (Principle 13) - Internal communication (Principle 14) - External communication (Principle 15) 5. **Monitoring Activities** — Ongoing and separate evaluations - Ongoing and/or separate evaluations (Principle 16) - Evaluate and communicate deficiencies (Principle 17) All 5 components and 17 principles must be present and functioning for ICFR to be effective. ### SOX Scoping **Top-down risk-based approach:** 1. **Entity-level controls (ELCs)**: Controls at the organizational level (governance, tone at the top, risk assessment, monitoring). Can be direct or indirect. Strong ELCs may reduce testing of process-level controls. 2. **Significant accounts and disclosures**: Identify financial statement line items with material misstatement risk. Consider: size, composition, susceptibility to misstatement, volume, complexity, exposure to fraud. 3. **Significant processes**: Map significant accounts to underlying business processes and IT systems. 4. **Key controls**: Identify controls that address the risk of material misstatement. Not all controls — only those that are key to preventing or detecting material misstatement. 5. **Locations/business units**: Multi-location scoping based on financial significance (typically: cover locations representing > 60-70% of consolidated financial metric). ### Control Types | Type | Description | Examples | |------|-------------|---------| | Preventive | Prevents errors/fraud before they occur | Segregation of duties, authorization limits, input validations | | Detective | Identifies errors/fraud after they occur | Reconciliations, variance analysis, exception reports | | Manual | Performed by a person | Management review, manual reconciliation, physical count | | Automated (ITAC) | Performed by IT system | Three-way match, automated calculations, system access controls | | IT General Controls (ITGCs) | Support reliable automated controls | Change management, access security, computer operations, program development | ### Deficiency Classification **Control Deficiency:** Design or operation of a control does not allow management or employees to prevent or detect misstatements on a timely basis. **Significant Deficiency:** A deficiency or combination of deficiencies that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight. **Material Weakness:** A deficiency or combination of deficiencies such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. If a material weakness exists, ICFR cannot be deemed effective. **Evaluation factors:** - Magnitude: What is the financial statement amount that could be affected? - Likelihood: How likely is it that a misstatement would occur and not be caught? - Nature: Fraud risk? Estimation? Complexity? - Compensating controls: Are there other controls that mitigate the risk? ## Methodology ### SOX Implementation Roadmap 1. **Scoping** (Q1): Risk assessment, identify significant accounts, processes, locations 2. **Documentation** (Q1-Q2): Process narratives, flowcharts, Risk and Control Matrices (RCMs) 3. **Design Assessment** (Q2): Evaluate whether controls, as designed, address the identified risks 4. **Remediation of Design Gaps** (Q2-Q3): Fix controls that are poorly designed 5. **Operating Effectiveness Testing** (Q3-Q4): Test that controls operated as designed throughout the period 6. **Deficiency Evaluation** (Q4): Classify deficiencies, assess aggregation 7. **Remediation** (ongoing): Fix identified deficiencies before year-end if possible 8. **Management Assessment** (year-end): Conclude on effectiveness of ICFR 9. **Auditor Attestation** (year-end): Coordinate with external auditor ### Control Testing **Design Effectiveness:** - Inquiry: Interview control owner about the control procedure - Observation: Watch the control being performed - Inspection: Examine the control documentation - Walkthrough: Trace a transaction end-to-end through the process **Operating Effectiveness — sample sizes:** | Control frequency | Minimum sample size | |-------------------|-------------------| | Annual | 1 | | Quarterly | 2 | | Monthly | 2-5 | | Weekly | 5-15 | | Daily | 20-40 | | Multiple per day | 25-60 | For automated controls: Test once per period (after confirming ITGCs are effective for change management and access). ### Remediation Planning 1. **Root cause analysis**: Why did the control fail? 2. **Remediation action**: Redesign, retrain, add compensating control 3. **Owner and timeline**: Who is responsible, by when? 4. **Validation testing**: Test the remediated control for design and operating effectiveness 5. **Sustainability**: Monitor to ensure the fix holds ## Templates ### Risk and Control Matrix (RCM) ``` Process: _______________ Significant Account: _______________ Risk ID Risk/Assertion Control ID Control Description Type Frequency Owner Test Result R-001 Completeness C-001 ___________________ Prev/Det Daily __________ Pass/Fail R-002 Valuation C-002 ___________________ Prev/Det Monthly __________ Pass/Fail R-003 Existence C-003 ___________________ Prev/Det Quarterly __________ Pass/Fail R-004 Fraud risk C-004 ___________________ Prev/Det _________ __________ Pass/Fail ``` ### Deficiency Evaluation ``` Deficiency ID: _______________ Control: _______________ Description of deficiency: _______________ Magnitude assessment: Account balance affected: € _______________ Maximum potential misstatement: € _______________ Materiality threshold: € _______________ Likelihood assessment: [ ] Remote [ ] Reasonably possible [ ] Probable Compensating controls: _______________ Aggregation with other deficiencies: _______________ Classification: [ ] Control deficiency [ ] Significant deficiency [ ] Material weakness Remediation plan: _______________ Owner: _______________ Target date: _______________ ``` ## Quality Gate - [ ] SOX scoping follows top-down, risk-based approach - [ ] All significant accounts, processes, and locations are identified - [ ] COSO framework (all 5 components, 17 principles) is addressed - [ ] Entity-level controls are documented and assessed - [ ] RCMs exist for all significant processes - [ ] Control testing covers both design and operating effectiveness - [ ] Sample sizes are appropriate for control frequency - [ ] ITGCs are tested to support reliance on automated controls - [ ] Deficiencies are evaluated individually and in aggregate - [ ] Remediation plans have clear owners, timelines, and validation steps - [ ] Management assessment conclusion is supported by evidence