Blog / SOX basics

SOX basics

The groundwork of a SOX program: what Section 404 asks of management, how controls are scoped into the year, and how one control travels from a row in the risk and control matrix to a test a reviewer will sign.

These guides are written for staff accountants, internal auditors and first-year SOX leads who need the whole picture before they test anything. They explain the terms that come up in every walkthrough and status meeting, such as RCM, test of design, test of operating effectiveness, population, sample and sign-off, and show how each step feeds the next so gaps are caught in the walkthrough instead of at year end.

Start with SOX control testing 101 for the seven steps end to end. When you are ready to size samples or plan the year, the Testing guides pick up where it stops, and Deficiencies covers what happens when a test fails.