PRODUCT

Everything a SOX testing cycle needs, in one workspace.

From the risk and control matrix through a signed-off, evidenced test, SOXLayer keeps plan, test, review and audit trail connected instead of scattered across spreadsheets and email.

SOXLayer dashboard showing open tests, deficiencies and tasks

PLAN

A multi-entity risk and control matrix, and plans that build themselves.

Each legal entity keeps its own controls, processes, tests and deficiencies, with a cross-entity view on top. SOXLayer suggests interim and roll-forward plans from your fiscal year end and testing deadlines, and one click turns a suggestion into a real plan.

Multi-entity risk and control matrix

  • Controls grouped by process, with risks mapped to each
  • Full control design: type, nature, frequency, owner, performer, reviewer
  • Controls are versioned as design changes over time
Risk and control matrix grouped by process
Control detail for a three-way match approval control

Every entity, and the whole company

  • Each legal entity has its own controls, tests and deficiencies
  • A cross-entity dashboard for the program as a whole
List of legal entities with controls and open items
Entity overview with tests by status and open deficiencies

Plans that fill themselves in

  • Suggested interim and roll-forward plans, one click to create
  • Sample sizes, due dates and preparers filled in automatically
  • A working calendar with company holidays and per-entity overrides
Interim test plan with assigned tests
Working calendar with working days and holidays

TEST

A guided flow from population to submission.

Every test follows the same guided path: Population, Sampling, Evidence, Test attributes, Conclude and submit, Review, Approve. Reusable templates define what "pass" means, so the same definition applies every time a control is tested.

  • Upload the population as CSV or Excel; SOXLayer totals it and fingerprints it with SHA-256
  • Judgemental sampling with a written justification, sized to company minimums
  • Evidence matched to samples automatically, unmatched files queued for review
  • Reusable, versioned test templates published once and used many times
Test workspace with guided steps and uploaded population
Library of reusable test templates

AI

The first pass, done for you, with a citation on every verdict.

For each sample, AI reads the evidence, proposes Pass, Fail, Insufficient or N/A for every attribute, and shows the exact quote and page it relied on. People still decide: accept, edit or override, always with a reason.

See the full AI testing deep dive
Five evidence attributes resolving to Pass with confidence, then Accept all Five evidence attributes resolving to Pass with confidence, then Accept all

REVIEW

Preparer, reviewer, approver, with segregation built in.

Review rounds carry ticked results and comments, and once approved a test locks. If the same person would hold conflicting roles, SOXLayer warns live rather than letting it slip through.

  • Segregation-of-duties checks warn live during assignment
  • Review rounds with comments attached to the test, not email
  • Approved tests lock
Testing page with a suggested roll-forward plan and test list

DEFICIENCIES

Exceptions become deficiencies, automatically linked.

A sample marked as an exception raises a deficiency automatically, linked back to the test and samples, with severity, root cause, remediation and a clear lifecycle.

  • Severity: control deficiency, significant deficiency, or material weakness
  • Root cause, remediation items with due dates, and retesting
  • Lifecycle: Open, Classified, Remediation, Closed
Deficiency register with severity and source

DOCUMENTS

Global documents, tracked and linked to the controls that use them.

Policies, procedures and reconciliations live in one library, with validity and expiry tracking, versioning, and links back to every control that relies on them.

  • Validity and expiry tracking on every document
  • Versioning, so you always know which copy was tested against
  • Linked to the controls that reference them
Global documents with validity tracking

AUDIT TRAIL

Every change, written down and checkable.

Every change is written to an append-only, hash-chained log: who, what, when, before and after, and the reason. Filter it, export it, and verify the chain in one click.

See the audit trail deep dive
Audit rows appearing with hashes, then the chain verified five out of five Audit rows appearing with hashes, then the chain verified five out of five

ACCESS

Invite people, scope them per entity, and see what they see.

Roles include control owner, preparer, reviewer, approver, viewer and external auditor. External auditors never get write access, and super admins can "View as" any role or person.

  • Per-role menus and capabilities, and roles can be switched off
  • "View as" any role or person
  • MFA policy: admins and approvers without MFA are flagged
Team list with roles per entity and MFA status
Matrix of roles and the menus and actions each can use

SETTINGS

Company settings that match how your team already works.

Numbering schemes, sample-size tables per frequency, testing deadlines, deficiency thresholds, data retention and security all live in company settings. Sign-in is Google or work email.

  • Your own sample-size table by control frequency
  • Numbering schemes for controls, tests and deficiencies
  • Google sign-in or work email
Company sample-size table by control frequency
SOXLayer sign-in screen with Google and work email options

Start your 14-day free trial.

Bring one control and its evidence. See the AI test it in minutes.

Start free trial Book a demo