SOX compliance and ICFR readiness for a management assessment that holds up under audit.

What it is

What is SOX compliance and what is ICFR?

The Sarbanes-Oxley Act of 2002 is a United States federal law that made the senior officers of public companies personally accountable for the reliability of what their companies report. Two of its provisions shape everyday finance work. Section 302 requires the principal executive and principal financial officers to certify each quarterly and annual report filed with the Securities and Exchange Commission. Section 404 requires management to assess the company's internal control over financial reporting every year and, for larger filers, requires the external auditor to report on it as well.

Internal control over financial reporting, usually shortened to ICFR, is defined in the SEC's rules as a process, designed under the supervision of those two officers and carried out by the board, management and staff, that gives reasonable assurance about the reliability of financial reporting and the preparation of external financial statements under generally accepted accounting principles. In practice it is the set of controls over journal entries, reconciliations, revenue, purchasing, payroll, the financial close, the systems that feed them and the tone set by leadership.

Current position. The Act was enacted on 30 July 2002. The SEC's rules on management's report were adopted in 2003 and are supported by the Commission's interpretive guidance for management of 27 June 2007. The auditor's work follows PCAOB AS 2201, which integrates the audit of internal control with the audit of the financial statements. There is no SOX certificate: compliance is shown through the certifications, management's report and, where required, the auditor's opinion.

Who it is for

Who needs SOX compliance?

The obligations fall on companies that file periodic reports with the SEC under the Securities Exchange Act, which includes foreign private issuers listed in the United States. Their reach is wider than the listed parent, because the assessment covers the consolidated group. Organisations come to Sterling for SOX readiness from four starting points:

• You are preparing for a US listing. Investors, underwriters and the audit committee expect a credible control environment from the first filing, and management's assessment will follow soon after it. Building controls before the listing costs far less than repairing them in public.
• Your filer status is changing. A company that becomes an accelerated filer, or that stops qualifying as an emerging growth company, moves into scope for the auditor's attestation. The controls then have to withstand a PCAOB-standard audit, not only an internal review.
• You are a subsidiary, shared service centre or acquired business of a US-listed group. When the parent's scoping brings your entity into the consolidated assessment, local finance and IT teams must document, operate and evidence controls on the group's timetable.
• Deficiencies keep recurring. The auditor has reported deficiencies, testing is carried by a few spreadsheets and the same people every year, or a material weakness has been disclosed and remediation must be proven.

Private companies outside the SEC's reach are not bound by the Act, but some adopt the same discipline ahead of a transaction or at a lender's or investor's request.

Requirements

What are the main SOX requirements?

SOX requirements come from the Act, the SEC's rules and the auditing standard. The map below is at title level; the exact obligations for your company depend on its filer status and are confirmed with your legal advisers and external auditor.

• Section 302 officer certifications: in every quarterly and annual report, the chief executive and chief financial officers certify that they reviewed it, that it contains no untrue statement or omission of a material fact, that it presents the financial position fairly, and that they are responsible for internal controls.
• Disclosure to auditors and the audit committee: the certifying officers report significant deficiencies in the design or operation of internal controls, and fraud, to the auditors and the audit committee.
• Disclosure controls and procedures: controls that make sure information required in SEC reports is recorded, processed, summarised and reported within the required time.
• Internal control over financial reporting: controls over accurate records, transactions recorded so that financial statements can be prepared under GAAP, and prevention or timely detection of unauthorised use or disposal of assets.
• Section 404(a) management's annual report: management's responsibility for ICFR, the framework used, its assessment of effectiveness as of the fiscal year end and a statement on the auditor's attestation where one applies.
• A suitable, recognised framework: the SEC accepts the COSO framework for the evaluation without mandating it; the framework must be free from bias, consistent, complete and relevant.
• Quarterly evaluation of changes: any change in ICFR during the quarter that materially affected it, or is reasonably likely to, is evaluated and disclosed.
• Section 404(b) auditor attestation: for accelerated and large accelerated filers, the registered public accounting firm expresses an opinion on ICFR under AS 2201, integrated with the financial statement audit.

Readiness route

How do you get ready for SOX 404?

SOX readiness is a management exercise, not a certification. Your officers sign, your management concludes and, where section 404(b) applies, your external auditor gives the opinion. Sterling works top-down and risk-based, the approach the SEC's guidance for management describes, so effort goes where a misstatement could be material.

1. 01
   Confirm what applies and scope the assessment.Establish filer status with your advisers, then select significant accounts, disclosures, locations and systems from the consolidated financial statements.
2. 02
   Gap analysis: map risks to controls.Document each in-scope process, identify what could go wrong in the numbers and compare existing entity-level, process and IT general controls with the COSO framework.
3. 03
   Remediate and operate the controls.Design missing controls, assign owners, train the people who perform them and let them run long enough to leave evidence.
4. 04
   Test design and operating effectiveness.Management testing, or a dry run on the auditor's methods, followed by a graded deficiency evaluation and remediation before year end.
5. 05
   Management's assessment and the external audit.Management concludes and reports; where section 404(b) applies, the registered public accounting firm performs its integrated audit under AS 2201 and issues its opinion.

Check the route before you sign. Confirm with your legal advisers which sections apply to your company and when, and confirm that your auditor is a registered public accounting firm. As good practice, keep readiness support separate from the firm that will audit your controls, so that no one tests their own work. SOC 1 reports for the service providers in your scope

Cost

How much does SOX compliance cost?

The cost of SOX readiness depends on what the consolidated group looks like, not on a standard rate. One entity on a single ERP with a stable close needs far less work than a group with acquisitions, several systems and manual spreadsheets at the heart of reporting. A Sterling proposal shows every component and one all-inclusive proposal.

Timeline

How long does SOX readiness take?

SOX readiness is paced by your fiscal year. Controls must exist and operate for long enough before year end for management, and the auditor where applicable, to test them. As an estimate, a first readiness programme takes 6 to 12 months from scoping to a supportable management assessment, shorter where controls are already documented and longer for multi-entity groups.

Share your listing date or first assessment year at the outset. We will show what can be ready and which decisions must be taken early.

Your engagement

What your SOX readiness engagement includes

Sterling OS™ organises the work. Choose Design™, where we guide your team and it does the build, or Drive™, where we manage the programme and do most of the documentation and testing; they are alternative levels of support, not stages. Sustain™ keeps the cycle running after the first assessment, and Automate™ is Effivity. We work alongside your legal advisers and external auditor.

• Scoping and gap analysis

  Significant accounts, entities and systems selected, with a remediation plan, owners and dates.

• Control documentation

  Narratives, flowcharts and a risk and control matrix built with your process owners.

• Effivity ISO & GRC software

  Controls, tests and evidence in one workspace, included with the engagement at no additional cost.

• Training for control owners

  Internal auditor training for your testing team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Management testing and deficiency evaluation

  Design and operating tests performed or facilitated as agreed, with deficiencies graded and remediated.

• External audit readiness

  Evidence organised for the auditor's requests and support through walkthroughs and testing.

Sterling does not audit or attest; management owns the assessment and the registered public accounting firm issues its own opinion.

Often combined with

Standards organisations pair with SOX / ICFR readiness

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.