SOX 404 is the section of the US Sarbanes-Oxley Act of 2002 that requires the management of every SEC-registered company to assess and report each year on the effectiveness of its internal control over financial reporting (ICFR), and, for larger companies, to have the external auditor attest to that assessment.
SOX 404 has two parts:
- 404(a): management's annual assessment of ICFR, required of all SEC registrants
- 404(b): the auditor's attestation, required of accelerated and large accelerated filers. Since SEC amendments effective 27 April 2020, smaller reporting companies with annual revenue below 100 million dollars are not accelerated filers and are exempt from it
Most companies use the COSO 2013 framework as their internal controls framework, and auditors perform the attestation under PCAOB standard AS 2201. Controls are documented in a risk and control matrix, tested through a walkthrough and samples, and deficiencies are graded as control deficiencies, significant deficiencies or material weaknesses. A material weakness must be disclosed publicly.
SOX 404 reaches beyond US companies. The European subsidiary of a US-listed group applies the group's SOX controls locally, and its finance team produces the evidence the group auditor tests. French listed companies fall under a different regime, the 2003 Loi de sécurité financière, which requires a report on internal control procedures without a SOX-style auditor attestation on their effectiveness.
Phacet makes SOX evidence a by-product of daily operations. Each automated control runs on every transaction rather than on a sample, keeps a timestamped audit trail, and separates preparation from approval in line with segregation of duties, so the tested population is complete by design.
