SOX controls are the controls over financial reporting that management must assess under Section 404. They sit in three layers: entity-level controls that set the tone, process-level controls that sit inside transaction cycles, and IT controls that keep systems reliable. Most teams get into trouble by testing only the middle layer.
Last reviewed: 17 October 2026. Facts checked. We opened 15 U.S.C. 7262 (Cornell LII) and the SEC's 2007 interpretive guidance on management's report (Release 33-8810, Federal Register text on govinfo.gov; we read roughly the first 100,000 of about 161,000 characters). We did not open PCAOB AS 2201, because the PCAOB page returned a 403 error. Framework descriptions beyond these sources are practitioner explanation, not a quotation from a standard.
SOX applies to companies subject to US securities law. An Indian company is covered only if it is an SEC registrant, or part of a group that is. See SOX compliance for Indian subsidiaries of US-listed companies.
What "SOX controls" means
Section 404 requires management to include an internal control report in each annual report. The report assesses whether internal control over financial reporting is effective at year end. Auditor attestation is separate and does not apply to every company. For the detail, read SOX 404 management assessment vs auditor attestation.
So a SOX control is not any control. It is a control that addresses a risk of material misstatement in the financial statements.
The three layers at a glance
| Layer | What it covers | Typical example | Where it can fail |
|---|---|---|---|
| Entity-level | Whole-company environment and oversight | Audit committee reviews results; code of conduct; whistleblower line | Too vague to catch a specific error |
| Process-level | A transaction cycle such as order to cash | Three-way match; credit note approval; bank reconciliation review | Control exists but is not performed or evidenced |
| IT | Systems that support the other controls | Access, change management, operations | Automated controls cannot be trusted if IT is weak |
Entity-level controls
These operate across the company. They include the control environment, risk assessment, monitoring and the financial close process. The COSO 2013 five components are the usual structure.
The SEC guidance says management ordinarily considers entity-level controls when it assesses risks and picks controls. It also says indirect entity-level controls have limited value alone. In its words, it is unlikely that management will identify only this type of entity-level control.
Some entity-level controls are direct. A monthly review of consolidated results against budget, with a defined investigation threshold, can catch errors in a specific account. That is closer to a process control and needs the same precision.
Evidence to keep:
- Audit committee minutes showing what was reviewed and challenged.
- Signed code-of-conduct acknowledgements.
- Whistleblower log with follow-up.
- Close checklist with sign-offs and dates.
Process-level controls
These sit inside cycles: revenue, purchasing, payroll, inventory, treasury, fixed assets, financial close. Each is tied to a risk and a financial statement assertion, such as existence or completeness.
Process-level controls are either manual (a person approves), automated (the system blocks a payment without a match) or a mix. For worked rows, see key controls examples for order to cash and procure to pay.
A good control row names:
- The risk.
- What is done, in one sentence.
- Who does it.
- How often.
- What evidence it leaves.
You can build rows with the internal audit RCM builder or the SOX risk control matrix template.
IT controls
The SEC guidance says IT general controls alone ordinarily do not adequately address financial reporting risks. It also says management needs to evaluate only the IT general controls that other relevant controls depend on.
Read that as a scoping rule. If a three-way match is automated, you test the match configuration and the IT controls that protect it. You do not test every system in the company.
The usual IT general control areas are access, change management and operations. Our SOX ITGC testing guide covers them. Application controls, such as system-enforced approvals and calculations, rely on them.
How the layers work together
Take a revenue risk: sales booked in the wrong period.
- Entity-level: the close calendar and a cut-off policy approved by the CFO.
- Process-level: a reviewer compares shipments in the last week of the month to invoices raised.
- IT: the shipment report used in that review comes from a system whose access and changes are controlled.
If the third layer fails, the second is weakened. The report may be wrong. See IPE testing.
Common mistakes
- Treating the policy manual as the control.
- Listing hundreds of controls when only some address a material risk.
- Writing review controls as "reviewed" with no threshold.
- Forgetting spreadsheets and reports used inside controls.
- Not recording who performed the control and when.
Frequently Asked Questions
Are entity-level controls enough on their own?
No. The SEC guidance says indirect entity-level controls rarely stand alone. You normally need process-level controls for significant accounts.
Are IT general controls "SOX controls"?
Yes, where other relevant controls depend on the system. They are in scope because of that dependency.
How many controls should a company have?
There is no fixed number in the sources we opened. The test is whether controls address the risks of material misstatement.
Does an Indian company need SOX controls?
Only if it is an SEC registrant or part of a group that is. Otherwise, see SOX controls vs IFC under the Companies Act.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error