A management review control is a person looking at numbers and deciding whether they are right. It only counts as a SOX control if it is precise enough to catch a material error, and if you can prove it did. A signature on a report is not evidence of precision.
Last reviewed: 17 October 2026. Facts checked. We opened the SEC's 2007 interpretive guidance (Release 33-8810, govinfo.gov; first 100,000 of about 161,000 characters read) and KPMG's IPE page. We searched for management review control guidance; the result was a consultancy paper (CFGI), which we did not open, so we use its points only as search-snippet context and as practitioner view. We did not open PCAOB AS 2201 (403 error). The SEC guidance does not single out management review controls, so the design checklist below is practice, not a rule.
SOX applies to companies subject to US securities law. Indian companies are covered only where they are SEC registrants or part of a group that is.
Why these controls get challenged
Review controls are common: variance review, reconciliation review, journal review, forecast review. They are also easy to write badly. "Controller reviews the reconciliation monthly" does not say what is checked, what counts as an exception or what happens next.
The SEC guidance says entity-level and other controls can address a risk if they operate at a sufficient level of precision. It says compensating controls must operate at a level that would prevent or detect a potentially material misstatement. The idea is the same: the control must be sharp enough for the risk.
The five parts of a precise review control
| Part | What to write | Weak example | Better example |
|---|---|---|---|
| Who | Role, with a backup | "Finance" | Financial controller; deputy if absent |
| What is reviewed | Named report or schedule | "The numbers" | Month-end variance report by account |
| Threshold | The level that triggers a query | "Large items" | Any variance above a set amount or percentage |
| Procedure | What the reviewer actually does | "Reviews" | Compares to prior month and budget, asks for reasons, agrees explanations to support |
| Follow-up | What happens to exceptions | "As needed" | Items logged, cleared before close, with a sign-off |
Set the threshold from your materiality work, and lower than materiality. See SOX materiality. Pick the numbers yourself and justify them. We do not give a number.
Check the data used in the review
A reviewer can only be as good as the report in front of them. Test the information the control relies on, as set out in IPE testing. If the report is incomplete, the review cannot detect the missing item.
What evidence shows precision
A signature shows the review happened. It does not show how good it was. Keep:
- The report reviewed, with date.
- The reviewer's marks, queries or notes.
- The list of items above the threshold.
- Explanations received and the support checked.
- Adjustments made as a result.
- Sign-off with date, before the close deadline.
For a sample of occurrences, the tester should be able to see a past query and how it was cleared.
Design checklist
- Is the risk named and linked to an assertion?
- Is the reviewer competent and independent of preparing the item?
- Is the threshold written and approved?
- Does the reviewer investigate above the threshold, not just notice it?
- Is the follow-up recorded?
- Is the underlying report tested?
- Does the review happen in time to correct the books?
If you answer no to any, redesign before testing.
How testers assess it
Testers ask the reviewer to walk through a past review. They look for exceptions found, the reasoning, and whether a different answer would have been reached for a material error. A control that has never produced a query in twelve months invites a question: is the threshold too high, or is the reviewer not looking?
Use walkthroughs to see this in practice, and record the result in the control test workpaper.
Common failures
- Threshold missing or set above materiality.
- Review done after the numbers were reported.
- Preparer reviews their own work.
- Only a tick mark as evidence.
- Explanations accepted without checking support.
- Reviewer relies on a spreadsheet no one tested.
A worked example
Control: each month the controller reviews the variance report for operating expenses by account.
- The report is agreed to the ledger total before the review starts.
- Any account that moves beyond the written threshold is queried.
- The account owner replies with a reason and support, such as an invoice or contract.
- The controller agrees the support, logs the item and signs off before the close deadline.
- If the support is weak, a correcting entry is posted.
A tester can pick a month, find the queries, see the support and re-perform the comparison. That is precision shown by evidence, not by signature.
Frequently Asked Questions
Is a management review control a key control?
It can be, if it addresses a significant risk.
Can one review cover many accounts?
Yes, if the thresholds and procedures are precise for each account at risk.
Do I need a quantitative threshold?
A threshold, quantitative or qualitative, helps the control to be defined. Write it down.
What if the reviewer is the CFO?
That is fine if the review is performed and evidenced. Keep notes of queries.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error