Remediation means fixing the cause of a control failure, giving the new control time to operate, and then testing it again. A fix that is only a policy change is not remediation. Plan the work early, because a control that is redesigned late may not have enough time to prove itself before year end.
Last reviewed: 17 October 2026. Facts checked. We opened the SEC's 2007 interpretive guidance (Release 33-8810, govinfo.gov; first 100,000 of about 161,000 characters read) and 17 CFR 229.308 (Cornell LII). We searched for SEC staff views on remediation; results were a law-firm summary and comment letters, which we did not open. We did not open PCAOB AS 2201 (403 error), so we give no minimum operating period or sample size. Those come from your methodology and your auditor.
SOX applies to companies subject to US securities law. Indian companies are covered only where they are SEC registrants or part of a group that is.
What the SEC guidance says
The SEC guidance says the severity of a deficiency does not depend on whether a misstatement actually occurred. It depends on whether there is a reasonable possibility one could. Multiple deficiencies affecting the same amount or disclosure may combine into a material weakness. Management may not conclude that internal control is effective if there is a material weakness. This is also in Item 308 of Regulation S-K.
On remediation, the guidance says that if all material weaknesses are fixed by year end, management may conclude internal control is effective. It should still consider whether to disclose the earlier weaknesses. Companies should also consider disclosing plans and actions to remediate a material weakness.
To classify the gap first, see classifying deficiencies and the SOX deficiency evaluation worksheet.
Step 1: Find the root cause
Do not fix the symptom. Ask why the control failed.
| Symptom | Possible root cause |
|---|---|
| Reviews not signed | Reviewer overloaded or unclear who owns it |
| Wrong data in a review | Report not tested (see IPE) |
| Leavers still active | No HR-to-IT trigger |
| Late close adjustments | Weak close calendar |
| Changes without approval | Developers can deploy directly |
Use the 5 whys when the cause is not obvious.
Step 2: Choose the fix
Options, from weakest to strongest:
- Reinforce the existing control through training. Weak on its own.
- Redesign it with a clearer threshold, owner or evidence.
- Automate it so the system enforces it.
- Add a second control that covers the gap.
- Remove the risk, such as by closing a process or system.
Pick the least costly fix that really removes the root cause.
Step 3: Write the plan
Keep a log with each item:
- Deficiency and its classification.
- Root cause.
- Fix and owner.
- Date the new control starts.
- Evidence expected.
- Retest date and tester.
- Status.
Step 4: Let it operate
A control cannot be tested the day it starts. It needs to run enough times to show it works. How many times depends on the control's frequency and your methodology. We did not confirm a standard minimum, so agree it with your auditor in advance.
During this period, keep proof of each run. A monthly control gives fewer chances than a daily one, so start monthly fixes earlier.
Step 5: Retest
Retesting should be as strong as the original test, and independent of the person who fixed the control.
- Re-confirm the design with a walkthrough. See SOX walkthroughs.
- Select a sample from the period after the fix.
- Test every attribute that failed before.
- Test the data and IT controls behind it.
- Record exceptions and conclude.
Use the control test workpaper.
Step 6: Document and report
Record what was wrong, what changed, when, the evidence and the conclusion. If remediation is still running at year end, record the status. The SEC guidance says disclosure about plans and actions may be appropriate for material weaknesses. Discuss wording with your legal and audit committee advisers.
What good looks like
A worked example: a sample of leavers shows five still had access after leaving.
- Root cause: no automatic alert from HR to IT.
- Fix: HR system triggers a ticket on the last working day, and IT confirms removal within an agreed time.
- Operate: three months of leavers.
- Retest: match the full leaver list to the user list and check removal dates and account use.
- Also check: the periodic review still runs. See user access controls.
Common failures
- Fix is a reminder email.
- Remediation starts too close to year end.
- Retest by the same person who fixed it.
- Only the failed sample item re-tested.
- No evidence of who ran the control.
- Related gaps in the same account not grouped.
Frequently Asked Questions
How long must a fixed control operate before retest?
We found no figure on a source we opened. Agree it with your auditor.
Can I conclude controls are effective if I fixed a weakness before year end?
The SEC guidance says management may, if all material weaknesses are remediated by year end, and it should consider disclosure.
Who should retest?
Someone independent of the fix.
Should I disclose a remediated weakness?
The guidance says consider it. Take advice.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error