Revenue is usually a significant account, and it is a common fraud and error risk. SOX revenue controls follow the sale from order to cash and target a few risks: wrong price, wrong period, fictitious sales and unrecorded credits. This article gives example controls and how to test each.
Last reviewed: 17 October 2026. Facts checked. We opened the SEC's 2007 interpretive guidance (Release 33-8810, govinfo.gov; first 100,000 of about 161,000 characters read) and 15 U.S.C. 7262. We searched for revenue control examples; results were secondary and we did not open a Big Four technical guide or the PCAOB standard (403 error). The controls below are illustrative examples from practice. They are not a required list, and your risks decide your controls.
SOX applies to companies subject to US securities law. Indian companies are covered only where they are SEC registrants or part of a group that is.
Start with the risk, not the control
The SEC guidance starts with identifying risks of misstatement and then the controls that address them. For revenue, begin with how your contracts work. A retail company and a software business have very different risks. For the accounting side under Indian standards, see our Ind AS 115 audit guide.
Example controls by risk
| Risk | Example control | Evidence |
|---|---|---|
| Sale not authorised | Orders above a limit need approval before release | System approval log |
| Wrong price or terms | Price list changes approved; system enforces price on order | Change approval; configuration screenshot |
| Revenue booked before delivery | Delivery confirmation required before invoice | Delivery record matched to invoice |
| Wrong period (cut-off) | Review of shipments and invoices around period end | Signed review with differences cleared |
| Fictitious or duplicate invoice | Invoice number sequence checked; duplicates blocked | Exception report and follow-up |
| Credit notes abused | Credit notes approved by someone other than the raiser | Approval record |
| Cash applied wrongly | Daily or weekly bank reconciliation reviewed | Reconciliation with reviewer sign-off |
| Bad debt not provided | Aged debtors reviewed with a stated threshold | Review notes, provision calculation |
For worked rows, see key controls examples for order to cash and the O2C internal audit checklist.
Test steps, control by control
Order approval
- Get a system population of orders above the limit.
- Select a sample.
- Check approval before release, by an authorised approver.
- Check the limit configured in the system.
Pricing
- Check price list changes in the period were approved.
- Re-perform price on sampled invoices against the approved list.
- Test how the system enforces price. If automated, test once and rely on change controls.
Cut-off
- Get shipments or service delivery data for days either side of period end.
- Compare to invoices and the period they were booked in.
- Check the management review that was meant to catch differences. Is the threshold clear? See management review controls.
Credit notes
- Get all credit notes after period end and before the close.
- Check whether each relates to a sale booked before period end.
- Confirm approval by someone other than the raiser.
Receivables review
- Test the aged debtor report as IPE.
- Check the reviewer followed up items over the threshold.
- Re-perform the provision calculation.
Automated or manual?
Many revenue controls are automated, such as invoice matching and price enforcement. Test the configuration and the IT general controls that protect it. Manual controls need a sample across the period. Use the sampling plan generator to size it in line with your method.
Judgment areas
Revenue with multiple deliverables, variable consideration or percentage of completion involves estimates. The control should cover the inputs, the calculation and the review. Test the data going into the estimate, and who reviews the assumptions.
Journal entries
Manual revenue journals bypass system controls. Test who can post them and how they are reviewed. See journal entry testing procedures and the journal entry testing working paper.
Evidence to keep
- Population report with date and source.
- Sample selection record.
- Copy of order, delivery record, invoice and cash receipt.
- Approval records.
- Reviewer notes on exceptions.
Record it in the SOX control test workpaper.
A short worked example
Risk: invoices raised for goods not yet shipped. Control: the billing system blocks an invoice unless a delivery record exists. Test: look at the configuration, run a test transaction without a delivery record, and confirm it is blocked. Then check change and access controls on that setting. If both hold, one test of the automated control can support the whole year. If the setting could be changed without approval, widen your testing.
Frequently Asked Questions
Which revenue controls are key?
Those that address your most significant risks, often cut-off, occurrence and accuracy.
Is revenue always significant?
Often, but decide by your own scoping. See SOX scoping.
How do I test a control that rarely fires?
Look for the population of occasions it applied, and test them. If there are none, document inquiry and observation.
Do service companies need different controls?
Yes. Delivery may be timesheets or milestones, so the evidence differs.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error