SOX scoping is the step that decides what you test. You start from the financial statements, pick the accounts and disclosures that could be materially misstated, link each to the assertions at risk, map the processes and systems behind them, and only then choose key controls. Scope from the top down, not from a list of controls you already have.
Last reviewed: 17 October 2026. Facts checked. We opened the SEC's 2007 interpretive guidance on management's report (Release 33-8810, govinfo.gov Federal Register text; first 100,000 of about 161,000 characters read) and 15 U.S.C. 7262 (Cornell LII). We ran searches on AS 2201 scoping terms, which returned only secondary sources. We did not open PCAOB AS 2201 itself (403 error). The step order below is practitioner method, consistent with the SEC's top-down, risk-based approach.
SOX covers companies subject to US securities law. An Indian entity is in scope only if it is an SEC registrant or part of a group that is. See SOX for Indian subsidiaries.
What the SEC guidance asks for
The SEC guidance says management should identify risks of misstatement that could, alone or together, cause a material misstatement. It starts with how the accounting framework applies to the company's operations. It says the risk of misstatement generally rises as an element grows relative to the amount that would be material.
It also says management does not have to identify every control in a process. Focus on the controls that address the risk. Documentation should concentrate on controls management concludes address those risks.
Step 1: List significant accounts and disclosures
Go line by line through the financial statements and the notes. Mark an account significant where there is a reasonable possibility of material misstatement, judged before you think about controls.
Use these questions:
- Is the balance large against the materiality benchmark? See SOX materiality.
- Does it involve estimates or judgment, such as impairment or provisions?
- Is it prone to fraud, such as revenue?
- Is it complex, unusual or new this year?
- Did it have errors, adjustments or restatements before?
- Do many small balances add up to something large?
Include disclosures, not only line items.
Step 2: Link relevant assertions
For each significant account, ask which assertions could go wrong: existence, completeness, valuation, rights and obligations, presentation. Only keep assertions with a real risk.
| Account | Assertions often at risk | Why |
|---|---|---|
| Trade receivables | Existence, valuation | Fictitious sales; weak collection |
| Revenue | Occurrence, cut-off, accuracy | Pressure to hit targets |
| Accounts payable | Completeness | Unrecorded liabilities |
| Inventory | Existence, valuation | Counts; slow-moving stock |
This table is a starting point from practice, not a standard. Your risk assessment decides.
Step 3: Map processes, systems and locations
For each account, trace the flow: where transactions start, who approves, which system records, how the ledger is updated. This tells you which processes, applications, spreadsheets and service providers feed the balance.
Then decide the locations in scope. A small entity can be in scope if it has a risk that is significant on its own, or if many small ones add up. Document the reasons.
Step 4: Choose key controls
A key control is one that, if it failed, would leave a relevant assertion unprotected. Pick the control that best addresses each risk. Do not test five controls that do the same job.
| Test for a key control | Question |
|---|---|
| Addresses a specific risk | Which assertion does it cover? |
| Precise enough | Would it catch a material error? |
| Evidence exists | Can another person re-perform it? |
| Not duplicated | Is there another control that does the same thing? |
Add the IT general controls that these controls depend on. The SEC guidance says IT general controls alone ordinarily do not address the risks, and management need only evaluate those needed for other controls to operate.
Worked example
A company sells software licences and services. Revenue is a significant account. Risk: licences recognised before delivery.
- Assertion: occurrence and cut-off.
- Process: order, delivery confirmation, invoicing, ledger posting.
- Key control: finance reviews the delivery report against invoices raised in the last five days of each month and clears differences before close.
- IT dependency: the delivery report and the billing system.
- Evidence: signed review, the report, list of differences and clearance notes.
Record it in a risk control matrix template or the RCM builder.
Review your scope yearly
Scope again each year. New products, acquisitions, system migrations and restatements change risk. Keep the memo that shows why accounts were in or out.
Frequently Asked Questions
Is there a fixed list of significant accounts?
No. It depends on the company's risks and materiality.
Do all accounts need controls tested?
No. Management focuses on controls that address risks of material misstatement.
Can I leave out a small subsidiary?
Maybe. You must document why its risk is not significant, alone or with others.
Where do service providers fit?
If a provider processes your transactions, its controls may be part of your scope. Record how you gain comfort.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error