CORAA
Log inRun your first audit free
Topic hub · Internal control over financial reporting

SOX compliance: controls, testing and what it means in India

SOX is the Sarbanes-Oxley Act of 2002, a US law on financial reporting and internal control. SOX compliance means meeting its requirements, most visibly the CEO and CFO certifications and management's annual assessment of internal control over financial reporting (ICFR).

It applies to companies subject to US securities law, and so reaches Indian companies only in specific cases: SEC registrants, or subsidiaries of a US-listed group. This hub collects CORAA's guides, templates and tools on SOX controls, testing and deficiency evaluation, and it keeps India's own regime (internal financial controls under the Companies Act) separate.

Each guide states what its facts rest on and what we could not verify. Standards and laws change, so confirm dates and wording against the primary source before relying on them.

Guides

The essential guides: start here.

Audit Standards · 6 Oct 2026
SOX Compliance Explained: Who Needs It and What It Involves
SOX compliance explained: what the Sarbanes-Oxley Act requires, who must comply, sections 302 and 404, and what a typical compliance programme involves.
Internal Audit · 26 Sept 2026
SOX 404: Management Assessment vs Auditor Attestation Explained
SOX 404 has two parts: management assesses internal control over financial reporting, and the auditor may attest to it. Who does what, and what each says.
Internal Audit · 26 Sept 2026
SOX 302 vs SOX 404: Certifications and What Each Requires
SOX 302 is a quarterly CEO and CFO certification; SOX 404 is an annual assessment of internal control. A plain comparison of timing, signers and evidence.
Audit Standards · 26 Sept 2026
COSO 2013 Internal Control Framework for Auditors: Five Components in Practice
COSO 2013 has five components and 17 principles. What each component means, what an auditor looks for, and example evidence for each.
Audit Standards · 27 Sept 2026
Control Deficiency, Significant Deficiency and Material Weakness: How to Classify
How to classify a control gap: control deficiency, significant deficiency or material weakness. The two questions that decide it, with worked examples.
Internal Audit · 27 Sept 2026
SOX Compliance for Indian Subsidiaries of US-Listed Companies
How SOX reaches an Indian subsidiary of a US-listed parent: scope, sub-certifications, controls testing, and how it overlaps with Indian IFC reporting.
Internal Audit · 10 Oct 2026
SOX Controls vs Internal Financial Controls in India: Section 143(3)(i) Explained
What SOX controls are, and how India's equivalent works: internal financial controls, section 134(5)(e), the auditor's report under section 143(3)(i), exemptions, a comparison table and a worked control test.
All guides on this topic
Free templates and tools

Ready-to-use working papers, no sign-up to look around.

Word template
SOX Risk and Control Matrix Template
Link each key control to its risk of misstatement, assertions, owner, frequency and evidence.
Word template
SOX Control Test Workpaper — Design and Operating Effectiveness
Record the walkthrough, the design conclusion, the sample tested and the operating-effectiveness conclusion for one control.
Word template
SOX Control Deficiency Evaluation Worksheet
Evaluate severity, compensating controls and combined deficiencies, then record the classification, rationale and remediation.
Word template
IPE Testing Worksheet — Information Produced by the Entity
Test the completeness and accuracy of a report a control relies on: source data, logic, parameters, change control and access.
Word template
SOX Management Review Control (MRC) Worksheet
Document and test a judgement-based review control: reviewer, information, expectation, threshold, follow-up and evidence.
Word template
Segregation of Duties Conflict Matrix
List incompatible duty pairs, who holds both, and the compensating control or access fix for each conflict.
Word template
Journal Entry Testing Working Paper — SA 240 (Benford + Characteristics)
The full SA 240 management-override working paper: population profile, Benford’s-Law leading-digit table, the ten-characteristic screening battery, detailed-testing schedule and conclusion — editable in Word.
Word template
ICFR Testing Working Paper — Sec 143(3)(i) Format
The internal-financial-controls audit in one paper: applicability gate (₹50 Cr/₹25 Cr exemption), risk-control matrix with design vs operating effectiveness, ITGC battery incl. the edit-log link, and the deficiency ladder to the 143(3)(i) opinion — editable in Word.
Free tool
COSO 2013 self-assessment
Rate the 17 principles across the five components and see the gaps.
Free tool
SOX deficiency severity evaluator
Indicative classification of a control deficiency, with the working shown.
Free tool
RCM builder
Build a risk and control matrix.
Frequently asked questions

SOX compliance: in plain words.

SOX compliance means meeting the requirements of the Sarbanes-Oxley Act of 2002, a US law. The best known are the CEO and CFO certifications of each periodic report (section 302) and management's annual assessment of internal control over financial reporting, with an auditor's opinion for some companies (section 404). Read more: SOX compliance explained.
SOX is short for the Sarbanes-Oxley Act (often called SOX), named after the two US lawmakers who sponsored it. It was enacted in 2002.
Mainly companies that are subject to US securities law and file reports with the SEC, and their auditors. Whether a company is covered, and which parts apply, depends on its filer status, so check with the company's securities counsel and auditors.
Most SOX requirements, such as the internal control assessment and certifications, apply to companies that report to the SEC. A few provisions, for example those on destroying records to obstruct an investigation, apply more widely. Private companies planning an IPO often prepare early.
Only in specific cases: Indian companies that are SEC registrants, or Indian subsidiaries of US-listed groups that are asked to follow the group's SOX programme. India has its own regime for internal financial controls under the Companies Act and SEBI rules, which is separate. Read more: SOX for Indian subsidiaries, SOX controls vs IFC in India.
Section 302 is a certification by the CEO and CFO of each periodic report and of the controls behind it. Section 404 is the annual assessment of internal control over financial reporting by management, with an auditor attestation for certain filers. Read more: SOX 302 vs 404.
IT general controls are the controls over the systems that financial reporting relies on, usually covering access, change management and operations. If they fail, controls that depend on those systems may not be relied on. Read more: SOX ITGC testing.
A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe but still merits the attention of those overseeing financial reporting. Read more: How to classify deficiencies.
No regulator issues a SOX certificate to companies. Compliance is shown through management's report on internal control and, where required, the auditor's opinion on it. Individuals can take SOX training courses, which are separate from company compliance.
In outline: scope the significant accounts and processes, document and walk through key controls, test their design and operation, evaluate any deficiencies, report, and remediate and retest. Our templates cover the control matrix, test workpaper and deficiency evaluation. Read more: Walkthroughs and testing.