Join the waitlist
Track 17 of 19 · Specialized

Internal audit and SOX 404 basics

Internal audit practice under the IIA Global Internal Audit Standards and the work behind SOX Sections 302 and 404: SEC management guidance, filer status, top-down scoping, walkthroughs, testing design and operating effectiveness, classifying deficiencies, remediation, and coordination with the external auditor.

14 lessonsAbout 66 minIIA Global Internal Audit Standards · SOX 302 · SOX 404 · AS 2201 · SEC Release 33-8810
0 of 14 complete
Syllabus

For: Internal audit and SOX compliance staff, and external audit staff on integrated audits.

  1. 01Internal audit and SOX 404: how the two programs fit togetherWho does what in a public company control program: internal audit under the IIA Standards, management under SOX 404(a), and the external auditor under 404(b).6 min · worked example · 5 self-check questions
  2. 02The IIA Global Internal Audit Standards (2024): domains, principles and how to read themHow the 2024 Global Internal Audit Standards are organized into five domains, 15 principles and 52 standards, and what changed for internal audit functions.5 min · worked example · 4 self-check questions
  3. 03Independence and objectivity for internal auditorsHow Standards 2.1 to 2.3 and 7.1 protect objectivity: the 12-month rule, advisory-to-assurance moves, CAE dual roles, and disclosure of impairments.5 min · worked example · 4 self-check questions
  4. 04Building the risk-based internal audit plan under Standard 9.4How to build the annual internal audit plan from a documented risk assessment, cover required areas, coordinate with SOX and report changes to the board.4 min · worked example · 4 self-check questions
  5. 05Engagement planning, work programs and the final reportPrinciples 13 to 15 in practice: engagement risk assessment, objectives and scope, the approved work program, findings, the final report and follow-up.4 min · worked example · 4 self-check questions
  6. 06SOX Sections 302, 404(a) and 404(b): what each one requiresWhat officers certify under Section 302, what management reports under 404(a), and when the auditor must attest under 404(b), with the statutory text.5 min · worked example · 4 self-check questions
  7. 07The SEC’s management guidance (Release 33-8810) and how to use itHow Release 33-8810 shapes management’s ICFR evaluation: financial reporting risks, ICFR risk, evidence choices, daily interaction and documentation.5 min · worked example · 4 self-check questions
  8. 08Filer status and the 404(b) exemption for non-accelerated filersHow public float, the SRC revenue test and emerging growth status decide whether a company needs an auditor’s ICFR attestation under Section 404(b).5 min · worked example · 4 self-check questions
  9. 09Top-down, risk-based scoping and entity-level controlsScoping a SOX program from the financial statements down: significant accounts, relevant assertions, locations, and the entity-level controls under AS 2201.5 min · worked example · 4 self-check questions
  10. 10Process walkthroughs and the risk and control matrixHow to run a walkthrough that meets AS 2201.34, document it, and turn it into a risk and control matrix that links risks, assertions, controls and tests.4 min · worked example · 4 self-check questions
  11. 11Testing design and operating effectiveness of controlsDesign versus operating effectiveness under AS 2201, how risk drives the evidence, interim testing and roll-forward, and how firms set sample sizes by policy.5 min · worked example · 4 self-check questions
  12. 12Evaluating deficiencies: control deficiency, significant deficiency, material weaknessThe definitions from AS 2201 and Regulation S-X Rule 1-02, how to judge likelihood and magnitude, compensating controls, aggregation and the MW indicators.5 min · worked example · 4 self-check questions
  13. 13Remediating deficiencies and reporting material weaknessesRemediation plans, how long a fixed control must run before it counts, year-end conclusions, the adverse ICFR opinion and the communications auditors must make.4 min · worked example · 4 self-check questions
  14. 14Internal audit and the external auditor: using the work of othersHow the external auditor assesses and uses internal audit’s work under AS 2201 and AS 2605, what stays with the auditor, and how to plan coordination.4 min · worked example · 4 self-check questions
For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required