Internal audit and SOX 404: how the two programs fit together

• Distinguish the internal audit mandate from management’s SOX 404 responsibility
• Identify the standards and rules that govern each party in the ICFR cycle
• Describe the annual SOX cycle from scoping to the management report
• Apply the Item 308 transition relief for a newly public company

Three parties, three rulebooks

A public company control program has three actors, and each works under its own rules.

• Management owns internal control over financial reporting (ICFR). Section 404(a) of the Sarbanes-Oxley Act (15 U.S.C. 7262(a)) requires the annual report to state management’s responsibility for an adequate internal control structure and to contain management’s assessment of its effectiveness as of the end of the fiscal year. The SEC’s interpretive guidance in Release 33-8810 tells management how to run that evaluation.
• The external auditor attests to ICFR under Section 404(b) when the company is an accelerated or large accelerated filer and is not an emerging growth company. The PCAOB standard for that work is AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.
• Internal audit provides independent assurance and advice to the board and management. It follows The IIA’s Global Internal Audit Standards, issued January 9, 2024 and effective January 9, 2025.

The common mistake is to treat internal audit as the owner of SOX. Internal audit often runs the testing program because it has the skills, but the 404(a) assessment is management’s. If internal audit designs controls, writes the narratives and then tests them, its objectivity on those controls is at risk (see the independence lesson).

The annual SOX cycle

Most issuers run the same sequence each year:

1. Scoping. Start from the consolidated financial statements, set materiality, identify significant accounts and disclosures and their relevant assertions, and pick the locations in scope. AS 2201.21 calls this the top-down approach; Release 33-8810 describes the same idea for management.
2. Entity-level controls. Evaluate the control environment, the risk assessment process, monitoring and the period-end financial reporting process.
3. Process documentation. Narratives or flowcharts and a risk and control matrix (RCM) for each in-scope process, confirmed by walkthroughs.
4. Testing. Design effectiveness, then operating effectiveness, with interim testing and a roll-forward to year-end.
5. Deficiency evaluation. Classify each deficiency as a deficiency, significant deficiency or material weakness, using the definitions in Regulation S-X Rule 1-02 and AS 2201 Appendix A.
6. Reporting. Management’s report in the 10-K, the officer certifications under Section 302, and, where required, the auditor’s ICFR opinion.

Where internal audit adds value

Internal audit contributes in three ways. It can perform management’s testing as an objective party, which gives the 404(a) evidence more weight. It can give the external auditor work to use under AS 2201.16 to .19 and AS 2605, which reduces fees and duplication. And it can look past ICFR at operational, compliance and IT risks that SOX does not cover, under its own risk-based plan.

How this track is built

The first five lessons cover internal audit as a profession: the 2024 Standards, independence and objectivity, the risk-based plan, and engagement planning through reporting. Lessons 6 to 8 cover the legal frame: Sections 302 and 404, the SEC management guidance, and filer status. Lessons 9 to 13 walk the SOX cycle: scoping and entity-level controls, walkthroughs and RCMs, testing, deficiency evaluation and remediation. The last lesson covers how the external auditor uses internal audit’s work.

Vocabulary you will use every day

• ICFR: the process that provides reasonable assurance about the reliability of financial reporting.
• Key control: a control selected for testing because it is important to the conclusion on a relevant assertion.
• Control deficiency: under AS 2201.A3, the design or operation of a control does not allow management or employees, in the normal course of their assigned functions, to prevent or detect misstatements on a timely basis.
• Material weakness: a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis (Rule 1-02(a)(4) and AS 2201.A7).
• Significant deficiency: less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of financial reporting.

What changes when a company goes public

A private company with a strong control culture still has work to do at the IPO. Controls that ran informally need evidence of performance. Reports used in controls need to be shown complete and accurate. Access and change controls over the general ledger and key applications need to be designed and documented. Instruction 1 to Item 308 of Regulation S-K gives a newly public company one annual report of relief: no management report or auditor attestation is required until the company either had been required to file, or had filed, an annual report for the prior fiscal year. The first 10-K states that it relies on this transition period. Plan a full cycle of documentation and testing before the second 10-K, and plan for the auditor’s attestation once the company is an accelerated filer and its emerging growth status has ended.

Assigning roles at Harborline Logistics, Inc.