SOX controls testing is the annual cycle public companies use to verify that their internal controls over financial reporting are designed properly and operating effectively. Under the Sarbanes-Oxley Act of 2002, management has to assess those controls every year and the CEO and CFO personally certify the results, with willful false certifications punishable by fines up to $5 million and up to 20 years in prison.1Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports Testing works from the top down: identify the accounts and risks that matter, find the controls that address them, confirm each control is designed correctly, and then gather enough evidence to conclude the control actually worked throughout the year.
What the Law Requires You to Test
Two provisions drive the workload. Section 302 requires the CEO and CFO to certify in every quarterly and annual report that they are responsible for internal controls, have evaluated their effectiveness within the prior 90 days, and have disclosed any significant deficiencies or material weaknesses to the auditors and audit committee.2Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports Section 404(a) requires an annual management assessment of whether internal controls were effective as of fiscal year-end. Section 404(b) then requires the external auditor to independently attest to management’s assessment.3Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
The 404(b) piece is where the second, independent round of testing comes from. Companies with a public float below $75 million are exempt from the external auditor attestation, but management’s own testing and assessment under 404(a) is still required.3Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls The exemption cuts audit cost. It does not cut the testing obligation.
Scoping: Deciding Which Controls Get Tested
Not every control in the company is in scope. PCAOB Auditing Standard 2201 requires a top-down, risk-based approach: start at the financial statement level, identify the accounts and disclosures with a reasonable possibility of material misstatement, then work down to the controls that address those risks.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting Significance is driven by account size, transaction complexity, fraud susceptibility, and the degree of judgment involved in recording activity.
From there, the distinction that matters most is key versus non-key. A key control directly mitigates a significant risk to financial reporting accuracy; if it fails, there’s a real possibility of material misstatement. Non-key controls support the broader environment but aren’t the primary safeguard against a significant risk. Only key controls are in scope for formal SOX testing. Scoping also considers precision, frequency, who performs the control, and whether it operates alone or alongside compensating controls.
Controls also split by scope. Entity-level controls operate across the company: tone at the top, board oversight, company-wide policies, and monitoring processes. Activity-level controls sit inside specific processes like revenue recognition, purchasing, payroll, or the financial close. Testing usually starts at the entity level, because those controls set the conditions that make everything below them possible.
IT General Controls
Underneath everything sits the IT environment. Automated three-way matches, system-generated revenue reports, access restrictions on the general ledger: each depends on IT general controls, or ITGCs, working. ITGCs typically cover four areas:
- Access management: how users are provisioned, removed, and periodically reviewed in financial systems, and how roles are designed to enforce segregation of duties.
- Change management: how changes to applications, configurations, and infrastructure are designed, tested, approved, and deployed, including emergency fixes.
- Computer operations: backup and recovery, batch job scheduling and monitoring, and incident management.
- System development and acquisition: how new applications are selected, configured, tested for security and control requirements, and moved into production.
ITGC failures cascade. If access or change management can’t be relied on, testers can’t rely on the reports and automated controls that run on top of those systems, and the shortcuts available for automated controls disappear.
Documenting Controls Before Testing Begins
Testing rests on documentation that describes how each process actually works. Three deliverables are standard.
Process narratives walk through a transaction from initiation to recording in the financial statements: who starts it, what approvals are required, what systems are involved, and where it lands in the books. Flowcharts give the same process a visual form and make hand-offs and gaps easier to see.
The risk-control matrix is the master inventory. Each in-scope control gets a unique identifier, a description of what it does, a frequency (daily, weekly, monthly, quarterly, or annual), an owner, the assertion it addresses, and the evidence the owner retains after performing it. The matrix has to stay current through the year, which is why most companies keep it in governance, risk, and compliance software with version control and owner sign-off.
Walkthroughs
Walkthroughs are the first hands-on step. The auditor picks a single transaction and follows it from start to finish through every system, document, and hand-off, using the same tools the employees use and questioning each person about what they’re supposed to do and why.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
The point isn’t statistical coverage. A walkthrough confirms the narrative matches reality, exposes where misstatements could arise, and shows whether controls are in place and properly designed. It typically pulls in all four testing techniques at once: inquiry, observation, inspection, and re-performance. A design flaw caught here saves the effort of sample-testing a control that was never going to work.
Testing Operating Effectiveness
After walkthroughs confirm design, operating effectiveness testing asks a different question: did this control actually run correctly, throughout the period, every time it was supposed to? Four methods produce that evidence:
- Inquiry: interviewing the control owner about the process and their responsibilities. Inquiry alone is never sufficient; it has to be paired with at least one other method.
- Observation: watching the control performed in real time, such as a physical inventory count or a journal entry approval session.
- Inspection: reviewing physical or electronic evidence, such as signed reconciliations, approved purchase orders, configuration screenshots, or review emails.
- Re-performance: the tester independently executes the control and compares the result to the original. This is the strongest form of evidence.
Sample Sizes by Frequency
Sample size scales with how often the control runs. Common practice for manual controls tests roughly 30 instances for daily controls, 8 for weekly, 2 for monthly, 1 for quarterly, and the single occurrence for annual controls. These figures aren’t regulatory mandates; PCAOB sampling standards leave sample size tied to the objectives and efficiency of the sample. They are, however, the widely adopted benchmarks external auditors expect to see.
Automated controls are treated differently. Because an automated control executes the same way each time it runs, one instance is typically enough to confirm the configuration works, provided the ITGCs supporting that system are effective. When ITGCs fail, that shortcut disappears and the automated control has to be tested more like a manual one.
Roll-Forward Procedures
Most companies run their main testing in the middle of the fiscal year, which leaves a gap between test completion and the year-end assessment date. Roll-forward testing closes it. Additional samples are selected from the remaining period, usually the fourth quarter, to confirm the control kept operating effectively through year-end. If the control changed during the gap, or the company reorganized, roll-forward procedures need to go deeper.
Testing Information Produced by the Entity
Many controls rely on internally generated reports or spreadsheets: an aging report a controller reviews, a journal entry listing filtered by threshold, a reconciliation comparing two system outputs. The control is only as reliable as the data feeding it. When information produced by the entity is used as audit evidence, PCAOB standards require the auditor to test its accuracy and completeness, or test the controls that ensure accuracy and completeness.5Public Company Accounting Oversight Board. AS 1105 – Audit Evidence
In practice that means verifying the report pulls from the expected source system, confirming the report logic returns the right information, and checking that parameters and filters match the control description. The report should be retained in its original form so another auditor could reproduce the same output. Skip this step and a perfectly executed control can still be unreliable because the data underneath it was incomplete. It is one of the most common audit findings.
When a Control Fails
Test failures get classified by severity. The PCAOB uses three tiers:
- Deficiency: the control’s design or operation doesn’t allow the people responsible to prevent or detect misstatements on a timely basis.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
- Significant deficiency: a deficiency, or combination of deficiencies, less severe than a material weakness but important enough to merit the attention of those overseeing financial reporting.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
- Material weakness: a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
Severity doesn’t turn on whether a misstatement actually occurred, only on whether the failed control creates a reasonable possibility that one could. The evaluation weighs the potential size of a misstatement, fraud susceptibility, and the presence of compensating controls. Individually minor deficiencies affecting the same account or assertion can aggregate into a material weakness.4Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
Documentation and Reporting
Every test gets a workpaper stating the purpose, procedures, samples selected, evidence obtained, and conclusion. An independent reviewer signs off. The standard is that a different auditor could pick up the workpaper and reach the same conclusion without additional context.
Material weaknesses are publicly disclosed. The SEC requires companies to identify all material weaknesses in the annual filing, and management’s internal control report must state whether internal controls are effective as of fiscal year-end.6U.S. Securities and Exchange Commission. Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports A company disclosing a material weakness cannot conclude that its internal controls are effective. Significant deficiencies and ordinary deficiencies are communicated in writing to management and the audit committee but don’t require public disclosure.7Public Company Accounting Oversight Board. AS 1305 – Communications About Control Deficiencies in an Audit of Financial Statements
Remediation
Fixing a material weakness starts with root cause. A missing signature on a reconciliation might trace back to inadequate training, unclear policy, or an overloaded owner covering too many controls. The failed control is either redesigned or replaced, and then it has to operate long enough for auditors to gather sufficient samples to conclude the new version works. The SEC sets no fixed timeline, but the weakness must be disclosed in every filing until remediation is complete and the redesigned control has operated effectively for a meaningful period. The external auditor independently tests the remediated control before agreeing the weakness has been resolved.