SOX 404

Section 404(a) requires management’s annual assessment of ICFR. Section 404(b) requires the external auditor’s attestation, applying to accelerated and large accelerated filers; smaller reporting companies and non-accelerated filers are exempt from 404(b) though not from 404(a). The auditor’s work is performed under PCAOB AS 2201.

SOX programmes are where the cost of the traditional model is most visible, because the same tests run every year against the same controls with the same evidence requests. It is difficult to think of a body of work better suited to being expressed as re-runnable definitions, and difficult to explain why so much of it is still assembled by hand each cycle.

Two structural points worth holding onto. First, SOX is about financial reporting — scope creep into operational controls is common and expensive. Second, the assessment is management’s; internal audit frequently performs much of the testing, and the more it does, the more carefully the independence boundary has to be documented, particularly if the same function also wants to provide assurance over the programme.