Most teams struggle in the same places: unclear scope, finance and IT working in silos, thin documentation, weak evidence, and remediation that starts too late. Many also blur management's duties with the external auditor's.
Repeat problems are common. According to Ideagen's twenty-year review, 76% of adverse FY2025 management reports repeated prior adverse reports. This guide walks through scope, controls, the six-step testing process, evidence, deficiencies, and practical ways to stay audit-ready.
Key Takeaways
- SOX testing targets risks that could cause a material misstatement in financial reporting.
- Scope covers financial process controls and IT controls such as access and change management.
- Strong testing needs documentation, sound evidence, consistent sampling, deficiency evaluation, and retesting.
- Continuous, risk-based preparation cuts year-end surprises, but management stays accountable.
What Is SOX Compliance Testing?
What SOX testing evaluates
SOX compliance testing is management's evaluation of ICFR under the Sarbanes-Oxley Act. It asks whether controls address relevant risks and whether they work in practice.
Sections 302 and 404 drive the work:
- Section 302: the principal executive and financial officers certify each annual and quarterly report, and disclose significant deficiencies, material weaknesses, and certain fraud to auditors and the audit committee.
- Section 404(a): management assesses ICFR annually, as of fiscal year-end.
- Section 404(b): an independent auditor attests to ICFR for accelerated and large accelerated filers. Non-accelerated filers and emerging growth companies are exempt from 404(b), but not from management's 404(a) assessment.
Confirm current SEC and PCAOB requirements before each cycle, since standards are amended periodically.
Why SOX testing matters
Good testing supports reliable reporting, catches errors and fraud earlier, and builds investor confidence. It also makes the audit smoother.
Weak testing has costs. Remediation drags, auditors repeat requests, disclosures get uncomfortable, and finance, IT, and executives all feel the pressure.
Enforcement shows how this plays out. In SEC Release 2019-6, Lifeway Foods and Digital Turbine each paid $100,000 after years of material weaknesses, and CytoDyn paid $35,000. Disclosing the weaknesses did not satisfy the underlying obligations.
Criminal penalties under Section 906 (up to $1M or 10 years for knowing false certification, $5M or 20 years for willful) concern false certifications, not the mere existence of a weakness.
Who is responsible for SOX testing?
- Management: designs, maintains, and evaluates ICFR, and owns the conclusions.
- Control owners: perform controls and produce evidence.
- Internal audit or co-sourced advisors: supply evaluation work.
- Audit committee: oversees financial reporting and receives escalations.
- External auditor: independently audits ICFR where 404(b) applies.
Auditor independence matters. SEC rules let an auditor assess controls and recommend improvements, but not design or implement them, because that puts the auditor in management's role.
SOX testing compared with related activities
- Financial statement audit: opines on the statements; ICFR work is integrated only where 404(b) applies.
- Internal audit: broader than financial reporting.
- Cybersecurity assessments: judge security posture, not ICFR.
- SOC 2: a service-organization examination against Trust Services Criteria. It is not the ICFR attestation SEC rules require.
ITGC testing supports SOX but is not a complete SOX assessment on its own.
What Controls Are Evaluated During SOX Testing?
Financial reporting and business-process controls
Typical areas include revenue recognition, payables and receivables, payroll, financial close, reconciliations, reserves, journal entries, fixed assets, and statement preparation.
For each control, document:
- The risk and control objective
- The control activity, owner, and frequency
- The evidence produced
- The assertion or reporting area affected
A monthly bank reconciliation is a simple example. The risk is unrecorded or misrecorded cash. The owner is the accounting manager, and the evidence is the signed, dated reconciliation with a supervisor's review.
IT general controls and application controls
ITGCs support the reliability of financial systems. KPMG's ICFR handbook groups them into access to programs and data, program changes, acquisition and development, and computer operations.
In practice that means:
- User provisioning, termination, and privileged access
- Segregation of duties
- Change management
- Backups, incident handling, and system operations
Application controls are automated business logic, such as approval thresholds, calculations, interface completeness checks, and report logic. An ITGC failure can undermine reliance on those controls and on system-generated reports, so finance, IT, internal audit, and the external auditor need to coordinate early.
Scope only ITGCs that support financial-reporting risk, not every operational IT control.
Entity-level, governance, and third-party controls
Entity-level controls include tone at the top, ethics programs, whistleblower processes, board and audit committee oversight, risk assessment, fraud risk management, and monitoring. They also cover management override, period-end reporting, and significant estimates.
Outsourced processes need attention too. A SOC 1 Type 2 report covers a service organization's controls relevant to your ICFR over a specified period. It also lists complementary user entity controls (CUECs), which you must implement yourself. Receiving the report does not supply them.
Control characteristics to document
- Preventive vs. detective: stop errors before they occur, or find them afterward.
- Manual vs. automated: judgment-based or system-enforced.
- Key vs. non-key: key controls tie to significant risks. Don't accumulate them indiscriminately; redundant controls need not all be tested.
A risk-control matrix ties it together, linking each financial reporting risk to its control objective, procedure, owner, frequency, system, evidence, and testing conclusion.
The SOX Compliance Testing Process: Step by Step
Step 1: Establish scope and perform a risk assessment
Work top-down and risk-based. Start at the financial-statement level, then identify significant accounts, disclosures, relevant assertions, material processes, locations, applications, interfaces, and third parties.
Factor in fraud risk, management override, system changes, acquisitions, and cloud migrations. Any of these can change the control environment.
Step 2: Document processes and controls
Build process narratives, flowcharts, risk-control matrices, control descriptions, and system inventories. Have control owners confirm them.
Documentation must reflect how work actually happens, not just what policy says. Check for undocumented manual workarounds and conflicting versions of the same process.
Step 3: Conduct walkthroughs and assess design effectiveness
A walkthrough traces one representative transaction from initiation through recording and reporting, with the people and systems that perform the control. It typically combines inquiry, observation, inspection, and reperformance.
Design effectiveness asks whether the control, performed as described by competent, authorized people, could prevent or detect a material misstatement. For automated controls, review system configuration.
Step 4: Test operating effectiveness
Operating effectiveness asks whether the control actually ran as designed throughout the period, by someone with the authority and competence to perform it. Inquiry alone is insufficient.
Plan these elements:
- Sample selection and testing frequency
- Population completeness
- Exception handling
- Reperformance where it is stronger than inquiry
There is no universal SEC or PCAOB sample size. PCAOB's AS 2315 frames sampling around tolerable deviation and sampling risk. Practitioner sample tables are guidance, not statutory rules.
Step 5: Perform interim, roll-forward, and year-end testing
Interim testing surfaces problems before year-end. Interim work requires roll-forward evidence covering the remaining period, including control changes, new risks, and remediation done since.
Year-end is for final evaluation, retesting, management conclusions, and coordination with the financial statement audit where applicable.
Step 6: Evaluate, remediate, and retest
Document each exception and decide whether it is isolated or systemic. Evaluate compensating controls, assess the effect on relevant assertions, and report to management and the audit committee.
Remediation follows a lifecycle:
- Assign an owner.
- Define corrective action and due dates.
- Preserve implementation evidence.
- Test the revised control.
- Confirm it operated long enough to support the final conclusion.
AS 2201 sets no universal minimum number of days or months, so judge the period against the control's frequency and risk.
Evidence, Findings, and Remediation
What makes SOX testing evidence persuasive?
Good evidence is relevant to the control objective, covers the whole period, and is complete and traceable. It shows who reviewed it, when it was approved, which system it came from, and that it is protected from alteration.
Policies and management representations alone rarely prove operating effectiveness. Stronger evidence includes:
- Reconciliations and approval records
- Access reports and system logs
- Exception reports
- Reperformance results
For company-produced reports, test accuracy and completeness, or the controls over them.
How to classify and report deficiencies
Severity escalates in three steps:
| Classification | Meaning |
|---|---|
| Control deficiency | Design or operation does not let people prevent or detect misstatements on time in the normal course of work |
| Significant deficiency | Less severe than a material weakness, yet important enough for those overseeing financial reporting to review |
| Material weakness | A reasonable possibility that a material misstatement will not be prevented or detected on time |
Assess related deficiencies together when they affect the same account, assertion, or control component. A compensating control reduces severity only if it is precise enough to catch a potentially material misstatement.
Management cannot conclude ICFR is effective with one or more material weaknesses, and must disclose them. Escalate to the audit committee promptly. Confirm definitions against current SEC and PCAOB text.
Building a remediation and retest record
Capture for each issue:
- Root cause and corrective action
- Responsible owner and implementation date
- Affected systems or processes
- Validation evidence and retest procedure
- Final status
A central issue log and evidence repository prevents duplicate requests, preserves the audit trail, and speeds up next year's testing.
Best Practices for Efficient, Audit-Ready Testing
Use risk-based planning and maintain control ownership
- Rationalize redundant controls and focus on those tied to significant risks.
- Confirm an accountable owner for every control.
- Refresh the risk-control matrix after business, system, personnel, or regulatory changes.
- Coordinate finance, IT, security, procurement, legal, internal audit, and the audit committee so ITGC dependencies surface early.
Improve consistency with technology and continuous monitoring
Tools that cut manual effort and improve traceability include:
- Centralized evidence management and workflow tracking
- Automated access reviews and change monitoring
- Exception reporting for faster issue detection
Adoption is still limited. Protiviti's 2024 polling found 41% using analytics in SOX testing only to a limited degree and 32% minimally or not at all.
Automation still has limits. Poor data quality, incomplete system coverage, and weak configuration undermine it. Management review and human judgment remain necessary.
Get expert support without confusing advisory and attestation roles
DeepSeas offers practitioner-led GRC support from ISO Lead Auditor-certified specialists. Engagements cover risk assessments, control documentation, ITGC coordination, and audit readiness work such as gap assessments, pre-audit preparation, and post-audit remediation. Support is available as a platform, advisory engagement, or fully managed service.
Advisory support does not replace management accountability or an independent auditor's attestation where required. DeepSeas does not perform statutory SOX audits.
Frequently Asked Questions
What is SOC 2 vs SOX?
SOX is a US law focused on public-company financial reporting and ICFR. SOC 2 is an independent examination of a service organization's controls against Trust Services Criteria. They can overlap but are not interchangeable.
What are the requirements for a compliance audit?
They depend on the law, framework, organization type, and scope. Generally they include defined criteria, documented controls, risk assessment, testing, evidence, findings, remediation, and independent review where required.
What are some examples of compliance controls?
Financial controls include reconciliations and journal-entry approvals. ITGCs include access and change management. Entity-level controls include ethics programs, board oversight, and whistleblower processes.
What is SOX compliance testing?
It is the evaluation of whether controls over financial reporting are suitably designed and operating effectively. It includes documentation, walkthroughs, evidence review, deficiency assessment, and remediation.
How often should SOX controls be tested?
Management assesses ICFR annually, with quarterly certifications and evaluation of material changes. Testing frequency is risk-based and may be interim, quarterly, continuous, or year-end depending on the control.
What happens if SOX testing identifies a deficiency?
Document and assess it, consider related controls and potential reporting impact, and communicate it appropriately. Then remediate and retest before management reaches its final conclusion.
