SOX Compliance: Requirements, Controls, and What Auditors Actually Ask For

SOX got stricter for evidence long before most teams noticed

SOX was signed into law on July 30, 2002, after Enron and WorldCom. The SEC says the law was meant to strengthen corporate responsibility, financial disclosures, and anti-fraud enforcement while creating the PCAOB to oversee issuer audits. From the start, Section 302 tied CEO and CFO certifications to annual and quarterly reports, and Section 404 tied year-end reporting to management’s assessment of internal control over financial reporting, or ICFR. In the PCAOB’s 2025 inspection priorities, internal control over financial reporting, audit evidence, and the use of technology stayed on the short list of areas inspectors planned to press on. 

What changed for most teams was not the statute. It was the evidence bar. Recent PCAOB inspection reports still point to weak testing around change management and the accuracy and completeness of system-generated data used in controls. The SEC has also stayed active in controls cases. In June 2024, it charged R.R. Donnelley over cybersecurity-related internal control failures, and in April 2026, it announced settled charges against Key Tronic over books and records and internal controls failures tied to improper expense management and the company’s response to an internal complaint. 

That is why the question we hear most from finance and IT teams is not abstract. It is usually some version of: what is the sox compliance in real life, what are the actual SOX compliance requirements, and what will auditors ask us to show. This guide answers that directly. 

What SOX compliance means in practice

A quick way to define sox compliance is this: it is the set of public-company obligations that make financial reporting reliable enough for investors to trust. The cleanest sox compliance definition is not a single checklist. It is a mix of legal duties, disclosure controls, executive certifications, recordkeeping expectations, and audit obligations. If you have searched for sox compliance meaning, define sox compliance, sarbanes oxley compliance, sarbanes-oxley compliance, sarbanes oxley sox compliance, what is sarbanes oxley compliance, or even the clunky query what is the sox compliance, the practical answer is the same: management has to design, maintain, evaluate, and support effective controls around financial reporting. 

Why does it exist? Because U.S. markets run on believable numbers. The SEC has framed SOX as a reform aimed at stronger disclosure, better governance, and less corporate and accounting fraud. Done well, SOX supports investor confidence, cleaner close processes, clearer accountability, and a board that gets better visibility into financial reporting risk instead of learning about it after a restatement. 

The two sections that drive most of the work: 302 and 404

Section 302 is where executive certification becomes operational. CEOs and CFOs certify that periodic reports were reviewed, that the reports do not contain material misstatements or omissions, and that disclosure controls and procedures were evaluated. That is why quarterly sub-certifications matter. Legal, finance, accounting, tax, and IT owners all feed the CEO and CFO’s comfort level on completeness of disclosures and changes in ICFR. 

Section 404 is where ICFR becomes a year-round management job. Management is responsible for establishing and maintaining adequate internal control over financial reporting, evaluating design and operating effectiveness as of year-end, and disclosing material weaknesses. For companies subject to 404(b), the registered public accounting firm also has to attest to management’s assessment. That is the point where a loose process map or a verbal review stops being good enough. 

This is where sox regulatory compliance stops looking like a law school concept and starts looking like recurring monthly close controls, quarterly disclosure meetings, user access reviews, change approvals, and remediation tracking. There is accountability behind it too. Section 906 creates a separate written certification tied to periodic financial reports and carries criminal penalties of up to $1 million and 10 years for knowing violations, or up to $5 million and 20 years for willful violations. 

The control areas auditors test most often

Most ICFR programs revolve around the same few pressure points. The accounts change by industry. The control logic does not.

• Entity-level controls: board and audit committee oversight, code of conduct, risk assessment, whistleblower intake, and the tone set by leadership. If the audit committee’s oversight of financial reporting is ineffective, PCAOB standards treat that as an indicator of a material weakness. 

• Close and consolidation: account reconciliations, close checklists, consolidation entries, unusual estimates, and review controls over the financial statements before filing. 

• Revenue: contract review, pricing approvals, cut-off and controls over system reports that drive revenue recognition or disclosure. 

• Procure-to-pay: vendor setup, three-way match, purchase approvals, accruals and segregation of duties around invoices and disbursements. 

• Payroll and equity compensation: HR master file changes, payroll reconciliations, stock-based compensation inputs and review of off-cycle payments. 

• Treasury and cash: bank reconciliations, wire approvals, debt covenant calculations and controls over cash movements.

• Tax: provision review, deferred tax calculations, return-to-provision true-ups and review controls over tax disclosures. 

• Journal entries: manual journals, nonstandard entries, consolidating adjustments and completeness of the journal population used for testing. PCAOB staff has kept journal-entry testing on its radar for 2025. 

• Management review controls: budget-to-actual reviews, margin analysis, reserve reviews and other detective controls where the reviewer’s precision matters just as much as the signature. 

• IT general controls: access provisioning and deprovisioning, privileged access, password and MFA settings where relevant, change management, SDLC approvals, incident management, logging and backup or recovery evidence for systems that support financial reporting. Recent inspection reports still cite gaps here. 

Teams that deal with SOX and PCI compliance often end up collecting some of the same artifacts, especially around access control, logging and change approvals. The overlap is real. The objective is different. PCI is built to protect cardholder data. SOX is built to support reliable financial reporting. 

How to scope SOX without testing everything in sight

Good SOX scoping starts with materiality, then works down through significant accounts and disclosures, relevant assertions, major locations, and the processes that could produce a material misstatement. PCAOB AS 2201 calls this a top-down approach. The SEC’s management guidance took the same risk-based path and made clear that management does not need to identify every control in a process or test everything at the same depth.

From there, the practical model is straightforward. Identify the significant processes behind those accounts. Map the key reports and spreadsheets that feed them. Draw the system boundary for each process so you know which ERPs, subledgers, data warehouses and manual handoffs matter. If a service organization touches the transaction flow, decide whether you are relying on a SOC 1 report, complementary user-entity controls or direct testing. Then separate key controls from non-key controls. A key control addresses a defined risk of material misstatement. A non-key control may still be useful operationally but it does not need SOX testing every cycle. 

This is also where rationalization pays off. We see teams carry duplicate reviews, weekly signoffs where a monthly control would cover the risk and old spreadsheet checks that no longer tie to a material account. You can remove that noise safely if each deleted control has a surviving owner, a documented risk linkage and a clean audit trail. That is one reason we like keeping scoping decisions, narratives and evidence in a governed workspace such as our Intelligent Repository. It preserves the “why” behind the control set instead of leaving it in someone’s inbox. 

What auditors actually ask for: the evidence package by control type

The fastest way to disappoint an auditor is to say “we did the control” and stop there. What they want is evidence that shows who performed it, when they performed it, what population or report they used, how precise the review was and what happened to exceptions. PCAOB standards on audit evidence are direct about this. When auditors use information produced by the company, they have to test accuracy and completeness or test the controls over that information, and they have to evaluate whether it is precise enough for the purpose. 

For design and walkthrough work, expect requests for the risk and control matrix row that links risk to control, current narratives or flowcharts, walkthrough evidence for a sample transaction, control owner interviews and documentation of key reports, spreadsheets and system dependencies. For recurring business-process controls, expect dated screenshots with preparer names, report parameters, reconciliations, journal entry support, reviewer sign-offs, exception reports and evidence that follow-up happened when something looked off. For management review controls, the support package matters as much as the sign-off. Auditors want to see the threshold, the comparison used, the investigation performed, and the reviewer’s conclusion. 

For ITGCs, auditors usually ask for user listings, access provisioning and deprovisioning tickets, privileged-access evidence, access review sign-offs, change tickets, approvals, test results, migration evidence, incident tickets, logging output, and backup or recovery evidence where the system supports financial reporting. For report and spreadsheet dependencies, they want logic documentation, parameter screenshots and completeness checks over the source data. For segregation of duties, they want the rule set, the user-population extract, exception analysis, and any compensating control evidence. For issues, they want a remediation tracker and a deficiency evaluation memo that explains severity, root cause, and whether a deficiency is a control deficiency, significant deficiency, or material weakness. We keep seeing the same gap here: evidence exists, but it sits across email, shared drives, ticketing tools, and ERP exports with no clean version history. A searchable Compliance Reporting & Audit Trail solves more audit pain than another spreadsheet tab. 

What a SOX audit looks like from kickoff to opinion

The phrase sox and audit gets used loosely. If you want the plain-English answer to what is sox audit, what is a sox audit, the basic sox audit meaning, or even a clean sox audit definition, here it is: a SOX audit is the testing and evaluation work around ICFR that supports management’s annual assessment and, for companies subject to 404(b), the external auditor’s independent opinion on ICFR. SOX auditing is not one meeting. Most sox audits move through planning, walkthroughs, design testing, operating-effectiveness testing, deficiency evaluation, remediation, and year-end reporting. 

Internal testing and external audit work are related but not identical. Process owners perform the control. Internal audit or a SOX team often documents the control, tests it during the year, and tracks remediation. External audit then performs its own risk assessment and testing to support the independent opinion. If the company is not subject to 404(b), the external auditor still considers internal control as part of the financial statement audit and communicates significant or material issues to the audit committee. 

One Reddit poster summed up the confusion well by asking what internal auditors test and what external auditors “do further.” A former auditor replied that external auditors verify whether the financial statements are materially correct while internal audit reports risk to the audit committee and may test many of the same controls first. That is close to how most programs feel on the ground. Internal audit is the readiness engine. External audit is the independent opinion. Process owners are the people who make the controls real. 

Where companies fail most often and what current regulators are watching

The failure pattern is remarkably consistent. Weak access controls in finance systems. Management review controls with a signature but no documented judgment. Spreadsheet controls that depend on one power user. Incomplete report populations. Journal-entry populations that were never proven complete. Remediation that starts in Q4 when the year is effectively over. Quarterly certification processes that rely on habit instead of a formal sub-certification workflow. PCAOB standards and staff publications keep returning to the same themes: precision of review controls and reliability of company-produced information. 

Current regulators are watching those same fault lines. The PCAOB’s 2025 inspection priorities highlighted ICFR, audit evidence and technology. The SEC’s 2024 case against R.R. Donnelley turned on inadequate controls for elevating cybersecurity incidents and protecting company assets. In January 2025, the SEC charged Vince McMahon for failing to disclose settlement agreements to WWE’s board, legal team, accountants, financial reporting personnel and auditor, saying the conduct circumvented internal accounting controls and caused material misstatements. In April 2026, the SEC settled with Key Tronic over internal controls and books-and-records failures tied to improper expense management and the handling of an internal complaint. In January 2026, the SEC also charged ADM and former executives in a disclosure-fraud case where ADM’s remedial measures included implementing and testing new internal accounting controls. 

For pre-IPO and newly public companies, the risk is even more obvious. PwC’s review of 2019 through 2024 domestic and foreign issuer IPO filings found that about half of companies going public each year disclosed at least one material weakness before the IPO, with common themes including insufficient accounting personnel, weak oversight, weak review processes and inadequate technology systems. That is why regulators and auditors both ask harder questions now about evidence quality in access reviews, IT changes and system-generated reports instead of accepting a policy document plus a signature. 

A realistic SOX calendar for a lean finance and IT team

For a December 31 year-end, a lean team usually uses Q1 to refresh scoping, update narratives, confirm key reports and run walkthroughs. Q2 is where interim testing should do the heavy lifting, especially for controls that operate monthly. Q3 is the last sane window for remediation and retesting. Q4 is for rollforwards, year-end controls, disclosure committee work and executive certifications. Layered underneath that are monthly routines like close checklists, reconciliations, access changes, exception follow-up and evidence filing. If those monthly habits are weak, year-end becomes chaos fast. 

For companies heading toward an IPO, the runway is longer than most founders expect. Deloitte says many readiness assessments start 6 to 18 months pre-IPO. KPMG says starting early is typical and often means about 18 to 24 months from the first potential year of SOX compliance. PwC’s IPO benchmarking points to one to two years of control formalization for traditional IPO companies. Protiviti’s recent SOX survey work also says scope, hours and costs continue to rise, with talent shortages and evidence collection still driving pressure on lean teams. In practice, we see the leanest public companies center SOX in controllership, then pull in IT and internal audit where system changes, access controls or service organizations raise the risk. 

SOX gets easier when evidence is organized before auditors ask for it

The manageable version of SOX is not the version with the fewest controls. It is the version where filer status is clear, scope is risk-based, and evidence is collected in the same rhythm as the control. Once you know which companies need management-only ICFR reporting versus external auditor attestation, once you scope down to significant accounts and real assertions, and once every key control has an audit-ready evidence pack, the annual cycle gets a lot less dramatic.

That is the practical core of sox compliance requirements. Good programs translate legal obligations into owned routines, searchable records, and defensible judgments. We built our SOX 404 workspace around that reality: one place for control tasks, approvals, remediation history, and the financial-records trail that supports the filing when auditors finally ask for it. 

See how we help teams keep controls, approvals, and audit evidence in one place

If you are building or tightening your SOX program, see how we use TeamSync to keep control tasks, approvals, remediation work and audit evidence organized in one shared workspace. Get in touch.