Section 404 does not tell you which controls to test – it tells you to conclude on internal control over financial reporting. The SOX top-down risk assessment is how you get from financial statements to a defensible control population, and it is where a programme is either efficient or enormous. 60 editable Word and Excel files, downloadable the moment you check out. On this page:
- What is in the SOX top-down risk assessment pack
- Why scoping decides the cost of your SOX programme
- Who needs SOX top-down risk assessment
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the SOX top-down risk assessment pack
The pack is organised by how a SOX programme is actually built in its first year:
- Foundation – compliance programme charter, scoping memorandum, the top-down risk assessment, significant accounts and disclosures analysis, materiality worksheet and fraud risk assessment
- Year one implementation roadmap, for organisations newly in scope after an IPO or a change in filer status
- Entity level controls – the control environment, risk assessment, information and communication, and monitoring components that auditors test first and rely on most
- Process level documentation – process narratives, flowcharts and risk and control matrices across the significant transaction cycles
- ITGC – access to programs and data, program change, program development and computer operations, which is where the majority of deficiencies are found
- Application controls – the controls inventory, automated control template and the information produced by the entity standard covering report and query completeness and accuracy
- Testing – test plans, sample size guidance, test of design and test of operating effectiveness templates and the evidence index
- Deficiency evaluation – the severity assessment framework that separates a control deficiency from a significant deficiency from a material weakness, and the remediation tracker
- Reporting – management assessment, sub-certification process and the disclosure committee material
Why scoping decides the cost of your SOX programme
The Sarbanes-Oxley Act itself has not changed – it is a statute from 2002 with no editions. What changes is how efficiently organisations apply it, and the spread between a lean programme and a bloated one is enormous.
A SOX top-down risk assessment works from the financial statements downwards: material accounts, then relevant assertions, then the processes that feed them, then the controls that address the risks of material misstatement. Done properly it produces a control population of manageable size. Skipped, it produces a matrix of every control anyone could think of, all of which then have to be tested annually.
Note one live development: the SEC has proposed expanding the exemptions from Section 404(b) auditor attestation. That is a proposal, not a final rule, and management assessment under 404(a) is unaffected. Do not plan around it until it settles.
Who needs SOX top-down risk assessment
Newly public companies and those approaching accelerated filer status, where year one is the hardest. Companies whose programme has grown organically into hundreds of controls that nobody can justify. Internal audit and finance teams preparing for an external auditor who will challenge scope. And private companies adopting ICFR discipline ahead of a transaction.
How the SOX top-down risk assessment maps to the framework
The risk and control matrix is the working document of a SOX programme, and its quality determines everything downstream. A control described as “management reviews the reconciliation” cannot be tested; one that states who reviews what, against what, to what threshold and with what evidence, can. The matrices here are written at that level, and the IPE standard is included because information produced by the entity is the most common source of audit findings.
Frequently asked questions
Has SOX changed recently?
The statute has not. The SEC has proposed expanding Section 404(b) auditor attestation exemptions, but that is a proposal only and management assessment under 404(a) is unaffected.
What is the difference between 404(a) and 404(b)?
404(a) is management assessment of ICFR, required of all filers. 404(b) is the external auditor attestation on ICFR, required of accelerated and large accelerated filers.
Does this cover ITGC?
Yes. Access to programs and data, program change, program development and computer operations – the four ITGC domains where most deficiencies arise.
What is IPE and why does it matter?
Information Produced by the Entity – reports and queries used in performing a control. Auditors test the completeness and accuracy of that information, and failures here invalidate the control that relied on it. A dedicated standard is included.
How many documents are included?
60 editable files – 43 Word documents and 17 Excel workbooks – plus guidance and a licence file.
Related toolkits
ICFR sits inside a wider control environment. See the COSO Toolkit for the framework SOX programmes are built on, the ISO 27001 Toolkit for the security controls behind ITGC, the COBIT 2019 Toolkit for IT governance and the ISO 31000 Toolkit for enterprise risk. Service organisations asked for an assurance report by their clients add the SOC 1 toolkit.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your SOX top-down risk assessment downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the SOX top-down risk assessment are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.