SOX Process Overview
Sox compliance requires every publicly traded company to establish internal control
over financial reporting and must document and test the controls, mitigate the risk of
fraud and increase the transparency in financial reporting.
Planning Stage: It involves understanding of the process followed by the Business by conducting the walkthroughs with the
Business owners, so as to determine whether we require to establish new controls or to update the existing controls.
Internal Control Stage: It involves finding the Inherent risk involved in the process. It also involves creating the audit plan by
giving appropriate attributes and collecting the Documents required for testing the efficiency and effectiveness of the controls.
Testing Stage : It involves testing of the attributes which were pre defined while creating the audit plan based on the pre defined
frequency, but certain controls may be tested more frequently based on risk assessments and materiality considerations.
Documentation: Documentation is a critical part of SOX compliance as it helps organizations understand the risks inherent in
their work processes and the controls, they have in place to address those risks. The risks and controls along with other
information about the controls such as how often the control operates, who is responsible for the control, the control
classification, etc. are generally summarized in a Risk and Control Matrix).
Reporting and Remediation: SOX reporting is a way for organizations to keep track of the status of their SOX programs. This
helps stakeholders know exactly where the company is with testing, the number and nature of any open issues and the progress
of issue remediation.
